@bongos/core 1.19.183 → 1.19.184

package/modules/lifecycle/db.js

@@ -220,7 +220,7 @@ function xenosClaimAllowed(rank, newcomerFriendly) {
 // 0016 — resolved server-side, uncached), and taking a second pool connection while
 // a tx holds FOR UPDATE locks is a needless deadlock/exhaustion hazard.
 async function claimPermissionsFor(builderId) {
-  const governance = seams.resolveOptional('governance');
+  const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
   try {
     const keys = await governance.resolveBuilderPermissions(builderId);
@@ -408,12 +408,12 @@ function disambiguateWorktreeName(desired, taken) {
 //
 // Returns the updated builder row, or throws { code:'BUILDER_NOT_FOUND' } /
 // { code:'RANK_UNCHANGED' }.
-// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
+// syncGovernanceRankRole — keep government_builder_ranks in step with builders.rank
 // (BV1.R95b, ADR 0151). This module's rank writer backs the automatic xenos→thetes
 // graduation, which had the same hole as the Archon-driven path: the rank moved and
 // the role did not, so a freshly-graduated Thetes kept the xenos role.
 //
-// Resolved through the `governance.roleSync` kernel port (never a sibling require —
+// Resolved through the `government.rankSync` kernel port (never a sibling require —
 // ADR 0083) and run on the CALLER's transaction client, so the rotation commits
 // atomically with the ship + graduation. A missing port (governance disabled) skips:
 // no role ⇒ zero permissions, fail-closed.
@@ -421,9 +421,9 @@ function disambiguateWorktreeName(desired, taken) {
 // TWINNED with src/bongos/db.js (the boundary-forced _applyRankChangeTx duplication,
 // ADR 0091 §2) — keep the two in sync.
 async function syncGovernanceRankRole(client, builderId, rank) {
-  const roleSync = seams.resolveOptional('governance.roleSync');
-  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
-  return roleSync.syncRankRole(client, { builderId, rank });
+  const roleSync = seams.resolveOptional('government.rankSync');
+  if (!roleSync || typeof roleSync.syncRank !== 'function') return null;
+  return roleSync.syncRank(client, { builderId, rank });
 }
 
 // _applyRankChangeTx — the in-transaction CORE of a rank change, shared by the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.183",
+  "version": "1.19.184",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.183",
+      "version": "1.19.184",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.183",
+  "version": "1.19.184",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -732,6 +732,16 @@ const LEGACY_NAMESPACED = {
   // game module: world_events + players were created before the module system (V1 schema). The
   // schema_migrations table is a core tracking table that every migration may re-create idempotently.
   game: new Set(['world_events', 'players', 'schema_migrations']),
+  // government module: the module KEY was renamed governance→government (ADR 0174, goal 1000068),
+  // so its own historical migrations now read as "outside the namespace" purely because the key
+  // moved underneath them. These three tables ARE this module's — under the name it used to have.
+  // They are not renamed in place because schema_migrations is keyed by filename STEM: renaming an
+  // already-applied migration file makes it look unapplied and re-runs it, and governance_002 is a
+  // seed/backfill. government_001_rename_from_governance.sql renames the live tables forward; these
+  // entries let the historical files that created them keep describing what actually happened.
+  government: new Set([
+    'governance_roles', 'governance_builder_roles', 'governance_role_permissions',
+  ]),
 };
 const DESTRUCTIVE_DDL = [
   { re: /\bdrop\s+table\b/i, label: 'DROP TABLE' },
@@ -1141,7 +1151,7 @@ function checkKernelPromptsNoHardcodedIdentity() {
 // this check nothing in CI could see it.
 //
 // Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
-// branding.json, config/governance.json) is host content that legitimately names
+// branding.json, config/government.json) is host content that legitimately names
 // its host, and is boundary-excluded from the published core anyway.
 function checkNeutralConfigsNoHostIdentity() {
   const violations = [];

package/scripts/gds/migration-namespace.js

@@ -57,6 +57,15 @@ const LEGACY_BARE_CORE_MAX = 187;
 // module migrations must be `<key>_`-prefixed; these stay bare (already applied on prod).
 const LEGACY_BARE_MODULES = new Set(['game', 'demo']);
 
+// RENAMED_MODULE_PREFIXES: a module whose KEY was renamed keeps its historical
+// migration-filename prefix for files that were already applied. schema_migrations
+// is keyed by filename STEM, so renaming an applied migration makes it look
+// unapplied and RE-RUNS it — and a re-run seed/backfill is a data event, not a
+// no-op. The already-applied files therefore keep the old prefix forever; only
+// NEW migrations must carry the module's current namespace.
+//   government <- governance (ADR 0174, goal 1000068)
+const RENAMED_MODULE_PREFIXES = { government: new Set(['governance']) };
+
 // ---- parsing ---------------------------------------------------------------
 
 const BARE_RE = /^(\d{3,})_(.+)\.sql$/;
@@ -116,9 +125,11 @@ function filenameViolation(source, basename, { moduleKey } = {}) {
       ? null // legacy bare module — grandfathered
       : `module "${moduleKey}" migration "${basename}" is bare — a NEW module migration must be ${ns}_-prefixed (ADR 0083 §Decision #5 / ADR 0108 §5): use ${ns}_${pad3(p.number)}_${p.slug}.sql`;
   }
-  return p.prefix === ns
-    ? null
-    : `module "${moduleKey}" migration "${basename}" carries the "${p.prefix}_" prefix — it must be ${ns}_-prefixed to its own module (ADR 0083 §Decision #5).`;
+  if (p.prefix === ns) return null;
+  // A renamed module's already-applied files keep their historical prefix (see
+  // RENAMED_MODULE_PREFIXES) — the stem is the schema_migrations key, so it cannot move.
+  if ((RENAMED_MODULE_PREFIXES[moduleKey] || new Set()).has(p.prefix)) return null;
+  return `module "${moduleKey}" migration "${basename}" carries the "${p.prefix}_" prefix — it must be ${ns}_-prefixed to its own module (ADR 0083 §Decision #5).`;
 }
 
 // ---- cross-root stem-collision detector ------------------------------------
@@ -186,6 +197,7 @@ function lineageReport({ core = [], instance = [], modulesByKey = {} } = {}) {
 
 module.exports = {
   CORE_NS,
+  RENAMED_MODULE_PREFIXES,
   INSTANCE_NS,
   RESERVED_NS,
   LEGACY_BARE_CORE_MAX,

package/scripts/gds/publish-manifest.js

@@ -75,7 +75,7 @@ const PUBLISH_ALLOWLIST = [
   'config/design-tokens.neutral.json',
   'config/design-tokens.schema.json',  // the design-token contract (generic schema, no instance values)
   'config/hierarchy.neutral.json',
-  'config/governance.neutral.json',     // the starting role templates a fresh instance inherits (BV1.R96)
+  'config/government.neutral.json',     // the starting rank templates a fresh instance inherits (BV1.R96; renamed from governance.neutral.json by ADR 0174)
   // --- the portable methodology core, governance, and sanitized docs ---
   'CLAUDE.md',
   'README.md',
@@ -212,7 +212,8 @@ const INSTANCE_EXCLUDE = [
   'config/modules.json',
   'config/devbox-app.json',
   'config/hierarchy.json',
-  'config/governance.json',
+  'config/government.json',
+  'config/governance.json',   // pre-ADR-0174 spelling — a live instance may still carry one; it is host content and stays denied
   'CODEOWNERS',              // names the owner (a protected surface, excluded as identity)
   // instance SEED migrations — this host's scope-truth SQL (planning seeds, world data).
   // ADR 0105: a consumer's core must not carry them; migrate.sh reads instance seeds from

package/scripts/gds/seed-governance-tasks.js

@@ -195,10 +195,10 @@ const TASKS = [
   {
     ref: 'R96', kind: 'feature', priority: 4, est_minutes: 100, manual_degree: 2, credits_reward: 40,
     criterion_ids: [C4], depends_on_refs: ['R93', 'R94'],
-    title: 'config/governance.json + neutral + resolve-over-neutral',
+    title: 'config/government.json + neutral + resolve-over-neutral',
     description: `**Why:** role templates/defaults are per-instance config (the branding pattern); live data is DB.
 
-**Done when:** \`config/governance.json\` (instance) resolves over \`config/governance.neutral.json\` (neutral) with env override on top, mirroring src/branding.js precedence; it seeds the starting role templates a fresh instance inherits; live assignments stay in the DB (R93). Depends on R93/R94.`,
+**Done when:** \`config/government.json\` (instance) resolves over \`config/government.neutral.json\` (neutral) with env override on top, mirroring src/branding.js precedence; it seeds the starting role templates a fresh instance inherits; live assignments stay in the DB (R93). Depends on R93/R94.`,
   },
   {
     ref: 'R102', kind: 'verify', priority: 3, est_minutes: 70, manual_degree: 2, credits_reward: 35,

package/src/bongos/auth.js

@@ -367,7 +367,7 @@ async function maybeSeatFirstAdmin(builder) {
 // flips xenos→archon outside any transaction), and it quietly repairs a builder whose
 // assignment drifted for any other reason.
 //
-// Resolved through the `governance.roleSync` kernel port — auth.js is a KERNEL_FILE
+// Resolved through the `government.rankSync` kernel port — auth.js is a KERNEL_FILE
 // and may not require a module (ADR 0083 / ADR 0091 §1). Runs on the pool: there is
 // no surrounding transaction here, unlike the two rank-change paths, which pass their
 // own client so the rotation is atomic with the rank write.
@@ -377,8 +377,8 @@ async function maybeSeatFirstAdmin(builder) {
 async function safeSyncRankRole(builder) {
   if (!builder || builder.id == null) return;
   try {
-    await seams.resolveOptional('governance.roleSync')
-      ?.syncRankRole(null, { builderId: builder.id, rank: builder.rank });
+    await seams.resolveOptional('government.rankSync')
+      ?.syncRank(null, { builderId: builder.id, rank: builder.rank });
   } catch (err) {
     console.error('[auth] rank-role sync failed (non-fatal):', err.message);
   }
@@ -1195,8 +1195,8 @@ async function resolveSession(req) {
 // a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
 //
 // GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
-// governance-owned data in modules/governance/session-scopes.json, validated
-// against the permission catalog at load by modules/governance/session-scopes.js.
+// governance-owned data in modules/government/session-scopes.json, validated
+// against the permission catalog at load by modules/government/session-scopes.js.
 // Core reads it as DATA with fs — never `require` (ADR 0083's one-way rule: a
 // module's code and enable/disable state must never be something the kernel
 // depends on). The sibling trust primitive permission-path-check.js reads the
@@ -1211,7 +1211,7 @@ async function resolveSession(req) {
 // registry does not declare is DENIED rather than defaulting to full authority. A
 // null/absent source is a DECLARED row (rows minted before migration 090 added the
 // column, which predate the 'box' source existing), not an implicit default.
-const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'governance', 'session-scopes.json');
+const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'session-scopes.json');
 
 // Pure: validate + normalize the parsed registry. Split from the file read so the
 // shipped assertions are what the tests exercise. `label` identifies the file in
@@ -1440,7 +1440,7 @@ function signInWithReturn(req) {
 //   requireGovernancePage  was rank === 'archon'  floor archon → page.view.governance
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
 // page.view.governance's floor archon→metic and the name stopped being true; the
-// floor now lives in modules/governance/catalog.js, not in the function's name.
+// floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
 // (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
 // no seeded role, so they now fail a page gate a bare rank test would have
@@ -1476,7 +1476,7 @@ const PAGE_GATES = Object.freeze({
 // through to the DB resolve, so the fold can only ever be an optimization.
 async function resolveHeldPermissions(builderId, rawKeys) {
   if (builderId === null || builderId === undefined || builderId === '') return null;
-  const governance = seams.resolveOptional('governance');
+  const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
   if (Array.isArray(rawKeys) && typeof governance.effectivePermissions === 'function') {
     try {
@@ -1723,7 +1723,7 @@ function requirePermission(...perms) {
     const deny = (held) => {
       const missing = held === null ? [...required] : required.filter((key) => !held.includes(key));
       const floors = {};
-      const governance = seams.resolveOptional('governance');
+      const governance = seams.resolveOptional('government');
       if (governance && typeof governance.permissionFloor === 'function') {
         for (const key of missing) {
           const floor = governance.permissionFloor(key);

package/src/bongos/db.js

@@ -338,10 +338,10 @@ function singleRungPromotionError(oldRank, newRank) {
 // has nothing to collide on, so it's returned unchanged. Pure + exported so
 // tests can exercise it without a DB; claimTask calls it inside the txn.
 
-// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
-// (BV1.R95b, ADR 0151). Resolved through the `governance.roleSync` kernel port and
+// syncGovernanceRankRole — keep government_builder_ranks in step with builders.rank
+// (BV1.R95b, ADR 0151). Resolved through the `government.rankSync` kernel port and
 // run on the CALLER's transaction client, so the role rotation is atomic with the
-// rank write beside it. Core never requires modules/governance/ (ADR 0083).
+// rank write beside it. Core never requires modules/government/ (ADR 0083).
 //
 // A missing port means the governance module is disabled, and skipping is the
 // fail-closed answer: the builder then holds no role and resolves to ZERO
@@ -351,9 +351,9 @@ function singleRungPromotionError(oldRank, newRank) {
 // TWINNED with modules/lifecycle/db.js (the boundary-forced _applyRankChangeTx
 // duplication, ADR 0091 §2) — keep the two in sync.
 async function syncGovernanceRankRole(client, builderId, rank) {
-  const roleSync = seams.resolveOptional('governance.roleSync');
-  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
-  return roleSync.syncRankRole(client, { builderId, rank });
+  const roleSync = seams.resolveOptional('government.rankSync');
+  if (!roleSync || typeof roleSync.syncRank !== 'function') return null;
+  return roleSync.syncRank(client, { builderId, rank });
 }
 
 async function _applyRankChangeTx(client, { builderId, newRank, actorBuilderId, reasonNote = null, enforceSingleRungPromotion = false }) {

package/src/bongos/permission-path-check.js

@@ -40,7 +40,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // GOVERNANCE OWNS THE DATA; THE SUBSTRATE STAYS THE ENFORCER. Which paths are
 // protected, at what rank floor, mapped to which `system: true` catalog
 // permission, is governance-owned data in
-// modules/governance/protected-surfaces.json — no longer a constant baked into
+// modules/government/protected-surfaces.json — no longer a constant baked into
 // this file. Re-mapping a floor there is a POLICY edit. It cannot move
 // enforcement into the app: the three layers above (git pre-push hook, grader
 // pre-pass, post-push main audit) plus gate-review.js and the goal-scope check
@@ -61,7 +61,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // file that ships inside the core package next to this file (modules/ ships with
 // @bongos/core, ADR 0108 §1). The sibling trust primitive route-rank-check.js
 // already reads modules/*/routes/*.js off disk the same way, to rank-gate them.
-// Code still flows ONE way only: modules/governance/protected-surfaces.js →
+// Code still flows ONE way only: modules/government/protected-surfaces.js →
 // src/module-api.js → this matcher. Nothing in core requires the module.
 //
 // FAIL-CLOSED: a missing/empty/malformed registry THROWS. It never degrades to
@@ -71,7 +71,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // Resolved from __dirname (this file is <coreRoot>/src/bongos/) rather than via
 // instance-config so the load keeps zero repo imports and works in a bare git
 // hook.
-const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'governance', 'protected-surfaces.json');
+const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'protected-surfaces.json');
 
 function loadRegistry(file) {
   let raw;

package/src/bongos/route-rank-check.js

@@ -52,7 +52,7 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // classified 'any-builder': a downgrade that reads as legitimate. To classify it
 // honestly the auditor needs each atom's rank FLOOR (the rank that holds it under
 // governance's compat seed), which is declared exactly once — in
-// modules/governance/catalog.js. There is deliberately NO second permission→rank table
+// modules/government/catalog.js. There is deliberately NO second permission→rank table
 // here; a second list is a list that drifts.
 //
 // READ AS DATA, NOT require()d. ADR 0083's one-way rule forbids core from importing a
@@ -60,14 +60,14 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // core, so we parse the catalog's `floor:` declarations out of its SOURCE — the same
 // technique this file already applies to modules/*/routes/*.js, and the posture the
 // sibling trust primitive permission-path-check.js takes with
-// modules/governance/protected-surfaces.json. Like those, it runs with no DB, no
+// modules/government/protected-surfaces.json. Like those, it runs with no DB, no
 // server and no module loader, so it works inside a git hook.
 //
 // LAZY + FAIL-CLOSED. Loaded on first use, so an instance whose routes carry no
 // permission gate and no permission pin never reads it. An unreadable or empty catalog
 // THROWS rather than degrading to "every atom is unknown"; an atom the catalog does not
 // define classifies 'unknown', which hard-fails a write route.
-const CATALOG_PATH = path.join(MODULES_DIR, 'governance', 'catalog.js');
+const CATALOG_PATH = path.join(MODULES_DIR, 'government', 'catalog.js');
 // low → high authority. Mirrors catalog.js RANK_ORDER; the parse below rejects any
 // floor outside it, so a divergence surfaces as 'unknown' (loud) rather than as trust.
 const PERMISSION_RANK_ORDER = ['xenos', 'thetes', 'metic', 'archon'];

package/src/module-api.js

@@ -336,7 +336,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         and 2026-08-03 with no bump behind them, so no vendored-tarball instance
 //         could take any of them. Headline: the governance permission system
 //         (BV1.R95–R109 — resolver + kernel port, first-class principals, session
-//         scopes, requirePermission(), ownership-scoped grants, config/governance.json)
+//         scopes, requirePermission(), ownership-scoped grants, config/government.json)
 //         and the route-rank/validation hardening that followed it; the ship.js
 //         Windows project-path fix so Windows sessions actually get paid (89f291c);
 //         the sequential chain runner (task 1002484); Metic task abandon/un-abandon
@@ -793,8 +793,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.181 with no explicit bump. run 31972846686. (task 1002620)
 //   1.19.183 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
+//   1.19.184 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.183 with no explicit bump. run 31974847472. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.183'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.184'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -34,9 +34,9 @@ const auth = require('../src/bongos/auth.js');
 // exactly as tests/governance_require_permission.mjs stubs it for requirePermission.
 // The audience is unchanged; tests/governance_page_gates.mjs is the parity proof.
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
+const catalog = require('../modules/government/catalog.js');
 seams._reset();
-seams.registerProvider('governance', {
+seams.registerProvider('government', {
   resolveBuilderPermissions: async () => catalog.seedForRank('xenos'),
 });
 

package/tests/criterion_authoring_gate.mjs

@@ -29,7 +29,7 @@ const buildDoneWhenRouter = require('../modules/lifecycle/routes/done-when.js');
 const { authorizeCriterionCreate } = buildDoneWhenRouter;
 const { authorizeGoalManagement, isGoalOwnerOrManager } = require('../modules/lifecycle/goal-authz.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
-const catalog = require('../modules/governance/catalog.js');
+const catalog = require('../modules/government/catalog.js');
 
 const doneWhenSrc = readFileSync(new URL('../modules/lifecycle/routes/done-when.js', import.meta.url), 'utf8');
 const { test, summary } = makeRunner();

package/tests/governance_abuse_matrix.mjs

@@ -49,11 +49,11 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const govConfig = require(path.join(ROOT, 'modules', 'governance', 'config.js'));
-const sessionScopes = require(path.join(ROOT, 'modules', 'governance', 'session-scopes.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
-const govDb = require(path.join(ROOT, 'modules', 'governance', 'db.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const govConfig = require(path.join(ROOT, 'modules', 'government', 'config.js'));
+const sessionScopes = require(path.join(ROOT, 'modules', 'government', 'session-scopes.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
+const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
@@ -134,11 +134,11 @@ api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon
 
 function grant(keys) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => keys });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
 grant(['governance.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);

package/tests/governance_catalog.mjs

@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const cat = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const cat = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 const { PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
 
 test('every permission is well-formed (key, boolean system, valid floor)', () => {

package/tests/governance_claim_eligibility.mjs

@@ -36,7 +36,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
 

package/tests/governance_config.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const config = require(path.join(GOV, 'config.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
@@ -157,7 +157,7 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
   // the CI gate (which does not scan .json itself — IDENTITY_SCAN_EXTS is js/html/css).
   const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
-  assert.deepEqual(scanPromptIdentity('config/governance.neutral.json', raw, '.json'), []);
+  assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
   // And it carries only templates — never a live per-builder assignment.
   assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['roles']);
   for (const role of Object.values(NEUTRAL.roles)) {
@@ -166,13 +166,13 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
 });
 
 test('the two config paths are the branding-shaped neutral/instance pair under config/', () => {
-  assert.equal(path.relative(ROOT, NEUTRAL_PATH).split(path.sep).join('/'), 'config/governance.neutral.json');
-  assert.equal(path.relative(ROOT, INSTANCE_PATH).split(path.sep).join('/'), 'config/governance.json');
+  assert.equal(path.relative(ROOT, NEUTRAL_PATH).split(path.sep).join('/'), 'config/government.neutral.json');
+  assert.equal(path.relative(ROOT, INSTANCE_PATH).split(path.sep).join('/'), 'config/government.json');
   assert.ok(fs.existsSync(NEUTRAL_PATH), 'the neutral starter must ship — it is the vanilla default');
 });
 
 test('loadGovernanceConfig reads the real neutral starter and tolerates a missing instance pack', () => {
-  // A vanilla instance has no config/governance.json at all — the default INSTANCE_PATH
+  // A vanilla instance has no config/government.json at all — the default INSTANCE_PATH
   // is genuinely absent in this checkout, so the default call exercises that path.
   assert.equal(fs.existsSync(INSTANCE_PATH), false, 'fixture guard: this checkout is the vanilla case');
   const out = loadGovernanceConfig({ env: NO_ENV });
@@ -182,6 +182,6 @@ test('loadGovernanceConfig reads the real neutral starter and tolerates a missin
 
 test('the neutral starter publishes with the core (a packaged vanilla instance needs it)', () => {
   const { isPublishable } = require(path.join(ROOT, 'scripts', 'gds', 'publish-manifest.js'));
-  assert.equal(isPublishable('config/governance.neutral.json'), true);
-  assert.equal(isPublishable('config/governance.json'), false, "a host's filled-in pack is instance content");
+  assert.equal(isPublishable('config/government.neutral.json'), true);
+  assert.equal(isPublishable('config/government.json'), false, "a host's filled-in pack is instance content");
 });

package/tests/governance_fold.mjs

@@ -27,7 +27,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 
 function fakeRes() {
@@ -44,7 +44,7 @@ function fakeRes() {
 // One gate run against a stubbed port. `port` null = unregistered.
 async function run(req, port) {
   seams._reset();
-  if (port !== null) seams.registerProvider('governance', port);
+  if (port !== null) seams.registerProvider('government', port);
   const res = fakeRes();
   let nexted = false;
   await auth.requirePermission('idea.triage')(req, res, () => { nexted = true; });
@@ -121,7 +121,7 @@ test('the kernel shape guard: the real fragment embeds; a malformed one degrades
   assert.equal(dbKernel.sessionPermsSelect(), '', 'a fragment with a statement separator is refused');
   // The REAL registered fragment passes the guard verbatim.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
   buildGovernanceRouter();
   const real = seams.resolveOptional('session-grants-sql').selectFragment;
   assert.equal(dbKernel.sessionPermsSelect(), real, 'the shipped fragment embeds unchanged');
@@ -133,7 +133,7 @@ test('the module registers the capability-named SQL seam the kernel embeds', ()
   // §Decision #4); the governance route factory is what registers it. Pin the
   // registration and the column contract the kernel query depends on.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
   buildGovernanceRouter();
   const provider = seams.resolveOptional('session-grants-sql');
   assert.ok(provider && typeof provider.selectFragment === 'string', 'fragment provider registered');

package/tests/governance_live_proof.mjs

@@ -176,7 +176,7 @@ try {
   // …the resolver reports it honestly (it is a defined catalog key; matrix V10
   // proves no route consumes it via requirePermission, so it admits nothing
   // in-app)…
-  const resolver = require('../modules/governance/resolver.js');
+  const resolver = require('../modules/government/resolver.js');
   const perms = await resolver.resolveBuilderPermissions(THETES);
   ok(perms.includes(OPERATIONAL_KEY), 'the resolved set includes the operational grant');
   console.log(`  (resolved set ${perms.includes(SYSTEM_KEY) ? 'includes' : 'omits'} the forced '${SYSTEM_KEY}' — in-app it guards no route either way)`);
@@ -187,7 +187,7 @@ try {
   // protected-path diff while the forced grant row sits in the database.
   const { checkPermissionPaths } = require('../src/bongos/permission-path-check.js');
   const sub = checkPermissionPaths({
-    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/governance/catalog.js'],
+    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/government/catalog.js'],
     builderRank: 'thetes',
   });
   ok(sub.hardFail === true && sub.findings.length === 2,

package/tests/governance_ownership_scope.mjs

@@ -30,7 +30,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));
 const db = require(path.join(GOV, 'db.js'));

package/tests/governance_page_gates.mjs

@@ -45,8 +45,8 @@ dbKernel.lookupSession = async () => {
 
 const auth = require('../src/bongos/auth.js');
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
-const resolver = require('../modules/governance/resolver.js');
+const catalog = require('../modules/government/catalog.js');
+const resolver = require('../modules/government/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
@@ -126,7 +126,7 @@ async function runGate(name, { rank = null, resolve, port = true } = {}) {
   lookupThrows = false;
   seams._reset();
   if (port) {
-    seams.registerProvider('governance', {
+    seams.registerProvider('government', {
       // The real seed for that rank — the rows governance_002 gives the one
       // rank-role a builder holds. The INPUT, not the oracle.
       resolveBuilderPermissions: resolve || (async () => catalog.seedForRank(rank)),
@@ -144,7 +144,7 @@ async function runGate(name, { rank = null, resolve, port = true } = {}) {
 
 test('A0: the hand-written audience table agrees with the real threshold function', () => {
   // A second, catalog-free oracle for the literal above: auth.rankMeetsThreshold
-  // is the production rank predicate and reads nothing from modules/governance/.
+  // is the production rank predicate and reads nothing from modules/government/.
   for (const gate of GATES) {
     for (const rank of LIVE_RANKS) {
       assert.equal(
@@ -203,7 +203,7 @@ test('B1: a session-lookup error fails CLOSED (redirect to sign-in, no page)', a
   for (const gate of GATES) {
     nextSession = null;
     seams._reset();
-    seams.registerProvider('governance', { resolveBuilderPermissions: async () => catalog.seedForRank('archon') });
+    seams.registerProvider('government', { resolveBuilderPermissions: async () => catalog.seedForRank('archon') });
     lookupThrows = true;
     const res = fakeRes();
     let nexted = false;
@@ -244,7 +244,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   nextSession = { builder_id: 7, rank: 'archon' };
   lookupThrows = false;
   seams._reset();
-  seams.registerProvider('governance', {
+  seams.registerProvider('government', {
     resolveBuilderPermissions: async () => { calls += 1; return keys; },
   });
   const req = { headers: { cookie: 'gds_session=validtoken' } };

package/tests/governance_parity.mjs

@@ -57,8 +57,8 @@ const { RANKS } = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
 const routeRank = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
 
 const { PERMISSIONS, RANK_ORDER, seedForRank } = catalog;
 const FLOORED = PERMISSIONS.filter((p) => p.floor !== null);
@@ -287,7 +287,7 @@ function fakeRes() {
 // not the logic — resolvedFor() is the real resolver over the real seed.
 async function permissionAdmits(key, rank) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => resolvedFor(rank) });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => resolvedFor(rank) });
   let nexted = false;
   await auth.requirePermission(key)({ builder: { id: 7, rank } }, fakeRes(), () => { nexted = true; });
   seams._reset();

package/tests/governance_principals.mjs

@@ -22,7 +22,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));