@bongos/core 1.19.183 → 1.19.185

package/tests/governance_live_proof.mjs

@@ -142,7 +142,7 @@ try {
     'BEFORE: the thetes builder cannot triage (403 permission_forbidden)');
 
   // Act 2 — an Archon creates a custom role and grants the operational permission.
-  r = await call(ARCHON_TOKEN, 'POST', '/governance/roles',
+  r = await call(ARCHON_TOKEN, 'POST', '/government/ranks',
     { role_key: ROLE_KEY, label: 'GLP demo triage role' });
   ok(r.status === 201, 'the Archon creates a custom role (201)');
   r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
@@ -153,13 +153,13 @@ try {
   r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/governance.manage`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/government.manage`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
-    'the meta-escalation (governance.manage) is refused the same way');
+    'the meta-escalation (government.manage) is refused the same way');
 
   // Act 4 — assign, then the same builder performs the action: no re-login, no
   // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
-  r = await call(ARCHON_TOKEN, 'POST', '/governance/assignments',
+  r = await call(ARCHON_TOKEN, 'POST', '/government/assignments',
     { builder_id: THETES, role_key: ROLE_KEY });
   ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
   r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });
@@ -176,7 +176,7 @@ try {
   // …the resolver reports it honestly (it is a defined catalog key; matrix V10
   // proves no route consumes it via requirePermission, so it admits nothing
   // in-app)…
-  const resolver = require('../modules/governance/resolver.js');
+  const resolver = require('../modules/government/resolver.js');
   const perms = await resolver.resolveBuilderPermissions(THETES);
   ok(perms.includes(OPERATIONAL_KEY), 'the resolved set includes the operational grant');
   console.log(`  (resolved set ${perms.includes(SYSTEM_KEY) ? 'includes' : 'omits'} the forced '${SYSTEM_KEY}' — in-app it guards no route either way)`);
@@ -187,7 +187,7 @@ try {
   // protected-path diff while the forced grant row sits in the database.
   const { checkPermissionPaths } = require('../src/bongos/permission-path-check.js');
   const sub = checkPermissionPaths({
-    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/governance/catalog.js'],
+    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/government/catalog.js'],
     builderRank: 'thetes',
   });
   ok(sub.hardFail === true && sub.findings.length === 2,

package/tests/governance_ownership_scope.mjs

@@ -30,7 +30,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));
 const db = require(path.join(GOV, 'db.js'));
@@ -397,7 +397,7 @@ test('G2: the role resolve is untouched — own-scoped keys still resolve, princ
 });
 
 test('G3: the kernel port carries the ownership axis on the ONE governance port', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   for (const name of ['authorizeOwned', 'authorizeOwnedOrAny', 'sameOwner', 'isOwnershipScoped', 'crossOwnerKeysFor']) {
     assert.equal(typeof governancePort[name], 'function', `the port must expose ${name}`);
   }

package/tests/governance_page_gates.mjs

@@ -45,8 +45,8 @@ dbKernel.lookupSession = async () => {
 
 const auth = require('../src/bongos/auth.js');
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
-const resolver = require('../modules/governance/resolver.js');
+const catalog = require('../modules/government/catalog.js');
+const resolver = require('../modules/government/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
@@ -58,7 +58,7 @@ const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 // requireNonXenosPage   admitted rank !== 'xenos'       → thetes and up
 // requireGovernancePage admitted rank === 'archon'      → archon only …until ADR 0157
 //
-// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.governance` archon→metic, so
+// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.government` archon→metic, so
 // the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
 // was spelled `requireArchonPage` through R107 and ADR 0157 — the name the rows below
 // were first written against — and was renamed once the floor moved; the audience here,
@@ -86,7 +86,7 @@ const DENIED_TO = {
 const GATE_PERMISSION = {
   requireBuilderPage: 'page.view.public',
   requireNonXenosPage: 'page.view.builder',
-  requireGovernancePage: 'page.view.governance',
+  requireGovernancePage: 'page.view.government',
 };
 const deniedLoc = (gate, { unavailable = false } = {}) =>
   `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
@@ -94,7 +94,7 @@ const deniedLoc = (gate, { unavailable = false } = {}) =>
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
   requireNonXenosPage: 'thetes',
-  // ADR 0157: `page.view.governance` floor archon→metic.
+  // ADR 0157: `page.view.government` floor archon→metic.
   requireGovernancePage: 'metic',
 };
 const SIGN_IN = '/api/gds/auth/web/start';
@@ -126,7 +126,7 @@ async function runGate(name, { rank = null, resolve, port = true } = {}) {
   lookupThrows = false;
   seams._reset();
   if (port) {
-    seams.registerProvider('governance', {
+    seams.registerProvider('government', {
       // The real seed for that rank — the rows governance_002 gives the one
       // rank-role a builder holds. The INPUT, not the oracle.
       resolveBuilderPermissions: resolve || (async () => catalog.seedForRank(rank)),
@@ -144,7 +144,7 @@ async function runGate(name, { rank = null, resolve, port = true } = {}) {
 
 test('A0: the hand-written audience table agrees with the real threshold function', () => {
   // A second, catalog-free oracle for the literal above: auth.rankMeetsThreshold
-  // is the production rank predicate and reads nothing from modules/governance/.
+  // is the production rank predicate and reads nothing from modules/government/.
   for (const gate of GATES) {
     for (const rank of LIVE_RANKS) {
       assert.equal(
@@ -203,7 +203,7 @@ test('B1: a session-lookup error fails CLOSED (redirect to sign-in, no page)', a
   for (const gate of GATES) {
     nextSession = null;
     seams._reset();
-    seams.registerProvider('governance', { resolveBuilderPermissions: async () => catalog.seedForRank('archon') });
+    seams.registerProvider('government', { resolveBuilderPermissions: async () => catalog.seedForRank('archon') });
     lookupThrows = true;
     const res = fakeRes();
     let nexted = false;
@@ -244,7 +244,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   nextSession = { builder_id: 7, rank: 'archon' };
   lookupThrows = false;
   seams._reset();
-  seams.registerProvider('governance', {
+  seams.registerProvider('government', {
     resolveBuilderPermissions: async () => { calls += 1; return keys; },
   });
   const req = { headers: { cookie: 'gds_session=validtoken' } };
@@ -264,7 +264,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
 test('B5: every permission a page gate names is a real catalog key', async () => {
   // Not an oracle — a sanity check that the gates did not migrate onto a typo,
   // which would silently deny everyone (fail-closed, but a bug all the same).
-  for (const key of ['page.view.public', 'page.view.builder', 'page.view.governance']) {
+  for (const key of ['page.view.public', 'page.view.builder', 'page.view.government']) {
     assert.ok(catalog.byKey(key), `${key} must exist in the catalog`);
   }
 });

package/tests/governance_parity.mjs

@@ -57,8 +57,8 @@ const { RANKS } = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
 const routeRank = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
 
 const { PERMISSIONS, RANK_ORDER, seedForRank } = catalog;
 const FLOORED = PERMISSIONS.filter((p) => p.floor !== null);
@@ -287,7 +287,7 @@ function fakeRes() {
 // not the logic — resolvedFor() is the real resolver over the real seed.
 async function permissionAdmits(key, rank) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => resolvedFor(rank) });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => resolvedFor(rank) });
   let nexted = false;
   await auth.requirePermission(key)({ builder: { id: 7, rank } }, fakeRes(), () => { nexted = true; });
   seams._reset();

package/tests/governance_principals.mjs

@@ -22,7 +22,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));
 
@@ -149,7 +149,7 @@ test('resolved principal sets are frozen — a caller cannot widen one', () => {
 // ── show, never grant ───────────────────────────────────────────────────────────
 
 test('the tab surface is a read-only projection: shown, flagged non-grantable', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   assert.equal(typeof governancePort.listPrincipals, 'function');
   assert.equal(typeof governancePort.resolvePrincipalPermissions, 'function');
   const listed = governancePort.listPrincipals();
@@ -162,7 +162,7 @@ test('the tab surface is a read-only projection: shown, flagged non-grantable',
 });
 
 test('the governance port exposes no way to create, grant, or assign a principal', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   const mutator = /(create|grant|assign|add|set|write|provision|revoke|delete|update)/i;
   for (const name of Object.keys(governancePort)) {
     if (!/principal/i.test(name)) continue;

package/tests/governance_protected_surfaces.mjs

@@ -8,7 +8,7 @@
 //
 // The load-bearing test is BEHAVIOR-IDENTITY. R101 moved WHERE the truth lives
 // (a hardcoded PROTECTED_GLOBS constant in src/bongos/permission-path-check.js →
-// governance-owned data in modules/governance/protected-surfaces.json). It did
+// governance-owned data in modules/government/protected-surfaces.json). It did
 // NOT change WHAT is protected. EXPECTED_GLOBS_BEFORE_R101 below is the literal
 // pre-change constant, pasted verbatim; the registry must reproduce it exactly,
 // in order.
@@ -22,7 +22,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const registry = require(path.join(GOV, 'protected-surfaces.js'));
@@ -92,22 +92,34 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // Each entry is { after, glob, why }: `after` is the glob it is inserted
 // directly below, so the expected list is reconstructed in order rather than
 // re-pasted (a re-paste is how the two lists drift apart).
-const ADDED_SINCE_R101 = [
+const ADDED_SINCE_R101 = [];
+
+// Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
+// a removal on purpose: a rename keeps the protection and moves it, a removal
+// ends it. The subset test below accepts a documented rename and rejects a bare
+// disappearance, so "we renamed it" can never be used to quietly unprotect
+// something — the replacement must actually be in the registry.
+const RENAMED_SINCE_R101 = [
   {
-    after: 'modules/governance/',
-    glob: 'modules/government/',
-    why: 'goal 1000068 / task 1003003 (ADR 0174) — the authz core is renamed '
-       + 'governance→government. The new glob is registered BEFORE the folder '
-       + 'moves because `protected` DERIVES from this registry: without it the '
-       + 'new module key computes protected:false and both the Archon gate on '
-       + 'goal creation and the pre-push block on these files would silently lapse.',
+    from: 'modules/governance/',
+    to:   'modules/government/',
+    why: 'goal 1000068 / ADR 0174 — the authz core was renamed governance→government. '
+       + 'The folder moved in task 1003004 and the one-release compatibility glob was '
+       + 'dropped in R05 (task 1003006) along with the /governance/* route aliases. '
+       + 'Protection did not lapse at any point: the new glob was registered BEFORE '
+       + 'the folder moved (task 1003003), so both were listed across the window.',
   },
 ];
 
 // The list the registry must produce TODAY: the pre-R101 set with each
 // documented addition spliced in at its declared position.
 const EXPECTED_GLOBS = (() => {
-  const out = [...EXPECTED_GLOBS_BEFORE_R101];
+  let out = [...EXPECTED_GLOBS_BEFORE_R101];
+  for (const r of RENAMED_SINCE_R101) {
+    const at = out.indexOf(r.from);
+    assert.notEqual(at, -1, `RENAMED_SINCE_R101 renames '${r.from}', which is not in the list`);
+    out[at] = r.to;
+  }
   for (const a of ADDED_SINCE_R101) {
     const at = out.indexOf(a.after);
     assert.notEqual(at, -1, `ADDED_SINCE_R101 anchors on '${a.after}', which is not in the list`);
@@ -119,15 +131,28 @@ const EXPECTED_GLOBS = (() => {
 // ---------- behavior identity: the same globs, at the same floor ----------
 
 test('nothing protected before R101 has been unprotected since', () => {
-  // The load-bearing half. Additions are ordinary policy; a REMOVAL silently
-  // unprotects a trust surface, so it is asserted separately and must never be
-  // satisfied by editing the pre-R101 array.
+  // The load-bearing half. A surface may be RENAMED (protection moves with it)
+  // but never simply dropped. Renames must be declared, and the declared
+  // replacement must actually be present — otherwise "it was renamed" becomes a
+  // way to unprotect a trust surface with a comment.
+  const renamedFrom = new Map(RENAMED_SINCE_R101.map((r) => [r.from, r.to]));
   for (const glob of EXPECTED_GLOBS_BEFORE_R101) {
-    assert.ok(
-      registry.PROTECTED_GLOBS.includes(glob),
+    if (registry.PROTECTED_GLOBS.includes(glob)) continue;
+    const to = renamedFrom.get(glob);
+    assert.ok(to,
       `'${glob}' was protected before R101 and is no longer in the registry — `
-      + 'a protected surface cannot be dropped without an ADR saying why.',
-    );
+      + 'a protected surface cannot be dropped without an ADR saying why. If it '
+      + 'was renamed, declare it in RENAMED_SINCE_R101.');
+    assert.ok(registry.PROTECTED_GLOBS.includes(to),
+      `'${glob}' is declared as renamed to '${to}', but '${to}' is not in the `
+      + 'registry — the protection went nowhere.');
+  }
+});
+
+test('every rename since R101 carries a documented reason', () => {
+  for (const r of RENAMED_SINCE_R101) {
+    assert.ok(r.why && r.why.length > 40,
+      `${r.from} -> ${r.to} must record WHY the surface moved.`);
   }
 });
 
@@ -234,7 +259,7 @@ test('a known path is protected at the right floor; an unknown path is not', ()
   assert.equal(ppc.floorFor('src/bongos/auth.js'), 'metic');
   assert.equal(ppc.permissionFor('src/bongos/auth.js'), 'path.protected.modify');
   assert.equal(registry.isProtected('migrations/999_x.sql'), true, 'subtree globs still match');
-  assert.equal(registry.floorFor('modules/governance/catalog.js'), 'metic');
+  assert.equal(registry.floorFor('modules/government/catalog.js'), 'metic');
 
   assert.equal(ppc.floorFor('public/game/main.js'), null);
   assert.equal(ppc.permissionFor('docs/session-logs/2026-07-30-x.md'), null);

package/tests/governance_require_permission.mjs

@@ -1,7 +1,7 @@
 // tests/governance_require_permission.mjs — the requirePermission gate (BV1.R97, ADR 0151).
 //
 // DB-free. The gate reaches the resolver through the `governance` KERNEL PORT
-// (the one-way rule — core never requires modules/governance/), so a stub
+// (the one-way rule — core never requires modules/government/), so a stub
 // provider registered on the seam is the whole test double: no Postgres, no
 // router, no live module. That is also the point being asserted — if auth.js ever
 // went back to importing the module directly, these tests could not stub it.
@@ -23,7 +23,7 @@ const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 const { classify } = require(path.join(ROOT, 'src', 'bongos', 'api-errors.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 // Minimal res double capturing status + body, with res.fail() installed exactly
 // as the router installs it (mirrors tests/rank_gate.mjs).
@@ -42,7 +42,7 @@ function fakeRes() {
 // resolveBuilderPermissions; pass null to leave the port UNREGISTERED.
 async function run(gate, req, resolve) {
   seams._reset();
-  if (resolve !== null) seams.registerProvider('governance', { resolveBuilderPermissions: resolve });
+  if (resolve !== null) seams.registerProvider('government', { resolveBuilderPermissions: resolve });
   const res = fakeRes();
   let nexted = false;
   await gate(req, res, () => { nexted = true; });
@@ -63,12 +63,12 @@ test('a builder holding the permission passes the gate', async () => {
 
 test('a missing grant 403s with permission_forbidden and explains the denial', async () => {
   const { res, nexted } = await run(
-    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+    auth.requirePermission('government.manage'), { builder: BUILDER }, holding('idea.triage'),
   );
   assert.equal(nexted, false, 'next() must NOT be called');
   assert.equal(res._status, 403);
   assert.equal(res._json.error.code, 'permission_forbidden');
-  assert.deepEqual(res._json.error.details.required, ['governance.manage']);
+  assert.deepEqual(res._json.error.details.required, ['government.manage']);
   assert.deepEqual(res._json.error.details.held, [], 'holds none of the required perms');
 });
 
@@ -89,7 +89,7 @@ test('the denial names the floor rank, not just the atom (task 1002613, map P-1)
   // this test moves WITH a floor change instead of pinning stale prose — the
   // D-16/N-3 failure shape the fix exists to avoid.
   seams._reset();
-  seams.registerProvider('governance', {
+  seams.registerProvider('government', {
     resolveBuilderPermissions: holding('idea.triage'),
     permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
   });
@@ -107,11 +107,11 @@ test('the denial names the floor rank, not just the atom (task 1002613, map P-1)
 
 test('a port without permissionFloor still denies with a message; floors is null', async () => {
   const { res } = await run(
-    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+    auth.requirePermission('government.manage'), { builder: BUILDER }, holding('idea.triage'),
   );
   assert.equal(res._status, 403);
   assert.equal(res._json.error.details.floors, null);
-  assert.ok(res._json.error.message.includes('governance.manage'),
+  assert.ok(res._json.error.message.includes('government.manage'),
     'the message names the missing atom even when no floor is resolvable');
 });
 
@@ -143,7 +143,7 @@ test('an UNREGISTERED governance port denies, it does not admit', async () => {
 
 test('a malformed port (no resolveBuilderPermissions) denies', async () => {
   seams._reset();
-  seams.registerProvider('governance', { isSystem: () => true });
+  seams.registerProvider('government', { isSystem: () => true });
   const res = fakeRes();
   let nexted = false;
   await auth.requirePermission('idea.triage')({ builder: BUILDER }, res, () => { nexted = true; });
@@ -175,7 +175,7 @@ test('the gate resolves per request — no memoised authority (ADR 0016)', async
   let calls = 0;
   let keys = ['idea.triage'];
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => { calls += 1; return keys; } });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => { calls += 1; return keys; } });
   const gate = auth.requirePermission('idea.triage');
   const first = fakeRes();
   let admitted = false;
@@ -264,7 +264,7 @@ test('over the four seeded ranks, requirePermission admits exactly who requireRa
     'security.report.file',
   ];
   const cases = [
-    ['governance.manage', ['archon']],
+    ['government.manage', ['archon']],
     ['task.claim.any', ['thetes', 'metic', 'archon']],
     ['cost.log', ['xenos', 'thetes', 'metic', 'archon']],
     // The CORE route gates migrated in BV1.R104, each paired with the requireRank

package/tests/governance_resolver.mjs

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const resolver = require(path.join(GOV, 'resolver.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { effectivePermissions, resolveBuilderPermissions, builderHasPermissions } = resolver;
@@ -74,11 +74,11 @@ test('the resolver holds no cache — authority is read fresh per request (ADR 0
 });
 
 test('the kernel port exposes the resolver without core importing the module', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   assert.equal(typeof governancePort.resolveBuilderPermissions, 'function');
   assert.equal(typeof governancePort.builderHasPermissions, 'function');
   assert.equal(typeof governancePort.isSystem, 'function');
   const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
-  assert.ok(manifest.provides.includes('governance'), 'module.json must declare the governance port');
-  assert.ok(manifest.contributes.routes.includes('governance'), 'the port registers from the route factory');
+  assert.ok(manifest.provides.includes('government'), 'module.json must declare the government port');
+  assert.ok(manifest.contributes.routes.includes('government'), 'the port registers from the route factory');
 });

package/tests/governance_role_sync.mjs

@@ -1,8 +1,8 @@
 // tests/governance_role_sync.mjs — rank→role assignment stays in sync (BV1.R95b, ADR 0151).
 //
-// DB-free. The decision the writer executes is a pure function (modules/governance/
-// rank-roles.js planRankRoleSync), so these exercise PRODUCTION logic directly rather
-// than a re-implementation: db.syncRankRole reads the two row sets, calls this exact
+// DB-free. The decision the writer executes is a pure function (modules/government/
+// ranks.js planRankSync), so these exercise PRODUCTION logic directly rather
+// than a re-implementation: db.syncRank reads the two row sets, calls this exact
 // function, and executes its verdict. The SQL halves — the DELETE/INSERT the writer
 // issues and the repair migration — are asserted structurally.
 //
@@ -21,21 +21,21 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
-const { planRankRoleSync, isSeededRankRole } = require(path.join(GOV, 'rank-roles.js'));
+const GOV = path.join(ROOT, 'modules', 'government');
+const { planRankSync, isSeededRank } = require(path.join(GOV, 'ranks.js'));
 
 // The seeded rank-roles exactly as governance_002 writes them.
 const SEEDED = [
-  { role_key: 'xenos', seeded_rank: 'xenos', is_system: true },
-  { role_key: 'thetes', seeded_rank: 'thetes', is_system: true },
-  { role_key: 'metic', seeded_rank: 'metic', is_system: true },
-  { role_key: 'archon', seeded_rank: 'archon', is_system: true },
+  { rank_key: 'xenos', seeded_rank: 'xenos', is_system: true },
+  { rank_key: 'thetes', seeded_rank: 'thetes', is_system: true },
+  { rank_key: 'metic', seeded_rank: 'metic', is_system: true },
+  { rank_key: 'archon', seeded_rank: 'archon', is_system: true },
 ];
-const seededRole = (rank) => ({ role_key: rank, seeded_rank: rank, is_system: true });
+const seededRank_ = (rank) => ({ rank_key: rank, seeded_rank: rank, is_system: true });
 // An Archon-authored custom role from the R110 tab: no seeded_rank, not a system role.
-const customRole = (key) => ({ role_key: key, seeded_rank: null, is_system: false });
+const customRank = (key) => ({ rank_key: key, seeded_rank: null, is_system: false });
 
-const plan = (rank, currentRoles) => planRankRoleSync({ rank, currentRoles, seededRoles: SEEDED });
+const plan = (rank, currentRanks) => planRankSync({ rank, currentRanks, seededRanks: SEEDED });
 
 // ---------------------------------------------------------------------------
 // registration — a builder with no roles gets the one matching their rank
@@ -60,7 +60,7 @@ test('registration: the firstAdmin bootstrap (seated straight to archon) assigns
 // ---------------------------------------------------------------------------
 
 test('promotion xenos→thetes: the new role is added and the old one removed', () => {
-  const p = plan('thetes', [seededRole('xenos')]);
+  const p = plan('thetes', [seededRank_('xenos')]);
   assert.equal(p.target, 'thetes');
   assert.deepEqual([...p.add], ['thetes']);
   assert.deepEqual([...p.remove], ['xenos'], 'the superseded rank-role must be removed');
@@ -69,8 +69,8 @@ test('promotion xenos→thetes: the new role is added and the old one removed',
 
 test('promotion via the auto-graduation path leaves exactly one seeded role', () => {
   // maybeAutoGraduateToThetes runs the same _applyRankChangeTx, so the same plan.
-  const p = plan('thetes', [seededRole('xenos')]);
-  const seededHeld = p.next.filter((k) => SEEDED.some((s) => s.role_key === k));
+  const p = plan('thetes', [seededRank_('xenos')]);
+  const seededHeld = p.next.filter((k) => SEEDED.some((s) => s.rank_key === k));
   assert.equal(seededHeld.length, 1);
 });
 
@@ -79,7 +79,7 @@ test('promotion via the auto-graduation path leaves exactly one seeded role', ()
 // ---------------------------------------------------------------------------
 
 test('demotion archon→metic REMOVES the archon role (not merely adds metic)', () => {
-  const p = plan('metic', [seededRole('archon')]);
+  const p = plan('metic', [seededRank_('archon')]);
   assert.deepEqual([...p.remove], ['archon'], 'the higher rank-role must be REMOVED on demotion');
   assert.deepEqual([...p.add], ['metic']);
   // The absence assertion is the one that matters: an additive-only sync would
@@ -89,7 +89,7 @@ test('demotion archon→metic REMOVES the archon role (not merely adds metic)',
 });
 
 test('demotion archon→xenos (a multi-rung drop) removes archon just the same', () => {
-  const p = plan('xenos', [seededRole('archon')]);
+  const p = plan('xenos', [seededRank_('archon')]);
   assert.ok(p.remove.includes('archon'));
   assert.ok(!p.next.includes('archon'));
   assert.deepEqual([...p.next], ['xenos']);
@@ -98,7 +98,7 @@ test('demotion archon→xenos (a multi-rung drop) removes archon just the same',
 test('a builder holding several stale seeded roles is reduced to exactly one', () => {
   // Defence in depth: if drift ever left two seeded roles on one builder, the sync
   // must not pick one and leave the other — every non-matching seeded role goes.
-  const p = plan('thetes', [seededRole('archon'), seededRole('metic'), seededRole('xenos')]);
+  const p = plan('thetes', [seededRank_('archon'), seededRank_('metic'), seededRank_('xenos')]);
   assert.deepEqual([...p.remove].sort(), ['archon', 'metic', 'xenos']);
   assert.deepEqual([...p.next], ['thetes']);
 });
@@ -108,17 +108,17 @@ test('a builder holding several stale seeded roles is reduced to exactly one', (
 // ---------------------------------------------------------------------------
 
 test('an Archon-assigned custom role survives a rank change', () => {
-  const p = plan('metic', [seededRole('archon'), customRole('release-manager')]);
+  const p = plan('metic', [seededRank_('archon'), customRank('release-manager')]);
   assert.deepEqual([...p.remove], ['archon'], 'only the seeded rank-role rotates');
   assert.ok(!p.remove.includes('release-manager'), 'a custom role must never be revoked by a rank change');
   assert.deepEqual([...p.next], ['metic', 'release-manager']);
 });
 
 test('a custom role is not mistaken for the rank-role even when its key matches a rank name', () => {
-  // role_key is UNIQUE so this cannot happen today, but the predicate must key on
+  // rank_key is UNIQUE so this cannot happen today, but the predicate must key on
   // is_system + seeded_rank rather than on the key's spelling.
-  const impostor = { role_key: 'archon', seeded_rank: null, is_system: false };
-  assert.equal(isSeededRankRole(impostor), false);
+  const impostor = { rank_key: 'archon', seeded_rank: null, is_system: false };
+  assert.equal(isSeededRank(impostor), false);
   const p = plan('metic', [impostor]);
   assert.deepEqual([...p.remove], [], 'a non-system role is never rotated away');
 });
@@ -127,7 +127,7 @@ test('a builder on a non-seeded legacy rank resolves to zero seeded roles', () =
   // migration 023's CHECK still admits twelve reserved ranks. governance_002's INNER
   // JOIN gives them no row BY DESIGN (ADR 0151's fail-closed divergence) — preserve
   // it, and strip any seeded role they were carrying.
-  const p = plan('hippeis', [seededRole('archon')]);
+  const p = plan('hippeis', [seededRank_('archon')]);
   assert.equal(p.target, null, 'no seeded role exists for a legacy rank — invent none');
   assert.deepEqual([...p.add], []);
   assert.deepEqual([...p.remove], ['archon'], 'a legacy rank must not retain a seeded rank-role');
@@ -135,7 +135,7 @@ test('a builder on a non-seeded legacy rank resolves to zero seeded roles', () =
 });
 
 test('a legacy-rank builder still keeps their custom roles', () => {
-  const p = plan('hippeis', [seededRole('metic'), customRole('release-manager')]);
+  const p = plan('hippeis', [seededRank_('metic'), customRank('release-manager')]);
   assert.deepEqual([...p.next], ['release-manager']);
 });
 
@@ -144,23 +144,23 @@ test('a legacy-rank builder still keeps their custom roles', () => {
 // ---------------------------------------------------------------------------
 
 test('the sync is idempotent — running it twice changes nothing the second time', () => {
-  const first = plan('metic', [seededRole('archon')]);
+  const first = plan('metic', [seededRank_('archon')]);
   assert.ok(first.add.length + first.remove.length > 0, 'the first run must do work');
-  const after = first.next.map((key) => (SEEDED.find((s) => s.role_key === key) || customRole(key)));
-  const second = planRankRoleSync({ rank: 'metic', currentRoles: after, seededRoles: SEEDED });
+  const after = first.next.map((key) => (SEEDED.find((s) => s.rank_key === key) || customRank(key)));
+  const second = planRankSync({ rank: 'metic', currentRanks: after, seededRanks: SEEDED });
   assert.deepEqual([...second.add], []);
   assert.deepEqual([...second.remove], []);
   assert.deepEqual([...second.next], [...first.next]);
 });
 
 test('a builder already holding the right role produces no write at all', () => {
-  const p = plan('metic', [seededRole('metic'), customRole('release-manager')]);
+  const p = plan('metic', [seededRank_('metic'), customRank('release-manager')]);
   assert.deepEqual([...p.add], []);
   assert.deepEqual([...p.remove], []);
 });
 
 test('the plan is frozen — a caller cannot widen it after the decision', () => {
-  const p = plan('metic', [seededRole('archon')]);
+  const p = plan('metic', [seededRank_('archon')]);
   assert.ok(Object.isFrozen(p) && Object.isFrozen(p.add) && Object.isFrozen(p.remove));
   assert.throws(() => p.add.push('archon'), TypeError);
 });
@@ -175,15 +175,15 @@ const repairSql = fs.readFileSync(path.join(migDir, 'governance_005_resync_build
 const stripSqlComments = (sql) => sql.replace(/--[^\n]*/g, '');
 
 test('the writer DELETEs the superseded assignments, not just INSERTs the new one', () => {
-  assert.match(dbSrc, /DELETE FROM governance_builder_roles/,
-    'syncRankRole must delete superseded rank-roles — an additive-only writer preserves privilege retention');
-  assert.match(dbSrc, /INSERT INTO governance_builder_roles[\s\S]*ON CONFLICT \(builder_id, role_key\) DO NOTHING/,
+  assert.match(dbSrc, /DELETE FROM government_builder_ranks/,
+    'syncRank must delete superseded rank-roles — an additive-only writer preserves privilege retention');
+  assert.match(dbSrc, /INSERT INTO government_builder_ranks[\s\S]*ON CONFLICT \(builder_id, rank_key\) DO NOTHING/,
     'the assignment insert must be idempotent');
 });
 
 test('the writer runs on the CALLER\'s transaction client when given one', () => {
-  assert.match(dbSrc, /async function syncRankRole\(client,/,
-    'syncRankRole must take the caller\'s client so the rotation is atomic with the rank write');
+  assert.match(dbSrc, /async function syncRank\(client,/,
+    'syncRank must take the caller\'s client so the rotation is atomic with the rank write');
   assert.match(dbSrc, /const q = client \|\| pool;/,
     'and fall back to the pool only when there is no surrounding transaction');
 });
@@ -197,7 +197,7 @@ test('both rank-change twins rotate the role inside their transaction', () => {
     assert.ok(upd !== -1, `${rel}: expected the rank UPDATE in _applyRankChangeTx`);
     assert.ok(sync !== -1, `${rel}: the rank write must rotate the seeded rank-role`);
     assert.ok(sync > upd, `${rel}: the rotation must follow the rank write inside the same transaction`);
-    assert.match(src, /resolveOptional\('governance\.roleSync'\)/,
+    assert.match(src, /resolveOptional\('government\.rankSync'\)/,
       `${rel}: must reach governance through the kernel port, never by importing the module`);
   }
 });