@bongos/core 1.19.184 → 1.19.186

package/scripts/hall-preview/server.js

@@ -44,7 +44,7 @@ const EMPTY = process.argv.includes('--empty');
 // --rank: view the hall as a different rank — the /me fixture's builder.rank is
 // overridden in the response, so the Archon-gated pages (watch, harbor, gate)
 // render their real content instead of the sealed notice. Preview-only theatre:
-// the real pages are server-gated (requireGovernancePage / ADR 0016).
+// the real pages are server-gated (requireGovernmentPage / ADR 0016).
 const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
 // --modules-on: force-report modules as enabled — a dev box's local config

package/src/bongos/auth.js

@@ -1437,9 +1437,9 @@ function signInWithReturn(req) {
 // ranks (catalog.RANK_ORDER):
 //   requireBuilderPage     was "any session"      floor xenos  → page.view.public
 //   requireNonXenosPage    was rank !== 'xenos'   floor thetes → page.view.builder
-//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.governance
+//   requireGovernmentPage  was rank === 'archon'  floor archon → page.view.government
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
-// page.view.governance's floor archon→metic and the name stopped being true; the
+// page.view.government's floor archon→metic and the name stopped being true; the
 // floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
 // (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
@@ -1456,8 +1456,8 @@ function signInWithReturn(req) {
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
-  requireGovernancePage: Object.freeze({ permission: 'page.view.governance', deniedTo: '/builders' }),
-  requireGovernanceManagePage: Object.freeze({ permission: 'governance.manage', deniedTo: '/builders' }),
+  requireGovernmentPage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
+  requireGovernmentManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
   requireProjectCuratePage: Object.freeze({ permission: 'project.curate', deniedTo: '/builders' }),
 });
 
@@ -1534,23 +1534,23 @@ async function requireBuilderPage(req, res, next) {
 }
 
 // The /watch monitoring surface, the /harbor dev-box page and the /gate page
-// (#726, idea 257, task 1179) — Metic and up, per `page.view.governance`'s catalog
+// (#726, idea 257, task 1179) — Metic and up, per `page.view.government`'s catalog
 // floor. Named `requireArchonPage` until ADR 0157 lowered that floor archon→metic
 // (older ADRs still use the old name; this line is the trail). Defense-in-depth:
 // every data endpoint these pages call is independently gated server-side, so no
 // cross-builder data leaks even if this gate were bypassed; it keeps a builder
 // without the permission from ever seeing the page shell.
-async function requireGovernancePage(req, res, next) {
-  return runPageGate('requireGovernancePage', req, res, next);
+async function requireGovernmentPage(req, res, next) {
+  return runPageGate('requireGovernmentPage', req, res, next);
 }
 
 // The /governance roles-and-permissions tab (BV1.R113) — gated on the
-// `governance.manage` ATOM itself (system, archon floor), the same key every
+// `government.manage` ATOM itself (system, archon floor), the same key every
 // /governance/* data route checks, so the page layer can never drift wider than
 // the API it fronts. Defense-in-depth as above: the data endpoints are all
 // independently gated; this keeps the tab shell from rendering for anyone else.
-async function requireGovernanceManagePage(req, res, next) {
-  return runPageGate('requireGovernanceManagePage', req, res, next);
+async function requireGovernmentManagePage(req, res, next) {
+  return runPageGate('requireGovernmentManagePage', req, res, next);
 }
 
 // The /people builder-directory page (task 1002577) — gated on the
@@ -1716,7 +1716,7 @@ function requireRank(...allowed) {
 // time — never hardcoded prose, which goes stale when a floor moves (the
 // D-16/N-3 failure shape ADR 0157 left behind).
 //
-// Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('governance.manage'), handler)
+// Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('government.manage'), handler)
 function requirePermission(...perms) {
   const required = Object.freeze([...perms]);
   return async function permissionGate(req, res, next) {
@@ -1827,8 +1827,8 @@ module.exports = {
   SESSION_SCOPES,
   requireBuilder,
   requireBuilderPage,
-  requireGovernancePage,
-  requireGovernanceManagePage,
+  requireGovernmentPage,
+  requireGovernmentManagePage,
   requireNonXenosPage,
   requireProjectCuratePage,
   requireRank,

package/src/bongos/module-scope-map.js

@@ -174,30 +174,15 @@ const MODULE_GLOBS = {
   //     role templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
-  //     RENAMED governance → government (goal 1000068, task 1003003, ADR 0174).
-  //     Both keys live through the transition and BOTH carry BOTH sets of globs,
-  //     so the wall is identical whichever key a goal names and whichever name
-  //     the folder currently has on disk. The `government` key must land BEFORE
-  //     R04 moves the folder: goals carry scope_modules by KEY, so moving the
-  //     folder first would leave goal 1000068's own wall not matching the files
-  //     its remaining tasks need to touch, blocking the rename mid-goal.
-  //     `modules/government/` is registered in protected-surfaces.json in the
-  //     same change — `protected` DERIVES from that registry, so without it this
-  //     key would compute protected:false and silently drop the Archon gate.
+  //     RENAMED governance → government (goal 1000068, ADR 0174). The
+  //     transitional `governance` alias key was removed in R05 (task 1003006)
+  //     together with the /governance/* route aliases — the same compatibility
+  //     window. The three live goals that named the old key (1000030, 1000057,
+  //     1000068) had it removed from goals.scope_modules in the same change, so
+  //     no stored row references a key the map no longer defines.
   government: [
-    'modules/government/', 'modules/governance/',
+    'modules/government/',
     'config/government.json', 'config/government.neutral.json',
-    'config/governance.json', 'config/governance.neutral.json',
-  ],
-  //     DEPRECATED ALIAS — kept for one release so goals and tasks already
-  //     scoped to `governance` keep resolving. Removed by goal 1000068 R05
-  //     (task 1003006), the release that drops the /governance/* route aliases;
-  //     the two removals are the same compatibility window and should land
-  //     together.
-  governance: [
-    'modules/government/', 'modules/governance/',
-    'config/government.json', 'config/government.neutral.json',
-    'config/governance.json', 'config/governance.neutral.json',
   ],
   // --- the two web surfaces ---
   // BV1.R85: hall-UI graduated to modules/hall-ui/ — public-builders/ moved to

package/src/bongos/route-rank-check.js

@@ -231,19 +231,18 @@ const EXPECTED_RANKS = {
   'GET /security/adr': 'metic+archon',
 };
 
-// The authz-core route pins, referenced by BOTH the `governance` and the
-// `government` module keys below while goal 1000068's rename is in flight
-// (ADR 0174, task 1003003). One object, two keys — never two literals.
+// The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
+// governance→government in R05 (task 1003006); the module-key alias is gone.
 const GOVERNMENT_PINS = {
-  'GET /governance/roles': 'perm:governance.manage',
-  'GET /governance/permissions': 'perm:governance.manage',
-  'GET /governance/assignments': 'perm:governance.manage',
-  'POST /governance/roles': 'perm:governance.manage',
-  'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-  'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-  'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
-  'POST /governance/assignments': 'perm:governance.manage',
-  'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
+  'GET /government/ranks': 'perm:government.manage',
+  'GET /government/permissions': 'perm:government.manage',
+  'GET /government/assignments': 'perm:government.manage',
+  'POST /government/ranks': 'perm:government.manage',
+  'PUT /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
+  'DELETE /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
+  'POST /government/ranks/:rankKey/reset': 'perm:government.manage',
+  'POST /government/assignments': 'perm:government.manage',
+  'DELETE /government/assignments/:builderId/:rankKey': 'perm:government.manage',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE
@@ -417,17 +416,12 @@ const MODULE_EXPECTED_RANKS = {
   },
   // The government tab's server half (BV1.R110, ADR 0151; renamed by ADR 0174) —
   // the routes that EDIT the rank/permission graph itself. Every route, the three
-  // reads included, is pinned to the `governance.manage` ATOM rather than a rank:
+  // reads included, is pinned to the `government.manage` ATOM rather than a rank:
   // on this surface the atom IS the authority (it is the catalog's meta-escalation
   // key), and a downgrade here is the model's worst case — the routes that write
   // authority drifting below the wall that guards authority. Reads are pinned too
   // because the full rank/grant/assignment map is the authority model's blueprint.
   //
-  // The ROUTE PATHS and the `governance.manage` key are renamed by R05 (task
-  // 1003006), not here: R02 only makes the pins reachable under both module keys.
-  // Renaming the paths before the routes move would pin routes that do not exist
-  // and red the build for the whole window.
-  governance: GOVERNMENT_PINS,
   // The same pins under the post-ADR-0174 module name (goal 1000068, task
   // 1003003). Pins are applied only when the module directory is IN SCOPE — at
   // least one route file was discovered under modules/<key>/ — so this entry is

package/src/bongos/serve-internal.js

@@ -749,9 +749,9 @@ function mountInternalSurfaces(app) {
   });
 
   // The /watch monitoring page and the /harbor dev-box management page (idea 257)
-  // and the /gate page (task 1179) all sit behind `page.view.governance` — Metic
+  // and the /gate page (task 1179) all sit behind `page.view.government` — Metic
   // and up since ADR 0157. Same server-side page gate, same posture: a builder
-  // without the permission never receives the shell (requireGovernancePage — named
+  // without the permission never receives the shell (requireGovernmentPage — named
   // requireArchonPage before ADR 0157 — redirects them to the hall, and an
   // unauthenticated visitor into sign-in). The subdomain shim above has already
   // rewritten the bare /watch + /harbor + /gate onto /builders/*. (Defense in
@@ -766,13 +766,13 @@ function mountInternalSurfaces(app) {
   // data never leaked (the route gate held), but the page was the one item in the
   // group without a wall. Gated here so the group is uniform (task 1002710).
   const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
-  // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
-  // the `governance.manage` atom itself (archon), the same key its data routes
-  // check — requireGovernanceManagePage, not the metic-floored gate above.
-  const GOVERNANCE_PAGE_RE = /^\/builders\/governance(?:\.html)?\/?$/;
+  // The /government ranks-and-permissions tab (BV1.R113) sits one floor higher:
+  // the `government.manage` atom itself (archon), the same key its data routes
+  // check — requireGovernmentManagePage, not the metic-floored gate above.
+  const GOVERNMENT_PAGE_RE = /^\/builders\/government(?:\.html)?\/?$/;
   // The /people builder directory (task 1002577): gated on `project.curate`, the
   // exact permission its data route (GET /scouting) checks — same posture as the
-  // /governance tab above (the page can never drift wider than the API it fronts).
+  // /government tab above (the page can never drift wider than the API it fronts).
   const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
   // /scouting is the LEGACY twin of /people — the same /api/gds/scouting directory,
   // left behind when task 1002577 graduated it into the hall. It has no nav entry
@@ -787,10 +787,10 @@ function mountInternalSurfaces(app) {
     const norm = path.posix.normalize(req.path);
     if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
       || SESSIONS_PAGE_RE.test(norm)) {
-      return gdsAuth.requireGovernancePage(req, res, next);
+      return gdsAuth.requireGovernmentPage(req, res, next);
     }
-    if (GOVERNANCE_PAGE_RE.test(norm)) {
-      return gdsAuth.requireGovernanceManagePage(req, res, next);
+    if (GOVERNMENT_PAGE_RE.test(norm)) {
+      return gdsAuth.requireGovernmentManagePage(req, res, next);
     }
     if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);

package/src/module-api.js

@@ -390,7 +390,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         ad7a262 and never packaged, so ~104 non-merge commits sat on main
 //         reachable by no pin; this is the artifact that ships them. Headline:
 //         the governance permission system's second half (R110 roles/perms/
-//         assignments CRUD behind governance.manage, R113 the Roles nav +
+//         assignments CRUD behind government.manage, R113 the Roles nav +
 //         page gate, R114 the C6 live proof, ADR 0157 delegating the
 //         operational block from Archon to Metic, and the permission resolve
 //         folded into the session load); the scan-before-install security
@@ -795,8 +795,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
 //   1.19.184 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.183 with no explicit bump. run 31974847472. (task 1002620)
+//   1.19.185 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.184 with no explicit bump. run 31976564067. (task 1002620)
+//   1.19.186 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.185 with no explicit bump. run 31977207459. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.184'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.186'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_resolve_failure.mjs

@@ -93,17 +93,17 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   // rot: a NEW bare `async function require*` added later fails this test.
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
   //   requireBuilderPage         \
-  //   requireGovernancePage       \
-  //   requireGovernanceManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
+  //   requireGovernmentPage       \
+  //   requireGovernmentManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
   //   requireNonXenosPage         /  (the R113 roles-tab gate; the /people curate gate)
   //   requireProjectCuratePage   /
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernanceManagePage', 'requireGovernancePage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernancePage', 'requireGovernanceManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/governance_abuse_matrix.mjs

@@ -16,7 +16,7 @@
 //     V3  HTTP: assign a seeded rank-role to a builder (rank is the only writer)
 //     V4  HTTP: mass-assignment on role create (is_system / permissions in body)
 //     V5  HTTP: every write vector 403s outright for a caller without
-//         governance.manage (the low-trust builder's own attempt)
+//         government.manage (the low-trust builder's own attempt)
 //     V6  config: a role template proposing system keys is stripped; a seeded
 //         role's template grants are dropped wholesale; env overrides labels only
 //     V7  session-scope: an allow-list naming a system or principal key THROWS
@@ -109,9 +109,9 @@ test('every system permission floors at archon or is a principal (never seeded l
 const calls = [];
 const stub = {
   getRoleByKey: async (k) => (SEEDED_ROLES.includes(k)
-    ? { role_key: k, label: k, is_system: true, seeded_rank: k }
-    : { role_key: k, label: k, is_system: false, seeded_rank: null }),
-  createRole: async (a) => ({ role_key: a.roleKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+    ? { rank_key: k, label: k, is_system: true, seeded_rank: k }
+    : { rank_key: k, label: k, is_system: false, seeded_rank: null }),
+  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
   grantRolePermission: async () => true,
   revokeRolePermission: async () => true,
   resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
@@ -127,7 +127,7 @@ for (const k of Object.keys(stub)) {
 }
 
 // The attacker holds the MOST privileged legitimate session — an Archon with
-// governance.manage. The matrix must hold even against the admin misusing the
+// government.manage. The matrix must hold even against the admin misusing the
 // API, not just against a low-trust caller (V5 covers that one).
 const realRequireBuilder = api.requireBuilder;
 api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon' }; next(); };
@@ -136,9 +136,9 @@ function grant(keys) {
   seams._reset();
   seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
-grant(['governance.manage']);
+grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
@@ -168,7 +168,7 @@ async function call(method, p, body) {
 
 test('V1: EVERY system permission is refused onto a custom role, before the db', async () => {
   for (const k of SYSTEM_KEYS) {
-    const r = await call('PUT', `/governance/roles/custom-role/permissions/${k}`);
+    const r = await call('PUT', `/government/ranks/custom-role/permissions/${k}`);
     assert.equal(r.status, 400, `${k} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable', k);
     assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
@@ -185,15 +185,15 @@ test('V1: EVERY system permission is refused onto a custom role, before the db',
 test('V2a: the ARCHON rank-role refuses EVERY write — grant, revoke and reset alike', async () => {
   for (const k of [...SYSTEM_KEYS, 'idea.triage']) {
     for (const method of ['PUT', 'DELETE']) {
-      const r = await call(method, `/governance/roles/archon/permissions/${k}`);
+      const r = await call(method, `/government/ranks/archon/permissions/${k}`);
       assert.equal(r.status, 403, `archon ← ${method} ${k} must be refused`);
-      assert.equal(r.json.error.code, 'archon_role_immutable', `archon ← ${method} ${k}`);
+      assert.equal(r.json.error.code, 'archon_rank_immutable', `archon ← ${method} ${k}`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission' || c === 'revokeRolePermission').length, 0);
     }
   }
-  const r = await call('POST', '/governance/roles/archon/reset');
+  const r = await call('POST', '/government/ranks/archon/reset');
   assert.equal(r.status, 403, 'reset must not be a back door into the archon role');
-  assert.equal(r.json.error.code, 'archon_role_immutable');
+  assert.equal(r.json.error.code, 'archon_rank_immutable');
   assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
 });
 
@@ -201,7 +201,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
   const neverGrantable = [...SUBSTRATE_KEYS, ...catalog.principalKeys()];
   for (const role of EDITABLE_RANK_ROLES) {
     for (const k of neverGrantable) {
-      const r = await call('PUT', `/governance/roles/${role}/permissions/${k}`);
+      const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 400, `${role} ← ${k} must be refused`);
       assert.equal(r.json.error.code, 'permission_not_grantable', `${role} ← ${k}`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
@@ -213,7 +213,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
 test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 lever)', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
     for (const k of [...OWNER_POWERS, 'idea.triage']) {
-      const r = await call('PUT', `/governance/roles/${role}/permissions/${k}`);
+      const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 200, `${role} ← ${k} must be ACCEPTED — this delegation is the owner's decision (ADR 0172)`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 1, `${role} ← ${k} must reach the db`);
     }
@@ -222,7 +222,7 @@ test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 l
 
 test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
-    const r = await call('POST', `/governance/roles/${role}/reset`);
+    const r = await call('POST', `/government/ranks/${role}/reset`);
     assert.equal(r.status, 200, `${role} must be resettable`);
     const [, args] = calls.find(([c]) => c === 'resetRoleGrants');
     assert.deepEqual([...args.permissionKeys].sort(), [...catalog.seedForRank(role)].sort(),
@@ -233,24 +233,24 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   }
   // A custom role has no catalog default, so reset is refused rather than silently
   // clearing its grants (which would be a destructive verb wearing a restore's name).
-  const r = await call('POST', '/governance/roles/custom-role/reset');
+  const r = await call('POST', '/government/ranks/custom-role/reset');
   assert.equal(r.status, 400);
-  assert.equal(r.json.error.code, 'role_has_no_default');
+  assert.equal(r.json.error.code, 'rank_has_no_default');
   assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
 });
 
 test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer — R95b)', async () => {
   for (const role of SEEDED_ROLES) {
-    const r = await call('POST', '/governance/assignments', { builder_id: 7, role_key: role });
+    const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: role });
     assert.equal(r.status, 403, `assigning seeded role ${role} must be refused`);
-    assert.equal(r.json.error.code, 'seeded_role_assignment_forbidden', role);
+    assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden', role);
     assert.equal(calls.filter(([c]) => c === 'assignRole').length, 0);
   }
 });
 
 test('V4: mass-assignment on role create is refused outright (strict schema)', async () => {
-  const r = await call('POST', '/governance/roles', {
-    role_key: 'sneaky-role',
+  const r = await call('POST', '/government/ranks', {
+    rank_key: 'sneaky-role',
     label: 'Sneaky',
     is_system: true,
     seeded_rank: 'archon',
@@ -262,32 +262,32 @@ test('V4: mass-assignment on role create is refused outright (strict schema)', a
 });
 
 test('V4: a clean role create is never system and carries no grants', async () => {
-  const r = await call('POST', '/governance/roles', { role_key: 'sneaky-role', label: 'Sneaky' });
+  const r = await call('POST', '/government/ranks', { rank_key: 'sneaky-role', label: 'Sneaky' });
   assert.equal(r.status, 201);
-  assert.equal(r.json.role.is_system, false, 'a created role is never system');
-  assert.equal(r.json.role.seeded_rank, null);
-  assert.deepEqual(r.json.role.permissions, [], 'creation carries no grants');
+  assert.equal(r.json.rank.is_system, false, 'a created role is never system');
+  assert.equal(r.json.rank.seeded_rank, null);
+  assert.deepEqual(r.json.rank.permissions, [], 'creation carries no grants');
   const c = calls.find(([k]) => k === 'createRole');
-  assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'roleKey'],
+  assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'rankKey'],
     'nothing beyond the four whitelisted fields reaches the db');
   assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
 });
 
-test('V5: a caller without governance.manage cannot reach ANY write vector at all', async () => {
-  grant(catalog.grantableKeys().filter((k) => k !== 'governance.manage'));
+test('V5: a caller without government.manage cannot reach ANY write vector at all', async () => {
+  grant(catalog.grantableKeys().filter((k) => k !== 'government.manage'));
   for (const [method, p, body] of [
-    ['POST', '/governance/roles', { role_key: 'x-role', label: 'X' }],
-    ['PUT', '/governance/roles/custom-role/permissions/deploy.push_main', undefined],
-    ['DELETE', '/governance/roles/custom-role/permissions/idea.triage', undefined],
-    ['POST', '/governance/roles/metic/reset', undefined],
-    ['POST', '/governance/assignments', { builder_id: 7, role_key: 'custom-role' }],
-    ['DELETE', '/governance/assignments/7/custom-role', undefined],
+    ['POST', '/government/ranks', { rank_key: 'x-role', label: 'X' }],
+    ['PUT', '/government/ranks/custom-role/permissions/deploy.push_main', undefined],
+    ['DELETE', '/government/ranks/custom-role/permissions/idea.triage', undefined],
+    ['POST', '/government/ranks/metic/reset', undefined],
+    ['POST', '/government/assignments', { builder_id: 7, rank_key: 'custom-role' }],
+    ['DELETE', '/government/assignments/7/custom-role', undefined],
   ]) {
     const r = await call(method, p, body);
     assert.equal(r.status, 403, `${method} ${p} must deny — even holding every operational grant`);
     assert.equal(r.json.error.code, 'permission_forbidden', `${method} ${p}`);
   }
-  grant(['governance.manage']);
+  grant(['government.manage']);
 });
 
 // ===========================================================================

package/tests/governance_catalog.mjs

@@ -57,7 +57,7 @@ test('substrate keys are the out-of-band three, and each implies system + archon
     assert.equal(byKey(k).floor, 'archon', `${k} must floor at archon`);
     assert.equal(byKey(k).principal, null, `${k} must not also be a principal key`);
   }
-  assert.equal(cat.isSubstrate('governance.manage'), false, 'an in-app archon power is not substrate');
+  assert.equal(cat.isSubstrate('government.manage'), false, 'an in-app archon power is not substrate');
   assert.equal(cat.isSubstrate('nope.not.a.key'), false, 'unknown fails closed');
 });
 
@@ -67,7 +67,7 @@ test('isGrantableTo: a sub-Archon rank-role takes owner powers, a custom role do
   const custom = { is_system: false, seeded_rank: null };
 
   // The widening: an in-app archon power reaches a rank-role, never a custom one.
-  for (const k of ['governance.manage', 'builder.rank.set', 'version.close']) {
+  for (const k of ['government.manage', 'builder.rank.set', 'version.close']) {
     assert.equal(cat.isGrantableTo(k, metic), true, `${k} → metic rank-role`);
     assert.equal(cat.isGrantableTo(k, custom), false, `${k} → custom role must stay refused`);
   }
@@ -173,7 +173,7 @@ test('an unknown/reserved rank resolves to no permissions (fail-closed; ADR 0151
 });
 
 test('byKey returns a frozen record or null', () => {
-  const p = byKey('governance.manage');
+  const p = byKey('government.manage');
   assert.ok(p && p.system === true && p.floor === 'archon');
   assert.throws(() => { p.system = false; }, /Cannot assign|read only|frozen/i);
   assert.equal(byKey('nope'), null);

package/tests/governance_fold.mjs

@@ -121,7 +121,7 @@ test('the kernel shape guard: the real fragment embeds; a malformed one degrades
   assert.equal(dbKernel.sessionPermsSelect(), '', 'a fragment with a statement separator is refused');
   // The REAL registered fragment passes the guard verbatim.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
   buildGovernanceRouter();
   const real = seams.resolveOptional('session-grants-sql').selectFragment;
   assert.equal(dbKernel.sessionPermsSelect(), real, 'the shipped fragment embeds unchanged');
@@ -133,7 +133,7 @@ test('the module registers the capability-named SQL seam the kernel embeds', ()
   // §Decision #4); the governance route factory is what registers it. Pin the
   // registration and the column contract the kernel query depends on.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
   buildGovernanceRouter();
   const provider = seams.resolveOptional('session-grants-sql');
   assert.ok(provider && typeof provider.selectFragment === 'string', 'fragment provider registered');

package/tests/governance_fold_bench.mjs

@@ -1,7 +1,7 @@
 // tests/governance_fold_bench.mjs — the task-1002556 benchmark, re-runnable.
 //
 // Measures end-to-end latency of a requireBuilder + requirePermission route
-// (GET /governance/roles) against a LIVE server, the way the fold was graded:
+// (GET /government/ranks) against a LIVE server, the way the fold was graded:
 // point it at a stack before and after and compare. Asserts only route health
 // (every request 200) — the numbers are the deliverable, printed for the
 // operator to diff.
@@ -27,7 +27,7 @@ import { strict as assert } from 'node:assert';
 const BASE = (process.env.GDS_BASE_URL || '').replace(/\/$/, '');
 const TOKEN = process.env.BENCH_TOKEN || '';
 if (!BASE || !TOKEN) {
-  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds governance.manage).');
+  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds government.manage).');
   process.exit(0);
 }
 const N = Number(process.env.BENCH_N) || 300;

package/tests/governance_live_proof.mjs

@@ -142,7 +142,7 @@ try {
     'BEFORE: the thetes builder cannot triage (403 permission_forbidden)');
 
   // Act 2 — an Archon creates a custom role and grants the operational permission.
-  r = await call(ARCHON_TOKEN, 'POST', '/governance/roles',
+  r = await call(ARCHON_TOKEN, 'POST', '/government/ranks',
     { role_key: ROLE_KEY, label: 'GLP demo triage role' });
   ok(r.status === 201, 'the Archon creates a custom role (201)');
   r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
@@ -153,13 +153,13 @@ try {
   r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/governance.manage`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/government.manage`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
-    'the meta-escalation (governance.manage) is refused the same way');
+    'the meta-escalation (government.manage) is refused the same way');
 
   // Act 4 — assign, then the same builder performs the action: no re-login, no
   // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
-  r = await call(ARCHON_TOKEN, 'POST', '/governance/assignments',
+  r = await call(ARCHON_TOKEN, 'POST', '/government/assignments',
     { builder_id: THETES, role_key: ROLE_KEY });
   ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
   r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });

package/tests/governance_ownership_scope.mjs

@@ -397,7 +397,7 @@ test('G2: the role resolve is untouched — own-scoped keys still resolve, princ
 });
 
 test('G3: the kernel port carries the ownership axis on the ONE governance port', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   for (const name of ['authorizeOwned', 'authorizeOwnedOrAny', 'sameOwner', 'isOwnershipScoped', 'crossOwnerKeysFor']) {
     assert.equal(typeof governancePort[name], 'function', `the port must expose ${name}`);
   }