@bongos/core 1.19.183 → 1.19.185

package/modules/{governance/routes/role-sync.js → government/routes/rank-sync.js}

@@ -11,7 +11,7 @@
 //   • this one is resolved by exactly three writers (the two _applyRankChangeTx
 //     twins + the sign-in path) and is a TRANSACTION PARTICIPANT — it takes the
 //     caller's client so the role rotation commits or rolls back with the rank write.
-// The port name is namespaced (`governance.roleSync`) like the `ideas.capture` /
+// The port name is namespaced (`government.rankSync`) like the `ideas.capture` /
 // `art.getBuilderGeminiKeyRow` / `grade.builderRollingAvgGrade` ports.
 //
 // Registered from a route factory for the same reason routes/governance.js is:
@@ -28,16 +28,16 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const db = require('../db');
 
-// DELEGATE, never spread — a test that stubs db.syncRankRole must still bite at call
+// DELEGATE, never spread — a test that stubs db.syncRank must still bite at call
 // time (the modules/onboarding/port.js precedent; a spread captures the original
 // reference at module-load).
-const rankRoleSyncPort = {
-  syncRankRole: (...a) => db.syncRankRole(...a),
+const rankSyncPort = {
+  syncRank: (...a) => db.syncRank(...a),
 };
 
 function registerSeams() {
-  if (!api.hasProvider('governance.roleSync')) {
-    api.registerProvider('governance.roleSync', rankRoleSyncPort);
+  if (!api.hasProvider('government.rankSync')) {
+    api.registerProvider('government.rankSync', rankSyncPort);
   }
 }
 
@@ -46,4 +46,4 @@ module.exports = function buildGovernanceRoleSyncRouter() {
   return express.Router();
 };
 
-module.exports.rankRoleSyncPort = rankRoleSyncPort;
+module.exports.rankSyncPort = rankSyncPort;

package/modules/hall-ui/public/gate.js

@@ -217,7 +217,7 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    // ADR 0157: the Gate page sits at the `page.view.governance` floor (metic). The
+    // ADR 0157: the Gate page sits at the `page.view.government` floor (metic). The
     // server's requireGovernancePage is the wall — this only decides whether to render the
     // body or the sealed notice, so it must agree or a Metic sees "sealed" on a page
     // they were just admitted to.

package/modules/hall-ui/public/governance.js

@@ -16,13 +16,13 @@
 //     owner's 2026-08-16 decision, and the section header says so out loud.
 //   • the ARCHON rank-role is read-only in full: it holds everything, and its
 //     immutability is what makes it impossible to click your way into locking the
-//     owner out of this tab. The API refuses it as `archon_role_immutable`.
-// ASSIGNMENT of any rank-role is still refused (`seeded_role_assignment_forbidden`)
+//     owner out of this tab. The API refuses it as `archon_rank_immutable`.
+// ASSIGNMENT of any rank-role is still refused (`seeded_rank_assignment_forbidden`)
 // — you get a rank-role by holding the rank, so that dial is the rank itself.
 //
 // Like The Gate, this reads /api/bongos/me for a friendly Sealed notice —
-// DEFENCE IN DEPTH only. Every /governance/* endpoint (reads included) is ALSO
-// gated server-side on the `governance.manage` atom (archon floor). On 401 →
+// DEFENCE IN DEPTH only. Every /government/* endpoint (reads included) is ALSO
+// gated server-side on the `government.manage` atom (archon floor). On 401 →
 // web sign-in.
 //
 // DELIBERATELY NOT IN THE SIDEBAR YET: the nav entry + the server page gate are
@@ -64,27 +64,27 @@
   // The R110 refusal codes, translated for the person clicking.
   const ERROR_COPY = {
     permission_not_grantable: 'That permission can’t be granted to this role. (The server’s reply says which of the three walls applied.)',
-    archon_role_immutable: 'The Archon role is read-only — it holds every permission, which is what keeps you from locking yourself out of this page.',
-    role_has_no_default: 'Only a rank role has a catalog default to reset to. Revoke a custom role’s permissions individually instead.',
-    seeded_role_assignment_forbidden: 'Rank roles are assigned by rank itself — change the builder’s rank instead.',
-    role_exists: 'A role with that key already exists.',
-    role_not_found: 'That role no longer exists — refreshing.',
+    archon_rank_immutable: 'The Archon role is read-only — it holds every permission, which is what keeps you from locking yourself out of this page.',
+    rank_has_no_default: 'Only a rank role has a catalog default to reset to. Revoke a custom role’s permissions individually instead.',
+    seeded_rank_assignment_forbidden: 'Rank roles are assigned by rank itself — change the builder’s rank instead.',
+    rank_exists: 'A role with that key already exists.',
+    rank_not_found: 'That role no longer exists — refreshing.',
     builder_not_found: 'No builder with that id.',
     unknown_permission: 'The permission catalog does not define that key.',
-    bad_role_key: 'Role keys are kebab-case: lowercase letters, digits, dashes.',
+    bad_rank_key: 'Role keys are kebab-case: lowercase letters, digits, dashes.',
     validation_failed: 'Missing or invalid fields.',
   };
   const friendlyError = (code) => ERROR_COPY[code] || null;
 
   // ---- state ---------------------------------------------------------------
 
-  let roles = [];        // [{ role_key, label, description, is_system, seeded_rank, permissions: [] }]
+  let roles = [];        // [{ rank_key, label, description, is_system, seeded_rank, permissions: [] }]
   let permissions = [];  // catalog rows: [{ key, system, floor, guards, grantable }]
   let principals = [];   // [{ system_role, permission, guards }]
-  let assignments = [];  // [{ builder_id, github_login, display_name, rank, role_key, role_label, is_system }]
+  let assignments = [];  // [{ builder_id, github_login, display_name, rank, rank_key, role_label, is_system }]
   let selectedRoleKey = null;
 
-  const selectedRole = () => roles.find((r) => r.role_key === selectedRoleKey) || null;
+  const selectedRole = () => roles.find((r) => r.rank_key === selectedRoleKey) || null;
 
   // ---- render: role list ---------------------------------------------------
 
@@ -102,11 +102,11 @@
       const btn = document.createElement('button');
       btn.type = 'button';
       btn.className = 'gov-role';
-      btn.setAttribute('aria-pressed', role.role_key === selectedRoleKey ? 'true' : 'false');
+      btn.setAttribute('aria-pressed', role.rank_key === selectedRoleKey ? 'true' : 'false');
       btn.innerHTML =
-        `<span class="gov-role__head"><span class="gov-role__label">${escapeHtml(role.label || role.role_key)}</span>${pill}</span>
-         <span class="gov-role__meta"><code>${escapeHtml(role.role_key)}</code> · ${(role.permissions || []).length} permission${(role.permissions || []).length === 1 ? '' : 's'}</span>`;
-      btn.addEventListener('click', () => { selectedRoleKey = role.role_key; renderRoles(); renderGrid(); });
+        `<span class="gov-role__head"><span class="gov-role__label">${escapeHtml(role.label || role.rank_key)}</span>${pill}</span>
+         <span class="gov-role__meta"><code>${escapeHtml(role.rank_key)}</code> · ${(role.permissions || []).length} permission${(role.permissions || []).length === 1 ? '' : 's'}</span>`;
+      btn.addEventListener('click', () => { selectedRoleKey = role.rank_key; renderRoles(); renderGrid(); });
       list.appendChild(btn);
     }
   }
@@ -176,7 +176,7 @@
       return 'The Archon role holds every permission and is read-only — that is what makes it impossible to lock yourself out of this page. To give a power away, hand it to one of the ranks below instead.';
     }
     if (isRankRole(role)) {
-      return `Everything a ${role.label || role.role_key} can do, and yours to change — every builder at this rank is affected immediately. “Reset to default” puts it back to the shipped ladder.`;
+      return `Everything a ${role.label || role.rank_key} can do, and yours to change — every builder at this rank is affected immediately. “Reset to default” puts it back to the shipped ladder.`;
     }
     return 'Toggle the everyday permissions this role carries. Owner powers can only go to a rank role, not to a custom one.';
   }
@@ -185,7 +185,7 @@
     const grid = document.getElementById('gov-grid');
     const role = selectedRole();
     document.getElementById('gov-grid-title').textContent = role
-      ? `Permissions — ${role.label || role.role_key}` : 'Permissions';
+      ? `Permissions — ${role.label || role.rank_key}` : 'Permissions';
     document.getElementById('gov-grid-note').textContent = gridNote(role);
 
     // The reset escape hatch — only a rank role has a catalog default, and the
@@ -223,11 +223,11 @@
   // Restore a rank role to the shipped ladder. Confirmed because it is the one
   // action here that discards work in bulk — a drifted role can be ~60 rows.
   async function resetRole(role, btn) {
-    const label = role.label || role.role_key;
+    const label = role.label || role.rank_key;
     if (!window.confirm(`Reset ${label} to its default permissions?\n\nEvery change you've made to this rank is discarded, and it takes effect for every builder at this rank on their next request.`)) return;
     btn.disabled = true;
     try {
-      const out = await sendJson('POST', `/governance/roles/${encodeURIComponent(role.role_key)}/reset`);
+      const out = await sendJson('POST', `/government/ranks/${encodeURIComponent(role.rank_key)}/reset`);
       toast(`${label} reset to its default ${out.permission_count} permissions.`);
       await reloadRoles();
     } catch (err) {
@@ -240,7 +240,7 @@
   async function toggleGrant(role, permissionKey, grant, btn) {
     btn.disabled = true;
     try {
-      await sendJson(grant ? 'PUT' : 'DELETE', `/governance/roles/${encodeURIComponent(role.role_key)}/permissions/${encodeURIComponent(permissionKey)}`);
+      await sendJson(grant ? 'PUT' : 'DELETE', `/government/ranks/${encodeURIComponent(role.rank_key)}/permissions/${encodeURIComponent(permissionKey)}`);
       toast(grant ? `Granted ${permissionKey}.` : `Revoked ${permissionKey}.`);
       await reloadRoles();
     } catch (err) {
@@ -266,8 +266,8 @@
       row.className = 'gov-assign-row';
       const who = `${escapeHtml(a.display_name || a.github_login || `builder ${a.builder_id}`)} <span class="muted">(#${escapeHtml(String(a.builder_id))} · ${escapeHtml(a.rank || '')})</span>`;
       const rolePill = a.is_system
-        ? `<span class="gov-pill gov-pill--seeded">${escapeHtml(a.role_label || a.role_key)} · via rank</span>`
-        : `<span class="gov-pill gov-pill--custom">${escapeHtml(a.role_label || a.role_key)}</span>`;
+        ? `<span class="gov-pill gov-pill--seeded">${escapeHtml(a.role_label || a.rank_key)} · via rank</span>`
+        : `<span class="gov-pill gov-pill--custom">${escapeHtml(a.role_label || a.rank_key)}</span>`;
       const action = a.is_system ? '' : `<button type="button" class="gov-btn gov-btn--ghost gov-btn--small" data-act="unassign">Remove</button>`;
       row.innerHTML = `<span class="gov-assign-row__who">${who}</span>${rolePill}${action}`;
       const btn = row.querySelector('[data-act=unassign]');
@@ -281,15 +281,15 @@
     const sel = document.getElementById('gov-assign-role');
     const custom = roles.filter((r) => !r.is_system);
     sel.innerHTML = custom.length
-      ? custom.map((r) => `<option value="${escapeHtml(r.role_key)}">${escapeHtml(r.label || r.role_key)}</option>`).join('')
+      ? custom.map((r) => `<option value="${escapeHtml(r.rank_key)}">${escapeHtml(r.label || r.rank_key)}</option>`).join('')
       : `<option value="" disabled selected>No custom roles yet</option>`;
   }
 
   async function unassign(a, btn) {
     btn.disabled = true;
     try {
-      await sendJson('DELETE', `/governance/assignments/${encodeURIComponent(a.builder_id)}/${encodeURIComponent(a.role_key)}`);
-      toast(`Removed ${a.role_label || a.role_key} from builder ${a.builder_id}.`);
+      await sendJson('DELETE', `/government/assignments/${encodeURIComponent(a.builder_id)}/${encodeURIComponent(a.rank_key)}`);
+      toast(`Removed ${a.role_label || a.rank_key} from builder ${a.builder_id}.`);
       await reloadAssignments();
     } catch (err) {
       if (err && err.kind === '401') return;
@@ -321,22 +321,22 @@
   // ---- loads ---------------------------------------------------------------
 
   async function reloadRoles() {
-    const data = await fetchJson('/governance/roles');
+    const data = await fetchJson('/government/ranks');
     roles = data.roles || [];
-    if (!roles.some((r) => r.role_key === selectedRoleKey)) selectedRoleKey = roles.length ? roles[0].role_key : null;
+    if (!roles.some((r) => r.rank_key === selectedRoleKey)) selectedRoleKey = roles.length ? roles[0].rank_key : null;
     renderRoles();
     renderGrid();
     renderAssignSelect();
   }
 
   async function reloadAssignments() {
-    const data = await fetchJson('/governance/assignments');
+    const data = await fetchJson('/government/assignments');
     assignments = data.assignments || [];
     renderAssignments();
   }
 
   async function load() {
-    const perms = await fetchJson('/governance/permissions');
+    const perms = await fetchJson('/government/permissions');
     permissions = perms.permissions || [];
     principals = perms.principals || [];
     await reloadRoles();
@@ -352,16 +352,16 @@
       const btn = e.target.querySelector('button');
       btn.disabled = true;
       const body = {
-        role_key: document.getElementById('gov-create-key').value.trim(),
+        rank_key: document.getElementById('gov-create-key').value.trim(),
         label: document.getElementById('gov-create-label').value.trim(),
       };
       const desc = document.getElementById('gov-create-desc').value.trim();
       if (desc) body.description = desc;
       try {
-        const r = await sendJson('POST', '/governance/roles', body);
-        toast(`Created role ${r.role ? r.role.role_key : body.role_key}.`);
+        const r = await sendJson('POST', '/government/ranks', body);
+        toast(`Created role ${r.role ? r.role.rank_key : body.rank_key}.`);
         e.target.reset();
-        selectedRoleKey = body.role_key;
+        selectedRoleKey = body.rank_key;
         await reloadRoles();
       } catch (err) {
         if (err && err.kind === '401') return;
@@ -379,7 +379,7 @@
       if (!roleKey) { toast('Create a custom role first.'); return; }
       btn.disabled = true;
       try {
-        await sendJson('POST', '/governance/assignments', { builder_id: builderId, role_key: roleKey });
+        await sendJson('POST', '/government/assignments', { builder_id: builderId, rank_key: roleKey });
         toast(`Assigned ${roleKey} to builder ${builderId}.`);
         e.target.reset();
         await reloadAssignments();
@@ -402,8 +402,8 @@
 
   async function init() {
     // Confirm rank for a friendly sealed notice; the server gates the page and
-    // every /governance endpoint on `governance.manage` regardless (cosmetic
-    // defence-in-depth). governance.manage is system:true, so only the archon
+    // every /governance endpoint on `government.manage` regardless (cosmetic
+    // defence-in-depth). government.manage is system:true, so only the archon
     // rank-role can hold it — rank is an accurate client-side proxy.
     let me;
     try {

package/modules/hall-ui/public/harbor.js

@@ -9,7 +9,7 @@
 // shows a restricted notice below the Metic floor — DEFENCE IN DEPTH only. The data +
 // mutation endpoints (/boxes, /boxes/:id/close, /boxes/:id/block) are ALSO gated
 // server-side on `box.fleet.manage` (ADR 0016), and the page itself is gated by
-// serve-internal.js requireGovernancePage — whose own floor is `page.view.governance`,
+// serve-internal.js requireGovernancePage — whose own floor is `page.view.government`,
 // metic since ADR 0157. On a 401 it redirects into the web sign-in flow.
 
 (() => {
@@ -326,7 +326,7 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    // ADR 0157: Harbor sits at the `page.view.governance` floor (metic), and the fleet
+    // ADR 0157: Harbor sits at the `page.view.government` floor (metic), and the fleet
     // data it reads is `box.fleet.manage` (also metic now). Cosmetic —
     // requireGovernancePage + the route gates are the wall; this just picks body vs
     // sealed notice.

package/modules/hall-ui/public/shell.js

@@ -98,7 +98,7 @@
   //               current (mirrors the old #hall-nav-work rule, task #833)
   //   archon    — rank === 'archon'
   //   governance — rank is metic or archon (ADR 0157): the monitoring/ops pages.
-  //               Mirrors the server's `page.view.governance` floor, which that ADR
+  //               Mirrors the server's `page.view.government` floor, which that ADR
   //               lowered archon→metic. Cosmetic only — requireGovernancePage is the wall.
   // `view` marks an index view (hash-routed); `module` gates on window.__MODULES__.
   // task 2175: grouped by AUDIENCE of the data, so the sidebar reads in coherent
@@ -178,7 +178,7 @@
       { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'governance' },
       // BV1.R113: the roles-and-permissions tab (ADR 0151). The one genuinely
       // Archon-only item the 'governance' gate comment anticipated — cosmetic
-      // only; requireGovernanceManagePage (the governance.manage atom) is the wall.
+      // only; requireGovernanceManagePage (the government.manage atom) is the wall.
       { id: 'governance', label: 'Roles', icon: 'admin', href: '/governance', gate: 'archon' },
     ] },
   ];
@@ -420,7 +420,7 @@
       case 'member': return member;
       case 'work': return authed && (member || access.showWork);
       case 'archon': return authed && access.rank === 'archon';
-      // ADR 0157: the monitoring/ops pages sit at the `page.view.governance` floor,
+      // ADR 0157: the monitoring/ops pages sit at the `page.view.government` floor,
       // which is metic. Kept as its own key rather than widening 'archon', so a
       // genuinely Archon-only nav item can still be added later.
       case 'governance': return authed && (access.rank === 'metic' || access.rank === 'archon');

package/modules/hall-ui/public/watch.js

@@ -885,7 +885,7 @@
       return;
     }
 
-    // ADR 0157: Watch sits at the `page.view.governance` floor (metic), and every panel
+    // ADR 0157: Watch sits at the `page.view.government` floor (metic), and every panel
     // it reads (roster, security reports, audit log, sessions, box costs) delegated to
     // metic with it. Cosmetic — requireGovernancePage + the route gates are the wall.
     if (!builder || (builder.rank !== 'metic' && builder.rank !== 'archon')) {

package/modules/lifecycle/db.js

@@ -220,7 +220,7 @@ function xenosClaimAllowed(rank, newcomerFriendly) {
 // 0016 — resolved server-side, uncached), and taking a second pool connection while
 // a tx holds FOR UPDATE locks is a needless deadlock/exhaustion hazard.
 async function claimPermissionsFor(builderId) {
-  const governance = seams.resolveOptional('governance');
+  const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
   try {
     const keys = await governance.resolveBuilderPermissions(builderId);
@@ -408,12 +408,12 @@ function disambiguateWorktreeName(desired, taken) {
 //
 // Returns the updated builder row, or throws { code:'BUILDER_NOT_FOUND' } /
 // { code:'RANK_UNCHANGED' }.
-// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
+// syncGovernanceRankRole — keep government_builder_ranks in step with builders.rank
 // (BV1.R95b, ADR 0151). This module's rank writer backs the automatic xenos→thetes
 // graduation, which had the same hole as the Archon-driven path: the rank moved and
 // the role did not, so a freshly-graduated Thetes kept the xenos role.
 //
-// Resolved through the `governance.roleSync` kernel port (never a sibling require —
+// Resolved through the `government.rankSync` kernel port (never a sibling require —
 // ADR 0083) and run on the CALLER's transaction client, so the rotation commits
 // atomically with the ship + graduation. A missing port (governance disabled) skips:
 // no role ⇒ zero permissions, fail-closed.
@@ -421,9 +421,9 @@ function disambiguateWorktreeName(desired, taken) {
 // TWINNED with src/bongos/db.js (the boundary-forced _applyRankChangeTx duplication,
 // ADR 0091 §2) — keep the two in sync.
 async function syncGovernanceRankRole(client, builderId, rank) {
-  const roleSync = seams.resolveOptional('governance.roleSync');
-  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
-  return roleSync.syncRankRole(client, { builderId, rank });
+  const roleSync = seams.resolveOptional('government.rankSync');
+  if (!roleSync || typeof roleSync.syncRank !== 'function') return null;
+  return roleSync.syncRank(client, { builderId, rank });
 }
 
 // _applyRankChangeTx — the in-transaction CORE of a rank change, shared by the

package/modules/lifecycle/routes/gate-approvals.js

@@ -68,7 +68,7 @@ module.exports = function buildGateApprovalsRouter() {
   // BV1.R105 left this on requireRank because `gate_approval.decide` was declared over
   // the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog
   // with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now
-  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.governance`
+  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government`
   // opens /gate to Metic, and without a Metic-readable data endpoint that page would
   // render nothing but a 403. Approving a held PR stays archon (`.decide`, system).
   router.get('/gate-approvals', auth.requireBuilder, auth.requirePermission('gate_approval.read'), async (req, res) => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.183",
+  "version": "1.19.185",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.183",
+      "version": "1.19.185",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.183",
+  "version": "1.19.185",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -732,6 +732,16 @@ const LEGACY_NAMESPACED = {
   // game module: world_events + players were created before the module system (V1 schema). The
   // schema_migrations table is a core tracking table that every migration may re-create idempotently.
   game: new Set(['world_events', 'players', 'schema_migrations']),
+  // government module: the module KEY was renamed governance→government (ADR 0174, goal 1000068),
+  // so its own historical migrations now read as "outside the namespace" purely because the key
+  // moved underneath them. These three tables ARE this module's — under the name it used to have.
+  // They are not renamed in place because schema_migrations is keyed by filename STEM: renaming an
+  // already-applied migration file makes it look unapplied and re-runs it, and governance_002 is a
+  // seed/backfill. government_001_rename_from_governance.sql renames the live tables forward; these
+  // entries let the historical files that created them keep describing what actually happened.
+  government: new Set([
+    'governance_roles', 'governance_builder_roles', 'governance_role_permissions',
+  ]),
 };
 const DESTRUCTIVE_DDL = [
   { re: /\bdrop\s+table\b/i, label: 'DROP TABLE' },
@@ -1141,7 +1151,7 @@ function checkKernelPromptsNoHardcodedIdentity() {
 // this check nothing in CI could see it.
 //
 // Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
-// branding.json, config/governance.json) is host content that legitimately names
+// branding.json, config/government.json) is host content that legitimately names
 // its host, and is boundary-excluded from the published core anyway.
 function checkNeutralConfigsNoHostIdentity() {
   const violations = [];

package/scripts/gds/migration-namespace.js

@@ -57,6 +57,15 @@ const LEGACY_BARE_CORE_MAX = 187;
 // module migrations must be `<key>_`-prefixed; these stay bare (already applied on prod).
 const LEGACY_BARE_MODULES = new Set(['game', 'demo']);
 
+// RENAMED_MODULE_PREFIXES: a module whose KEY was renamed keeps its historical
+// migration-filename prefix for files that were already applied. schema_migrations
+// is keyed by filename STEM, so renaming an applied migration makes it look
+// unapplied and RE-RUNS it — and a re-run seed/backfill is a data event, not a
+// no-op. The already-applied files therefore keep the old prefix forever; only
+// NEW migrations must carry the module's current namespace.
+//   government <- governance (ADR 0174, goal 1000068)
+const RENAMED_MODULE_PREFIXES = { government: new Set(['governance']) };
+
 // ---- parsing ---------------------------------------------------------------
 
 const BARE_RE = /^(\d{3,})_(.+)\.sql$/;
@@ -116,9 +125,11 @@ function filenameViolation(source, basename, { moduleKey } = {}) {
       ? null // legacy bare module — grandfathered
       : `module "${moduleKey}" migration "${basename}" is bare — a NEW module migration must be ${ns}_-prefixed (ADR 0083 §Decision #5 / ADR 0108 §5): use ${ns}_${pad3(p.number)}_${p.slug}.sql`;
   }
-  return p.prefix === ns
-    ? null
-    : `module "${moduleKey}" migration "${basename}" carries the "${p.prefix}_" prefix — it must be ${ns}_-prefixed to its own module (ADR 0083 §Decision #5).`;
+  if (p.prefix === ns) return null;
+  // A renamed module's already-applied files keep their historical prefix (see
+  // RENAMED_MODULE_PREFIXES) — the stem is the schema_migrations key, so it cannot move.
+  if ((RENAMED_MODULE_PREFIXES[moduleKey] || new Set()).has(p.prefix)) return null;
+  return `module "${moduleKey}" migration "${basename}" carries the "${p.prefix}_" prefix — it must be ${ns}_-prefixed to its own module (ADR 0083 §Decision #5).`;
 }
 
 // ---- cross-root stem-collision detector ------------------------------------
@@ -186,6 +197,7 @@ function lineageReport({ core = [], instance = [], modulesByKey = {} } = {}) {
 
 module.exports = {
   CORE_NS,
+  RENAMED_MODULE_PREFIXES,
   INSTANCE_NS,
   RESERVED_NS,
   LEGACY_BARE_CORE_MAX,

package/scripts/gds/publish-manifest.js

@@ -61,7 +61,6 @@ const PUBLISH_ALLOWLIST = [
   'modules/sessions/',
   'modules/autonomy/',
   'modules/security/',
-  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true. Renamed → modules/government/ (ADR 0174); dropped with the folder in goal 1000068 R04.
   'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
   'modules/hall-ui/',
   'modules/status-ui/',
@@ -75,7 +74,7 @@ const PUBLISH_ALLOWLIST = [
   'config/design-tokens.neutral.json',
   'config/design-tokens.schema.json',  // the design-token contract (generic schema, no instance values)
   'config/hierarchy.neutral.json',
-  'config/governance.neutral.json',     // the starting role templates a fresh instance inherits (BV1.R96)
+  'config/government.neutral.json',     // the starting rank templates a fresh instance inherits (BV1.R96; renamed from governance.neutral.json by ADR 0174)
   // --- the portable methodology core, governance, and sanitized docs ---
   'CLAUDE.md',
   'README.md',
@@ -212,7 +211,7 @@ const INSTANCE_EXCLUDE = [
   'config/modules.json',
   'config/devbox-app.json',
   'config/hierarchy.json',
-  'config/governance.json',
+  'config/government.json',
   'CODEOWNERS',              // names the owner (a protected surface, excluded as identity)
   // instance SEED migrations — this host's scope-truth SQL (planning seeds, world data).
   // ADR 0105: a consumer's core must not carry them; migrate.sh reads instance seeds from

package/scripts/gds/seed-governance-tasks.js

@@ -195,10 +195,10 @@ const TASKS = [
   {
     ref: 'R96', kind: 'feature', priority: 4, est_minutes: 100, manual_degree: 2, credits_reward: 40,
     criterion_ids: [C4], depends_on_refs: ['R93', 'R94'],
-    title: 'config/governance.json + neutral + resolve-over-neutral',
+    title: 'config/government.json + neutral + resolve-over-neutral',
     description: `**Why:** role templates/defaults are per-instance config (the branding pattern); live data is DB.
 
-**Done when:** \`config/governance.json\` (instance) resolves over \`config/governance.neutral.json\` (neutral) with env override on top, mirroring src/branding.js precedence; it seeds the starting role templates a fresh instance inherits; live assignments stay in the DB (R93). Depends on R93/R94.`,
+**Done when:** \`config/government.json\` (instance) resolves over \`config/government.neutral.json\` (neutral) with env override on top, mirroring src/branding.js precedence; it seeds the starting role templates a fresh instance inherits; live assignments stay in the DB (R93). Depends on R93/R94.`,
   },
   {
     ref: 'R102', kind: 'verify', priority: 3, est_minutes: 70, manual_degree: 2, credits_reward: 35,
@@ -216,7 +216,7 @@ const TASKS = [
     title: 'Governance API routes (roles/perms/assignments CRUD)',
     description: `**Why:** the tab's server surface.
 
-**Done when:** routes list roles/permissions/assignments, create a role, toggle an operational permission on a role, and assign a role to a builder — all gated \`governance.manage\` (Archon), system permissions rejected as non-grantable server-side, and pinned in route-rank-check. Depends on R97 + R109.`,
+**Done when:** routes list roles/permissions/assignments, create a role, toggle an operational permission on a role, and assign a role to a builder — all gated \`government.manage\` (Archon), system permissions rejected as non-grantable server-side, and pinned in route-rank-check. Depends on R97 + R109.`,
   },
   {
     ref: 'R111', kind: 'feature', priority: 3, est_minutes: 180, manual_degree: 2, credits_reward: 55,

package/src/bongos/auth.js

@@ -367,7 +367,7 @@ async function maybeSeatFirstAdmin(builder) {
 // flips xenos→archon outside any transaction), and it quietly repairs a builder whose
 // assignment drifted for any other reason.
 //
-// Resolved through the `governance.roleSync` kernel port — auth.js is a KERNEL_FILE
+// Resolved through the `government.rankSync` kernel port — auth.js is a KERNEL_FILE
 // and may not require a module (ADR 0083 / ADR 0091 §1). Runs on the pool: there is
 // no surrounding transaction here, unlike the two rank-change paths, which pass their
 // own client so the rotation is atomic with the rank write.
@@ -377,8 +377,8 @@ async function maybeSeatFirstAdmin(builder) {
 async function safeSyncRankRole(builder) {
   if (!builder || builder.id == null) return;
   try {
-    await seams.resolveOptional('governance.roleSync')
-      ?.syncRankRole(null, { builderId: builder.id, rank: builder.rank });
+    await seams.resolveOptional('government.rankSync')
+      ?.syncRank(null, { builderId: builder.id, rank: builder.rank });
   } catch (err) {
     console.error('[auth] rank-role sync failed (non-fatal):', err.message);
   }
@@ -1195,8 +1195,8 @@ async function resolveSession(req) {
 // a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
 //
 // GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
-// governance-owned data in modules/governance/session-scopes.json, validated
-// against the permission catalog at load by modules/governance/session-scopes.js.
+// governance-owned data in modules/government/session-scopes.json, validated
+// against the permission catalog at load by modules/government/session-scopes.js.
 // Core reads it as DATA with fs — never `require` (ADR 0083's one-way rule: a
 // module's code and enable/disable state must never be something the kernel
 // depends on). The sibling trust primitive permission-path-check.js reads the
@@ -1211,7 +1211,7 @@ async function resolveSession(req) {
 // registry does not declare is DENIED rather than defaulting to full authority. A
 // null/absent source is a DECLARED row (rows minted before migration 090 added the
 // column, which predate the 'box' source existing), not an implicit default.
-const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'governance', 'session-scopes.json');
+const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'session-scopes.json');
 
 // Pure: validate + normalize the parsed registry. Split from the file read so the
 // shipped assertions are what the tests exercise. `label` identifies the file in
@@ -1437,10 +1437,10 @@ function signInWithReturn(req) {
 // ranks (catalog.RANK_ORDER):
 //   requireBuilderPage     was "any session"      floor xenos  → page.view.public
 //   requireNonXenosPage    was rank !== 'xenos'   floor thetes → page.view.builder
-//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.governance
+//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.government
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
-// page.view.governance's floor archon→metic and the name stopped being true; the
-// floor now lives in modules/governance/catalog.js, not in the function's name.
+// page.view.government's floor archon→metic and the name stopped being true; the
+// floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
 // (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
 // no seeded role, so they now fail a page gate a bare rank test would have
@@ -1456,8 +1456,8 @@ function signInWithReturn(req) {
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
-  requireGovernancePage: Object.freeze({ permission: 'page.view.governance', deniedTo: '/builders' }),
-  requireGovernanceManagePage: Object.freeze({ permission: 'governance.manage', deniedTo: '/builders' }),
+  requireGovernancePage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
+  requireGovernanceManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
   requireProjectCuratePage: Object.freeze({ permission: 'project.curate', deniedTo: '/builders' }),
 });
 
@@ -1476,7 +1476,7 @@ const PAGE_GATES = Object.freeze({
 // through to the DB resolve, so the fold can only ever be an optimization.
 async function resolveHeldPermissions(builderId, rawKeys) {
   if (builderId === null || builderId === undefined || builderId === '') return null;
-  const governance = seams.resolveOptional('governance');
+  const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
   if (Array.isArray(rawKeys) && typeof governance.effectivePermissions === 'function') {
     try {
@@ -1534,7 +1534,7 @@ async function requireBuilderPage(req, res, next) {
 }
 
 // The /watch monitoring surface, the /harbor dev-box page and the /gate page
-// (#726, idea 257, task 1179) — Metic and up, per `page.view.governance`'s catalog
+// (#726, idea 257, task 1179) — Metic and up, per `page.view.government`'s catalog
 // floor. Named `requireArchonPage` until ADR 0157 lowered that floor archon→metic
 // (older ADRs still use the old name; this line is the trail). Defense-in-depth:
 // every data endpoint these pages call is independently gated server-side, so no
@@ -1545,7 +1545,7 @@ async function requireGovernancePage(req, res, next) {
 }
 
 // The /governance roles-and-permissions tab (BV1.R113) — gated on the
-// `governance.manage` ATOM itself (system, archon floor), the same key every
+// `government.manage` ATOM itself (system, archon floor), the same key every
 // /governance/* data route checks, so the page layer can never drift wider than
 // the API it fronts. Defense-in-depth as above: the data endpoints are all
 // independently gated; this keeps the tab shell from rendering for anyone else.
@@ -1716,14 +1716,14 @@ function requireRank(...allowed) {
 // time — never hardcoded prose, which goes stale when a floor moves (the
 // D-16/N-3 failure shape ADR 0157 left behind).
 //
-// Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('governance.manage'), handler)
+// Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('government.manage'), handler)
 function requirePermission(...perms) {
   const required = Object.freeze([...perms]);
   return async function permissionGate(req, res, next) {
     const deny = (held) => {
       const missing = held === null ? [...required] : required.filter((key) => !held.includes(key));
       const floors = {};
-      const governance = seams.resolveOptional('governance');
+      const governance = seams.resolveOptional('government');
       if (governance && typeof governance.permissionFloor === 'function') {
         for (const key of missing) {
           const floor = governance.permissionFloor(key);