@bongos/core 1.19.184 → 1.19.186

package/tests/governance_page_gates.mjs

@@ -50,15 +50,15 @@ const resolver = require('../modules/government/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
-const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireGovernancePage'];
+const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireGovernmentPage'];
 const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 
 // ═══ the ORACLE — hand-written, from the rank tests R107 deleted ═════════════
 // requireBuilderPage    admitted any session at all     → every live rank
 // requireNonXenosPage   admitted rank !== 'xenos'       → thetes and up
-// requireGovernancePage admitted rank === 'archon'      → archon only …until ADR 0157
+// requireGovernmentPage admitted rank === 'archon'      → archon only …until ADR 0157
 //
-// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.governance` archon→metic, so
+// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.government` archon→metic, so
 // the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
 // was spelled `requireArchonPage` through R107 and ADR 0157 — the name the rows below
 // were first written against — and was renamed once the floor moved; the audience here,
@@ -71,7 +71,7 @@ const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 const PRE_R107_AUDIENCE = {
   requireBuilderPage: { xenos: true, thetes: true, metic: true, archon: true },
   requireNonXenosPage: { xenos: false, thetes: true, metic: true, archon: true },
-  requireGovernancePage: { xenos: false, thetes: false, metic: true, archon: true },
+  requireGovernmentPage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
 // they already have a session, so that would loop. Since task 1002613 (map N-1)
@@ -81,12 +81,12 @@ const PRE_R107_AUDIENCE = {
 const DENIED_TO = {
   requireBuilderPage: '/builders',
   requireNonXenosPage: '/builders/not-ready',
-  requireGovernancePage: '/builders',
+  requireGovernmentPage: '/builders',
 };
 const GATE_PERMISSION = {
   requireBuilderPage: 'page.view.public',
   requireNonXenosPage: 'page.view.builder',
-  requireGovernancePage: 'page.view.governance',
+  requireGovernmentPage: 'page.view.government',
 };
 const deniedLoc = (gate, { unavailable = false } = {}) =>
   `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
@@ -94,8 +94,8 @@ const deniedLoc = (gate, { unavailable = false } = {}) =>
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
   requireNonXenosPage: 'thetes',
-  // ADR 0157: `page.view.governance` floor archon→metic.
-  requireGovernancePage: 'metic',
+  // ADR 0157: `page.view.government` floor archon→metic.
+  requireGovernmentPage: 'metic',
 };
 const SIGN_IN = '/api/gds/auth/web/start';
 
@@ -249,22 +249,22 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   });
   const req = { headers: { cookie: 'gds_session=validtoken' } };
   let admitted = false;
-  await auth.requireGovernancePage(req, fakeRes(), () => { admitted = true; });
+  await auth.requireGovernmentPage(req, fakeRes(), () => { admitted = true; });
   assert.equal(admitted, true, 'an Archon should reach the page');
   keys = []; // the role is revoked between requests
   const second = fakeRes();
   let admittedAgain = false;
-  await auth.requireGovernancePage(req, second, () => { admittedAgain = true; });
+  await auth.requireGovernmentPage(req, second, () => { admittedAgain = true; });
   seams._reset();
   assert.equal(calls, 2, 'the resolver must be consulted on every request');
   assert.equal(admittedAgain, false, 'a revoked role must deny on the very next request');
-  assert.equal(second._redirect.loc, deniedLoc('requireGovernancePage'));
+  assert.equal(second._redirect.loc, deniedLoc('requireGovernmentPage'));
 });
 
 test('B5: every permission a page gate names is a real catalog key', async () => {
   // Not an oracle — a sanity check that the gates did not migrate onto a typo,
   // which would silently deny everyone (fail-closed, but a bug all the same).
-  for (const key of ['page.view.public', 'page.view.builder', 'page.view.governance']) {
+  for (const key of ['page.view.public', 'page.view.builder', 'page.view.government']) {
     assert.ok(catalog.byKey(key), `${key} must exist in the catalog`);
   }
 });

package/tests/governance_principals.mjs

@@ -149,7 +149,7 @@ test('resolved principal sets are frozen — a caller cannot widen one', () => {
 // ── show, never grant ───────────────────────────────────────────────────────────
 
 test('the tab surface is a read-only projection: shown, flagged non-grantable', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   assert.equal(typeof governancePort.listPrincipals, 'function');
   assert.equal(typeof governancePort.resolvePrincipalPermissions, 'function');
   const listed = governancePort.listPrincipals();
@@ -162,7 +162,7 @@ test('the tab surface is a read-only projection: shown, flagged non-grantable',
 });
 
 test('the governance port exposes no way to create, grant, or assign a principal', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   const mutator = /(create|grant|assign|add|set|write|provision|revoke|delete|update)/i;
   for (const name of Object.keys(governancePort)) {
     if (!/principal/i.test(name)) continue;

package/tests/governance_protected_surfaces.mjs

@@ -92,22 +92,34 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // Each entry is { after, glob, why }: `after` is the glob it is inserted
 // directly below, so the expected list is reconstructed in order rather than
 // re-pasted (a re-paste is how the two lists drift apart).
-const ADDED_SINCE_R101 = [
+const ADDED_SINCE_R101 = [];
+
+// Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
+// a removal on purpose: a rename keeps the protection and moves it, a removal
+// ends it. The subset test below accepts a documented rename and rejects a bare
+// disappearance, so "we renamed it" can never be used to quietly unprotect
+// something — the replacement must actually be in the registry.
+const RENAMED_SINCE_R101 = [
   {
-    after: 'modules/governance/',
-    glob: 'modules/government/',
-    why: 'goal 1000068 / task 1003003 (ADR 0174) — the authz core is renamed '
-       + 'governance→government. The new glob is registered BEFORE the folder '
-       + 'moves because `protected` DERIVES from this registry: without it the '
-       + 'new module key computes protected:false and both the Archon gate on '
-       + 'goal creation and the pre-push block on these files would silently lapse.',
+    from: 'modules/governance/',
+    to:   'modules/government/',
+    why: 'goal 1000068 / ADR 0174 — the authz core was renamed governance→government. '
+       + 'The folder moved in task 1003004 and the one-release compatibility glob was '
+       + 'dropped in R05 (task 1003006) along with the /governance/* route aliases. '
+       + 'Protection did not lapse at any point: the new glob was registered BEFORE '
+       + 'the folder moved (task 1003003), so both were listed across the window.',
   },
 ];
 
 // The list the registry must produce TODAY: the pre-R101 set with each
 // documented addition spliced in at its declared position.
 const EXPECTED_GLOBS = (() => {
-  const out = [...EXPECTED_GLOBS_BEFORE_R101];
+  let out = [...EXPECTED_GLOBS_BEFORE_R101];
+  for (const r of RENAMED_SINCE_R101) {
+    const at = out.indexOf(r.from);
+    assert.notEqual(at, -1, `RENAMED_SINCE_R101 renames '${r.from}', which is not in the list`);
+    out[at] = r.to;
+  }
   for (const a of ADDED_SINCE_R101) {
     const at = out.indexOf(a.after);
     assert.notEqual(at, -1, `ADDED_SINCE_R101 anchors on '${a.after}', which is not in the list`);
@@ -119,15 +131,28 @@ const EXPECTED_GLOBS = (() => {
 // ---------- behavior identity: the same globs, at the same floor ----------
 
 test('nothing protected before R101 has been unprotected since', () => {
-  // The load-bearing half. Additions are ordinary policy; a REMOVAL silently
-  // unprotects a trust surface, so it is asserted separately and must never be
-  // satisfied by editing the pre-R101 array.
+  // The load-bearing half. A surface may be RENAMED (protection moves with it)
+  // but never simply dropped. Renames must be declared, and the declared
+  // replacement must actually be present — otherwise "it was renamed" becomes a
+  // way to unprotect a trust surface with a comment.
+  const renamedFrom = new Map(RENAMED_SINCE_R101.map((r) => [r.from, r.to]));
   for (const glob of EXPECTED_GLOBS_BEFORE_R101) {
-    assert.ok(
-      registry.PROTECTED_GLOBS.includes(glob),
+    if (registry.PROTECTED_GLOBS.includes(glob)) continue;
+    const to = renamedFrom.get(glob);
+    assert.ok(to,
       `'${glob}' was protected before R101 and is no longer in the registry — `
-      + 'a protected surface cannot be dropped without an ADR saying why.',
-    );
+      + 'a protected surface cannot be dropped without an ADR saying why. If it '
+      + 'was renamed, declare it in RENAMED_SINCE_R101.');
+    assert.ok(registry.PROTECTED_GLOBS.includes(to),
+      `'${glob}' is declared as renamed to '${to}', but '${to}' is not in the `
+      + 'registry — the protection went nowhere.');
+  }
+});
+
+test('every rename since R101 carries a documented reason', () => {
+  for (const r of RENAMED_SINCE_R101) {
+    assert.ok(r.why && r.why.length > 40,
+      `${r.from} -> ${r.to} must record WHY the surface moved.`);
   }
 });
 

package/tests/governance_require_permission.mjs

@@ -63,12 +63,12 @@ test('a builder holding the permission passes the gate', async () => {
 
 test('a missing grant 403s with permission_forbidden and explains the denial', async () => {
   const { res, nexted } = await run(
-    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+    auth.requirePermission('government.manage'), { builder: BUILDER }, holding('idea.triage'),
   );
   assert.equal(nexted, false, 'next() must NOT be called');
   assert.equal(res._status, 403);
   assert.equal(res._json.error.code, 'permission_forbidden');
-  assert.deepEqual(res._json.error.details.required, ['governance.manage']);
+  assert.deepEqual(res._json.error.details.required, ['government.manage']);
   assert.deepEqual(res._json.error.details.held, [], 'holds none of the required perms');
 });
 
@@ -107,11 +107,11 @@ test('the denial names the floor rank, not just the atom (task 1002613, map P-1)
 
 test('a port without permissionFloor still denies with a message; floors is null', async () => {
   const { res } = await run(
-    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+    auth.requirePermission('government.manage'), { builder: BUILDER }, holding('idea.triage'),
   );
   assert.equal(res._status, 403);
   assert.equal(res._json.error.details.floors, null);
-  assert.ok(res._json.error.message.includes('governance.manage'),
+  assert.ok(res._json.error.message.includes('government.manage'),
     'the message names the missing atom even when no floor is resolvable');
 });
 
@@ -264,7 +264,7 @@ test('over the four seeded ranks, requirePermission admits exactly who requireRa
     'security.report.file',
   ];
   const cases = [
-    ['governance.manage', ['archon']],
+    ['government.manage', ['archon']],
     ['task.claim.any', ['thetes', 'metic', 'archon']],
     ['cost.log', ['xenos', 'thetes', 'metic', 'archon']],
     // The CORE route gates migrated in BV1.R104, each paired with the requireRank

package/tests/governance_resolver.mjs

@@ -74,11 +74,11 @@ test('the resolver holds no cache — authority is read fresh per request (ADR 0
 });
 
 test('the kernel port exposes the resolver without core importing the module', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
   assert.equal(typeof governancePort.resolveBuilderPermissions, 'function');
   assert.equal(typeof governancePort.builderHasPermissions, 'function');
   assert.equal(typeof governancePort.isSystem, 'function');
   const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
   assert.ok(manifest.provides.includes('government'), 'module.json must declare the government port');
-  assert.ok(manifest.contributes.routes.includes('governance'), 'the port registers from the route factory');
+  assert.ok(manifest.contributes.routes.includes('government'), 'the port registers from the route factory');
 });

package/tests/governance_role_sync.mjs

@@ -26,16 +26,16 @@ const { planRankSync, isSeededRank } = require(path.join(GOV, 'ranks.js'));
 
 // The seeded rank-roles exactly as governance_002 writes them.
 const SEEDED = [
-  { role_key: 'xenos', seeded_rank: 'xenos', is_system: true },
-  { role_key: 'thetes', seeded_rank: 'thetes', is_system: true },
-  { role_key: 'metic', seeded_rank: 'metic', is_system: true },
-  { role_key: 'archon', seeded_rank: 'archon', is_system: true },
+  { rank_key: 'xenos', seeded_rank: 'xenos', is_system: true },
+  { rank_key: 'thetes', seeded_rank: 'thetes', is_system: true },
+  { rank_key: 'metic', seeded_rank: 'metic', is_system: true },
+  { rank_key: 'archon', seeded_rank: 'archon', is_system: true },
 ];
-const seededRole = (rank) => ({ role_key: rank, seeded_rank: rank, is_system: true });
+const seededRank_ = (rank) => ({ rank_key: rank, seeded_rank: rank, is_system: true });
 // An Archon-authored custom role from the R110 tab: no seeded_rank, not a system role.
-const customRole = (key) => ({ role_key: key, seeded_rank: null, is_system: false });
+const customRank = (key) => ({ rank_key: key, seeded_rank: null, is_system: false });
 
-const plan = (rank, currentRoles) => planRankSync({ rank, currentRoles, seededRoles: SEEDED });
+const plan = (rank, currentRanks) => planRankSync({ rank, currentRanks, seededRanks: SEEDED });
 
 // ---------------------------------------------------------------------------
 // registration — a builder with no roles gets the one matching their rank
@@ -60,7 +60,7 @@ test('registration: the firstAdmin bootstrap (seated straight to archon) assigns
 // ---------------------------------------------------------------------------
 
 test('promotion xenos→thetes: the new role is added and the old one removed', () => {
-  const p = plan('thetes', [seededRole('xenos')]);
+  const p = plan('thetes', [seededRank_('xenos')]);
   assert.equal(p.target, 'thetes');
   assert.deepEqual([...p.add], ['thetes']);
   assert.deepEqual([...p.remove], ['xenos'], 'the superseded rank-role must be removed');
@@ -69,8 +69,8 @@ test('promotion xenos→thetes: the new role is added and the old one removed',
 
 test('promotion via the auto-graduation path leaves exactly one seeded role', () => {
   // maybeAutoGraduateToThetes runs the same _applyRankChangeTx, so the same plan.
-  const p = plan('thetes', [seededRole('xenos')]);
-  const seededHeld = p.next.filter((k) => SEEDED.some((s) => s.role_key === k));
+  const p = plan('thetes', [seededRank_('xenos')]);
+  const seededHeld = p.next.filter((k) => SEEDED.some((s) => s.rank_key === k));
   assert.equal(seededHeld.length, 1);
 });
 
@@ -79,7 +79,7 @@ test('promotion via the auto-graduation path leaves exactly one seeded role', ()
 // ---------------------------------------------------------------------------
 
 test('demotion archon→metic REMOVES the archon role (not merely adds metic)', () => {
-  const p = plan('metic', [seededRole('archon')]);
+  const p = plan('metic', [seededRank_('archon')]);
   assert.deepEqual([...p.remove], ['archon'], 'the higher rank-role must be REMOVED on demotion');
   assert.deepEqual([...p.add], ['metic']);
   // The absence assertion is the one that matters: an additive-only sync would
@@ -89,7 +89,7 @@ test('demotion archon→metic REMOVES the archon role (not merely adds metic)',
 });
 
 test('demotion archon→xenos (a multi-rung drop) removes archon just the same', () => {
-  const p = plan('xenos', [seededRole('archon')]);
+  const p = plan('xenos', [seededRank_('archon')]);
   assert.ok(p.remove.includes('archon'));
   assert.ok(!p.next.includes('archon'));
   assert.deepEqual([...p.next], ['xenos']);
@@ -98,7 +98,7 @@ test('demotion archon→xenos (a multi-rung drop) removes archon just the same',
 test('a builder holding several stale seeded roles is reduced to exactly one', () => {
   // Defence in depth: if drift ever left two seeded roles on one builder, the sync
   // must not pick one and leave the other — every non-matching seeded role goes.
-  const p = plan('thetes', [seededRole('archon'), seededRole('metic'), seededRole('xenos')]);
+  const p = plan('thetes', [seededRank_('archon'), seededRank_('metic'), seededRank_('xenos')]);
   assert.deepEqual([...p.remove].sort(), ['archon', 'metic', 'xenos']);
   assert.deepEqual([...p.next], ['thetes']);
 });
@@ -108,16 +108,16 @@ test('a builder holding several stale seeded roles is reduced to exactly one', (
 // ---------------------------------------------------------------------------
 
 test('an Archon-assigned custom role survives a rank change', () => {
-  const p = plan('metic', [seededRole('archon'), customRole('release-manager')]);
+  const p = plan('metic', [seededRank_('archon'), customRank('release-manager')]);
   assert.deepEqual([...p.remove], ['archon'], 'only the seeded rank-role rotates');
   assert.ok(!p.remove.includes('release-manager'), 'a custom role must never be revoked by a rank change');
   assert.deepEqual([...p.next], ['metic', 'release-manager']);
 });
 
 test('a custom role is not mistaken for the rank-role even when its key matches a rank name', () => {
-  // role_key is UNIQUE so this cannot happen today, but the predicate must key on
+  // rank_key is UNIQUE so this cannot happen today, but the predicate must key on
   // is_system + seeded_rank rather than on the key's spelling.
-  const impostor = { role_key: 'archon', seeded_rank: null, is_system: false };
+  const impostor = { rank_key: 'archon', seeded_rank: null, is_system: false };
   assert.equal(isSeededRank(impostor), false);
   const p = plan('metic', [impostor]);
   assert.deepEqual([...p.remove], [], 'a non-system role is never rotated away');
@@ -127,7 +127,7 @@ test('a builder on a non-seeded legacy rank resolves to zero seeded roles', () =
   // migration 023's CHECK still admits twelve reserved ranks. governance_002's INNER
   // JOIN gives them no row BY DESIGN (ADR 0151's fail-closed divergence) — preserve
   // it, and strip any seeded role they were carrying.
-  const p = plan('hippeis', [seededRole('archon')]);
+  const p = plan('hippeis', [seededRank_('archon')]);
   assert.equal(p.target, null, 'no seeded role exists for a legacy rank — invent none');
   assert.deepEqual([...p.add], []);
   assert.deepEqual([...p.remove], ['archon'], 'a legacy rank must not retain a seeded rank-role');
@@ -135,7 +135,7 @@ test('a builder on a non-seeded legacy rank resolves to zero seeded roles', () =
 });
 
 test('a legacy-rank builder still keeps their custom roles', () => {
-  const p = plan('hippeis', [seededRole('metic'), customRole('release-manager')]);
+  const p = plan('hippeis', [seededRank_('metic'), customRank('release-manager')]);
   assert.deepEqual([...p.next], ['release-manager']);
 });
 
@@ -144,23 +144,23 @@ test('a legacy-rank builder still keeps their custom roles', () => {
 // ---------------------------------------------------------------------------
 
 test('the sync is idempotent — running it twice changes nothing the second time', () => {
-  const first = plan('metic', [seededRole('archon')]);
+  const first = plan('metic', [seededRank_('archon')]);
   assert.ok(first.add.length + first.remove.length > 0, 'the first run must do work');
-  const after = first.next.map((key) => (SEEDED.find((s) => s.role_key === key) || customRole(key)));
-  const second = planRankSync({ rank: 'metic', currentRoles: after, seededRoles: SEEDED });
+  const after = first.next.map((key) => (SEEDED.find((s) => s.rank_key === key) || customRank(key)));
+  const second = planRankSync({ rank: 'metic', currentRanks: after, seededRanks: SEEDED });
   assert.deepEqual([...second.add], []);
   assert.deepEqual([...second.remove], []);
   assert.deepEqual([...second.next], [...first.next]);
 });
 
 test('a builder already holding the right role produces no write at all', () => {
-  const p = plan('metic', [seededRole('metic'), customRole('release-manager')]);
+  const p = plan('metic', [seededRank_('metic'), customRank('release-manager')]);
   assert.deepEqual([...p.add], []);
   assert.deepEqual([...p.remove], []);
 });
 
 test('the plan is frozen — a caller cannot widen it after the decision', () => {
-  const p = plan('metic', [seededRole('archon')]);
+  const p = plan('metic', [seededRank_('archon')]);
   assert.ok(Object.isFrozen(p) && Object.isFrozen(p.add) && Object.isFrozen(p.remove));
   assert.throws(() => p.add.push('archon'), TypeError);
 });