@bongos/core 1.19.184 → 1.19.185

package/modules/government/routes/{governance.js → government.js}

@@ -97,7 +97,7 @@ function registerSeams() {
       selectFragment: `,
             (SELECT COALESCE(array_agg(DISTINCT rp.permission_key), '{}')
                FROM government_builder_ranks br
-               JOIN government_rank_permissions rp ON rp.role_key = br.role_key
+               JOIN government_rank_permissions rp ON rp.rank_key = br.rank_key
               WHERE br.builder_id = s.builder_id) AS raw_permission_keys`,
     });
   }
@@ -105,7 +105,7 @@ function registerSeams() {
 
 // ── the R110 CRUD surface (ADR 0151 §2 — the governance tab's server half) ────
 //
-// Every route — the three reads included — gates on the `governance.manage`
+// Every route — the three reads included — gates on the `government.manage`
 // atom (system, floor archon): this surface EDITS the role/permission graph
 // itself, the meta-escalation the catalog flags non-grantable, and even listing
 // it exposes the full authority map. The invariants are enforced HERE, against
@@ -131,37 +131,37 @@ function registerSeams() {
 // SUBSTRATE keys stay non-grantable to everything, rank-roles included, because a
 // grant row for one delegates nothing (ADR 0043 enforces them out of band).
 const { validateOrRespond, LIMITS, parseId } = api;
-const ROLE_KEY_RE = /^[a-z][a-z0-9-]*$/;
-const ROLE_KEY_MAX = 64;
+const RANK_KEY_RE = /^[a-z][a-z0-9-]*$/;
+const RANK_KEY_MAX = 64;
 
 module.exports = function buildGovernanceRouter() {
   registerSeams();
   const router = express.Router();
 
-  // Param guard for :roleKey. Responds bad_role_key and returns null on a
+  // Param guard for :rankKey. Responds bad_rank_key and returns null on a
   // malformed slug (seeded keys like 'metic' pass shape and are refused later,
   // by policy, with the honest code).
-  function roleKeyParam(req, res) {
-    const roleKey = req.params.roleKey;
-    if (roleKey.length > ROLE_KEY_MAX || !ROLE_KEY_RE.test(roleKey)) {
-      res.fail('bad_role_key', 400, { role_key: roleKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
+  function rankKeyParam(req, res) {
+    const rankKey = req.params.rankKey;
+    if (rankKey.length > RANK_KEY_MAX || !RANK_KEY_RE.test(rankKey)) {
+      res.fail('bad_rank_key', 400, { rank_key: rankKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
       return null;
     }
-    return roleKey;
+    return rankKey;
   }
 
   // Load a role whose GRANTS this API may edit (ADR 0172): 404 on a missing role,
   // refuse only the Archon rank-role. Every other role — the three sub-Archon
   // rank-roles and every custom one — is grant-editable; WHICH keys is then
   // `catalog.isGrantableTo(key, role)`, per role. Returns null after responding.
-  async function loadGrantEditableRole(res, roleKey) {
-    const role = await db.getRoleByKey(roleKey);
+  async function loadGrantEditableRole(res, rankKey) {
+    const role = await db.getRoleByKey(rankKey);
     if (!role) {
-      res.fail('role_not_found', 404, { role_key: roleKey });
+      res.fail('rank_not_found', 404, { rank_key: rankKey });
       return null;
     }
     if (role.is_system && role.seeded_rank === ARCHON) {
-      res.fail('archon_role_immutable', 403, { role_key: roleKey, reason: ARCHON_REASON });
+      res.fail('archon_rank_immutable', 403, { rank_key: rankKey, reason: ARCHON_REASON });
       return null;
     }
     return role;
@@ -169,14 +169,14 @@ module.exports = function buildGovernanceRouter() {
 
   // Load a role this API may ASSIGN. Unchanged from R110: every seeded rank-role is
   // refused, because assignment derives from builders.rank via the R95b sync.
-  async function loadAssignableRole(res, roleKey) {
-    const role = await db.getRoleByKey(roleKey);
+  async function loadAssignableRole(res, rankKey) {
+    const role = await db.getRoleByKey(rankKey);
     if (!role) {
-      res.fail('role_not_found', 404, { role_key: roleKey });
+      res.fail('rank_not_found', 404, { rank_key: rankKey });
       return null;
     }
     if (role.is_system) {
-      res.fail('seeded_role_assignment_forbidden', 403, { role_key: roleKey, reason: ASSIGN_REASON });
+      res.fail('seeded_rank_assignment_forbidden', 403, { rank_key: rankKey, reason: ASSIGN_REASON });
       return null;
     }
     return role;
@@ -185,18 +185,43 @@ module.exports = function buildGovernanceRouter() {
   const ARCHON_REASON = 'the Archon rank-role holds every permission and is immutable — it is the role that can never be locked out of this tab (ADR 0172)';
   const ASSIGN_REASON = 'a seeded rank-role is assigned by rank (R95b sync); change the builder\'s rank instead';
 
-  // rank: perm governance.manage — the full role list with each role's grants.
-  router.get('/governance/roles', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+  // ── one-release compatibility aliases: /governance/* -> /government/* ──────
+  // ADR 0174 committed to keeping the pre-rename paths answering for exactly one
+  // release. The case this actually protects is narrow but real: a browser that
+  // still has the OLD hall page open when the instance upgrades will keep calling
+  // /governance/* against the new server. Everything else that consumed these
+  // paths (the hall bundle, the generated client) ships INSIDE the same core
+  // package and moves in lockstep.
+  //
+  // A 308 preserves the method and body, so a PUT/DELETE grant toggle survives
+  // the hop. The alias carries NO gate of its own — it redirects, and the real
+  // route re-runs requireBuilder + requirePermission on the followed request, so
+  // this cannot become a way around the wall.
+  //
+  // REMOVE THIS BLOCK one release after the rename ships (goal 1000068 follow-up).
+  // The `alias` counter in the log line is how we tell whether anything still
+  // calls them before deleting.
+  const LEGACY_PATH_PREFIX = '/governance';
+  router.all(`${LEGACY_PATH_PREFIX}/*rest`, (req, res, next) => {
+    const rest = req.originalUrl.slice(req.originalUrl.indexOf(LEGACY_PATH_PREFIX) + LEGACY_PATH_PREFIX.length);
+    if (!rest) return next();
+    const target = `/government${rest.replace(/^\/roles(?=\/|$)/, '/ranks')}`;
+    console.warn(`[government] legacy path hit: ${req.method} ${req.originalUrl} -> ${target} (ADR 0174 alias; remove one release after the rename)`);
+    return res.redirect(308, target);
+  });
+
+  // rank: perm government.manage — the full role list with each role's grants.
+  router.get('/government/ranks', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     try {
       const roles = await db.listRolesWithGrants();
       res.json({ roles });
     } catch (err) {
-      console.error('[gds] GET /governance/roles', err);
+      console.error('[gds] GET /government/ranks', err);
       res.fail('roles_list_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — the permission catalog + principals, straight
+  // rank: perm government.manage — the permission catalog + principals, straight
   // from code (the catalog is CODE, not a table); no DB read. Principals are
   // read-only by construction. Three flags the tab renders its locks from, and the
   // tab must read all three rather than just `grantable`, because since ADR 0172
@@ -205,7 +230,7 @@ module.exports = function buildGovernanceRouter() {
   //   • `system`    — an in-app Archon power: locked on a custom role, togglable on
   //                   a sub-Archon rank-role.
   //   • `substrate` — locked EVERYWHERE, on every role, forever (ADR 0043).
-  router.get('/governance/permissions', api.requireBuilder, api.requirePermission('governance.manage'), (req, res) => {
+  router.get('/government/permissions', api.requireBuilder, api.requirePermission('government.manage'), (req, res) => {
     const permissions = catalog.PERMISSIONS.map((p) => ({
       key: p.key,
       system: p.system,
@@ -219,33 +244,33 @@ module.exports = function buildGovernanceRouter() {
     res.json({ permissions, principals: catalog.principals() });
   });
 
-  // rank: perm governance.manage — every builder↔role assignment row.
-  router.get('/governance/assignments', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+  // rank: perm government.manage — every builder↔role assignment row.
+  router.get('/government/assignments', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     try {
       const assignments = await db.listAssignments();
       res.json({ assignments });
     } catch (err) {
-      console.error('[gds] GET /governance/assignments', err);
+      console.error('[gds] GET /government/assignments', err);
       res.fail('assignments_list_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — create a CUSTOM role (is_system false, no
+  // rank: perm government.manage — create a CUSTOM role (is_system false, no
   // seeded_rank — the seeded four exist only via governance_002). Grants are
   // added one at a time via the toggle below, so creation carries none.
-  router.post('/governance/roles', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+  router.post('/government/ranks', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
-      role_key: { required: true, type: 'string', minLength: 2, maxLength: ROLE_KEY_MAX },
+      rank_key: { required: true, type: 'string', minLength: 2, maxLength: RANK_KEY_MAX },
       label: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
       description: { type: 'string', maxLength: 2000 },
     })) return;
-    const roleKey = req.body.role_key;
-    if (!ROLE_KEY_RE.test(roleKey)) {
-      return res.fail('bad_role_key', 400, { role_key: roleKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
+    const rankKey = req.body.rank_key;
+    if (!RANK_KEY_RE.test(rankKey)) {
+      return res.fail('bad_rank_key', 400, { rank_key: rankKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
     }
     try {
       const role = await db.createRole({
-        roleKey,
+        rankKey,
         label: req.body.label,
         description: req.body.description ?? null,
         createdBy: req.builder.id,
@@ -253,22 +278,22 @@ module.exports = function buildGovernanceRouter() {
       res.status(201).json({ role: { ...role, permissions: [] } });
     } catch (err) {
       if (err && err.code === '23505') {
-        return res.fail('role_exists', 409, { role_key: roleKey });
+        return res.fail('rank_exists', 409, { rank_key: rankKey });
       }
-      console.error('[gds] POST /governance/roles', err);
+      console.error('[gds] POST /government/ranks', err);
       res.fail('role_create_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — grant one permission to a role (the toggle's ON
+  // rank: perm government.manage — grant one permission to a role (the toggle's ON
   // half). The order of refusals is the authority order: role exists → role is not
   // the Archon one → the key exists → the key is grantable TO THIS ROLE.
-  router.put('/governance/roles/:roleKey/permissions/:permissionKey', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
-    const roleKey = roleKeyParam(req, res);
-    if (roleKey === null) return;
+  router.put('/government/ranks/:rankKey/permissions/:permissionKey', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
+    const rankKey = rankKeyParam(req, res);
+    if (rankKey === null) return;
     const permissionKey = req.params.permissionKey;
     try {
-      const role = await loadGrantEditableRole(res, roleKey);
+      const role = await loadGrantEditableRole(res, rankKey);
       if (role === null) return;
       if (!catalog.byKey(permissionKey)) {
         return res.fail('unknown_permission', 400, { permission_key: permissionKey });
@@ -276,7 +301,7 @@ module.exports = function buildGovernanceRouter() {
       if (!catalog.isGrantableTo(permissionKey, role)) {
         return res.fail('permission_not_grantable', 400, {
           permission_key: permissionKey,
-          role_key: roleKey,
+          rank_key: rankKey,
           // Name the ACTUAL wall. "Not grantable" now has three distinct causes and
           // a caller that cannot tell them apart cannot tell a policy choice
           // (widen the role) from a structural one (nothing will ever work).
@@ -287,34 +312,34 @@ module.exports = function buildGovernanceRouter() {
               : 'a system (trust-boundary) permission is non-grantable to a CUSTOM role; only a sub-Archon rank-role may carry one (ADR 0172)',
         });
       }
-      const granted = await db.grantRolePermission({ roleKey, permissionKey });
-      res.json({ ok: true, role_key: roleKey, permission_key: permissionKey, granted });
+      const granted = await db.grantRolePermission({ rankKey, permissionKey });
+      res.json({ ok: true, rank_key: rankKey, permission_key: permissionKey, granted });
     } catch (err) {
-      console.error('[gds] PUT /governance/roles/:roleKey/permissions/:permissionKey', err);
+      console.error('[gds] PUT /government/ranks/:rankKey/permissions/:permissionKey', err);
       res.fail('grant_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — revoke a grant (the toggle's OFF half).
+  // rank: perm government.manage — revoke a grant (the toggle's OFF half).
   // Deliberately NOT validated against the catalog: a grant whose key the
   // catalog since retired is exactly the row an Archon most needs to remove
   // (the resolver already drops it — this is hygiene, not authority).
-  router.delete('/governance/roles/:roleKey/permissions/:permissionKey', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
-    const roleKey = roleKeyParam(req, res);
-    if (roleKey === null) return;
+  router.delete('/government/ranks/:rankKey/permissions/:permissionKey', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
+    const rankKey = rankKeyParam(req, res);
+    if (rankKey === null) return;
     const permissionKey = req.params.permissionKey;
     try {
-      const role = await loadGrantEditableRole(res, roleKey);
+      const role = await loadGrantEditableRole(res, rankKey);
       if (role === null) return;
-      const removed = await db.revokeRolePermission({ roleKey, permissionKey });
-      res.json({ ok: true, role_key: roleKey, permission_key: permissionKey, removed });
+      const removed = await db.revokeRolePermission({ rankKey, permissionKey });
+      res.json({ ok: true, rank_key: rankKey, permission_key: permissionKey, removed });
     } catch (err) {
-      console.error('[gds] DELETE /governance/roles/:roleKey/permissions/:permissionKey', err);
+      console.error('[gds] DELETE /government/ranks/:rankKey/permissions/:permissionKey', err);
       res.fail('revoke_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — restore a SEEDED rank-role to its catalog
+  // rank: perm government.manage — restore a SEEDED rank-role to its catalog
   // default (ADR 0172). The counterweight to making the rank-roles editable: a
   // rank's grant set is ~60 rows, so an owner who drifts one has no practical way
   // back by clicking, and "what does Trusted mean by default" is a question only
@@ -325,15 +350,15 @@ module.exports = function buildGovernanceRouter() {
   // Deliberately NOT offered for a CUSTOM role: a custom role has no catalog
   // default to return to (its "default" is the empty set it was created with), so
   // the honest verb there is revoking the grants, which the toggle already does.
-  router.post('/governance/roles/:roleKey/reset', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
-    const roleKey = roleKeyParam(req, res);
-    if (roleKey === null) return;
+  router.post('/government/ranks/:rankKey/reset', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
+    const rankKey = rankKeyParam(req, res);
+    if (rankKey === null) return;
     try {
-      const role = await loadGrantEditableRole(res, roleKey);
+      const role = await loadGrantEditableRole(res, rankKey);
       if (role === null) return;
       if (!role.is_system || !catalog.RANK_ORDER.includes(role.seeded_rank)) {
-        return res.fail('role_has_no_default', 400, {
-          role_key: roleKey,
+        return res.fail('rank_has_no_default', 400, {
+          rank_key: rankKey,
           reason: 'only a seeded rank-role has a catalog default to reset to; revoke a custom role\'s grants instead',
         });
       }
@@ -341,58 +366,58 @@ module.exports = function buildGovernanceRouter() {
       // — below archon — never a system one. Filtering by isGrantableTo anyway keeps
       // reset from being a back door that writes what the toggle refuses.
       const keys = catalog.seedForRank(role.seeded_rank).filter((k) => catalog.isGrantableTo(k, role));
-      const count = await db.resetRoleGrants({ roleKey, permissionKeys: keys });
-      res.json({ ok: true, role_key: roleKey, seeded_rank: role.seeded_rank, permission_count: count });
+      const count = await db.resetRoleGrants({ rankKey, permissionKeys: keys });
+      res.json({ ok: true, rank_key: rankKey, seeded_rank: role.seeded_rank, permission_count: count });
     } catch (err) {
-      console.error('[gds] POST /governance/roles/:roleKey/reset', err);
+      console.error('[gds] POST /government/ranks/:rankKey/reset', err);
       res.fail('reset_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — assign a CUSTOM role to a builder.
+  // rank: perm government.manage — assign a CUSTOM role to a builder.
   // assigned_by is ALWAYS the session builder, never input (the audit trail's
   // "who did this" must be the authenticated actor).
-  router.post('/governance/assignments', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+  router.post('/government/assignments', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       builder_id: { required: true, type: 'integer', min: 1 },
-      role_key: { required: true, type: 'string', minLength: 2, maxLength: ROLE_KEY_MAX },
+      rank_key: { required: true, type: 'string', minLength: 2, maxLength: RANK_KEY_MAX },
     })) return;
-    const roleKey = req.body.role_key;
-    if (!ROLE_KEY_RE.test(roleKey)) {
-      return res.fail('bad_role_key', 400, { role_key: roleKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
+    const rankKey = req.body.rank_key;
+    if (!RANK_KEY_RE.test(rankKey)) {
+      return res.fail('bad_rank_key', 400, { rank_key: rankKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
     }
     try {
-      const role = await loadAssignableRole(res, roleKey);
+      const role = await loadAssignableRole(res, rankKey);
       if (role === null) return;
       const assigned = await db.assignRole({
         builderId: req.body.builder_id,
-        roleKey,
+        rankKey,
         assignedBy: req.builder.id,
       });
-      res.status(assigned ? 201 : 200).json({ ok: true, builder_id: req.body.builder_id, role_key: roleKey, assigned });
+      res.status(assigned ? 201 : 200).json({ ok: true, builder_id: req.body.builder_id, rank_key: rankKey, assigned });
     } catch (err) {
       if (err && err.code === '23503') {
         return res.fail('builder_not_found', 404, { builder_id: req.body.builder_id });
       }
-      console.error('[gds] POST /governance/assignments', err);
+      console.error('[gds] POST /government/assignments', err);
       res.fail('assign_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // rank: perm governance.manage — remove a custom-role assignment. Idempotent:
+  // rank: perm government.manage — remove a custom-role assignment. Idempotent:
   // `removed` says whether a row went away.
-  router.delete('/governance/assignments/:builderId/:roleKey', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+  router.delete('/government/assignments/:builderId/:rankKey', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     const builderId = parseId(req, res, { param: 'builderId', code: 'bad_builder_id', positiveInt: true });
     if (builderId === null) return;
-    const roleKey = roleKeyParam(req, res);
-    if (roleKey === null) return;
+    const rankKey = rankKeyParam(req, res);
+    if (rankKey === null) return;
     try {
-      const role = await loadAssignableRole(res, roleKey);
+      const role = await loadAssignableRole(res, rankKey);
       if (role === null) return;
-      const removed = await db.unassignRole({ builderId, roleKey });
-      res.json({ ok: true, builder_id: builderId, role_key: roleKey, removed });
+      const removed = await db.unassignRole({ builderId, rankKey });
+      res.json({ ok: true, builder_id: builderId, rank_key: rankKey, removed });
     } catch (err) {
-      console.error('[gds] DELETE /governance/assignments/:builderId/:roleKey', err);
+      console.error('[gds] DELETE /government/assignments/:builderId/:rankKey', err);
       res.fail('unassign_failed', { status: 500, message: 'internal error' });
     }
   });

package/modules/hall-ui/public/gate.js

@@ -217,7 +217,7 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    // ADR 0157: the Gate page sits at the `page.view.governance` floor (metic). The
+    // ADR 0157: the Gate page sits at the `page.view.government` floor (metic). The
     // server's requireGovernancePage is the wall — this only decides whether to render the
     // body or the sealed notice, so it must agree or a Metic sees "sealed" on a page
     // they were just admitted to.

package/modules/hall-ui/public/governance.js

@@ -16,13 +16,13 @@
 //     owner's 2026-08-16 decision, and the section header says so out loud.
 //   • the ARCHON rank-role is read-only in full: it holds everything, and its
 //     immutability is what makes it impossible to click your way into locking the
-//     owner out of this tab. The API refuses it as `archon_role_immutable`.
-// ASSIGNMENT of any rank-role is still refused (`seeded_role_assignment_forbidden`)
+//     owner out of this tab. The API refuses it as `archon_rank_immutable`.
+// ASSIGNMENT of any rank-role is still refused (`seeded_rank_assignment_forbidden`)
 // — you get a rank-role by holding the rank, so that dial is the rank itself.
 //
 // Like The Gate, this reads /api/bongos/me for a friendly Sealed notice —
-// DEFENCE IN DEPTH only. Every /governance/* endpoint (reads included) is ALSO
-// gated server-side on the `governance.manage` atom (archon floor). On 401 →
+// DEFENCE IN DEPTH only. Every /government/* endpoint (reads included) is ALSO
+// gated server-side on the `government.manage` atom (archon floor). On 401 →
 // web sign-in.
 //
 // DELIBERATELY NOT IN THE SIDEBAR YET: the nav entry + the server page gate are
@@ -64,27 +64,27 @@
   // The R110 refusal codes, translated for the person clicking.
   const ERROR_COPY = {
     permission_not_grantable: 'That permission can’t be granted to this role. (The server’s reply says which of the three walls applied.)',
-    archon_role_immutable: 'The Archon role is read-only — it holds every permission, which is what keeps you from locking yourself out of this page.',
-    role_has_no_default: 'Only a rank role has a catalog default to reset to. Revoke a custom role’s permissions individually instead.',
-    seeded_role_assignment_forbidden: 'Rank roles are assigned by rank itself — change the builder’s rank instead.',
-    role_exists: 'A role with that key already exists.',
-    role_not_found: 'That role no longer exists — refreshing.',
+    archon_rank_immutable: 'The Archon role is read-only — it holds every permission, which is what keeps you from locking yourself out of this page.',
+    rank_has_no_default: 'Only a rank role has a catalog default to reset to. Revoke a custom role’s permissions individually instead.',
+    seeded_rank_assignment_forbidden: 'Rank roles are assigned by rank itself — change the builder’s rank instead.',
+    rank_exists: 'A role with that key already exists.',
+    rank_not_found: 'That role no longer exists — refreshing.',
     builder_not_found: 'No builder with that id.',
     unknown_permission: 'The permission catalog does not define that key.',
-    bad_role_key: 'Role keys are kebab-case: lowercase letters, digits, dashes.',
+    bad_rank_key: 'Role keys are kebab-case: lowercase letters, digits, dashes.',
     validation_failed: 'Missing or invalid fields.',
   };
   const friendlyError = (code) => ERROR_COPY[code] || null;
 
   // ---- state ---------------------------------------------------------------
 
-  let roles = [];        // [{ role_key, label, description, is_system, seeded_rank, permissions: [] }]
+  let roles = [];        // [{ rank_key, label, description, is_system, seeded_rank, permissions: [] }]
   let permissions = [];  // catalog rows: [{ key, system, floor, guards, grantable }]
   let principals = [];   // [{ system_role, permission, guards }]
-  let assignments = [];  // [{ builder_id, github_login, display_name, rank, role_key, role_label, is_system }]
+  let assignments = [];  // [{ builder_id, github_login, display_name, rank, rank_key, role_label, is_system }]
   let selectedRoleKey = null;
 
-  const selectedRole = () => roles.find((r) => r.role_key === selectedRoleKey) || null;
+  const selectedRole = () => roles.find((r) => r.rank_key === selectedRoleKey) || null;
 
   // ---- render: role list ---------------------------------------------------
 
@@ -102,11 +102,11 @@
       const btn = document.createElement('button');
       btn.type = 'button';
       btn.className = 'gov-role';
-      btn.setAttribute('aria-pressed', role.role_key === selectedRoleKey ? 'true' : 'false');
+      btn.setAttribute('aria-pressed', role.rank_key === selectedRoleKey ? 'true' : 'false');
       btn.innerHTML =
-        `<span class="gov-role__head"><span class="gov-role__label">${escapeHtml(role.label || role.role_key)}</span>${pill}</span>
-         <span class="gov-role__meta"><code>${escapeHtml(role.role_key)}</code> · ${(role.permissions || []).length} permission${(role.permissions || []).length === 1 ? '' : 's'}</span>`;
-      btn.addEventListener('click', () => { selectedRoleKey = role.role_key; renderRoles(); renderGrid(); });
+        `<span class="gov-role__head"><span class="gov-role__label">${escapeHtml(role.label || role.rank_key)}</span>${pill}</span>
+         <span class="gov-role__meta"><code>${escapeHtml(role.rank_key)}</code> · ${(role.permissions || []).length} permission${(role.permissions || []).length === 1 ? '' : 's'}</span>`;
+      btn.addEventListener('click', () => { selectedRoleKey = role.rank_key; renderRoles(); renderGrid(); });
       list.appendChild(btn);
     }
   }
@@ -176,7 +176,7 @@
       return 'The Archon role holds every permission and is read-only — that is what makes it impossible to lock yourself out of this page. To give a power away, hand it to one of the ranks below instead.';
     }
     if (isRankRole(role)) {
-      return `Everything a ${role.label || role.role_key} can do, and yours to change — every builder at this rank is affected immediately. “Reset to default” puts it back to the shipped ladder.`;
+      return `Everything a ${role.label || role.rank_key} can do, and yours to change — every builder at this rank is affected immediately. “Reset to default” puts it back to the shipped ladder.`;
     }
     return 'Toggle the everyday permissions this role carries. Owner powers can only go to a rank role, not to a custom one.';
   }
@@ -185,7 +185,7 @@
     const grid = document.getElementById('gov-grid');
     const role = selectedRole();
     document.getElementById('gov-grid-title').textContent = role
-      ? `Permissions — ${role.label || role.role_key}` : 'Permissions';
+      ? `Permissions — ${role.label || role.rank_key}` : 'Permissions';
     document.getElementById('gov-grid-note').textContent = gridNote(role);
 
     // The reset escape hatch — only a rank role has a catalog default, and the
@@ -223,11 +223,11 @@
   // Restore a rank role to the shipped ladder. Confirmed because it is the one
   // action here that discards work in bulk — a drifted role can be ~60 rows.
   async function resetRole(role, btn) {
-    const label = role.label || role.role_key;
+    const label = role.label || role.rank_key;
     if (!window.confirm(`Reset ${label} to its default permissions?\n\nEvery change you've made to this rank is discarded, and it takes effect for every builder at this rank on their next request.`)) return;
     btn.disabled = true;
     try {
-      const out = await sendJson('POST', `/governance/roles/${encodeURIComponent(role.role_key)}/reset`);
+      const out = await sendJson('POST', `/government/ranks/${encodeURIComponent(role.rank_key)}/reset`);
       toast(`${label} reset to its default ${out.permission_count} permissions.`);
       await reloadRoles();
     } catch (err) {
@@ -240,7 +240,7 @@
   async function toggleGrant(role, permissionKey, grant, btn) {
     btn.disabled = true;
     try {
-      await sendJson(grant ? 'PUT' : 'DELETE', `/governance/roles/${encodeURIComponent(role.role_key)}/permissions/${encodeURIComponent(permissionKey)}`);
+      await sendJson(grant ? 'PUT' : 'DELETE', `/government/ranks/${encodeURIComponent(role.rank_key)}/permissions/${encodeURIComponent(permissionKey)}`);
       toast(grant ? `Granted ${permissionKey}.` : `Revoked ${permissionKey}.`);
       await reloadRoles();
     } catch (err) {
@@ -266,8 +266,8 @@
       row.className = 'gov-assign-row';
       const who = `${escapeHtml(a.display_name || a.github_login || `builder ${a.builder_id}`)} <span class="muted">(#${escapeHtml(String(a.builder_id))} · ${escapeHtml(a.rank || '')})</span>`;
       const rolePill = a.is_system
-        ? `<span class="gov-pill gov-pill--seeded">${escapeHtml(a.role_label || a.role_key)} · via rank</span>`
-        : `<span class="gov-pill gov-pill--custom">${escapeHtml(a.role_label || a.role_key)}</span>`;
+        ? `<span class="gov-pill gov-pill--seeded">${escapeHtml(a.role_label || a.rank_key)} · via rank</span>`
+        : `<span class="gov-pill gov-pill--custom">${escapeHtml(a.role_label || a.rank_key)}</span>`;
       const action = a.is_system ? '' : `<button type="button" class="gov-btn gov-btn--ghost gov-btn--small" data-act="unassign">Remove</button>`;
       row.innerHTML = `<span class="gov-assign-row__who">${who}</span>${rolePill}${action}`;
       const btn = row.querySelector('[data-act=unassign]');
@@ -281,15 +281,15 @@
     const sel = document.getElementById('gov-assign-role');
     const custom = roles.filter((r) => !r.is_system);
     sel.innerHTML = custom.length
-      ? custom.map((r) => `<option value="${escapeHtml(r.role_key)}">${escapeHtml(r.label || r.role_key)}</option>`).join('')
+      ? custom.map((r) => `<option value="${escapeHtml(r.rank_key)}">${escapeHtml(r.label || r.rank_key)}</option>`).join('')
       : `<option value="" disabled selected>No custom roles yet</option>`;
   }
 
   async function unassign(a, btn) {
     btn.disabled = true;
     try {
-      await sendJson('DELETE', `/governance/assignments/${encodeURIComponent(a.builder_id)}/${encodeURIComponent(a.role_key)}`);
-      toast(`Removed ${a.role_label || a.role_key} from builder ${a.builder_id}.`);
+      await sendJson('DELETE', `/government/assignments/${encodeURIComponent(a.builder_id)}/${encodeURIComponent(a.rank_key)}`);
+      toast(`Removed ${a.role_label || a.rank_key} from builder ${a.builder_id}.`);
       await reloadAssignments();
     } catch (err) {
       if (err && err.kind === '401') return;
@@ -321,22 +321,22 @@
   // ---- loads ---------------------------------------------------------------
 
   async function reloadRoles() {
-    const data = await fetchJson('/governance/roles');
+    const data = await fetchJson('/government/ranks');
     roles = data.roles || [];
-    if (!roles.some((r) => r.role_key === selectedRoleKey)) selectedRoleKey = roles.length ? roles[0].role_key : null;
+    if (!roles.some((r) => r.rank_key === selectedRoleKey)) selectedRoleKey = roles.length ? roles[0].rank_key : null;
     renderRoles();
     renderGrid();
     renderAssignSelect();
   }
 
   async function reloadAssignments() {
-    const data = await fetchJson('/governance/assignments');
+    const data = await fetchJson('/government/assignments');
     assignments = data.assignments || [];
     renderAssignments();
   }
 
   async function load() {
-    const perms = await fetchJson('/governance/permissions');
+    const perms = await fetchJson('/government/permissions');
     permissions = perms.permissions || [];
     principals = perms.principals || [];
     await reloadRoles();
@@ -352,16 +352,16 @@
       const btn = e.target.querySelector('button');
       btn.disabled = true;
       const body = {
-        role_key: document.getElementById('gov-create-key').value.trim(),
+        rank_key: document.getElementById('gov-create-key').value.trim(),
         label: document.getElementById('gov-create-label').value.trim(),
       };
       const desc = document.getElementById('gov-create-desc').value.trim();
       if (desc) body.description = desc;
       try {
-        const r = await sendJson('POST', '/governance/roles', body);
-        toast(`Created role ${r.role ? r.role.role_key : body.role_key}.`);
+        const r = await sendJson('POST', '/government/ranks', body);
+        toast(`Created role ${r.role ? r.role.rank_key : body.rank_key}.`);
         e.target.reset();
-        selectedRoleKey = body.role_key;
+        selectedRoleKey = body.rank_key;
         await reloadRoles();
       } catch (err) {
         if (err && err.kind === '401') return;
@@ -379,7 +379,7 @@
       if (!roleKey) { toast('Create a custom role first.'); return; }
       btn.disabled = true;
       try {
-        await sendJson('POST', '/governance/assignments', { builder_id: builderId, role_key: roleKey });
+        await sendJson('POST', '/government/assignments', { builder_id: builderId, rank_key: roleKey });
         toast(`Assigned ${roleKey} to builder ${builderId}.`);
         e.target.reset();
         await reloadAssignments();
@@ -402,8 +402,8 @@
 
   async function init() {
     // Confirm rank for a friendly sealed notice; the server gates the page and
-    // every /governance endpoint on `governance.manage` regardless (cosmetic
-    // defence-in-depth). governance.manage is system:true, so only the archon
+    // every /governance endpoint on `government.manage` regardless (cosmetic
+    // defence-in-depth). government.manage is system:true, so only the archon
     // rank-role can hold it — rank is an accurate client-side proxy.
     let me;
     try {

package/modules/hall-ui/public/harbor.js

@@ -9,7 +9,7 @@
 // shows a restricted notice below the Metic floor — DEFENCE IN DEPTH only. The data +
 // mutation endpoints (/boxes, /boxes/:id/close, /boxes/:id/block) are ALSO gated
 // server-side on `box.fleet.manage` (ADR 0016), and the page itself is gated by
-// serve-internal.js requireGovernancePage — whose own floor is `page.view.governance`,
+// serve-internal.js requireGovernancePage — whose own floor is `page.view.government`,
 // metic since ADR 0157. On a 401 it redirects into the web sign-in flow.
 
 (() => {
@@ -326,7 +326,7 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    // ADR 0157: Harbor sits at the `page.view.governance` floor (metic), and the fleet
+    // ADR 0157: Harbor sits at the `page.view.government` floor (metic), and the fleet
     // data it reads is `box.fleet.manage` (also metic now). Cosmetic —
     // requireGovernancePage + the route gates are the wall; this just picks body vs
     // sealed notice.