@bongos/core 1.19.182 → 1.19.184

package/tests/governance_live_proof.mjs

@@ -176,7 +176,7 @@ try {
   // …the resolver reports it honestly (it is a defined catalog key; matrix V10
   // proves no route consumes it via requirePermission, so it admits nothing
   // in-app)…
-  const resolver = require('../modules/governance/resolver.js');
+  const resolver = require('../modules/government/resolver.js');
   const perms = await resolver.resolveBuilderPermissions(THETES);
   ok(perms.includes(OPERATIONAL_KEY), 'the resolved set includes the operational grant');
   console.log(`  (resolved set ${perms.includes(SYSTEM_KEY) ? 'includes' : 'omits'} the forced '${SYSTEM_KEY}' — in-app it guards no route either way)`);
@@ -187,7 +187,7 @@ try {
   // protected-path diff while the forced grant row sits in the database.
   const { checkPermissionPaths } = require('../src/bongos/permission-path-check.js');
   const sub = checkPermissionPaths({
-    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/governance/catalog.js'],
+    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/government/catalog.js'],
     builderRank: 'thetes',
   });
   ok(sub.hardFail === true && sub.findings.length === 2,

package/tests/governance_ownership_scope.mjs

@@ -30,7 +30,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));
 const db = require(path.join(GOV, 'db.js'));

package/tests/governance_page_gates.mjs

@@ -45,8 +45,8 @@ dbKernel.lookupSession = async () => {
 
 const auth = require('../src/bongos/auth.js');
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
-const resolver = require('../modules/governance/resolver.js');
+const catalog = require('../modules/government/catalog.js');
+const resolver = require('../modules/government/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
@@ -126,7 +126,7 @@ async function runGate(name, { rank = null, resolve, port = true } = {}) {
   lookupThrows = false;
   seams._reset();
   if (port) {
-    seams.registerProvider('governance', {
+    seams.registerProvider('government', {
       // The real seed for that rank — the rows governance_002 gives the one
       // rank-role a builder holds. The INPUT, not the oracle.
       resolveBuilderPermissions: resolve || (async () => catalog.seedForRank(rank)),
@@ -144,7 +144,7 @@ async function runGate(name, { rank = null, resolve, port = true } = {}) {
 
 test('A0: the hand-written audience table agrees with the real threshold function', () => {
   // A second, catalog-free oracle for the literal above: auth.rankMeetsThreshold
-  // is the production rank predicate and reads nothing from modules/governance/.
+  // is the production rank predicate and reads nothing from modules/government/.
   for (const gate of GATES) {
     for (const rank of LIVE_RANKS) {
       assert.equal(
@@ -203,7 +203,7 @@ test('B1: a session-lookup error fails CLOSED (redirect to sign-in, no page)', a
   for (const gate of GATES) {
     nextSession = null;
     seams._reset();
-    seams.registerProvider('governance', { resolveBuilderPermissions: async () => catalog.seedForRank('archon') });
+    seams.registerProvider('government', { resolveBuilderPermissions: async () => catalog.seedForRank('archon') });
     lookupThrows = true;
     const res = fakeRes();
     let nexted = false;
@@ -244,7 +244,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   nextSession = { builder_id: 7, rank: 'archon' };
   lookupThrows = false;
   seams._reset();
-  seams.registerProvider('governance', {
+  seams.registerProvider('government', {
     resolveBuilderPermissions: async () => { calls += 1; return keys; },
   });
   const req = { headers: { cookie: 'gds_session=validtoken' } };

package/tests/governance_parity.mjs

@@ -57,8 +57,8 @@ const { RANKS } = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
 const routeRank = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
 
 const { PERMISSIONS, RANK_ORDER, seedForRank } = catalog;
 const FLOORED = PERMISSIONS.filter((p) => p.floor !== null);
@@ -287,7 +287,7 @@ function fakeRes() {
 // not the logic — resolvedFor() is the real resolver over the real seed.
 async function permissionAdmits(key, rank) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => resolvedFor(rank) });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => resolvedFor(rank) });
   let nexted = false;
   await auth.requirePermission(key)({ builder: { id: 7, rank } }, fakeRes(), () => { nexted = true; });
   seams._reset();

package/tests/governance_principals.mjs

@@ -22,7 +22,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));
 

package/tests/governance_protected_surfaces.mjs

@@ -8,7 +8,7 @@
 //
 // The load-bearing test is BEHAVIOR-IDENTITY. R101 moved WHERE the truth lives
 // (a hardcoded PROTECTED_GLOBS constant in src/bongos/permission-path-check.js →
-// governance-owned data in modules/governance/protected-surfaces.json). It did
+// governance-owned data in modules/government/protected-surfaces.json). It did
 // NOT change WHAT is protected. EXPECTED_GLOBS_BEFORE_R101 below is the literal
 // pre-change constant, pasted verbatim; the registry must reproduce it exactly,
 // in order.
@@ -22,7 +22,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const registry = require(path.join(GOV, 'protected-surfaces.js'));
@@ -83,14 +83,70 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
   '.claude/settings.json',
 ];
 
+// Globs added to the registry SINCE R101, each with the change that added it.
+// Kept separate from the verbatim pre-R101 array above so that array stays what
+// it claims to be — the literal pre-change constant. Overwriting it to make a
+// later addition pass would destroy the only evidence that R101 moved WHERE the
+// truth lives without changing WHAT is protected.
+//
+// Each entry is { after, glob, why }: `after` is the glob it is inserted
+// directly below, so the expected list is reconstructed in order rather than
+// re-pasted (a re-paste is how the two lists drift apart).
+const ADDED_SINCE_R101 = [
+  {
+    after: 'modules/governance/',
+    glob: 'modules/government/',
+    why: 'goal 1000068 / task 1003003 (ADR 0174) — the authz core is renamed '
+       + 'governance→government. The new glob is registered BEFORE the folder '
+       + 'moves because `protected` DERIVES from this registry: without it the '
+       + 'new module key computes protected:false and both the Archon gate on '
+       + 'goal creation and the pre-push block on these files would silently lapse.',
+  },
+];
+
+// The list the registry must produce TODAY: the pre-R101 set with each
+// documented addition spliced in at its declared position.
+const EXPECTED_GLOBS = (() => {
+  const out = [...EXPECTED_GLOBS_BEFORE_R101];
+  for (const a of ADDED_SINCE_R101) {
+    const at = out.indexOf(a.after);
+    assert.notEqual(at, -1, `ADDED_SINCE_R101 anchors on '${a.after}', which is not in the list`);
+    out.splice(at + 1, 0, a.glob);
+  }
+  return out;
+})();
+
 // ---------- behavior identity: the same globs, at the same floor ----------
 
-test('the registry reproduces the pre-R101 PROTECTED_GLOBS exactly, in order', () => {
-  assert.deepEqual(registry.PROTECTED_GLOBS, EXPECTED_GLOBS_BEFORE_R101);
-  assert.deepEqual(ppc.PROTECTED_GLOBS, EXPECTED_GLOBS_BEFORE_R101,
+test('nothing protected before R101 has been unprotected since', () => {
+  // The load-bearing half. Additions are ordinary policy; a REMOVAL silently
+  // unprotects a trust surface, so it is asserted separately and must never be
+  // satisfied by editing the pre-R101 array.
+  for (const glob of EXPECTED_GLOBS_BEFORE_R101) {
+    assert.ok(
+      registry.PROTECTED_GLOBS.includes(glob),
+      `'${glob}' was protected before R101 and is no longer in the registry — `
+      + 'a protected surface cannot be dropped without an ADR saying why.',
+    );
+  }
+});
+
+test('the registry reproduces the expected glob list exactly, in order', () => {
+  assert.deepEqual(registry.PROTECTED_GLOBS, EXPECTED_GLOBS);
+  assert.deepEqual(ppc.PROTECTED_GLOBS, EXPECTED_GLOBS,
     'the kernel matcher must expose the same derived list the registry declares');
 });
 
+test('every glob added since R101 carries a documented reason', () => {
+  for (const a of ADDED_SINCE_R101) {
+    assert.ok(a.why && a.why.length > 40,
+      `${a.glob} must record WHY it became protected — an undocumented addition `
+      + 'is indistinguishable from a typo.');
+    assert.ok(registry.PROTECTED_GLOBS.includes(a.glob),
+      `${a.glob} is declared as added but is not in the registry`);
+  }
+});
+
 test('every surface floors at metic — the ADR 0043 floor, unchanged by the move', () => {
   for (const s of registry.SURFACES) {
     assert.equal(s.floor, 'metic', `${s.glob} must keep the Metic floor`);
@@ -128,7 +184,7 @@ test('the registry loads synchronously from the repo with no DB and no server',
     "const p=require('./src/bongos/permission-path-check');" +
     "process.stdout.write(String(p.PROTECTED_GLOBS.length)+':'+String(p.floorFor('migrations/001.sql')));",
   ], { cwd: ROOT, encoding: 'utf8', env: { ...process.env, DATABASE_URL: '', PGHOST: '' } });
-  assert.equal(out, `${EXPECTED_GLOBS_BEFORE_R101.length}:metic`);
+  assert.equal(out, `${EXPECTED_GLOBS.length}:metic`);
 });
 
 test('the registry data file carries no DB/network dependency', () => {
@@ -178,7 +234,7 @@ test('a known path is protected at the right floor; an unknown path is not', ()
   assert.equal(ppc.floorFor('src/bongos/auth.js'), 'metic');
   assert.equal(ppc.permissionFor('src/bongos/auth.js'), 'path.protected.modify');
   assert.equal(registry.isProtected('migrations/999_x.sql'), true, 'subtree globs still match');
-  assert.equal(registry.floorFor('modules/governance/catalog.js'), 'metic');
+  assert.equal(registry.floorFor('modules/government/catalog.js'), 'metic');
 
   assert.equal(ppc.floorFor('public/game/main.js'), null);
   assert.equal(ppc.permissionFor('docs/session-logs/2026-07-30-x.md'), null);

package/tests/governance_require_permission.mjs

@@ -1,7 +1,7 @@
 // tests/governance_require_permission.mjs — the requirePermission gate (BV1.R97, ADR 0151).
 //
 // DB-free. The gate reaches the resolver through the `governance` KERNEL PORT
-// (the one-way rule — core never requires modules/governance/), so a stub
+// (the one-way rule — core never requires modules/government/), so a stub
 // provider registered on the seam is the whole test double: no Postgres, no
 // router, no live module. That is also the point being asserted — if auth.js ever
 // went back to importing the module directly, these tests could not stub it.
@@ -23,7 +23,7 @@ const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 const { classify } = require(path.join(ROOT, 'src', 'bongos', 'api-errors.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 // Minimal res double capturing status + body, with res.fail() installed exactly
 // as the router installs it (mirrors tests/rank_gate.mjs).
@@ -42,7 +42,7 @@ function fakeRes() {
 // resolveBuilderPermissions; pass null to leave the port UNREGISTERED.
 async function run(gate, req, resolve) {
   seams._reset();
-  if (resolve !== null) seams.registerProvider('governance', { resolveBuilderPermissions: resolve });
+  if (resolve !== null) seams.registerProvider('government', { resolveBuilderPermissions: resolve });
   const res = fakeRes();
   let nexted = false;
   await gate(req, res, () => { nexted = true; });
@@ -89,7 +89,7 @@ test('the denial names the floor rank, not just the atom (task 1002613, map P-1)
   // this test moves WITH a floor change instead of pinning stale prose — the
   // D-16/N-3 failure shape the fix exists to avoid.
   seams._reset();
-  seams.registerProvider('governance', {
+  seams.registerProvider('government', {
     resolveBuilderPermissions: holding('idea.triage'),
     permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
   });
@@ -143,7 +143,7 @@ test('an UNREGISTERED governance port denies, it does not admit', async () => {
 
 test('a malformed port (no resolveBuilderPermissions) denies', async () => {
   seams._reset();
-  seams.registerProvider('governance', { isSystem: () => true });
+  seams.registerProvider('government', { isSystem: () => true });
   const res = fakeRes();
   let nexted = false;
   await auth.requirePermission('idea.triage')({ builder: BUILDER }, res, () => { nexted = true; });
@@ -175,7 +175,7 @@ test('the gate resolves per request — no memoised authority (ADR 0016)', async
   let calls = 0;
   let keys = ['idea.triage'];
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => { calls += 1; return keys; } });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => { calls += 1; return keys; } });
   const gate = auth.requirePermission('idea.triage');
   const first = fakeRes();
   let admitted = false;

package/tests/governance_resolver.mjs

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const resolver = require(path.join(GOV, 'resolver.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { effectivePermissions, resolveBuilderPermissions, builderHasPermissions } = resolver;
@@ -79,6 +79,6 @@ test('the kernel port exposes the resolver without core importing the module', (
   assert.equal(typeof governancePort.builderHasPermissions, 'function');
   assert.equal(typeof governancePort.isSystem, 'function');
   const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
-  assert.ok(manifest.provides.includes('governance'), 'module.json must declare the governance port');
+  assert.ok(manifest.provides.includes('government'), 'module.json must declare the government port');
   assert.ok(manifest.contributes.routes.includes('governance'), 'the port registers from the route factory');
 });

package/tests/governance_role_sync.mjs

@@ -1,8 +1,8 @@
 // tests/governance_role_sync.mjs — rank→role assignment stays in sync (BV1.R95b, ADR 0151).
 //
-// DB-free. The decision the writer executes is a pure function (modules/governance/
-// rank-roles.js planRankRoleSync), so these exercise PRODUCTION logic directly rather
-// than a re-implementation: db.syncRankRole reads the two row sets, calls this exact
+// DB-free. The decision the writer executes is a pure function (modules/government/
+// ranks.js planRankSync), so these exercise PRODUCTION logic directly rather
+// than a re-implementation: db.syncRank reads the two row sets, calls this exact
 // function, and executes its verdict. The SQL halves — the DELETE/INSERT the writer
 // issues and the repair migration — are asserted structurally.
 //
@@ -21,8 +21,8 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
-const { planRankRoleSync, isSeededRankRole } = require(path.join(GOV, 'rank-roles.js'));
+const GOV = path.join(ROOT, 'modules', 'government');
+const { planRankSync, isSeededRank } = require(path.join(GOV, 'ranks.js'));
 
 // The seeded rank-roles exactly as governance_002 writes them.
 const SEEDED = [
@@ -35,7 +35,7 @@ const seededRole = (rank) => ({ role_key: rank, seeded_rank: rank, is_system: tr
 // An Archon-authored custom role from the R110 tab: no seeded_rank, not a system role.
 const customRole = (key) => ({ role_key: key, seeded_rank: null, is_system: false });
 
-const plan = (rank, currentRoles) => planRankRoleSync({ rank, currentRoles, seededRoles: SEEDED });
+const plan = (rank, currentRoles) => planRankSync({ rank, currentRoles, seededRoles: SEEDED });
 
 // ---------------------------------------------------------------------------
 // registration — a builder with no roles gets the one matching their rank
@@ -118,7 +118,7 @@ test('a custom role is not mistaken for the rank-role even when its key matches
   // role_key is UNIQUE so this cannot happen today, but the predicate must key on
   // is_system + seeded_rank rather than on the key's spelling.
   const impostor = { role_key: 'archon', seeded_rank: null, is_system: false };
-  assert.equal(isSeededRankRole(impostor), false);
+  assert.equal(isSeededRank(impostor), false);
   const p = plan('metic', [impostor]);
   assert.deepEqual([...p.remove], [], 'a non-system role is never rotated away');
 });
@@ -147,7 +147,7 @@ test('the sync is idempotent — running it twice changes nothing the second tim
   const first = plan('metic', [seededRole('archon')]);
   assert.ok(first.add.length + first.remove.length > 0, 'the first run must do work');
   const after = first.next.map((key) => (SEEDED.find((s) => s.role_key === key) || customRole(key)));
-  const second = planRankRoleSync({ rank: 'metic', currentRoles: after, seededRoles: SEEDED });
+  const second = planRankSync({ rank: 'metic', currentRoles: after, seededRoles: SEEDED });
   assert.deepEqual([...second.add], []);
   assert.deepEqual([...second.remove], []);
   assert.deepEqual([...second.next], [...first.next]);
@@ -175,15 +175,15 @@ const repairSql = fs.readFileSync(path.join(migDir, 'governance_005_resync_build
 const stripSqlComments = (sql) => sql.replace(/--[^\n]*/g, '');
 
 test('the writer DELETEs the superseded assignments, not just INSERTs the new one', () => {
-  assert.match(dbSrc, /DELETE FROM governance_builder_roles/,
-    'syncRankRole must delete superseded rank-roles — an additive-only writer preserves privilege retention');
-  assert.match(dbSrc, /INSERT INTO governance_builder_roles[\s\S]*ON CONFLICT \(builder_id, role_key\) DO NOTHING/,
+  assert.match(dbSrc, /DELETE FROM government_builder_ranks/,
+    'syncRank must delete superseded rank-roles — an additive-only writer preserves privilege retention');
+  assert.match(dbSrc, /INSERT INTO government_builder_ranks[\s\S]*ON CONFLICT \(builder_id, rank_key\) DO NOTHING/,
     'the assignment insert must be idempotent');
 });
 
 test('the writer runs on the CALLER\'s transaction client when given one', () => {
-  assert.match(dbSrc, /async function syncRankRole\(client,/,
-    'syncRankRole must take the caller\'s client so the rotation is atomic with the rank write');
+  assert.match(dbSrc, /async function syncRank\(client,/,
+    'syncRank must take the caller\'s client so the rotation is atomic with the rank write');
   assert.match(dbSrc, /const q = client \|\| pool;/,
     'and fall back to the pool only when there is no surrounding transaction');
 });
@@ -197,7 +197,7 @@ test('both rank-change twins rotate the role inside their transaction', () => {
     assert.ok(upd !== -1, `${rel}: expected the rank UPDATE in _applyRankChangeTx`);
     assert.ok(sync !== -1, `${rel}: the rank write must rotate the seeded rank-role`);
     assert.ok(sync > upd, `${rel}: the rotation must follow the rank write inside the same transaction`);
-    assert.match(src, /resolveOptional\('governance\.roleSync'\)/,
+    assert.match(src, /resolveOptional\('government\.rankSync'\)/,
       `${rel}: must reach governance through the kernel port, never by importing the module`);
   }
 });

package/tests/governance_routes.mjs

@@ -33,13 +33,13 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const govDb = require(path.join(ROOT, 'modules', 'governance', 'db.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 const express = require('express');
 
-const ROUTES_SRC = path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js');
+const ROUTES_SRC = path.join(ROOT, 'modules', 'government', 'routes', 'governance.js');
 
 // ===========================================================================
 // Layer 1 — gate classification + route-rank-check pins
@@ -88,7 +88,7 @@ test('every declared /governance route is pinned, and every pin exists (both dir
 
 test('checkRouteRanks passes over the real tree (no governance findings)', () => {
   const result = rrc.checkRouteRanks();
-  const ours = result.findings.filter((f) => String(f.file).includes('modules/governance/'));
+  const ours = result.findings.filter((f) => String(f.file).includes('modules/government/'));
   assert.deepEqual(ours, [], `governance findings: ${JSON.stringify(ours, null, 2)}`);
 });
 
@@ -131,11 +131,11 @@ api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon
 
 function grant(keys) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => keys });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
 grant(['governance.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);

package/tests/governance_seed.mjs

@@ -15,9 +15,9 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { RANK_ROLE_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const { RANK_ROLE_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
-const MIG_DIR = path.join(ROOT, 'modules', 'governance', 'migrations');
+const MIG_DIR = path.join(ROOT, 'modules', 'government', 'migrations');
 const seedSql = fs.readFileSync(path.join(MIG_DIR, 'governance_002_seed_and_backfill.sql'), 'utf8');
 const tablesSql = fs.readFileSync(path.join(MIG_DIR, 'governance_001_tables.sql'), 'utf8');
 
@@ -28,8 +28,16 @@ const tablesSql = fs.readFileSync(path.join(MIG_DIR, 'governance_001_tables.sql'
 // ADR 0152), and what must equal RANK_ROLE_SEED is the union of them all, not any one
 // file. Read in filename order; every file is scanned for `SELECT '<role>', unnest(…)`
 // blocks, so a new grant migration needs no change here.
+// SCHEMA migrations — they shape the tables, they do not grant. Excluded by NAME
+// rather than by "does it INSERT?" so that `a grant migration must INSERT something`
+// below stays a real assertion: a file we believe grants but which inserts nothing is
+// a bug worth failing on, and a content-sniffing filter would quietly excuse it.
+const SCHEMA_MIGRATIONS = new Set([
+  'governance_001_tables.sql',                    // creates the three tables
+  'government_001_rename_from_governance.sql',    // ADR 0174 rename (task 1003004)
+]);
 const grantMigrationFiles = fs.readdirSync(MIG_DIR)
-  .filter((f) => f.endsWith('.sql') && f !== 'governance_001_tables.sql')
+  .filter((f) => f.endsWith('.sql') && !SCHEMA_MIGRATIONS.has(f))
   .sort();
 const grantSqlByFile = grantMigrationFiles.map((f) => [f, fs.readFileSync(path.join(MIG_DIR, f), 'utf8')]);
 

package/tests/governance_session_scope.mjs

@@ -38,7 +38,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 
 // auth.js destructures lookupSession at load, so the stub must be installed before
 // ANYTHING pulls auth.js in (src/module-api does, via the governance route file).

package/tests/governance_vanilla_boot.mjs

@@ -1,7 +1,7 @@
 // tests/governance_vanilla_boot.mjs — the VANILLA BOOT proof (BV1.R102, ADR 0151).
 //
 // The core/host split only holds if a FRESH instance — one that has never been
-// branded, with no config/governance.json on disk and no rows in
+// branded, with no config/government.json on disk and no rows in
 // governance_builder_roles — comes up sane, anonymous, and powerless. This file is
 // that proof. It is deliberately scoped to what R96's tests/governance_config.mjs
 // does NOT cover: that file pins the config CONTRACT (precedence, per-field merge,
@@ -37,7 +37,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { loadGovernanceConfig, resolveGovernanceConfig, NEUTRAL_PATH, INSTANCE_PATH } = require(path.join(GOV, 'config.js'));
 const { effectivePermissions, resolveBuilderPermissions } = require(path.join(GOV, 'resolver.js'));
@@ -127,10 +127,10 @@ test('the identity guard is not a no-op — a planted host brand in the neutral
   // trip it, in the exact file this task is about.
   for (const brand of ['Off the Boats', 'amazonprimea.com']) {
     const poisoned = NEUTRAL_TEXT.replace('"roles"', `"instance": "${brand}",\n  "roles"`);
-    const found = fitness.scanPromptIdentity('config/governance.neutral.json', poisoned, '.json');
+    const found = fitness.scanPromptIdentity('config/government.neutral.json', poisoned, '.json');
     assert.ok(found.length >= 1, `a "${brand}" literal in the neutral pack must be caught`);
   }
-  assert.deepEqual(fitness.scanPromptIdentity('config/governance.neutral.json', NEUTRAL_TEXT, '.json'), [], 'the real pack is clean');
+  assert.deepEqual(fitness.scanPromptIdentity('config/government.neutral.json', NEUTRAL_TEXT, '.json'), [], 'the real pack is clean');
 });
 
 // ── (c) the trust boundary on a vanilla boot ────────────────────────────────────

package/tests/hall_page_gate_map.mjs

@@ -32,7 +32,7 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 // correct for the genuinely public pages and a BUG anywhere else, so every such
 // row is spelled out rather than left to a default.
 //
-// Audiences (the floors live in modules/governance/catalog.js; the gate
+// Audiences (the floors live in modules/government/catalog.js; the gate
 // functions in src/bongos/auth.js):
 //   requireBuilderPage          page.view.public    any signed-in builder (xenos+)
 //   requireGovernancePage       page.view.governance  metic+   (ADR 0157)

package/tests/memory_isolation.mjs

@@ -336,8 +336,8 @@ app.use(attachFail);
 // currently impersonating, so the cases below exercise the PERMISSION decision rather
 // than the port-missing fallback.
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
-seams.registerProvider('governance', {
+const catalog = require('../modules/government/catalog.js');
+seams.registerProvider('government', {
   resolveBuilderPermissions: async () => catalog.seedForRank(
     (fixture.session && fixture.session.rank) || 'xenos',
   ),

package/tests/module_loader.mjs

@@ -197,7 +197,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'governance', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/onboarding_observability.mjs

@@ -43,8 +43,8 @@ async function t(name, fn) {
 // src/bongos/routes, so we patch the resolved module before requiring the
 // routes.
 const authPath = require.resolve('../src/bongos/auth.js');
-const catalog = require('../modules/governance/catalog.js');
-// Mirrors the canonical ladder in modules/governance/catalog.js — omitting a rung
+const catalog = require('../modules/government/catalog.js');
+// Mirrors the canonical ladder in modules/government/catalog.js — omitting a rung
 // would resolve its floor to Infinity and deny everyone, including archon. Kept at
 // module scope (BV1.R104) so requireRank and requirePermission below share ONE
 // ladder; R105's branch still had the stale 3-rung inline copy that dropped thetes.

package/tests/rank_tier_single_source.mjs

@@ -40,7 +40,7 @@ const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const sequence = require(path.join(ROOT, 'scripts', 'gds', 'sequence.js'));
 const boxConnect = require(path.join(ROOT, 'scripts', 'gds', 'box-connect-lib.js'));
 const boxes = require(path.join(ROOT, 'modules', 'dev-box', 'boxes.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const LADDER = kernel.LIVE_RANK_LADDER;
 const TIER = kernel.RANK_TIER;
@@ -142,7 +142,7 @@ const MAP_ALLOWLIST = new Set([
 // Where a rank-ladder array literal is allowed to exist.
 const LADDER_ALLOWLIST = new Set([
   'src/bongos/db-kernel.js', // the canonical source itself
-  'modules/governance/catalog.js',
+  'modules/government/catalog.js',
   'src/bongos/route-rank-check.js',
   ...STATIC_LADDER_FILES,
 ]);

package/tests/route_permission_check.mjs

@@ -9,7 +9,7 @@
 // a downgrade that reads as legitimate, and a published API doc that misstates authority.
 //
 // THE ORACLE PROBLEM (the trap R103 fell into). The classifier DERIVES a permission's
-// rank from modules/governance/catalog.js, so asserting it back against catalog.floor
+// rank from modules/government/catalog.js, so asserting it back against catalog.floor
 // would move both sides together and prove nothing. Every expectation below is therefore
 // either a HAND-WRITTEN literal (a floor read off the catalog once, by a human, and
 // frozen here — so a floor edit reds this file and has to be argued with) or
@@ -67,7 +67,7 @@ const HAND_WRITTEN_FLOORS = {
 // oracle, not a tautology.
 
 test('P0: the parsed floor map matches the catalog module exactly (key set and floors)', () => {
-  const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+  const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
   const parsed = rrc.permissionFloors();
   const evaluated = new Map(catalog.PERMISSIONS.map((p) => [p.key, p.floor]));
   assert.equal(parsed.size, evaluated.size,

package/modules/governance/module.json

@@ -1,11 +0,0 @@
-{
-  "key": "governance",
-  "title": "Governance (configurable roles & permissions)",
-  "description": "Discord-style configurable roles and permissions (ADR 0151, BONGOS-V1 goal 1000030). Permissions are the atomic authority unit and the four ranks (xenos/thetes/metic/archon) become seeded roles; this module owns the code-defined permission catalog (each key flagged `system` = trust-boundary, non-grantable, or operational = delegable) plus the compatibility seed that reproduces today's rank thresholds exactly. A core-domain module, default-on: a Cloud Bongos instance ships configurable roles the way it ships its status page. This first slice (BV1.R94) is the catalog + seed as code constants — the single source the resolver (R95), the requirePermission gate (R97), and the Archon tab (R110/R111) all read. Preserves ADR 0016 (authority resolved server-side, per request, uncached).",
-  "coreVersion": "^1.18.0",
-  "default": true,
-  "maintenance": { "status": "core-maintained" },
-  "contributes": { "migrations": true, "routes": ["governance", "role-sync"] },
-  "provides": ["governance", "governance.roleSync"],
-  "consumes": []
-}