@bongos/core 1.19.185 → 1.19.187

package/scripts/gds/fitness.js

@@ -1640,6 +1640,141 @@ function checkWriteRoutesValidated() {
 
 // ---- runner ----------------------------------------------------------------
 
+
+// ── Check 19 — the ADR 0174 vocabulary wall (goal 1000068 R07, task 1003008) ──
+//
+// "Role" means ONE thing in this codebase: a craft — Artist, Ideator, or Builder.
+// The permission system is the GOVERNMENT and the positions in it are RANKS.
+// Before ADR 0174 the same word named both, and goal 1000066 was about to claim
+// it for the crafts while modules/governance/ still used it for the ladder. This
+// check is what stops that collision reforming the first time someone copies an
+// old file.
+//
+// TWO RULES, both scoped to the GOVERNMENT SURFACE — not the whole repo. A repo-
+// wide ban would be wrong: `builders.system_role` is a core column for machine
+// identities, Discord's API owns its own "role" noun, and the crafts are supposed
+// to use the word.
+//
+//   1. no "role" under modules/government/ or on the Government hall page
+//   2. no "governance" there either — the old name of the same surface
+//
+// EXCLUDED BY CONSTRUCTION (not by allowlist):
+//   • modules/government/migrations/governance_*.sql — the already-applied
+//     migrations keep their filenames forever (schema_migrations is stem-keyed;
+//     renaming one re-runs it, and governance_002 is a seed/backfill). Their
+//     bodies necessarily name the pre-rename tables they created.
+//   • docs/adr/, docs/session-logs/, docs/governance/ — the historical record.
+//     An ADR describes a decision at a point in time; rewriting it to match
+//     today's vocabulary would erase the evidence that the words changed.
+//
+// The ALLOWLIST below is deliberately tiny and each entry carries its reason. A
+// rule that passes because everything is suppressed reads as evidence while
+// proving nothing — if this list grows, that is the signal to finish the rename,
+// not to add a line.
+const VOCAB_ALLOW = [
+  {
+    file: 'modules/government/config.js',
+    match: 'roles',
+    why: 'the legacy INSTANCE-config key fallback. The core ships `ranks`, but an '
+       + 'external self-hosted instance may still have a config/government.json '
+       + 'authored as `roles`; reading it is what stops their templates vanishing '
+       + 'on upgrade. Removing this line would break them silently.',
+  },
+  {
+    file: 'modules/government/config.js',
+    match: 'governance_role_labels',
+    why: 'the legacy ENV-VAR fallback. <PREFIX>_GOVERNMENT_RANK_LABELS is the current '
+       + 'name, but an operator sets this in their own shell or env file, outside this '
+       + 'repo, so the old spelling is still read. Dropping it would silently stop '
+       + 'honouring a label override someone already configured.',
+  },
+  {
+    file: 'modules/government/routes/government.js',
+    match: '/governance',
+    why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
+       + 'compatibility shim has to name the thing it is compatible with. Note the '
+       + 'match requires the leading SLASH — this permits citing the legacy PATH, not '
+       + 'the bare word. Delete with the alias block one release after the rename ships.',
+  },
+  {
+    file: 'modules/government/module.json',
+    match: 'role',
+    why: 'the manifest states the rule itself — "The word `role` is deliberately '
+       + 'absent here". Meta-commentary about the ban has to be able to name it.',
+  },
+];
+
+// A line CITING a historical artifact by its real name: an ADR filename, the
+// docs/governance/ evidence folder, or one of the already-applied
+// governance_NNN migrations. These names are permanent (see the header), so a
+// reference to one is a citation, not drift.
+const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|governance_0\d\d/;
+
+const VOCAB_SURFACE = [
+  'modules/government',
+  'modules/hall-ui/public/government.js',
+  'modules/hall-ui/public/government.html',
+  'modules/hall-ui/public/government.css',
+];
+const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
+const VOCAB_BANNED = [
+  { re: /\brole/i,       label: 'role',       hint: '"role" is reserved for the crafts (Artist / Ideator / Builder). On this surface the noun is RANK.' },
+  { re: /governance/i,    label: 'governance', hint: 'the pre-ADR-0174 name of this surface. It is the GOVERNMENT now.' },
+];
+
+function vocabFilesToScan() {
+  const out = [];
+  const walk = (abs, rel) => {
+    let st;
+    try { st = fs.statSync(abs); } catch { return; }
+    if (st.isDirectory()) {
+      // the historical migrations keep their names + bodies (see header)
+      if (rel.endsWith('/migrations')) return;
+      for (const e of fs.readdirSync(abs)) walk(path.join(abs, e), `${rel}/${e}`);
+      return;
+    }
+    if (VOCAB_EXTS.has(path.extname(abs))) out.push({ abs, rel });
+  };
+  for (const s of VOCAB_SURFACE) walk(path.join(CORE_ROOT, s), s);
+  return out;
+}
+
+function checkVocabularyWall() {
+  const violations = [];
+  let scanned = 0;
+  for (const { abs, rel } of vocabFilesToScan()) {
+    scanned += 1;
+    const lines = fs.readFileSync(abs, 'utf8').split('\n');
+    lines.forEach((line, i) => {
+      // `role="…"` is HTML's own ARIA attribute — a different word that happens to
+      // be spelled the same. Strip attributes before matching rather than
+      // allowlisting each occurrence: this is a property of HTML, not of any one file.
+      const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
+      for (const b of VOCAB_BANNED) {
+        if (!b.re.test(scanLine)) continue;
+        // A REFERENCE to a historical artifact by its real name is not a
+        // vocabulary violation — it is a citation. The artifacts themselves are
+        // excluded by construction (see the header); naming one has to be legal
+        // too, or the code could not point at the migration that created its own
+        // tables. Same principle, applied to the line rather than the file.
+        if (VOCAB_HISTORICAL_REF.test(scanLine)) continue;
+        const excused = VOCAB_ALLOW.some((a) => a.file === rel && scanLine.toLowerCase().includes(a.match));
+        if (excused) continue;
+        violations.push(`${rel}:${i + 1}: "${b.label}" — ${b.hint}  →  ${line.trim().slice(0, 90)}`);
+      }
+    });
+  }
+  return {
+    name: 'the word "role" means a craft, never a rank (ADR 0174)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} government-surface file(s) scanned for "role"/"governance"; `
+        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies). Historical migrations + docs/adr are excluded by construction, not suppressed.`,
+  };
+}
+
 const CHECKS = [
   checkCoreHostBoundary,
   checkClaudeMdBudget,
@@ -1661,6 +1796,7 @@ const CHECKS = [
   checkCoreRequiresExcludedConfig, // task 1824 — core→instance-config require guard
   checkCoreRequiresExcludedModule, // Check 16b — task 2135: core→excluded-module require guard (R89 split)
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
+  checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
 ];
 
@@ -1690,6 +1826,8 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
+  checkVocabularyWall,
+  VOCAB_ALLOW,
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/scripts/hall-preview/server.js

@@ -44,7 +44,7 @@ const EMPTY = process.argv.includes('--empty');
 // --rank: view the hall as a different rank — the /me fixture's builder.rank is
 // overridden in the response, so the Archon-gated pages (watch, harbor, gate)
 // render their real content instead of the sealed notice. Preview-only theatre:
-// the real pages are server-gated (requireGovernancePage / ADR 0016).
+// the real pages are server-gated (requireGovernmentPage / ADR 0016).
 const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
 // --modules-on: force-report modules as enabled — a dev box's local config

package/src/bongos/auth.js

@@ -1191,7 +1191,7 @@ async function resolveSession(req) {
 // inside the session's scope at all". That projection is deliberately the ROLE-FREE
 // half — folding the builder's roles in here would change who can reach the
 // bootstrap routes (a builder on a rank with no seeded governance role resolves to
-// zero permissions by design — see tests/governance_parity.mjs Part D), and R99 is
+// zero permissions by design — see tests/government_parity.mjs Part D), and R99 is
 // a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
 //
 // GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
@@ -1437,12 +1437,12 @@ function signInWithReturn(req) {
 // ranks (catalog.RANK_ORDER):
 //   requireBuilderPage     was "any session"      floor xenos  → page.view.public
 //   requireNonXenosPage    was rank !== 'xenos'   floor thetes → page.view.builder
-//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.government
+//   requireGovernmentPage  was rank === 'archon'  floor archon → page.view.government
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
 // page.view.government's floor archon→metic and the name stopped being true; the
 // floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
-// (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
+// (tests/government_parity.mjs Part D): a builder on a reserved/divine rank holds
 // no seeded role, so they now fail a page gate a bare rank test would have
 // admitted. That is a TIGHTENING, never a widening.
 //
@@ -1456,8 +1456,8 @@ function signInWithReturn(req) {
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
-  requireGovernancePage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
-  requireGovernanceManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
+  requireGovernmentPage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
+  requireGovernmentManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
   requireProjectCuratePage: Object.freeze({ permission: 'project.curate', deniedTo: '/builders' }),
 });
 
@@ -1540,8 +1540,8 @@ async function requireBuilderPage(req, res, next) {
 // every data endpoint these pages call is independently gated server-side, so no
 // cross-builder data leaks even if this gate were bypassed; it keeps a builder
 // without the permission from ever seeing the page shell.
-async function requireGovernancePage(req, res, next) {
-  return runPageGate('requireGovernancePage', req, res, next);
+async function requireGovernmentPage(req, res, next) {
+  return runPageGate('requireGovernmentPage', req, res, next);
 }
 
 // The /governance roles-and-permissions tab (BV1.R113) — gated on the
@@ -1549,8 +1549,8 @@ async function requireGovernancePage(req, res, next) {
 // /governance/* data route checks, so the page layer can never drift wider than
 // the API it fronts. Defense-in-depth as above: the data endpoints are all
 // independently gated; this keeps the tab shell from rendering for anyone else.
-async function requireGovernanceManagePage(req, res, next) {
-  return runPageGate('requireGovernanceManagePage', req, res, next);
+async function requireGovernmentManagePage(req, res, next) {
+  return runPageGate('requireGovernmentManagePage', req, res, next);
 }
 
 // The /people builder-directory page (task 1002577) — gated on the
@@ -1827,8 +1827,8 @@ module.exports = {
   SESSION_SCOPES,
   requireBuilder,
   requireBuilderPage,
-  requireGovernancePage,
-  requireGovernanceManagePage,
+  requireGovernmentPage,
+  requireGovernmentManagePage,
   requireNonXenosPage,
   requireProjectCuratePage,
   requireRank,

package/src/bongos/serve-internal.js

@@ -751,7 +751,7 @@ function mountInternalSurfaces(app) {
   // The /watch monitoring page and the /harbor dev-box management page (idea 257)
   // and the /gate page (task 1179) all sit behind `page.view.government` — Metic
   // and up since ADR 0157. Same server-side page gate, same posture: a builder
-  // without the permission never receives the shell (requireGovernancePage — named
+  // without the permission never receives the shell (requireGovernmentPage — named
   // requireArchonPage before ADR 0157 — redirects them to the hall, and an
   // unauthenticated visitor into sign-in). The subdomain shim above has already
   // rewritten the bare /watch + /harbor + /gate onto /builders/*. (Defense in
@@ -766,13 +766,13 @@ function mountInternalSurfaces(app) {
   // data never leaked (the route gate held), but the page was the one item in the
   // group without a wall. Gated here so the group is uniform (task 1002710).
   const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
-  // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
+  // The /government ranks-and-permissions tab (BV1.R113) sits one floor higher:
   // the `government.manage` atom itself (archon), the same key its data routes
-  // check — requireGovernanceManagePage, not the metic-floored gate above.
-  const GOVERNANCE_PAGE_RE = /^\/builders\/governance(?:\.html)?\/?$/;
+  // check — requireGovernmentManagePage, not the metic-floored gate above.
+  const GOVERNMENT_PAGE_RE = /^\/builders\/government(?:\.html)?\/?$/;
   // The /people builder directory (task 1002577): gated on `project.curate`, the
   // exact permission its data route (GET /scouting) checks — same posture as the
-  // /governance tab above (the page can never drift wider than the API it fronts).
+  // /government tab above (the page can never drift wider than the API it fronts).
   const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
   // /scouting is the LEGACY twin of /people — the same /api/gds/scouting directory,
   // left behind when task 1002577 graduated it into the hall. It has no nav entry
@@ -787,10 +787,10 @@ function mountInternalSurfaces(app) {
     const norm = path.posix.normalize(req.path);
     if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
       || SESSIONS_PAGE_RE.test(norm)) {
-      return gdsAuth.requireGovernancePage(req, res, next);
+      return gdsAuth.requireGovernmentPage(req, res, next);
     }
-    if (GOVERNANCE_PAGE_RE.test(norm)) {
-      return gdsAuth.requireGovernanceManagePage(req, res, next);
+    if (GOVERNMENT_PAGE_RE.test(norm)) {
+      return gdsAuth.requireGovernmentManagePage(req, res, next);
     }
     if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);

package/src/module-api.js

@@ -797,8 +797,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.183 with no explicit bump. run 31974847472. (task 1002620)
 //   1.19.185 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.184 with no explicit bump. run 31976564067. (task 1002620)
+//   1.19.186 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.185 with no explicit bump. run 31977207459. (task 1002620)
+//   1.19.187 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.186 with no explicit bump. run 31978548058. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.185'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.187'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -31,8 +31,8 @@ const auth = require('../src/bongos/auth.js');
 
 // BV1.R107: the page gate now also resolves a permission (page.view.public) through
 // the `governance` kernel port, so an authenticated request needs the port stubbed —
-// exactly as tests/governance_require_permission.mjs stubs it for requirePermission.
-// The audience is unchanged; tests/governance_page_gates.mjs is the parity proof.
+// exactly as tests/government_require_permission.mjs stubs it for requirePermission.
+// The audience is unchanged; tests/government_page_gates.mjs is the parity proof.
 const seams = require('../src/module-seams.js');
 const catalog = require('../modules/government/catalog.js');
 seams._reset();

package/tests/auth_resolve_failure.mjs

@@ -93,17 +93,17 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   // rot: a NEW bare `async function require*` added later fails this test.
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
   //   requireBuilderPage         \
-  //   requireGovernancePage       \
-  //   requireGovernanceManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
+  //   requireGovernmentPage       \
+  //   requireGovernmentManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
   //   requireNonXenosPage         /  (the R113 roles-tab gate; the /people curate gate)
   //   requireProjectCuratePage   /
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernanceManagePage', 'requireGovernancePage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernancePage', 'requireGovernanceManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/{governance_abuse_matrix.mjs → government_abuse_matrix.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_abuse_matrix.mjs — the abuse matrix (BV1.R112, ADR 0151).
+// tests/government_abuse_matrix.mjs — the abuse matrix (BV1.R112, ADR 0151).
 //
 // Mechanically proves the safety guarantee the governance module asserts in
 // prose: NO configuration surface can grant a `system: true` (trust-boundary)
@@ -32,10 +32,10 @@
 //     V12 seed integrity: no rank-role below archon holds a system key; no
 //         rank-role at all holds a principal key
 //
-// DB-free (the governance_routes.mjs pattern): real router + real
+// DB-free (the government_routes.mjs pattern): real router + real
 // requirePermission over a stub `governance` port, db sibling monkeypatched.
 //
-// Run:  node tests/governance_abuse_matrix.mjs
+// Run:  node tests/government_abuse_matrix.mjs
 
 import { strict as assert } from 'node:assert';
 import { test, after } from 'node:test';
@@ -108,16 +108,16 @@ test('every system permission floors at archon or is a principal (never seeded l
 
 const calls = [];
 const stub = {
-  getRoleByKey: async (k) => (SEEDED_ROLES.includes(k)
+  getRankByKey: async (k) => (SEEDED_ROLES.includes(k)
     ? { rank_key: k, label: k, is_system: true, seeded_rank: k }
     : { rank_key: k, label: k, is_system: false, seeded_rank: null }),
-  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
-  grantRolePermission: async () => true,
-  revokeRolePermission: async () => true,
-  resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
-  assignRole: async () => true,
-  unassignRole: async () => true,
-  listRolesWithGrants: async () => [],
+  createRank: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+  grantRankPermission: async () => true,
+  revokeRankPermission: async () => true,
+  resetRankGrants: async ({ permissionKeys }) => permissionKeys.length,
+  assignRank: async () => true,
+  unassignRank: async () => true,
+  listRanksWithGrants: async () => [],
   listAssignments: async () => [],
 };
 const REAL = {};
@@ -138,11 +138,11 @@ function grant(keys) {
 }
 grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
+const buildGovernmentRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-app.use(buildGovernanceRouter());
+app.use(buildGovernmentRouter());
 const server = http.createServer(app);
 await new Promise((r) => server.listen(0, '127.0.0.1', r));
 const BASE = `http://127.0.0.1:${server.address().port}`;
@@ -171,7 +171,7 @@ test('V1: EVERY system permission is refused onto a custom role, before the db',
     const r = await call('PUT', `/government/ranks/custom-role/permissions/${k}`);
     assert.equal(r.status, 400, `${k} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable', k);
-    assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
+    assert.equal(calls.filter(([c]) => c === 'grantRankPermission').length, 0,
       `${k}: the refusal must land BEFORE any db write`);
   }
 });
@@ -188,13 +188,13 @@ test('V2a: the ARCHON rank-role refuses EVERY write — grant, revoke and reset
       const r = await call(method, `/government/ranks/archon/permissions/${k}`);
       assert.equal(r.status, 403, `archon ← ${method} ${k} must be refused`);
       assert.equal(r.json.error.code, 'archon_rank_immutable', `archon ← ${method} ${k}`);
-      assert.equal(calls.filter(([c]) => c === 'grantRolePermission' || c === 'revokeRolePermission').length, 0);
+      assert.equal(calls.filter(([c]) => c === 'grantRankPermission' || c === 'revokeRankPermission').length, 0);
     }
   }
   const r = await call('POST', '/government/ranks/archon/reset');
   assert.equal(r.status, 403, 'reset must not be a back door into the archon role');
   assert.equal(r.json.error.code, 'archon_rank_immutable');
-  assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
+  assert.equal(calls.filter(([c]) => c === 'resetRankGrants').length, 0);
 });
 
 test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL key', async () => {
@@ -204,7 +204,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
       const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 400, `${role} ← ${k} must be refused`);
       assert.equal(r.json.error.code, 'permission_not_grantable', `${role} ← ${k}`);
-      assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
+      assert.equal(calls.filter(([c]) => c === 'grantRankPermission').length, 0,
         `${role} ← ${k}: the refusal must land BEFORE any db write`);
     }
   }
@@ -215,7 +215,7 @@ test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 l
     for (const k of [...OWNER_POWERS, 'idea.triage']) {
       const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 200, `${role} ← ${k} must be ACCEPTED — this delegation is the owner's decision (ADR 0172)`);
-      assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 1, `${role} ← ${k} must reach the db`);
+      assert.equal(calls.filter(([c]) => c === 'grantRankPermission').length, 1, `${role} ← ${k} must reach the db`);
     }
   }
 });
@@ -224,7 +224,7 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
     const r = await call('POST', `/government/ranks/${role}/reset`);
     assert.equal(r.status, 200, `${role} must be resettable`);
-    const [, args] = calls.find(([c]) => c === 'resetRoleGrants');
+    const [, args] = calls.find(([c]) => c === 'resetRankGrants');
     assert.deepEqual([...args.permissionKeys].sort(), [...catalog.seedForRank(role)].sort(),
       `${role} reset must write exactly the floor-derived seed`);
     for (const k of args.permissionKeys) {
@@ -236,7 +236,7 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   const r = await call('POST', '/government/ranks/custom-role/reset');
   assert.equal(r.status, 400);
   assert.equal(r.json.error.code, 'rank_has_no_default');
-  assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
+  assert.equal(calls.filter(([c]) => c === 'resetRankGrants').length, 0);
 });
 
 test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer — R95b)', async () => {
@@ -244,7 +244,7 @@ test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer —
     const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: role });
     assert.equal(r.status, 403, `assigning seeded role ${role} must be refused`);
     assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden', role);
-    assert.equal(calls.filter(([c]) => c === 'assignRole').length, 0);
+    assert.equal(calls.filter(([c]) => c === 'assignRank').length, 0);
   }
 });
 
@@ -264,13 +264,13 @@ test('V4: mass-assignment on role create is refused outright (strict schema)', a
 test('V4: a clean role create is never system and carries no grants', async () => {
   const r = await call('POST', '/government/ranks', { rank_key: 'sneaky-role', label: 'Sneaky' });
   assert.equal(r.status, 201);
-  assert.equal(r.json.role.is_system, false, 'a created role is never system');
-  assert.equal(r.json.role.seeded_rank, null);
-  assert.deepEqual(r.json.role.permissions, [], 'creation carries no grants');
-  const c = calls.find(([k]) => k === 'createRole');
+  assert.equal(r.json.rank.is_system, false, 'a created role is never system');
+  assert.equal(r.json.rank.seeded_rank, null);
+  assert.deepEqual(r.json.rank.permissions, [], 'creation carries no grants');
+  const c = calls.find(([k]) => k === 'createRank');
   assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'rankKey'],
     'nothing beyond the four whitelisted fields reaches the db');
-  assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
+  assert.equal(calls.filter(([k]) => k === 'grantRankPermission').length, 0);
 });
 
 test('V5: a caller without government.manage cannot reach ANY write vector at all', async () => {
@@ -295,35 +295,35 @@ test('V5: a caller without government.manage cannot reach ANY write vector at al
 // ===========================================================================
 
 test('V6: a config template proposing EVERY system key resolves with all of them stripped', () => {
-  const resolved = govConfig.resolveGovernanceConfig({
-    instance: { roles: { 'evil-template': { label: 'Evil', permissions: [...SYSTEM_KEYS, 'no.such.key', 'idea.triage'] } } },
+  const resolved = govConfig.resolveGovernmentConfig({
+    instance: { ranks: { 'evil-template': { label: 'Evil', permissions: [...SYSTEM_KEYS, 'no.such.key', 'idea.triage'] } } },
     env: {},
   });
-  const evil = resolved.roles['evil-template'];
+  const evil = resolved.ranks['evil-template'];
   assert.deepEqual([...evil.permissions], ['idea.triage'],
     'only the operational key survives; every system + unknown key is stripped');
 });
 
 test('V6: a seeded rank-role template cannot re-grant — its permissions drop wholesale', () => {
-  const resolved = govConfig.resolveGovernanceConfig({
-    instance: { roles: { thetes: { label: 'Upgraded', permissions: ['idea.triage', ...SYSTEM_KEYS] } } },
+  const resolved = govConfig.resolveGovernmentConfig({
+    instance: { ranks: { thetes: { label: 'Upgraded', permissions: ['idea.triage', ...SYSTEM_KEYS] } } },
     env: {},
   });
-  assert.deepEqual([...resolved.roles.thetes.permissions], [],
+  assert.deepEqual([...resolved.ranks.thetes.permissions], [],
     'a seeded role takes NO permissions from config, operational ones included');
 });
 
 test('V6: the env layer relabels only — it cannot add a permission or a role', () => {
   // The role must exist in the merged config for the relabel to land (an env
   // var can only RELABEL a declared role) — mirror the neutral starter's shape.
-  const resolved = govConfig.resolveGovernanceConfig({
-    neutral: { roles: { metic: { label: 'Metic' } } },
+  const resolved = govConfig.resolveGovernmentConfig({
+    neutral: { ranks: { metic: { label: 'Metic' } } },
     instance: {},
     env: { OTB_GOVERNANCE_ROLE_LABELS: 'metic=Overlord,ghost-role=Ghost' },
   });
-  assert.equal(resolved.roles.metic.label, 'Overlord', 'relabeling works');
-  assert.equal(resolved.roles['ghost-role'], undefined, 'an env var cannot mint a role');
-  assert.deepEqual([...resolved.roles.metic.permissions], [],
+  assert.equal(resolved.ranks.metic.label, 'Overlord', 'relabeling works');
+  assert.equal(resolved.ranks['ghost-role'], undefined, 'an env var cannot mint a role');
+  assert.deepEqual([...resolved.ranks.metic.permissions], [],
     'the relabeled seeded role still takes no grants from config or env');
 });
 
@@ -438,7 +438,7 @@ test('V11: the substrate checker is structurally grant-blind (node builtins only
 
 test('V12: no rank-role below archon holds a system key; none holds a principal key', () => {
   for (const rank of SEEDED_ROLES) {
-    const seed = catalog.RANK_ROLE_SEED[rank];
+    const seed = catalog.RANK_SEED[rank];
     for (const k of seed) {
       assert.equal(catalog.isPrincipalKey(k), false, `${rank} seeds principal key ${k}`);
       if (rank !== 'archon') {
@@ -446,7 +446,7 @@ test('V12: no rank-role below archon holds a system key; none holds a principal
       }
     }
   }
-  const archonSystem = catalog.RANK_ROLE_SEED.archon.filter((k) => catalog.isSystem(k)).sort();
+  const archonSystem = catalog.RANK_SEED.archon.filter((k) => catalog.isSystem(k)).sort();
   const expected = SYSTEM_KEYS.filter((k) => catalog.byKey(k).floor === 'archon').sort();
   assert.deepEqual(archonSystem, expected,
     'archon holds exactly the archon-floored system keys — principals stay out of every rank-role');

package/tests/{governance_catalog.mjs → government_catalog.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_catalog.mjs — the permission catalog + compat seed (BV1.R94, ADR 0151).
+// tests/government_catalog.mjs — the permission catalog + compat seed (BV1.R94, ADR 0151).
 //
 // Guards the "zero day-one behavior change" promise structurally: the seed is
 // DERIVED from per-permission floors, so these invariants prove the derivation is
@@ -12,7 +12,7 @@ import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const cat = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
-const { PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
+const { PERMISSIONS, RANK_ORDER, RANK_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
 
 test('every permission is well-formed (key, boolean system, valid floor)', () => {
   assert.ok(PERMISSIONS.length >= 60, `expected a substantial catalog, saw ${PERMISSIONS.length}`);
@@ -98,17 +98,17 @@ test('isGrantableTo fails closed on every unrecognised input', () => {
 });
 
 test('the four rank-roles exist; seed keys all reference real permissions', () => {
-  assert.deepEqual(Object.keys(RANK_ROLE_SEED).sort(), [...RANK_ORDER].sort());
+  assert.deepEqual(Object.keys(RANK_SEED).sort(), [...RANK_ORDER].sort());
   const all = new Set(permissionKeys());
   for (const rank of RANK_ORDER) {
-    for (const k of RANK_ROLE_SEED[rank]) assert.ok(all.has(k), `seed[${rank}] references unknown ${k}`);
+    for (const k of RANK_SEED[rank]) assert.ok(all.has(k), `seed[${rank}] references unknown ${k}`);
   }
 });
 
 test('seed is cumulative: archon ⊇ metic ⊇ thetes ⊇ xenos (nested supersets)', () => {
   for (let i = 1; i < RANK_ORDER.length; i++) {
-    const lower = new Set(RANK_ROLE_SEED[RANK_ORDER[i - 1]]);
-    const higher = new Set(RANK_ROLE_SEED[RANK_ORDER[i]]);
+    const lower = new Set(RANK_SEED[RANK_ORDER[i - 1]]);
+    const higher = new Set(RANK_SEED[RANK_ORDER[i]]);
     for (const k of lower) assert.ok(higher.has(k), `${RANK_ORDER[i]} missing ${k} that ${RANK_ORDER[i - 1]} has`);
     assert.ok(higher.size > lower.size, `${RANK_ORDER[i]} should strictly extend ${RANK_ORDER[i - 1]}`);
   }
@@ -116,7 +116,7 @@ test('seed is cumulative: archon ⊇ metic ⊇ thetes ⊇ xenos (nested superset
 
 test('a role holds a permission iff its floor is a real rank at-or-below (derivation is faithful)', () => {
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_ROLE_SEED[rank]);
+    const held = new Set(RANK_SEED[rank]);
     const tier = RANK_ORDER.indexOf(rank);
     for (const p of PERMISSIONS) {
       const shouldHold = p.floor !== null && RANK_ORDER.indexOf(p.floor) <= tier;
@@ -127,12 +127,12 @@ test('a role holds a permission iff its floor is a real rank at-or-below (deriva
 
 test('system permissions are Archon-only in the seed (never in xenos/thetes/metic)', () => {
   for (const rank of ['xenos', 'thetes', 'metic']) {
-    for (const k of RANK_ROLE_SEED[rank]) {
+    for (const k of RANK_SEED[rank]) {
       assert.equal(isSystem(k), false, `${rank} seed must not hold system perm ${k}`);
     }
   }
   // and archon DOES hold the archon-floored system perms (that is how Archon gets its power)
-  const archon = new Set(RANK_ROLE_SEED.archon);
+  const archon = new Set(RANK_SEED.archon);
   assert.ok(archon.has('builder.rank.set'));
   assert.ok(archon.has('deploy.push_main'));
 });
@@ -142,14 +142,14 @@ test('machine principals are held by NO rank-role and are system + floor null',
     assert.equal(p.system, true, `${p.key} must be system`);
     assert.equal(p.floor, null, `${p.key} must have floor null (held by no rank-role)`);
     for (const rank of RANK_ORDER) {
-      assert.ok(!RANK_ROLE_SEED[rank].includes(p.key), `${rank} must not hold principal ${p.key}`);
+      assert.ok(!RANK_SEED[rank].includes(p.key), `${rank} must not hold principal ${p.key}`);
     }
   }
   assert.ok(PERMISSIONS.some((p) => p.key === 'principal.bfg'));
 });
 
 test('threshold spot-checks reproduce today\'s requireRank floors', () => {
-  const has = (rank, k) => RANK_ROLE_SEED[rank].includes(k);
+  const has = (rank, k) => RANK_SEED[rank].includes(k);
   // idea.triage: metic+ only (requireRank('metic','archon'))
   assert.equal(has('xenos', 'idea.triage'), false);
   assert.equal(has('thetes', 'idea.triage'), false);

package/tests/{governance_claim_eligibility.mjs → government_claim_eligibility.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_claim_eligibility.mjs — claim eligibility as PERMISSIONS
+// tests/government_claim_eligibility.mjs — claim eligibility as PERMISSIONS
 // (BV1.R106, ADR 0151).
 //
 // DB-free. The whole point of R106 is that the queue half of claim-time authority
@@ -23,7 +23,7 @@
 //          GENERAL_QUEUE_RANKS and knows nothing about catalog floors.
 //      The new side reads catalog.seedForRank. A check whose two sides both read
 //      catalog.floor would pass while proving nothing (the lesson tests/
-//      governance_parity.mjs writes down); neither oracle here does.
+//      government_parity.mjs writes down); neither oracle here does.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';