@bongos/core 1.19.183 → 1.19.185

package/tests/governance_routes.mjs

@@ -4,7 +4,7 @@
 //
 //   1. Gate classification + pins: route-rank-check's own classifier is run over
 //      the real routes source — every /governance route must gate on the
-//      `governance.manage` atom through real middleware, and every declared
+//      `government.manage` atom through real middleware, and every declared
 //      route must be pinned in MODULE_EXPECTED_RANKS. The pin set and the
 //      declared set are compared BOTH ways, so adding an unpinned governance
 //      route (or orphaning a pin) fails here before the grader sees it.
@@ -17,7 +17,7 @@
 //      tests assert that, so a later tightening can't quietly re-close the owner's
 //      lever); the ARCHON rank-role and every SUBSTRATE key stay refused; rank-role
 //      ASSIGNMENT is still rank-derived (R95b); and every route denies without the
-//      `governance.manage` grant.
+//      `government.manage` grant.
 //
 // Run:  node tests/governance_routes.mjs
 
@@ -33,53 +33,53 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const govDb = require(path.join(ROOT, 'modules', 'governance', 'db.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 const express = require('express');
 
-const ROUTES_SRC = path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js');
+const ROUTES_SRC = path.join(ROOT, 'modules', 'government', 'routes', 'government.js');
 
 // ===========================================================================
 // Layer 1 — gate classification + route-rank-check pins
 // ===========================================================================
 
 const classified = rrc.classifyText(fs.readFileSync(ROUTES_SRC, 'utf8'))
-  .filter((r) => r.route.startsWith('/governance'));
+  .filter((r) => r.route.startsWith('/government'));
 
 test('the routes file declares the full R110 surface', () => {
   const declared = new Set(classified.map((r) => r.key));
   const wanted = [
-    'GET /governance/roles',
-    'GET /governance/permissions',
-    'GET /governance/assignments',
-    'POST /governance/roles',
-    'PUT /governance/roles/:roleKey/permissions/:permissionKey',
-    'DELETE /governance/roles/:roleKey/permissions/:permissionKey',
-    'POST /governance/roles/:roleKey/reset',
-    'POST /governance/assignments',
-    'DELETE /governance/assignments/:builderId/:roleKey',
+    'GET /government/ranks',
+    'GET /government/permissions',
+    'GET /government/assignments',
+    'POST /government/ranks',
+    'PUT /government/ranks/:rankKey/permissions/:permissionKey',
+    'DELETE /government/ranks/:rankKey/permissions/:permissionKey',
+    'POST /government/ranks/:rankKey/reset',
+    'POST /government/assignments',
+    'DELETE /government/assignments/:builderId/:rankKey',
   ];
   for (const key of wanted) assert.ok(declared.has(key), `missing route ${key}`);
 });
 
-test('every /governance route gates on governance.manage via REAL middleware', () => {
-  assert.ok(classified.length > 0, 'no /governance routes found to classify');
+test('every /governance route gates on government.manage via REAL middleware', () => {
+  assert.ok(classified.length > 0, 'no /government routes found to classify');
   for (const r of classified) {
     assert.equal(r.via, 'middleware', `${r.key}: gate must be middleware, not an annotation`);
-    assert.deepEqual(r.perms, ['governance.manage'], `${r.key}: must gate on exactly governance.manage`);
-    assert.equal(r.rank, 'archon', `${r.key}: governance.manage floors at archon`);
+    assert.deepEqual(r.perms, ['government.manage'], `${r.key}: must gate on exactly government.manage`);
+    assert.equal(r.rank, 'archon', `${r.key}: government.manage floors at archon`);
   }
 });
 
 test('every declared /governance route is pinned, and every pin exists (both directions)', () => {
-  const pins = rrc.MODULE_EXPECTED_RANKS.governance;
-  assert.ok(pins, 'MODULE_EXPECTED_RANKS has no governance block');
+  const pins = rrc.MODULE_EXPECTED_RANKS.government;
+  assert.ok(pins, 'MODULE_EXPECTED_RANKS has no government block');
   const declared = new Set(classified.map((r) => r.key));
   for (const key of declared) {
-    assert.equal(pins[key], `${rrc.PERM_PIN_PREFIX}governance.manage`,
-      `${key} must be pinned to perm:governance.manage`);
+    assert.equal(pins[key], `${rrc.PERM_PIN_PREFIX}government.manage`,
+      `${key} must be pinned to perm:government.manage`);
   }
   for (const key of Object.keys(pins)) {
     assert.ok(declared.has(key), `pin ${key} names a route the file no longer declares`);
@@ -88,7 +88,7 @@ test('every declared /governance route is pinned, and every pin exists (both dir
 
 test('checkRouteRanks passes over the real tree (no governance findings)', () => {
   const result = rrc.checkRouteRanks();
-  const ours = result.findings.filter((f) => String(f.file).includes('modules/governance/'));
+  const ours = result.findings.filter((f) => String(f.file).includes('modules/government/'));
   assert.deepEqual(ours, [], `governance findings: ${JSON.stringify(ours, null, 2)}`);
 });
 
@@ -99,18 +99,18 @@ test('checkRouteRanks passes over the real tree (no governance findings)', () =>
 // The db stub: every function the routes call, recording args. Reset per test.
 const calls = [];
 const stub = {
-  listRolesWithGrants: async () => [{ role_key: 'metic', label: 'Metic', description: null, is_system: true, seeded_rank: 'metic', created_by: null, created_at: 't', permissions: ['task.create'] }],
-  listAssignments: async () => [{ builder_id: 7, github_login: 'x', display_name: 'X', rank: 'metic', role_key: 'metic', role_label: 'Metic', is_system: true, seeded_rank: 'metic', assigned_by: null, assigned_at: 't' }],
+  listRolesWithGrants: async () => [{ rank_key: 'metic', label: 'Metic', description: null, is_system: true, seeded_rank: 'metic', created_by: null, created_at: 't', permissions: ['task.create'] }],
+  listAssignments: async () => [{ builder_id: 7, github_login: 'x', display_name: 'X', rank: 'metic', rank_key: 'metic', role_label: 'Metic', is_system: true, seeded_rank: 'metic', assigned_by: null, assigned_at: 't' }],
   // Every rank name is a seeded rank-role; anything else is a custom one. Keyed off
   // the catalog's ladder rather than a hand-listed pair, so a rank added to
   // RANK_ORDER is exercised here instead of quietly falling through as "custom".
   getRoleByKey: async (k) => (k === 'missing' ? null : {
-    role_key: k,
+    rank_key: k,
     label: k,
     is_system: catalog.RANK_ORDER.includes(k),
     seeded_rank: catalog.RANK_ORDER.includes(k) ? k : null,
   }),
-  createRole: async (a) => ({ role_key: a.roleKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
   grantRolePermission: async () => true,
   revokeRolePermission: async () => true,
   resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
@@ -131,11 +131,11 @@ api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon
 
 function grant(keys) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => keys });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
-grant(['governance.manage']);
+grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
@@ -165,41 +165,41 @@ async function call(method, p, body) {
 
 // --- the deny wall -----------------------------------------------------------
 
-test('without governance.manage EVERY route 403s (reads included)', async () => {
+test('without government.manage EVERY route 403s (reads included)', async () => {
   grant(['idea.triage', 'task.create']);
   for (const [method, p] of [
-    ['GET', '/governance/roles'],
-    ['GET', '/governance/permissions'],
-    ['GET', '/governance/assignments'],
-    ['POST', '/governance/roles'],
-    ['PUT', '/governance/roles/r/permissions/task.create'],
-    ['DELETE', '/governance/roles/r/permissions/task.create'],
-    ['POST', '/governance/assignments'],
-    ['DELETE', '/governance/assignments/7/r'],
+    ['GET', '/government/ranks'],
+    ['GET', '/government/permissions'],
+    ['GET', '/government/assignments'],
+    ['POST', '/government/ranks'],
+    ['PUT', '/government/ranks/r/permissions/task.create'],
+    ['DELETE', '/government/ranks/r/permissions/task.create'],
+    ['POST', '/government/assignments'],
+    ['DELETE', '/government/assignments/7/r'],
   ]) {
     const r = await call(method, p, method === 'GET' ? undefined : {});
     assert.equal(r.status, 403, `${method} ${p} must deny`);
     assert.equal(r.json.error.code, 'permission_forbidden', `${method} ${p}`);
   }
-  grant(['governance.manage']);
+  grant(['government.manage']);
 });
 
 // --- reads -------------------------------------------------------------------
 
-test('GET /governance/roles returns the role list with grants', async () => {
-  const r = await call('GET', '/governance/roles');
+test('GET /government/ranks returns the role list with grants', async () => {
+  const r = await call('GET', '/government/ranks');
   assert.equal(r.status, 200);
-  assert.equal(r.json.roles[0].role_key, 'metic');
+  assert.equal(r.json.roles[0].rank_key, 'metic');
   assert.deepEqual(r.json.roles[0].permissions, ['task.create']);
 });
 
-test('GET /governance/permissions renders the catalog: grantable flags + principals, no DB call', async () => {
-  const r = await call('GET', '/governance/permissions');
+test('GET /government/permissions renders the catalog: grantable flags + principals, no DB call', async () => {
+  const r = await call('GET', '/government/permissions');
   assert.equal(r.status, 200);
   assert.equal(calls.length, 0, 'the permission catalog is code, not a table');
   const byKey = new Map(r.json.permissions.map((p) => [p.key, p]));
   assert.equal(byKey.size, catalog.permissionKeys().length, 'every catalog key is listed');
-  const sys = byKey.get('governance.manage');
+  const sys = byKey.get('government.manage');
   assert.equal(sys.system, true);
   assert.equal(sys.grantable, false, 'a system permission renders non-grantable');
   const op = byKey.get('idea.triage');
@@ -209,56 +209,56 @@ test('GET /governance/permissions renders the catalog: grantable flags + princip
   assert.ok(r.json.principals.every((p) => p.grantable === false));
 });
 
-test('GET /governance/assignments returns builder↔role rows', async () => {
-  const r = await call('GET', '/governance/assignments');
+test('GET /government/assignments returns builder↔role rows', async () => {
+  const r = await call('GET', '/government/assignments');
   assert.equal(r.status, 200);
   assert.equal(r.json.assignments[0].builder_id, 7);
-  assert.equal(r.json.assignments[0].role_key, 'metic');
+  assert.equal(r.json.assignments[0].rank_key, 'metic');
 });
 
 // --- create role -------------------------------------------------------------
 
-test('POST /governance/roles creates a custom role, created_by = the session builder', async () => {
-  const r = await call('POST', '/governance/roles', { role_key: 'triage-helper', label: 'Triage helper' });
+test('POST /government/ranks creates a custom role, created_by = the session builder', async () => {
+  const r = await call('POST', '/government/ranks', { rank_key: 'triage-helper', label: 'Triage helper' });
   assert.equal(r.status, 201);
-  assert.equal(r.json.role.role_key, 'triage-helper');
+  assert.equal(r.json.role.rank_key, 'triage-helper');
   assert.equal(r.json.role.is_system, false);
   const c = calls.find(([k]) => k === 'createRole');
   assert.equal(c[1].createdBy, 42, 'created_by must be the session builder, never input');
 });
 
-test('POST /governance/roles validates: label required, role_key must be a slug', async () => {
-  const missing = await call('POST', '/governance/roles', { role_key: 'x-role' });
+test('POST /government/ranks validates: label required, rank_key must be a slug', async () => {
+  const missing = await call('POST', '/government/ranks', { rank_key: 'x-role' });
   assert.equal(missing.status, 400);
   assert.equal(missing.json.error.code, 'validation_failed');
   for (const bad of ['Has Space', 'UPPER', '-lead', 'dots.bad', '']) {
-    const r = await call('POST', '/governance/roles', { role_key: bad, label: 'L' });
-    assert.equal(r.status, 400, `role_key "${bad}" must be rejected`);
+    const r = await call('POST', '/government/ranks', { rank_key: bad, label: 'L' });
+    assert.equal(r.status, 400, `rank_key "${bad}" must be rejected`);
   }
   assert.equal(calls.filter(([k]) => k === 'createRole').length, 0, 'nothing reached the db');
 });
 
-test('POST /governance/roles maps a unique-violation to role_exists 409', async () => {
+test('POST /government/ranks maps a unique-violation to rank_exists 409', async () => {
   const prev = stub.createRole;
   stub.createRole = async () => { const e = new Error('dup'); e.code = '23505'; throw e; };
-  const r = await call('POST', '/governance/roles', { role_key: 'metic-two', label: 'L' });
+  const r = await call('POST', '/government/ranks', { rank_key: 'metic-two', label: 'L' });
   stub.createRole = prev;
   assert.equal(r.status, 409);
-  assert.equal(r.json.error.code, 'role_exists');
+  assert.equal(r.json.error.code, 'rank_exists');
 });
 
 // --- toggle a grant ----------------------------------------------------------
 
 test('PUT grant: an operational permission lands on a custom role', async () => {
-  const r = await call('PUT', '/governance/roles/triage-helper/permissions/idea.triage');
+  const r = await call('PUT', '/government/ranks/triage-helper/permissions/idea.triage');
   assert.equal(r.status, 200);
   const c = calls.find(([k]) => k === 'grantRolePermission');
-  assert.deepEqual(c[1], { roleKey: 'triage-helper', permissionKey: 'idea.triage' });
+  assert.deepEqual(c[1], { rankKey: 'triage-helper', permissionKey: 'idea.triage' });
 });
 
 test('PUT grant: a SYSTEM permission is rejected as non-grantable — the R110 wall', async () => {
-  for (const sysKey of ['governance.manage', 'deploy.push_main', 'builder.rank.set']) {
-    const r = await call('PUT', `/governance/roles/triage-helper/permissions/${sysKey}`);
+  for (const sysKey of ['government.manage', 'deploy.push_main', 'builder.rank.set']) {
+    const r = await call('PUT', `/government/ranks/triage-helper/permissions/${sysKey}`);
     assert.equal(r.status, 400, `${sysKey} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable');
     assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0, 'the refusal is BEFORE the db');
@@ -266,29 +266,29 @@ test('PUT grant: a SYSTEM permission is rejected as non-grantable — the R110 w
 });
 
 test('PUT grant: an unknown permission fails closed', async () => {
-  const r = await call('PUT', '/governance/roles/triage-helper/permissions/no.such.key');
+  const r = await call('PUT', '/government/ranks/triage-helper/permissions/no.such.key');
   assert.equal(r.status, 400);
   assert.equal(r.json.error.code, 'unknown_permission');
 });
 
 test('PUT grant: a sub-Archon rank-role is EDITABLE (ADR 0172)', async () => {
-  const r = await call('PUT', '/governance/roles/metic/permissions/idea.triage');
+  const r = await call('PUT', '/government/ranks/metic/permissions/idea.triage');
   assert.equal(r.status, 200);
   const c = calls.find(([k]) => k === 'grantRolePermission');
-  assert.deepEqual(c[1], { roleKey: 'metic', permissionKey: 'idea.triage' });
+  assert.deepEqual(c[1], { rankKey: 'metic', permissionKey: 'idea.triage' });
 });
 
 test('PUT grant: an in-app owner power CAN go to a rank-role but never to a custom one', async () => {
-  const rank = await call('PUT', '/governance/roles/metic/permissions/builder.rank.set');
+  const rank = await call('PUT', '/government/ranks/metic/permissions/builder.rank.set');
   assert.equal(rank.status, 200, 'the owner may delegate an in-app Archon power to a rank');
-  const custom = await call('PUT', '/governance/roles/triage-helper/permissions/builder.rank.set');
+  const custom = await call('PUT', '/government/ranks/triage-helper/permissions/builder.rank.set');
   assert.equal(custom.status, 400, 'a custom role keeps the R110 wall');
   assert.equal(custom.json.error.code, 'permission_not_grantable');
 });
 
 test('PUT grant: a SUBSTRATE key is refused even on a rank-role (it would confer nothing)', async () => {
   for (const key of ['deploy.push_main', 'path.protected.modify', 'infra.ssh']) {
-    const r = await call('PUT', `/governance/roles/metic/permissions/${key}`);
+    const r = await call('PUT', `/government/ranks/metic/permissions/${key}`);
     assert.equal(r.status, 400, `${key} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable');
     assert.match(r.json.error.details.reason || '', /substrate/i,
@@ -298,39 +298,39 @@ test('PUT grant: a SUBSTRATE key is refused even on a rank-role (it would confer
 });
 
 test('PUT grant: the ARCHON rank-role stays immutable (the lockout guard)', async () => {
-  const r = await call('PUT', '/governance/roles/archon/permissions/idea.triage');
+  const r = await call('PUT', '/government/ranks/archon/permissions/idea.triage');
   assert.equal(r.status, 403);
-  assert.equal(r.json.error.code, 'archon_role_immutable');
+  assert.equal(r.json.error.code, 'archon_rank_immutable');
   assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
 });
 
 test('PUT grant: an unknown role 404s', async () => {
-  const r = await call('PUT', '/governance/roles/missing/permissions/idea.triage');
+  const r = await call('PUT', '/government/ranks/missing/permissions/idea.triage');
   assert.equal(r.status, 404);
-  assert.equal(r.json.error.code, 'role_not_found');
+  assert.equal(r.json.error.code, 'rank_not_found');
 });
 
 test('DELETE grant revokes without consulting the catalog (stale keys stay removable)', async () => {
-  const r = await call('DELETE', '/governance/roles/triage-helper/permissions/some.retired.key');
+  const r = await call('DELETE', '/government/ranks/triage-helper/permissions/some.retired.key');
   assert.equal(r.status, 200);
   const c = calls.find(([k]) => k === 'revokeRolePermission');
-  assert.deepEqual(c[1], { roleKey: 'triage-helper', permissionKey: 'some.retired.key' });
+  assert.deepEqual(c[1], { rankKey: 'triage-helper', permissionKey: 'some.retired.key' });
 });
 
 test('DELETE grant: revocable on a sub-Archon rank-role, refused on the Archon one', async () => {
-  const metic = await call('DELETE', '/governance/roles/metic/permissions/idea.triage');
+  const metic = await call('DELETE', '/government/ranks/metic/permissions/idea.triage');
   assert.equal(metic.status, 200, 'taking a permission away from a rank is the other half of editable');
 
-  const archon = await call('DELETE', '/governance/roles/archon/permissions/idea.triage');
+  const archon = await call('DELETE', '/government/ranks/archon/permissions/idea.triage');
   assert.equal(archon.status, 403);
-  assert.equal(archon.json.error.code, 'archon_role_immutable');
+  assert.equal(archon.json.error.code, 'archon_rank_immutable');
   assert.equal(calls.filter(([k]) => k === 'revokeRolePermission').length, 0);
 });
 
 // --- reset (ADR 0172) --------------------------------------------------------
 
 test('POST reset: a rank-role goes back to its floor-derived catalog seed', async () => {
-  const r = await call('POST', '/governance/roles/thetes/reset');
+  const r = await call('POST', '/government/ranks/thetes/reset');
   assert.equal(r.status, 200);
   assert.equal(r.json.seeded_rank, 'thetes');
   const c = calls.find(([k]) => k === 'resetRoleGrants');
@@ -338,57 +338,57 @@ test('POST reset: a rank-role goes back to its floor-derived catalog seed', asyn
 });
 
 test('POST reset: refused on a custom role (no catalog default to return to)', async () => {
-  const r = await call('POST', '/governance/roles/triage-helper/reset');
+  const r = await call('POST', '/government/ranks/triage-helper/reset');
   assert.equal(r.status, 400);
-  assert.equal(r.json.error.code, 'role_has_no_default');
+  assert.equal(r.json.error.code, 'rank_has_no_default');
   assert.equal(calls.filter(([k]) => k === 'resetRoleGrants').length, 0);
 });
 
 // --- assignments -------------------------------------------------------------
 
-test('POST /governance/assignments assigns a custom role, assigned_by = the session builder', async () => {
-  const r = await call('POST', '/governance/assignments', { builder_id: 7, role_key: 'triage-helper' });
+test('POST /government/assignments assigns a custom role, assigned_by = the session builder', async () => {
+  const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: 'triage-helper' });
   assert.equal(r.status, 201);
   const c = calls.find(([k]) => k === 'assignRole');
-  assert.deepEqual(c[1], { builderId: 7, roleKey: 'triage-helper', assignedBy: 42 });
+  assert.deepEqual(c[1], { builderId: 7, rankKey: 'triage-helper', assignedBy: 42 });
 });
 
-test('POST /governance/assignments refuses a seeded rank-role (rank is the writer — R95b)', async () => {
-  const r = await call('POST', '/governance/assignments', { builder_id: 7, role_key: 'archon' });
+test('POST /government/assignments refuses a seeded rank-role (rank is the writer — R95b)', async () => {
+  const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: 'archon' });
   assert.equal(r.status, 403);
-  assert.equal(r.json.error.code, 'seeded_role_assignment_forbidden');
+  assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden');
   assert.equal(calls.filter(([k]) => k === 'assignRole').length, 0);
 });
 
-test('POST /governance/assignments maps a missing builder (FK) to 404', async () => {
+test('POST /government/assignments maps a missing builder (FK) to 404', async () => {
   const prev = stub.assignRole;
   stub.assignRole = async () => { const e = new Error('fk'); e.code = '23503'; throw e; };
-  const r = await call('POST', '/governance/assignments', { builder_id: 999, role_key: 'triage-helper' });
+  const r = await call('POST', '/government/assignments', { builder_id: 999, rank_key: 'triage-helper' });
   stub.assignRole = prev;
   assert.equal(r.status, 404);
   assert.equal(r.json.error.code, 'builder_not_found');
 });
 
-test('POST /governance/assignments validates builder_id and role_key', async () => {
-  const r = await call('POST', '/governance/assignments', { builder_id: 'seven', role_key: 'triage-helper' });
+test('POST /government/assignments validates builder_id and rank_key', async () => {
+  const r = await call('POST', '/government/assignments', { builder_id: 'seven', rank_key: 'triage-helper' });
   assert.equal(r.status, 400);
   assert.equal(r.json.error.code, 'validation_failed');
 });
 
-test('DELETE /governance/assignments/:builderId/:roleKey unassigns a custom role', async () => {
-  const r = await call('DELETE', '/governance/assignments/7/triage-helper');
+test('DELETE /government/assignments/:builderId/:rankKey unassigns a custom role', async () => {
+  const r = await call('DELETE', '/government/assignments/7/triage-helper');
   assert.equal(r.status, 200);
   const c = calls.find(([k]) => k === 'unassignRole');
-  assert.deepEqual(c[1], { builderId: 7, roleKey: 'triage-helper' });
+  assert.deepEqual(c[1], { builderId: 7, rankKey: 'triage-helper' });
 });
 
 test('DELETE /governance/assignments refuses a seeded rank-role', async () => {
-  const r = await call('DELETE', '/governance/assignments/7/metic');
+  const r = await call('DELETE', '/government/assignments/7/metic');
   assert.equal(r.status, 403);
-  assert.equal(r.json.error.code, 'seeded_role_assignment_forbidden');
+  assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden');
 });
 
 test('DELETE /governance/assignments validates the builder id param', async () => {
-  const r = await call('DELETE', '/governance/assignments/not-a-number/triage-helper');
+  const r = await call('DELETE', '/government/assignments/not-a-number/triage-helper');
   assert.equal(r.status, 400);
 });

package/tests/governance_seed.mjs

@@ -15,9 +15,9 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { RANK_ROLE_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const { RANK_ROLE_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
-const MIG_DIR = path.join(ROOT, 'modules', 'governance', 'migrations');
+const MIG_DIR = path.join(ROOT, 'modules', 'government', 'migrations');
 const seedSql = fs.readFileSync(path.join(MIG_DIR, 'governance_002_seed_and_backfill.sql'), 'utf8');
 const tablesSql = fs.readFileSync(path.join(MIG_DIR, 'governance_001_tables.sql'), 'utf8');
 
@@ -28,8 +28,31 @@ const tablesSql = fs.readFileSync(path.join(MIG_DIR, 'governance_001_tables.sql'
 // ADR 0152), and what must equal RANK_ROLE_SEED is the union of them all, not any one
 // file. Read in filename order; every file is scanned for `SELECT '<role>', unnest(…)`
 // blocks, so a new grant migration needs no change here.
+// Migrations that do NOT grant. Excluded by NAME rather than by "does it
+// INSERT?" so that `a grant migration must INSERT something` below stays a real
+// assertion: a file we believe grants but which inserts nothing is a bug worth
+// failing on, and a content-sniffing filter would quietly excuse it.
+const NON_GRANT_MIGRATIONS = new Set([
+  'governance_001_tables.sql',                     // creates the three tables
+  'government_001_rename_from_governance.sql',     // ADR 0174 table rename (task 1003004)
+  'government_002_rename_permission_keys.sql',     // ADR 0174 key rename (task 1003006)
+]);
+
+// Permission keys RENAMED after the grant migrations that first granted them.
+// The union model below is append-only — it reads INSERTs — so a rename is
+// invisible to it: the historical migration still grants the old spelling while
+// the catalog now declares the new one. Applying this map to the union is what
+// makes the comparison describe the EFFECTIVE grant set after every migration
+// has run, which is what the seed actually is.
+// Each entry must be performed by a real migration; government_002 does these two.
+const RENAMED_KEYS = new Map([
+  ['governance.manage',    'government.manage'],
+  ['page.view.governance', 'page.view.government'],
+]);
+const applyRenames = (keys) => keys.map((k) => RENAMED_KEYS.get(k) || k);
+
 const grantMigrationFiles = fs.readdirSync(MIG_DIR)
-  .filter((f) => f.endsWith('.sql') && f !== 'governance_001_tables.sql')
+  .filter((f) => f.endsWith('.sql') && !NON_GRANT_MIGRATIONS.has(f))
   .sort();
 const grantSqlByFile = grantMigrationFiles.map((f) => [f, fs.readFileSync(path.join(MIG_DIR, f), 'utf8')]);
 
@@ -53,7 +76,7 @@ test('the union of every grant migration matches RANK_ROLE_SEED exactly (no drif
     for (const b of blocks) {
       assert.equal(b.keys.length, new Set(b.keys).size, `${role}: duplicate permission in the ${b.file} array`);
     }
-    const granted = blocks.flatMap((b) => b.keys);
+    const granted = applyRenames(blocks.flatMap((b) => b.keys));
     // set-equality (order in SQL is illustrative; the grant set is what matters)
     assert.deepEqual(new Set(granted), new Set(RANK_ROLE_SEED[role]),
       `${role}: grant migrations drift from catalog RANK_ROLE_SEED`);

package/tests/governance_session_scope.mjs

@@ -18,7 +18,7 @@
 // ORACLE DISCIPLINE. A test whose two sides read the same source of truth passes
 // while proving nothing, so nothing load-bearing here is driven by the registry:
 //   • the Archon-box assertions name Archon powers LITERALLY (builder.rank.set,
-//     governance.manage, deploy.push_main …) and cross-check them against `floor`
+//     government.manage, deploy.push_main …) and cross-check them against `floor`
 //     run through auth.rankMeetsThreshold — the REAL production rank gate, a
 //     pre-R99 oracle;
 //   • the deny-by-default assertions pin a hand-written expected set, so widening
@@ -38,7 +38,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 
 // auth.js destructures lookupSession at load, so the stub must be installed before
 // ANYTHING pulls auth.js in (src/module-api does, via the governance route file).
@@ -66,7 +66,7 @@ const EXPECTED_BOX_SCOPE = ['box.manage.own'];
 // Archon powers, named literally. If a box session ever resolves one of these the
 // #919 containment is gone.
 const ARCHON_POWERS = [
-  'builder.rank.set', 'governance.manage', 'deploy.push_main', 'version.close',
+  'builder.rank.set', 'government.manage', 'deploy.push_main', 'version.close',
   'task.confirm.grade_bypass', 'path.protected.modify', 'infra.ssh',
   'builder.roster.read', 'claim.release.any', 'memory.read.any', 'audit_log.read',
 ];
@@ -326,7 +326,7 @@ test('F2: an unscoped session reaches every route, declared or not', () => {
     assert.equal(auth.sessionScopeAdmits(source, undefined), true);
     assert.equal(auth.sessionScopeAdmits(source, []), true);
     assert.equal(auth.sessionScopeAdmits(source, ['box.manage.own']), true);
-    assert.equal(auth.sessionScopeAdmits(source, ['governance.manage']), true);
+    assert.equal(auth.sessionScopeAdmits(source, ['government.manage']), true);
   }
 });
 
@@ -419,7 +419,7 @@ test('H3: the resolve is still per-request and frozen — no memoised session au
 // ═══ I — the ONE governance port carries the axis ════════════════════════════
 
 test('I1: the session-scope axis lands on the single governance port', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   for (const name of ['resolveSessionPermissions', 'narrowToSessionScope', 'sessionScopeFor', 'listSessionScopes']) {
     assert.equal(typeof governancePort[name], 'function', `the port must expose ${name}`);
   }

package/tests/governance_vanilla_boot.mjs

@@ -1,7 +1,7 @@
 // tests/governance_vanilla_boot.mjs — the VANILLA BOOT proof (BV1.R102, ADR 0151).
 //
 // The core/host split only holds if a FRESH instance — one that has never been
-// branded, with no config/governance.json on disk and no rows in
+// branded, with no config/government.json on disk and no rows in
 // governance_builder_roles — comes up sane, anonymous, and powerless. This file is
 // that proof. It is deliberately scoped to what R96's tests/governance_config.mjs
 // does NOT cover: that file pins the config CONTRACT (precedence, per-field merge,
@@ -37,7 +37,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { loadGovernanceConfig, resolveGovernanceConfig, NEUTRAL_PATH, INSTANCE_PATH } = require(path.join(GOV, 'config.js'));
 const { effectivePermissions, resolveBuilderPermissions } = require(path.join(GOV, 'resolver.js'));
@@ -127,10 +127,10 @@ test('the identity guard is not a no-op — a planted host brand in the neutral
   // trip it, in the exact file this task is about.
   for (const brand of ['Off the Boats', 'amazonprimea.com']) {
     const poisoned = NEUTRAL_TEXT.replace('"roles"', `"instance": "${brand}",\n  "roles"`);
-    const found = fitness.scanPromptIdentity('config/governance.neutral.json', poisoned, '.json');
+    const found = fitness.scanPromptIdentity('config/government.neutral.json', poisoned, '.json');
     assert.ok(found.length >= 1, `a "${brand}" literal in the neutral pack must be caught`);
   }
-  assert.deepEqual(fitness.scanPromptIdentity('config/governance.neutral.json', NEUTRAL_TEXT, '.json'), [], 'the real pack is clean');
+  assert.deepEqual(fitness.scanPromptIdentity('config/government.neutral.json', NEUTRAL_TEXT, '.json'), [], 'the real pack is clean');
 });
 
 // ── (c) the trust boundary on a vanilla boot ────────────────────────────────────

package/tests/hall_page_gate_map.mjs

@@ -32,12 +32,12 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 // correct for the genuinely public pages and a BUG anywhere else, so every such
 // row is spelled out rather than left to a default.
 //
-// Audiences (the floors live in modules/governance/catalog.js; the gate
+// Audiences (the floors live in modules/government/catalog.js; the gate
 // functions in src/bongos/auth.js):
 //   requireBuilderPage          page.view.public    any signed-in builder (xenos+)
-//   requireGovernancePage       page.view.governance  metic+   (ADR 0157)
+//   requireGovernancePage       page.view.government  metic+   (ADR 0157)
 //   requireProjectCuratePage    project.curate        metic+
-//   requireGovernanceManagePage governance.manage     archon
+//   requireGovernanceManagePage government.manage     archon
 const ORACLE = {
   // Any signed-in builder — no rank floor.
   '/builders/work': 'requireBuilderPage',

package/tests/memory_isolation.mjs

@@ -336,8 +336,8 @@ app.use(attachFail);
 // currently impersonating, so the cases below exercise the PERMISSION decision rather
 // than the port-missing fallback.
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
-seams.registerProvider('governance', {
+const catalog = require('../modules/government/catalog.js');
+seams.registerProvider('government', {
   resolveBuilderPermissions: async () => catalog.seedForRank(
     (fixture.session && fixture.session.rank) || 'xenos',
   ),

package/tests/module_loader.mjs

@@ -197,7 +197,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'governance', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/onboarding_observability.mjs

@@ -43,8 +43,8 @@ async function t(name, fn) {
 // src/bongos/routes, so we patch the resolved module before requiring the
 // routes.
 const authPath = require.resolve('../src/bongos/auth.js');
-const catalog = require('../modules/governance/catalog.js');
-// Mirrors the canonical ladder in modules/governance/catalog.js — omitting a rung
+const catalog = require('../modules/government/catalog.js');
+// Mirrors the canonical ladder in modules/government/catalog.js — omitting a rung
 // would resolve its floor to Infinity and deny everyone, including archon. Kept at
 // module scope (BV1.R104) so requireRank and requirePermission below share ONE
 // ladder; R105's branch still had the stale 3-rung inline copy that dropped thetes.