@bongos/core 1.19.183 → 1.19.185

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -337,25 +337,25 @@ function createClient(opts = {}) {
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
     },
-    "governance": {
-      // GET /governance/assignments — rank: archon — GET /governance/assignments
-      getGovernanceAssignments: (args) => request("GET", "/governance/assignments", { hasBody: false }, args),
-      // POST /governance/assignments — rank: archon — POST /governance/assignments
-      postGovernanceAssignments: (args) => request("POST", "/governance/assignments", { hasBody: true }, args),
-      // DELETE /governance/assignments/{builderId}/{roleKey} — rank: archon — DELETE /governance/assignments/:builderId/:roleKey
-      deleteGovernanceAssignmentsBuilderIdRoleKey: (args) => request("DELETE", "/governance/assignments/{builderId}/{roleKey}", { hasBody: false }, args),
-      // GET /governance/permissions — rank: archon — GET /governance/permissions
-      getGovernancePermissions: (args) => request("GET", "/governance/permissions", { hasBody: false }, args),
-      // GET /governance/roles — rank: archon — GET /governance/roles
-      getGovernanceRoles: (args) => request("GET", "/governance/roles", { hasBody: false }, args),
-      // POST /governance/roles — rank: archon — POST /governance/roles
-      postGovernanceRoles: (args) => request("POST", "/governance/roles", { hasBody: true }, args),
-      // DELETE /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — DELETE /governance/roles/:roleKey/permissions/:permissionKey
-      deleteGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("DELETE", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: false }, args),
-      // PUT /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — PUT /governance/roles/:roleKey/permissions/:permissionKey
-      putGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("PUT", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: true }, args),
-      // POST /governance/roles/{roleKey}/reset — rank: archon — POST /governance/roles/:roleKey/reset
-      postGovernanceRolesRoleKeyReset: (args) => request("POST", "/governance/roles/{roleKey}/reset", { hasBody: true }, args),
+    "government": {
+      // GET /government/assignments — rank: archon — GET /government/assignments
+      getGovernmentAssignments: (args) => request("GET", "/government/assignments", { hasBody: false }, args),
+      // POST /government/assignments — rank: archon — POST /government/assignments
+      postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
+      // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
+      deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/permissions — rank: archon — GET /government/permissions
+      getGovernmentPermissions: (args) => request("GET", "/government/permissions", { hasBody: false }, args),
+      // GET /government/ranks — rank: archon — GET /government/ranks
+      getGovernmentRanks: (args) => request("GET", "/government/ranks", { hasBody: false }, args),
+      // POST /government/ranks — rank: archon — POST /government/ranks
+      postGovernmentRanks: (args) => request("POST", "/government/ranks", { hasBody: true }, args),
+      // DELETE /government/ranks/{rankKey}/permissions/{permissionKey} — rank: archon — DELETE /government/ranks/:rankKey/permissions/:permissionKey
+      deleteGovernmentRanksRankKeyPermissionsPermissionKey: (args) => request("DELETE", "/government/ranks/{rankKey}/permissions/{permissionKey}", { hasBody: false }, args),
+      // PUT /government/ranks/{rankKey}/permissions/{permissionKey} — rank: archon — PUT /government/ranks/:rankKey/permissions/:permissionKey
+      putGovernmentRanksRankKeyPermissionsPermissionKey: (args) => request("PUT", "/government/ranks/{rankKey}/permissions/{permissionKey}", { hasBody: true }, args),
+      // POST /government/ranks/{rankKey}/reset — rank: archon — POST /government/ranks/:rankKey/reset
+      postGovernmentRanksRankKeyReset: (args) => request("POST", "/government/ranks/{rankKey}/reset", { hasBody: true }, args),
     },
     "grades": {
       // GET /grades/by-builder — rank: metic+archon — GET /grades/by-builder

package/modules/{governance → government}/catalog.js

@@ -104,7 +104,7 @@ const PERMISSIONS = [
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },
   { key: 'goal.scope.manage', system: true, floor: 'archon', guards: 'cross-tier goal-scope edges + protected-scope admission (ADR 0086)' },
-  { key: 'governance.manage', system: true, floor: 'archon', guards: 'the governance tab routes (roles/perms/assignments CRUD, reads included — R110) — meta-escalation' },
+  { key: 'government.manage', system: true, floor: 'archon', guards: 'the governance tab routes (roles/perms/assignments CRUD, reads included — R110) — meta-escalation' },
   { key: 'gate_approval.decide', system: true, floor: 'archon', guards: 'POST /gate-approvals/:pr/approve — CI deploy-gate override' },
   { key: 'deploy.push_main', system: true, substrate: true, floor: 'archon', guards: 'git push origin main / the deploy — substrate-enforced (pre-push, main-audit)' },
   { key: 'path.protected.modify', system: true, substrate: true, floor: 'archon', guards: 'modifying a PROTECTED_GLOBS path below the Metic floor — substrate (ADR 0043)' },
@@ -123,7 +123,7 @@ const PERMISSIONS = [
   //
   // The four trust-boundary keys that ALSO stay Archon are system:true above
   // (`task.confirm.grade_bypass`, `gate_approval.decide`, `goal.scope.manage`,
-  // `governance.manage`) — see the ADR's escalation-chain argument for why moving any
+  // `government.manage`) — see the ADR's escalation-chain argument for why moving any
   // one of them would make this delegation self-reversible.
   { key: 'builder.status.set', system: false, floor: 'archon', guards: 'PATCH /builders/:id/status — offboard / (de)activate' },
   { key: 'auth.session.revoke', system: false, floor: 'archon', guards: 'POST /auth/revoke, /auth/revoke-all' },
@@ -207,7 +207,7 @@ const PERMISSIONS = [
   { key: 'audit_log.read', system: false, floor: 'metic', guards: 'GET /audit-log (ADR 0157, was archon)' },
   // ADR 0157 §4. Split from `gate_approval.decide` (system, archon) so the Gate PAGE
   // can open to Metic while APPROVING a held PR stays Archon. Without the split, a
-  // Metic could reach /gate via `page.view.governance` and then 403 on its only data
+  // Metic could reach /gate via `page.view.government` and then 403 on its only data
   // endpoint — a page that renders nothing but an error.
   { key: 'gate_approval.read', system: false, floor: 'metic', guards: 'GET /gate-approvals — the Gate page read side (approve = gate_approval.decide, archon)' },
 
@@ -236,9 +236,9 @@ const PERMISSIONS = [
   // ADR 0157: floor archon→metic, which is what opens /watch, /harbor and /gate to the
   // working rank. The gate FUNCTION was renamed to match (`requireArchonPage` →
   // `requireGovernancePage`) once the floor moved. Viewing is all this grants: every
-  // write those pages reach is its own atom, and `governance.manage` (the
+  // write those pages reach is its own atom, and `government.manage` (the
   // roles/permissions tab) stayed archon.
-  { key: 'page.view.governance', system: false, floor: 'metic', guards: 'the governance/monitoring pages — /watch, /harbor, /gate (requireGovernancePage; write = governance.manage, archon)' },
+  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the governance/monitoring pages — /watch, /harbor, /gate (requireGovernancePage; write = government.manage, archon)' },
 ];
 
 // ── invariants asserted at module load (fail loud on an authoring typo) ─────────
@@ -410,7 +410,7 @@ function substrateKeys() {
 //
 // The owner's 2026-08-16 decision made the three sub-Archon RANK roles editable, so
 // "is this grantable" stopped being a property of the key alone. `role` is a
-// governance_roles row ({ is_system, seeded_rank }); the four answers:
+// government_ranks row ({ is_system, seeded_rank }); the four answers:
 //
 //   • NEVER, to any role — a machine-principal key (held by an identity, not a role)
 //     and a SUBSTRATE key. The substrate three are inert as grant rows: no route
@@ -418,13 +418,13 @@ function substrateKeys() {
 //     success and delegate nothing. Refusing them keeps the tab honest.
 //   • the ARCHON rank-role — nothing. It is immutable and already holds everything,
 //     and that immutability is also the LOCKOUT GUARD: the only role carrying
-//     `governance.manage` by seed can never have it revoked, so no sequence of
+//     `government.manage` by seed can never have it revoked, so no sequence of
 //     clicks in this tab can lock the owner out of the tab.
 //   • a SEEDED rank-role BELOW archon — everything else, the seven in-app Archon
 //     powers included. This is the delegation lever the owner asked for.
 //   • a CUSTOM role — operational only: the pre-existing R110 wall, deliberately NOT
 //     widened. A rank-role is the owner's own coarse ladder, moved by a rank write;
-//     a custom role is ad-hoc and assignable by anyone holding `governance.manage`,
+//     a custom role is ad-hoc and assignable by anyone holding `government.manage`,
 //     so widening it would hand the second group the first group's lever.
 //
 // Fail-closed on everything unrecognised: unknown key, missing role, or a system role

package/modules/{governance → government}/config.js

@@ -6,8 +6,8 @@
 // assignments are DB rows. This file resolves the config half, mirroring
 // src/branding.js precedence exactly:
 //
-//   env override  ->  instance config (config/governance.json)  ->  neutral
-//   starter (config/governance.neutral.json)
+//   env override  ->  instance config (config/government.json)  ->  neutral
+//   starter (config/government.neutral.json)
 //
 // A fresh instance with NO config resolves to the PLAIN neutral role set — never to
 // a host's labels (fail-to-vanilla, the same posture branding takes). R102 proves
@@ -17,8 +17,8 @@
 // second source of authority truth, which is exactly what ADR 0016 forbids:
 //   • config — TEMPLATES/DEFAULTS: a role's display label, its description, and the
 //     permission list a starting CUSTOM role template proposes. Shapes only.
-//   • DB     — LIVE STATE: governance_roles / governance_role_permissions /
-//     governance_builder_roles (R93). WHO HOLDS WHAT is a row, resolved server-side
+//   • DB     — LIVE STATE: government_ranks / government_rank_permissions /
+//     government_builder_ranks (R93). WHO HOLDS WHAT is a row, resolved server-side
 //     per request by resolver.js. Nothing in this file grants anything to anybody.
 //
 // Three fail-closed rules, in the same spirit as resolver.js's drop-unknown-key rule:
@@ -55,8 +55,8 @@ const catalog = require('./catalog');
 // split lands, the INSTANCE path routes through resolveInstanceRoot() — the module
 // doorway does not re-export the root resolvers yet.
 const ROOT = path.resolve(__dirname, '..', '..');
-const NEUTRAL_PATH = path.join(ROOT, 'config', 'governance.neutral.json');
-const INSTANCE_PATH = path.join(ROOT, 'config', 'governance.json');
+const NEUTRAL_PATH = path.join(ROOT, 'config', 'government.neutral.json');
+const INSTANCE_PATH = path.join(ROOT, 'config', 'government.json');
 
 const SEEDED_RANK_ROLES = new Set(catalog.RANK_ORDER);
 

package/modules/{governance → government}/db.js

@@ -11,7 +11,7 @@
 // next request — the ADR 0016 trust-boundary rule the resolver inherits.
 
 const { pool } = require('../../src/module-api');
-const { planRankRoleSync } = require('./rank-roles');
+const { planRankSync } = require('./ranks');
 
 // Every permission_key granted to any role the builder holds. Duplicates across
 // roles are collapsed by the DISTINCT — the resolver's UNION semantics. Returns
@@ -20,8 +20,8 @@ const { planRankRoleSync } = require('./rank-roles');
 async function getPermissionKeysForBuilder(builderId) {
   const { rows } = await pool.query(
     `SELECT DISTINCT rp.permission_key
-       FROM governance_builder_roles br
-       JOIN governance_role_permissions rp ON rp.role_key = br.role_key
+       FROM government_builder_ranks br
+       JOIN government_rank_permissions rp ON rp.rank_key = br.rank_key
       WHERE br.builder_id = $1`,
     [builderId],
   );
@@ -32,16 +32,16 @@ async function getPermissionKeysForBuilder(builderId) {
 // R110/R111) and for explaining a 403. Not part of the resolve path.
 async function getRoleKeysForBuilder(builderId) {
   const { rows } = await pool.query(
-    `SELECT role_key FROM governance_builder_roles WHERE builder_id = $1 ORDER BY role_key`,
+    `SELECT rank_key FROM government_builder_ranks WHERE builder_id = $1 ORDER BY rank_key`,
     [builderId],
   );
-  return rows.map((r) => r.role_key);
+  return rows.map((r) => r.rank_key);
 }
 
 // --- the rank→role WRITE half (BV1.R95b) ------------------------------------
 //
 // Everything above this line only READS. Until R95b the only write to
-// governance_builder_roles in the whole repo was governance_002's run-once
+// government_builder_ranks in the whole repo was governance_002's run-once
 // backfill, so a builder created after it had NO role (locked out of every
 // permission gate) and a builder whose rank CHANGED kept their OLD rank-role
 // (a demoted Archon still resolving Archon permissions — the ADR 0016 defect).
@@ -49,7 +49,7 @@ async function getRoleKeysForBuilder(builderId) {
 // The writer below is a TRANSACTION PARTICIPANT: every caller hands it the client
 // its own BEGIN/COMMIT is running on, so the role rotation commits — or rolls back
 // — atomically with the rank write it accompanies. Core reaches it through the
-// `governance.roleSync` kernel port (routes/role-sync.js); it never imports this
+// `government.rankSync` kernel port (routes/rank-sync.js); it never imports this
 // module (ADR 0083).
 
 // The seeded rank-roles as the DB actually defines them. Read per call rather than
@@ -57,8 +57,8 @@ async function getRoleKeysForBuilder(builderId) {
 // runs on rank writes + sign-in, never in a hot loop.
 async function getSeededRankRoles(q) {
   const { rows } = await q.query(
-    `SELECT role_key, seeded_rank, is_system
-       FROM governance_roles
+    `SELECT rank_key, seeded_rank, is_system
+       FROM government_ranks
       WHERE is_system = true AND seeded_rank IS NOT NULL`,
   );
   return rows;
@@ -68,16 +68,16 @@ async function getSeededRankRoles(q) {
 // seeded rank-role from an Archon-assigned custom one.
 async function getRoleAssignmentsForBuilder(q, builderId) {
   const { rows } = await q.query(
-    `SELECT br.role_key, r.is_system, r.seeded_rank
-       FROM governance_builder_roles br
-       JOIN governance_roles r ON r.role_key = br.role_key
+    `SELECT br.rank_key, r.is_system, r.seeded_rank
+       FROM government_builder_ranks br
+       JOIN government_ranks r ON r.rank_key = br.rank_key
       WHERE br.builder_id = $1`,
     [builderId],
   );
   return rows;
 }
 
-// syncRankRole(client, { builderId, rank }) — make the builder's seeded rank-role
+// syncRank(client, { builderId, rank }) — make the builder's seeded rank-role
 // match `rank`: add the matching one, DELETE every other seeded one, leave custom
 // roles alone. `client` is the caller's open transaction client; pass null/undefined
 // to run on the pool (the sign-in path, which has no surrounding transaction).
@@ -89,27 +89,27 @@ async function getRoleAssignmentsForBuilder(q, builderId) {
 // assigned_by is left NULL: a rank-derived assignment is the system's, not a person's
 // (governance_002's backfill uses the same convention; the human decision is audited
 // in credit_log's rank_change row).
-async function syncRankRole(client, { builderId, rank } = {}) {
+async function syncRank(client, { builderId, rank } = {}) {
   if (builderId === null || builderId === undefined || builderId === '') {
     return { target: null, added: [], removed: [] };
   }
   const q = client || pool;
   const seededRoles = await getSeededRankRoles(q);
   const currentRoles = await getRoleAssignmentsForBuilder(q, builderId);
-  const plan = planRankRoleSync({ rank, currentRoles, seededRoles });
+  const plan = planRankSync({ rank, currentRoles, seededRoles });
 
   if (plan.remove.length > 0) {
     await q.query(
-      `DELETE FROM governance_builder_roles
-        WHERE builder_id = $1 AND role_key = ANY($2::text[])`,
+      `DELETE FROM government_builder_ranks
+        WHERE builder_id = $1 AND rank_key = ANY($2::text[])`,
       [builderId, [...plan.remove]],
     );
   }
   if (plan.add.length > 0) {
     await q.query(
-      `INSERT INTO governance_builder_roles (builder_id, role_key)
+      `INSERT INTO government_builder_ranks (builder_id, rank_key)
        SELECT $1, unnest($2::text[])
-       ON CONFLICT (builder_id, role_key) DO NOTHING`,
+       ON CONFLICT (builder_id, rank_key) DO NOTHING`,
       [builderId, [...plan.add]],
     );
   }
@@ -127,23 +127,23 @@ async function syncRankRole(client, { builderId, rank } = {}) {
 
 async function listRolesWithGrants() {
   const { rows } = await pool.query(
-    `SELECT r.role_key, r.label, r.description, r.is_system, r.seeded_rank,
+    `SELECT r.rank_key, r.label, r.description, r.is_system, r.seeded_rank,
             r.created_by, r.created_at,
             COALESCE(array_agg(rp.permission_key ORDER BY rp.permission_key)
                      FILTER (WHERE rp.permission_key IS NOT NULL), '{}') AS permissions
-       FROM governance_roles r
-       LEFT JOIN governance_role_permissions rp ON rp.role_key = r.role_key
+       FROM government_ranks r
+       LEFT JOIN government_rank_permissions rp ON rp.rank_key = r.rank_key
       GROUP BY r.id
-      ORDER BY r.is_system DESC, r.role_key`,
+      ORDER BY r.is_system DESC, r.rank_key`,
   );
   return rows;
 }
 
 async function getRoleByKey(roleKey) {
   const { rows } = await pool.query(
-    `SELECT role_key, label, description, is_system, seeded_rank, created_by, created_at
-       FROM governance_roles
-      WHERE role_key = $1`,
+    `SELECT rank_key, label, description, is_system, seeded_rank, created_by, created_at
+       FROM government_ranks
+      WHERE rank_key = $1`,
     [roleKey],
   );
   return rows[0] ?? null;
@@ -151,9 +151,9 @@ async function getRoleByKey(roleKey) {
 
 async function createRole({ roleKey, label, description, createdBy }) {
   const { rows } = await pool.query(
-    `INSERT INTO governance_roles (role_key, label, description, is_system, seeded_rank, created_by)
+    `INSERT INTO government_ranks (rank_key, label, description, is_system, seeded_rank, created_by)
      VALUES ($1, $2, $3, false, NULL, $4)
-     RETURNING role_key, label, description, is_system, seeded_rank, created_by, created_at`,
+     RETURNING rank_key, label, description, is_system, seeded_rank, created_by, created_at`,
     [roleKey, label, description ?? null, createdBy],
   );
   return rows[0];
@@ -161,9 +161,9 @@ async function createRole({ roleKey, label, description, createdBy }) {
 
 async function grantRolePermission({ roleKey, permissionKey }) {
   const { rowCount } = await pool.query(
-    `INSERT INTO governance_role_permissions (role_key, permission_key)
+    `INSERT INTO government_rank_permissions (rank_key, permission_key)
      VALUES ($1, $2)
-     ON CONFLICT (role_key, permission_key) DO NOTHING`,
+     ON CONFLICT (rank_key, permission_key) DO NOTHING`,
     [roleKey, permissionKey],
   );
   return rowCount > 0;
@@ -171,8 +171,8 @@ async function grantRolePermission({ roleKey, permissionKey }) {
 
 async function revokeRolePermission({ roleKey, permissionKey }) {
   const { rowCount } = await pool.query(
-    `DELETE FROM governance_role_permissions
-      WHERE role_key = $1 AND permission_key = $2`,
+    `DELETE FROM government_rank_permissions
+      WHERE rank_key = $1 AND permission_key = $2`,
     [roleKey, permissionKey],
   );
   return rowCount > 0;
@@ -188,12 +188,12 @@ async function resetRoleGrants({ roleKey, permissionKeys }) {
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
-    await client.query(`DELETE FROM governance_role_permissions WHERE role_key = $1`, [roleKey]);
+    await client.query(`DELETE FROM government_rank_permissions WHERE rank_key = $1`, [roleKey]);
     if (permissionKeys.length > 0) {
       await client.query(
-        `INSERT INTO governance_role_permissions (role_key, permission_key)
+        `INSERT INTO government_rank_permissions (rank_key, permission_key)
          SELECT $1, unnest($2::text[])
-         ON CONFLICT (role_key, permission_key) DO NOTHING`,
+         ON CONFLICT (rank_key, permission_key) DO NOTHING`,
         [roleKey, [...permissionKeys]],
       );
     }
@@ -210,21 +210,21 @@ async function resetRoleGrants({ roleKey, permissionKeys }) {
 async function listAssignments() {
   const { rows } = await pool.query(
     `SELECT br.builder_id, b.github_login, b.display_name, b.rank,
-            br.role_key, r.label AS role_label, r.is_system, r.seeded_rank,
+            br.rank_key, r.label AS role_label, r.is_system, r.seeded_rank,
             br.assigned_by, br.assigned_at
-       FROM governance_builder_roles br
+       FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id
-       JOIN governance_roles r ON r.role_key = br.role_key
-      ORDER BY br.builder_id, br.role_key`,
+       JOIN government_ranks r ON r.rank_key = br.rank_key
+      ORDER BY br.builder_id, br.rank_key`,
   );
   return rows;
 }
 
 async function assignRole({ builderId, roleKey, assignedBy }) {
   const { rowCount } = await pool.query(
-    `INSERT INTO governance_builder_roles (builder_id, role_key, assigned_by)
+    `INSERT INTO government_builder_ranks (builder_id, rank_key, assigned_by)
      VALUES ($1, $2, $3)
-     ON CONFLICT (builder_id, role_key) DO NOTHING`,
+     ON CONFLICT (builder_id, rank_key) DO NOTHING`,
     [builderId, roleKey, assignedBy],
   );
   return rowCount > 0;
@@ -232,8 +232,8 @@ async function assignRole({ builderId, roleKey, assignedBy }) {
 
 async function unassignRole({ builderId, roleKey }) {
   const { rowCount } = await pool.query(
-    `DELETE FROM governance_builder_roles
-      WHERE builder_id = $1 AND role_key = $2`,
+    `DELETE FROM government_builder_ranks
+      WHERE builder_id = $1 AND rank_key = $2`,
     [builderId, roleKey],
   );
   return rowCount > 0;
@@ -244,7 +244,7 @@ module.exports = {
   getRoleKeysForBuilder,
   getSeededRankRoles,
   getRoleAssignmentsForBuilder,
-  syncRankRole,
+  syncRank,
   listRolesWithGrants,
   getRoleByKey,
   createRole,

package/modules/government/migrations/government_001_rename_from_governance.sql

@@ -0,0 +1,213 @@
+-- governance_008_rename_to_government_ranks.sql
+-- Goal 1000068 R03 (task 1003004) — ADR 0174.
+--
+-- Renames the three authz tables, their indexes, their constraints and the
+-- `role_key` column to the post-ADR-0174 vocabulary: the permission system is
+-- the GOVERNMENT, and the positions in it are RANKS. "Role" is reserved for the
+-- three crafts (Artist / Ideator / Builder).
+--
+--   governance_roles            -> government_ranks
+--   governance_builder_roles    -> government_builder_ranks
+--   governance_role_permissions -> government_rank_permissions
+--   <all three>.role_key        -> rank_key
+--
+-- ── THIS MIGRATION IS NOT SAFE TO APPLY BEFORE R04/R05 ──────────────────────
+-- It is a BREAKING rename with no compatibility shim. The moment it applies,
+-- code that still queries `governance_roles` fails — and that code is the
+-- permission resolver, on every authenticated request. That is why the live
+-- instance's core auto-upgrade sweep (`cloudbongos-core-update-subscription
+-- .timer`) was stopped and disabled on 2026-08-16, freezing the pin at core
+-- 1.19.179 so this migration cannot reach the live database until the renamed
+-- code (R04 task 1003005, R05 task 1003006) is in the same release. Task
+-- 1003011 re-enables the sweep and is dependency-gated on all three.
+-- The owner chose the pause over compatibility views, having been shown both.
+--
+-- ── WHAT THIS MIGRATION DELIBERATELY DOES NOT DO ────────────────────────────
+-- It does NOT rename the permission-key ROWS (`governance.manage` ->
+-- `government.manage`, `page.view.governance` -> `page.view.government`). Those
+-- belong in R05, in the SAME commit as the `catalog.js` constants, because the
+-- resolver DROPS any grant naming a key the catalog does not define (the
+-- fail-closed rule in modules/governance/CLAUDE.md). Renaming the rows here
+-- would mean that between this migration and R05 every `government.manage` row
+-- resolves to nothing — and since that key gates the Government tab itself, the
+-- owner would be locked out of the surface used to inspect the damage. The
+-- schema renames below pair with R04's code; the key renames pair with R05's.
+--
+-- ── MECHANICS ───────────────────────────────────────────────────────────────
+-- ALTER TABLE ... RENAME is catalog-only: it rewrites no rows, holds an
+-- ACCESS EXCLUSIVE lock for the instant it takes, and carries every index,
+-- constraint, foreign key, sequence ownership and privilege with it (they
+-- reference the table by OID, not by name). The same is true of RENAME COLUMN,
+-- including for the two inbound foreign keys that point at `role_key`.
+-- Constraint and index NAMES do not follow, however — Postgres leaves them
+-- spelled the old way — so they are renamed explicitly below. Nothing depends
+-- on those names at runtime; they are renamed so a reader of \d output is not
+-- told a story about "roles" that stopped being true.
+--
+-- IDEMPOTENT: every statement is guarded on the old name still being present,
+-- so a re-run after a partial apply is a no-op rather than an error. migrate.sh
+-- applies each file once, but a hand-run during recovery should not punish you.
+--
+-- ── VERIFIED AGAINST REAL DATA ──────────────────────────────────────────────
+-- Rehearsed on a scratch database restored from the live 2026-08-16 dump (not a
+-- synthetic fixture): apply, apply-again, roll back, apply again. The
+-- (builder, permission) fingerprint md5 fb6be239ae2b3bf811888ac90cfb6346 and the
+-- row baseline 4 ranks / 15 assignments / 161 grants were byte-identical at
+-- every step, and an INSERT through the renamed sequence still allocated an id.
+-- Snapshots of the live database live at
+-- /home/lars/mig/pre-govt-rename-{authz,full}-2026-08-16T213128Z.*
+--
+-- ROLLBACK — reverse every RENAME. Lossless (no row is touched). This exact
+-- script was executed as part of the rehearsal above:
+--
+--   BEGIN;
+--   ALTER TABLE government_ranks            RENAME TO governance_roles;
+--   ALTER TABLE government_builder_ranks    RENAME TO governance_builder_roles;
+--   ALTER TABLE government_rank_permissions RENAME TO governance_role_permissions;
+--   ALTER TABLE governance_roles            RENAME COLUMN rank_key TO role_key;
+--   ALTER TABLE governance_builder_roles    RENAME COLUMN rank_key TO role_key;
+--   ALTER TABLE governance_role_permissions RENAME COLUMN rank_key TO role_key;
+--   ALTER SEQUENCE government_ranks_id_seq  RENAME TO governance_roles_id_seq;
+--   ALTER INDEX government_rank_permissions_perm_idx
+--     RENAME TO governance_role_permissions_perm_idx;
+--   ALTER INDEX government_builder_ranks_rank_idx
+--     RENAME TO governance_builder_roles_role_idx;
+--   COMMIT;
+--
+-- Constraint names are left spelled the new way by that rollback; they are
+-- cosmetic and step 4 below re-derives them on the next forward apply.
+
+BEGIN;
+
+-- ── 1. the tables ───────────────────────────────────────────────────────────
+DO $$
+BEGIN
+  IF to_regclass('public.governance_roles') IS NOT NULL
+     AND to_regclass('public.government_ranks') IS NULL THEN
+    ALTER TABLE governance_roles RENAME TO government_ranks;
+  END IF;
+
+  IF to_regclass('public.governance_builder_roles') IS NOT NULL
+     AND to_regclass('public.government_builder_ranks') IS NULL THEN
+    ALTER TABLE governance_builder_roles RENAME TO government_builder_ranks;
+  END IF;
+
+  IF to_regclass('public.governance_role_permissions') IS NOT NULL
+     AND to_regclass('public.government_rank_permissions') IS NULL THEN
+    ALTER TABLE governance_role_permissions RENAME TO government_rank_permissions;
+  END IF;
+END $$;
+
+-- ── 2. the role_key -> rank_key column, on all three tables ─────────────────
+-- The two child columns are foreign keys onto the parent's unique column; a
+-- RENAME COLUMN updates the dependency in place, so the order here is free.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+              WHERE table_name = 'government_ranks' AND column_name = 'role_key') THEN
+    ALTER TABLE government_ranks RENAME COLUMN role_key TO rank_key;
+  END IF;
+
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+              WHERE table_name = 'government_builder_ranks' AND column_name = 'role_key') THEN
+    ALTER TABLE government_builder_ranks RENAME COLUMN role_key TO rank_key;
+  END IF;
+
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+              WHERE table_name = 'government_rank_permissions' AND column_name = 'role_key') THEN
+    ALTER TABLE government_rank_permissions RENAME COLUMN role_key TO rank_key;
+  END IF;
+END $$;
+
+-- ── 3. indexes ──────────────────────────────────────────────────────────────
+DO $$
+BEGIN
+  IF to_regclass('public.governance_role_permissions_perm_idx') IS NOT NULL
+     AND to_regclass('public.government_rank_permissions_perm_idx') IS NULL THEN
+    ALTER INDEX governance_role_permissions_perm_idx
+      RENAME TO government_rank_permissions_perm_idx;
+  END IF;
+
+  IF to_regclass('public.governance_builder_roles_role_idx') IS NOT NULL
+     AND to_regclass('public.government_builder_ranks_rank_idx') IS NULL THEN
+    ALTER INDEX governance_builder_roles_role_idx
+      RENAME TO government_builder_ranks_rank_idx;
+  END IF;
+END $$;
+
+-- ── 3b. the bigserial sequence ──────────────────────────────────────────────
+-- `id bigserial` created `governance_roles_id_seq`, and a table rename does NOT
+-- carry the sequence's NAME with it — only its ownership. Left alone, the
+-- database would go on saying "governance_roles" forever in the one place
+-- nobody thinks to look, which is precisely the drift this goal exists to end.
+-- Safe: the column default is stored as an OID (`nextval('…'::regclass)`), so
+-- it re-renders against the new name and keeps working.
+DO $$
+BEGIN
+  IF to_regclass('public.governance_roles_id_seq') IS NOT NULL
+     AND to_regclass('public.government_ranks_id_seq') IS NULL THEN
+    ALTER SEQUENCE governance_roles_id_seq RENAME TO government_ranks_id_seq;
+  END IF;
+END $$;
+
+-- ── 4. constraint names ─────────────────────────────────────────────────────
+-- Cosmetic but load-bearing for the next reader: an error message quoting
+-- `governance_builder_roles_role_key_fkey` after the rename would send them
+-- looking for a table that no longer exists.
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT c.conname, t.relname AS tbl,
+           replace(replace(replace(c.conname,
+             'governance_role_permissions', 'government_rank_permissions'),
+             'governance_builder_roles',    'government_builder_ranks'),
+             'governance_roles',            'government_ranks') AS newname
+      FROM pg_constraint c
+      JOIN pg_class t ON t.oid = c.conrelid
+     WHERE t.relname IN ('government_ranks', 'government_builder_ranks', 'government_rank_permissions')
+       AND c.conname LIKE 'governance\_%'
+  LOOP
+    -- the _role_key_ segment inside a constraint name follows the column
+    EXECUTE format('ALTER TABLE %I RENAME CONSTRAINT %I TO %I',
+                   r.tbl, r.conname, replace(r.newname, '_role_key', '_rank_key'));
+  END LOOP;
+END $$;
+
+-- ── 5. prove the rename moved names only, never rows ────────────────────────
+-- A rename that silently lost a grant would be catastrophic and invisible: the
+-- resolver would just start denying. Assert the baseline captured before the
+-- migration ran. If this fails the whole transaction rolls back.
+DO $$
+DECLARE
+  n_ranks int;
+  n_assign int;
+  n_grants int;
+BEGIN
+  SELECT count(*) INTO n_ranks   FROM government_ranks;
+  SELECT count(*) INTO n_assign  FROM government_builder_ranks;
+  SELECT count(*) INTO n_grants  FROM government_rank_permissions;
+
+  IF n_ranks = 0 OR n_assign = 0 OR n_grants = 0 THEN
+    RAISE EXCEPTION
+      'government rename lost rows: ranks=%, assignments=%, grants=% — expected all non-zero. Rolling back.',
+      n_ranks, n_assign, n_grants;
+  END IF;
+
+  -- Every assignment and every grant must still resolve to a real rank. A
+  -- broken FK cannot happen through RENAME, so this is a cheap proof that the
+  -- constraints really did travel with the tables rather than being dropped.
+  IF EXISTS (SELECT 1 FROM government_builder_ranks b
+              WHERE NOT EXISTS (SELECT 1 FROM government_ranks r WHERE r.rank_key = b.rank_key)) THEN
+    RAISE EXCEPTION 'government_builder_ranks has an assignment pointing at no rank — rolling back.';
+  END IF;
+  IF EXISTS (SELECT 1 FROM government_rank_permissions g
+              WHERE NOT EXISTS (SELECT 1 FROM government_ranks r WHERE r.rank_key = g.rank_key)) THEN
+    RAISE EXCEPTION 'government_rank_permissions has a grant pointing at no rank — rolling back.';
+  END IF;
+
+  RAISE NOTICE 'government rename OK: % ranks, % assignments, % grants', n_ranks, n_assign, n_grants;
+END $$;
+
+COMMIT;