@bongos/core 1.19.185 → 1.19.187

package/tests/{governance_config.mjs → government_config.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_config.mjs — the governance config contract (BV1.R96, ADR 0151).
+// tests/government_config.mjs — the governance config contract (BV1.R96, ADR 0151).
 //
 // DB-free: exercises the PURE resolver (all inputs injected) plus the disk loader
 // against the real neutral starter. The invariants that matter here are trust-boundary
@@ -18,7 +18,7 @@ const GOV = path.join(ROOT, 'modules', 'government');
 const config = require(path.join(GOV, 'config.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
-const { resolveGovernanceConfig, loadGovernanceConfig, grantableOnly, NEUTRAL_PATH, INSTANCE_PATH } = config;
+const { resolveGovernmentConfig, loadGovernmentConfig, grantableOnly, NEUTRAL_PATH, INSTANCE_PATH } = config;
 
 const NEUTRAL = JSON.parse(fs.readFileSync(NEUTRAL_PATH, 'utf8'));
 // No env by default — every precedence test injects exactly the env it is asserting on.
@@ -27,73 +27,73 @@ const NO_ENV = {};
 // ── precedence: neutral -> instance -> env ──────────────────────────────────────
 
 test('neutral-only resolution yields sane defaults (the vanilla boot R102 proves)', () => {
-  const out = resolveGovernanceConfig({ neutral: NEUTRAL, env: NO_ENV });
-  assert.deepEqual(Object.keys(out.roles).sort(), [...catalog.RANK_ORDER].sort());
-  assert.equal(out.roles.metic.label, 'Metic');
-  assert.equal(out.roles.archon.seeded, true);
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: NO_ENV });
+  assert.deepEqual(Object.keys(out.ranks).sort(), [...catalog.RANK_ORDER].sort());
+  assert.equal(out.ranks.metic.label, 'Metic');
+  assert.equal(out.ranks.archon.seeded, true);
   for (const rank of catalog.RANK_ORDER) {
-    assert.ok(out.roles[rank].description, `${rank} template must carry a description`);
+    assert.ok(out.ranks[rank].description, `${rank} template must carry a description`);
   }
 });
 
 test('an empty config still resolves the four rank-roles to their canonical names', () => {
   // governance_002 seeds them unconditionally, so a missing/mangled config must fall
   // back rather than drop a role out of the set.
-  const out = resolveGovernanceConfig({ env: NO_ENV });
-  assert.deepEqual(Object.keys(out.roles).sort(), [...catalog.RANK_ORDER].sort());
-  assert.equal(out.roles.xenos.label, 'xenos');
+  const out = resolveGovernmentConfig({ env: NO_ENV });
+  assert.deepEqual(Object.keys(out.ranks).sort(), [...catalog.RANK_ORDER].sort());
+  assert.equal(out.ranks.xenos.label, 'xenos');
 });
 
 test('the instance file overrides the neutral starter, per role and per field', () => {
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { metic: { label: 'Trusted' } } },
+    instance: { ranks: { metic: { label: 'Trusted' } } },
     env: NO_ENV,
   });
-  assert.equal(out.roles.metic.label, 'Trusted');
+  assert.equal(out.ranks.metic.label, 'Trusted');
   // The untouched field survives the merge, and so do the other three roles.
-  assert.equal(out.roles.metic.description, NEUTRAL.roles.metic.description);
-  assert.equal(out.roles.archon.label, 'Archon');
+  assert.equal(out.ranks.metic.description, NEUTRAL.ranks.metic.description);
+  assert.equal(out.ranks.archon.label, 'Archon');
 });
 
 test('the instance file may add a custom role template the neutral starter has not', () => {
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { triager: { label: 'Triager', permissions: ['idea.triage', 'blocker.review'] } } },
+    instance: { ranks: { triager: { label: 'Triager', permissions: ['idea.triage', 'blocker.review'] } } },
     env: NO_ENV,
   });
-  assert.equal(out.roles.triager.seeded, false);
-  assert.deepEqual(out.roles.triager.permissions, ['blocker.review', 'idea.triage']);
+  assert.equal(out.ranks.triager.seeded, false);
+  assert.deepEqual(out.ranks.triager.permissions, ['blocker.review', 'idea.triage']);
 });
 
 test('an env override beats both the instance file and the neutral starter', () => {
   const env = { [`${envPrefix()}_GOVERNANCE_ROLE_LABELS`]: 'metic=Crew,archon=Captain' };
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { metic: { label: 'Trusted' } } },
+    instance: { ranks: { metic: { label: 'Trusted' } } },
     env,
   });
-  assert.equal(out.roles.metic.label, 'Crew');
-  assert.equal(out.roles.archon.label, 'Captain');
-  assert.equal(out.roles.xenos.label, 'Xenos', 'an unnamed role keeps its resolved label');
+  assert.equal(out.ranks.metic.label, 'Crew');
+  assert.equal(out.ranks.archon.label, 'Captain');
+  assert.equal(out.ranks.xenos.label, 'Xenos', 'an unnamed role keeps its resolved label');
 });
 
 test('the env layer can relabel a role but can never grant it a permission', () => {
   // The whole point of restricting env to labels: an env var must not widen authority.
   const env = { [`${envPrefix()}_GOVERNANCE_ROLE_LABELS`]: 'triager=Renamed' };
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { triager: { label: 'Triager', permissions: ['idea.triage'] } } },
+    instance: { ranks: { triager: { label: 'Triager', permissions: ['idea.triage'] } } },
     env,
   });
-  assert.equal(out.roles.triager.label, 'Renamed');
-  assert.deepEqual(out.roles.triager.permissions, ['idea.triage']);
+  assert.equal(out.ranks.triager.label, 'Renamed');
+  assert.deepEqual(out.ranks.triager.permissions, ['idea.triage']);
 });
 
 test('an env label naming a role no config defines is inert (a typo cannot grow the role set)', () => {
   const env = { [`${envPrefix()}_GOVERNANCE_ROLE_LABELS`]: 'metics=Typo' };
-  const out = resolveGovernanceConfig({ neutral: NEUTRAL, env });
-  assert.deepEqual(Object.keys(out.roles).sort(), [...catalog.RANK_ORDER].sort());
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env });
+  assert.deepEqual(Object.keys(out.ranks).sort(), [...catalog.RANK_ORDER].sort());
 });
 
 // ── fail-closed: config is not a trust boundary ─────────────────────────────────
@@ -101,41 +101,41 @@ test('an env label naming a role no config defines is inert (a typo cannot grow
 test('a template naming a system permission is stripped (config cannot grant system power)', () => {
   const systemKeys = catalog.systemKeys();
   assert.ok(systemKeys.includes('deploy.push_main'), 'fixture guard: the catalog still flags deploy.push_main');
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { sneaky: { label: 'Sneaky', permissions: ['deploy.push_main', 'builder.rank.set', 'idea.triage'] } } },
+    instance: { ranks: { sneaky: { label: 'Sneaky', permissions: ['deploy.push_main', 'builder.rank.set', 'idea.triage'] } } },
     env: NO_ENV,
   });
-  assert.deepEqual(out.roles.sneaky.permissions, ['idea.triage']);
+  assert.deepEqual(out.ranks.sneaky.permissions, ['idea.triage']);
   // Belt and braces: NO system key survives a template, whichever one is named.
-  const all = resolveGovernanceConfig({
+  const all = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { everything: { permissions: catalog.permissionKeys() } } },
+    instance: { ranks: { everything: { permissions: catalog.permissionKeys() } } },
     env: NO_ENV,
   });
   for (const k of systemKeys) {
-    assert.ok(!all.roles.everything.permissions.includes(k), `config must not be able to grant system permission "${k}"`);
+    assert.ok(!all.ranks.everything.permissions.includes(k), `config must not be able to grant system permission "${k}"`);
   }
-  assert.deepEqual(all.roles.everything.permissions, [...catalog.grantableKeys()].sort());
+  assert.deepEqual(all.ranks.everything.permissions, [...catalog.grantableKeys()].sort());
 });
 
 test('a template naming an unknown permission key is dropped (the catalog is the truth)', () => {
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { odd: { permissions: ['idea.triage', 'not.a.real.permission', 'deploy.everything'] } } },
+    instance: { ranks: { odd: { permissions: ['idea.triage', 'not.a.real.permission', 'deploy.everything'] } } },
     env: NO_ENV,
   });
-  assert.deepEqual(out.roles.odd.permissions, ['idea.triage']);
+  assert.deepEqual(out.ranks.odd.permissions, ['idea.triage']);
 });
 
 test('permissions on a SEEDED rank-role are dropped wholesale (grants derive from floors)', () => {
-  const out = resolveGovernanceConfig({
+  const out = resolveGovernmentConfig({
     neutral: NEUTRAL,
-    instance: { roles: { xenos: { label: 'Newcomer', permissions: ['task.create', 'audit_log.read'] } } },
+    instance: { ranks: { xenos: { label: 'Newcomer', permissions: ['task.create', 'audit_log.read'] } } },
     env: NO_ENV,
   });
-  assert.equal(out.roles.xenos.label, 'Newcomer', 'a seeded role may be relabelled');
-  assert.deepEqual(out.roles.xenos.permissions, [], 'a seeded role may never be re-granted from config');
+  assert.equal(out.ranks.xenos.label, 'Newcomer', 'a seeded role may be relabelled');
+  assert.deepEqual(out.ranks.xenos.permissions, [], 'a seeded role may never be re-granted from config');
 });
 
 test('grantableOnly de-duplicates, sorts, and rejects non-string entries', () => {
@@ -145,9 +145,9 @@ test('grantableOnly de-duplicates, sorts, and rejects non-string entries', () =>
 });
 
 test('the resolved config is frozen — a caller cannot mutate it into a grant', () => {
-  const out = resolveGovernanceConfig({ neutral: NEUTRAL, env: NO_ENV });
-  assert.ok(Object.isFrozen(out) && Object.isFrozen(out.roles) && Object.isFrozen(out.roles.metic));
-  assert.throws(() => out.roles.metic.permissions.push('deploy.push_main'), TypeError);
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: NO_ENV });
+  assert.ok(Object.isFrozen(out) && Object.isFrozen(out.ranks) && Object.isFrozen(out.ranks.metic));
+  assert.throws(() => out.ranks.metic.permissions.push('deploy.push_main'), TypeError);
 });
 
 // ── the neutral starter itself ──────────────────────────────────────────────────
@@ -159,9 +159,9 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
   assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
   // And it carries only templates — never a live per-builder assignment.
-  assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['roles']);
-  for (const role of Object.values(NEUTRAL.roles)) {
-    assert.ok(!('permissions' in role), 'the neutral seeded roles carry labels only, never grants');
+  assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['ranks']);
+  for (const rank of Object.values(NEUTRAL.ranks)) {
+    assert.ok(!('permissions' in rank), 'the neutral seeded ranks carry labels only, never grants');
   }
 });
 
@@ -171,13 +171,13 @@ test('the two config paths are the branding-shaped neutral/instance pair under c
   assert.ok(fs.existsSync(NEUTRAL_PATH), 'the neutral starter must ship — it is the vanilla default');
 });
 
-test('loadGovernanceConfig reads the real neutral starter and tolerates a missing instance pack', () => {
+test('loadGovernmentConfig reads the real neutral starter and tolerates a missing instance pack', () => {
   // A vanilla instance has no config/government.json at all — the default INSTANCE_PATH
   // is genuinely absent in this checkout, so the default call exercises that path.
   assert.equal(fs.existsSync(INSTANCE_PATH), false, 'fixture guard: this checkout is the vanilla case');
-  const out = loadGovernanceConfig({ env: NO_ENV });
-  assert.equal(out.roles.archon.label, 'Archon');
-  assert.deepEqual(Object.keys(out.roles).sort(), [...catalog.RANK_ORDER].sort());
+  const out = loadGovernmentConfig({ env: NO_ENV });
+  assert.equal(out.ranks.archon.label, 'Archon');
+  assert.deepEqual(Object.keys(out.ranks).sort(), [...catalog.RANK_ORDER].sort());
 });
 
 test('the neutral starter publishes with the core (a packaged vanilla instance needs it)', () => {

package/tests/{governance_fold.mjs → government_fold.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_fold.mjs — the session-load permission FOLD (task 1002556).
+// tests/government_fold.mjs — the session-load permission FOLD (task 1002556).
 //
 // DB-free. requirePermission used to cost a second round-trip on every gated
 // request (requireBuilder loads the session, then resolveHeldPermissions hits
@@ -15,7 +15,7 @@
 //   • fail-closed posture is untouched: a missing/malformed port still denies
 //     even when raw keys are present (authority must be ESTABLISHED, ADR 0016).
 //
-// The real-DB / real-HTTP complement is tests/governance_live_proof.mjs, which
+// The real-DB / real-HTTP complement is tests/government_live_proof.mjs, which
 // exercises the folded lookupSession end-to-end on a live stack.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
@@ -121,8 +121,8 @@ test('the kernel shape guard: the real fragment embeds; a malformed one degrades
   assert.equal(dbKernel.sessionPermsSelect(), '', 'a fragment with a statement separator is refused');
   // The REAL registered fragment passes the guard verbatim.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
-  buildGovernanceRouter();
+  const buildGovernmentRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
+  buildGovernmentRouter();
   const real = seams.resolveOptional('session-grants-sql').selectFragment;
   assert.equal(dbKernel.sessionPermsSelect(), real, 'the shipped fragment embeds unchanged');
   seams._reset();
@@ -133,8 +133,8 @@ test('the module registers the capability-named SQL seam the kernel embeds', ()
   // §Decision #4); the governance route factory is what registers it. Pin the
   // registration and the column contract the kernel query depends on.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
-  buildGovernanceRouter();
+  const buildGovernmentRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
+  buildGovernmentRouter();
   const provider = seams.resolveOptional('session-grants-sql');
   assert.ok(provider && typeof provider.selectFragment === 'string', 'fragment provider registered');
   assert.match(provider.selectFragment, /AS raw_permission_keys/, 'yields the column auth.js reads');

package/tests/{governance_fold_bench.mjs → government_fold_bench.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_fold_bench.mjs — the task-1002556 benchmark, re-runnable.
+// tests/government_fold_bench.mjs — the task-1002556 benchmark, re-runnable.
 //
 // Measures end-to-end latency of a requireBuilder + requirePermission route
 // (GET /government/ranks) against a LIVE server, the way the fold was graded:
@@ -19,7 +19,7 @@
 // set so the DB-free lane never runs it.
 //
 // Run:  GDS_BASE_URL=http://localhost:3000 BENCH_TOKEN=<archon session token> \
-//         node tests/governance_fold_bench.mjs
+//         node tests/government_fold_bench.mjs
 //   BENCH_N (default 300) / BENCH_WARMUP (default 30) tune the sample.
 
 import { strict as assert } from 'node:assert';
@@ -27,7 +27,7 @@ import { strict as assert } from 'node:assert';
 const BASE = (process.env.GDS_BASE_URL || '').replace(/\/$/, '');
 const TOKEN = process.env.BENCH_TOKEN || '';
 if (!BASE || !TOKEN) {
-  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds government.manage).');
+  console.log('government_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds government.manage).');
   process.exit(0);
 }
 const N = Number(process.env.BENCH_N) || 300;

package/tests/{governance_live_proof.mjs → government_live_proof.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_live_proof.mjs — the C6 governance LIVE proof (BV1.R114, ADR 0151).
+// tests/government_live_proof.mjs — the C6 governance LIVE proof (BV1.R114, ADR 0151).
 //
 // C6's live-demonstration clause: an Archon creates a CUSTOM role granting an
 // OPERATIONAL permission, assigns it to a low-trust builder, and that builder can
@@ -7,7 +7,7 @@
 // substrate: the deploy/protected-path attempt is still blocked.
 //
 // This is the goal_wall_proof.mjs pattern: the abuse MATRIX
-// (tests/governance_abuse_matrix.mjs, R112) already proves every vector DB-free
+// (tests/government_abuse_matrix.mjs, R112) already proves every vector DB-free
 // with stubs; THIS file proves the same story END-TO-END on the real stack —
 // real Postgres rows, real sessions, real HTTP through the real router, the real
 // resolver behind the real `governance` kernel port, no stubs, no monkeypatches.
@@ -18,7 +18,7 @@
 // and is listed in run-unit-tests.js's INTEGRATION set so the DB-free lane
 // never runs it.
 //
-// Run:  DATABASE_URL=... node tests/governance_live_proof.mjs
+// Run:  DATABASE_URL=... node tests/government_live_proof.mjs
 //   GDS_BASE_URL=http://localhost:3000  — optional: drive an already-running
 //   sandbox server (sharing that DATABASE_URL) instead of booting the router
 //   in-process. Same routes either way; this is how the live sandbox transcript
@@ -32,7 +32,7 @@ process.env.NODE_ENV = process.env.NODE_ENV || 'test';
 const require = createRequire(import.meta.url);
 
 if (!process.env.DATABASE_URL) {
-  console.log('governance_live_proof.mjs SKIPPED — DATABASE_URL not set.');
+  console.log('government_live_proof.mjs SKIPPED — DATABASE_URL not set.');
   process.exit(0);
 }
 
@@ -41,7 +41,7 @@ const pool = new Pool({ connectionString: process.env.DATABASE_URL });
 try {
   await pool.query('SELECT 1 FROM governance_roles LIMIT 1');
 } catch (e) {
-  console.log(`governance_live_proof.mjs SKIPPED — no migrated Postgres (${e.code || e.message}).`);
+  console.log(`government_live_proof.mjs SKIPPED — no migrated Postgres (${e.code || e.message}).`);
   await pool.end().catch(() => {});
   process.exit(0);
 }

package/tests/{governance_ownership_scope.mjs → government_ownership_scope.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_ownership_scope.mjs — ownership-scoped permissions
+// tests/government_ownership_scope.mjs — ownership-scoped permissions
 // ("act on OWN X") as a first-class axis (BV1.R100, ADR 0151 §3). DB-free.
 //
 // The thing being proved is a CONJUNCTION. `box.manage.own` is not a grant that
@@ -37,7 +37,7 @@ const db = require(path.join(GOV, 'db.js'));
 const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
 
 const {
-  PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, RESOURCE_FAMILIES, permissionKeys, byKey,
+  PERMISSIONS, RANK_ORDER, RANK_SEED, RESOURCE_FAMILIES, permissionKeys, byKey,
   scopeOf, resourceOf, isOwnershipScoped, isCrossOwner, ownershipScopedKeys, crossOwnerKeys,
   crossOwnerKeysFor, isPrincipalKey, seedForRank,
 } = catalog;
@@ -153,16 +153,16 @@ test('B1: for every paired family some rank reaches its OWN row but not everyone
 test('B2: the seed grants the own key to ranks it withholds the cross-owner key from', () => {
   for (const [resource, fam] of PAIRED) {
     for (const ownKey of fam.own) {
-      const ownOnly = RANK_ORDER.filter((r) => RANK_ROLE_SEED[r].includes(ownKey) && !fam.any.some((a) => RANK_ROLE_SEED[r].includes(a)));
+      const ownOnly = RANK_ORDER.filter((r) => RANK_SEED[r].includes(ownKey) && !fam.any.some((a) => RANK_SEED[r].includes(a)));
       assert.ok(ownOnly.length > 0, `${resource}: no rank holds ${ownKey} without also holding ${fam.any.join('/')}`);
     }
   }
   // The concrete claim, spelled out: a xenos may act on their own claim and their
   // own box; they may not release another builder's claim or close another's box.
-  assert.ok(RANK_ROLE_SEED.xenos.includes('task.act.own'));
-  assert.ok(!RANK_ROLE_SEED.xenos.includes('claim.release.any'));
-  assert.ok(RANK_ROLE_SEED.xenos.includes('box.manage.own'));
-  assert.ok(!RANK_ROLE_SEED.xenos.includes('box.fleet.manage'));
+  assert.ok(RANK_SEED.xenos.includes('task.act.own'));
+  assert.ok(!RANK_SEED.xenos.includes('claim.release.any'));
+  assert.ok(RANK_SEED.xenos.includes('box.manage.own'));
+  assert.ok(!RANK_SEED.xenos.includes('box.fleet.manage'));
 });
 
 test('B3: cross-owner authority is never CHEAPER than own-only authority', () => {
@@ -372,13 +372,13 @@ test('F4: a cross-owner key with no ownership-scoped counterpart throws at modul
 
 test('G1: the seed is still floor-derived and cumulative — the ownership axis adds no grants', () => {
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_ROLE_SEED[rank]);
+    const held = new Set(RANK_SEED[rank]);
     const tier = RANK_ORDER.indexOf(rank);
     for (const p of PERMISSIONS) {
       assert.equal(held.has(p.key), p.floor !== null && RANK_ORDER.indexOf(p.floor) <= tier,
         `${rank} vs ${p.key}: scope must not touch the floor derivation`);
     }
-    assert.deepEqual([...seedForRank(rank)].sort(), [...RANK_ROLE_SEED[rank]].sort());
+    assert.deepEqual([...seedForRank(rank)].sort(), [...RANK_SEED[rank]].sort());
   }
 });
 
@@ -397,14 +397,14 @@ test('G2: the role resolve is untouched — own-scoped keys still resolve, princ
 });
 
 test('G3: the kernel port carries the ownership axis on the ONE governance port', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
+  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
   for (const name of ['authorizeOwned', 'authorizeOwnedOrAny', 'sameOwner', 'isOwnershipScoped', 'crossOwnerKeysFor']) {
-    assert.equal(typeof governancePort[name], 'function', `the port must expose ${name}`);
+    assert.equal(typeof governmentPort[name], 'function', `the port must expose ${name}`);
   }
   // still the same one object port the earlier slices registered
-  assert.equal(typeof governancePort.resolveBuilderPermissions, 'function');
-  assert.equal(typeof governancePort.resolvePrincipalPermissions, 'function');
-  assert.equal(governancePort.isOwnershipScoped('box.manage.own'), true);
-  assert.equal(governancePort.isOwnershipScoped('claim.release.any'), false);
-  assert.equal(governancePort.isOwnershipScoped('nope.not.a.key'), false);
+  assert.equal(typeof governmentPort.resolveBuilderPermissions, 'function');
+  assert.equal(typeof governmentPort.resolvePrincipalPermissions, 'function');
+  assert.equal(governmentPort.isOwnershipScoped('box.manage.own'), true);
+  assert.equal(governmentPort.isOwnershipScoped('claim.release.any'), false);
+  assert.equal(governmentPort.isOwnershipScoped('nope.not.a.key'), false);
 });

package/tests/{governance_page_gates.mjs → government_page_gates.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_page_gates.mjs — the three HTML PAGE GATES + the wandering
+// tests/government_page_gates.mjs — the three HTML PAGE GATES + the wandering
 // CEILING, re-expressed on the governance model (BV1.R107, ADR 0151).
 //
 // DB-free. Two doubles, both installed the way the existing suites do it:
@@ -6,7 +6,7 @@
 //     auth.js destructures it at load time (tests/auth_page_gate.mjs precedent).
 //   • the `governance` KERNEL PORT is a seam stub, so the gates' authority half
 //     needs no Postgres, no router, no live module
-//     (tests/governance_require_permission.mjs precedent).
+//     (tests/government_require_permission.mjs precedent).
 //
 // WHAT THIS FILE HAS TO PROVE, and why the oracles are split.
 //   A page gate that resolves its audience from catalog.floor cannot be checked
@@ -26,7 +26,7 @@
 //   installed on the response double precisely so a regression to JSON shows up
 //   as an assertion rather than a TypeError.
 //
-// Run:  node --test tests/governance_page_gates.mjs
+// Run:  node --test tests/government_page_gates.mjs
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
@@ -50,13 +50,13 @@ const resolver = require('../modules/government/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
-const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireGovernancePage'];
+const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireGovernmentPage'];
 const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 
 // ═══ the ORACLE — hand-written, from the rank tests R107 deleted ═════════════
 // requireBuilderPage    admitted any session at all     → every live rank
 // requireNonXenosPage   admitted rank !== 'xenos'       → thetes and up
-// requireGovernancePage admitted rank === 'archon'      → archon only …until ADR 0157
+// requireGovernmentPage admitted rank === 'archon'      → archon only …until ADR 0157
 //
 // ADR 0157 (owner decision, 2026-08-05) lowered `page.view.government` archon→metic, so
 // the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
@@ -71,7 +71,7 @@ const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 const PRE_R107_AUDIENCE = {
   requireBuilderPage: { xenos: true, thetes: true, metic: true, archon: true },
   requireNonXenosPage: { xenos: false, thetes: true, metic: true, archon: true },
-  requireGovernancePage: { xenos: false, thetes: false, metic: true, archon: true },
+  requireGovernmentPage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
 // they already have a session, so that would loop. Since task 1002613 (map N-1)
@@ -81,12 +81,12 @@ const PRE_R107_AUDIENCE = {
 const DENIED_TO = {
   requireBuilderPage: '/builders',
   requireNonXenosPage: '/builders/not-ready',
-  requireGovernancePage: '/builders',
+  requireGovernmentPage: '/builders',
 };
 const GATE_PERMISSION = {
   requireBuilderPage: 'page.view.public',
   requireNonXenosPage: 'page.view.builder',
-  requireGovernancePage: 'page.view.government',
+  requireGovernmentPage: 'page.view.government',
 };
 const deniedLoc = (gate, { unavailable = false } = {}) =>
   `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
@@ -95,7 +95,7 @@ const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
   requireNonXenosPage: 'thetes',
   // ADR 0157: `page.view.government` floor archon→metic.
-  requireGovernancePage: 'metic',
+  requireGovernmentPage: 'metic',
 };
 const SIGN_IN = '/api/gds/auth/web/start';
 
@@ -249,16 +249,16 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   });
   const req = { headers: { cookie: 'gds_session=validtoken' } };
   let admitted = false;
-  await auth.requireGovernancePage(req, fakeRes(), () => { admitted = true; });
+  await auth.requireGovernmentPage(req, fakeRes(), () => { admitted = true; });
   assert.equal(admitted, true, 'an Archon should reach the page');
   keys = []; // the role is revoked between requests
   const second = fakeRes();
   let admittedAgain = false;
-  await auth.requireGovernancePage(req, second, () => { admittedAgain = true; });
+  await auth.requireGovernmentPage(req, second, () => { admittedAgain = true; });
   seams._reset();
   assert.equal(calls, 2, 'the resolver must be consulted on every request');
   assert.equal(admittedAgain, false, 'a revoked role must deny on the very next request');
-  assert.equal(second._redirect.loc, deniedLoc('requireGovernancePage'));
+  assert.equal(second._redirect.loc, deniedLoc('requireGovernmentPage'));
 });
 
 test('B5: every permission a page gate names is a real catalog key', async () => {
@@ -286,7 +286,7 @@ test('C1: the per-role wandering default + ceiling are unchanged', () => {
     assert.equal(wandering.defaultLevelForRank(role), expected.default, `${role} default`);
     assert.equal(wandering.maxLevelForRank(role), expected.ceiling, `${role} ceiling`);
     assert.deepEqual(
-      { default: wandering.roleWandering(role).default, ceiling: wandering.roleWandering(role).ceiling },
+      { default: wandering.rankWandering(role).default, ceiling: wandering.rankWandering(role).ceiling },
       expected,
       `${role} role metadata`,
     );
@@ -339,7 +339,7 @@ test('C4: the ceiling is NOT answerable through the boolean permission axis', ()
 });
 
 test('C5: the derived rank projections cannot drift from the role metadata', () => {
-  for (const [role, meta] of Object.entries(wandering.ROLE_WANDERING)) {
+  for (const [role, meta] of Object.entries(wandering.RANK_WANDERING)) {
     assert.equal(wandering.RANK_DEFAULT[role], meta.default, `RANK_DEFAULT.${role}`);
     assert.equal(wandering.RANK_MAX[role], meta.ceiling, `RANK_MAX.${role}`);
     assert.ok(meta.default <= meta.ceiling, `${role}: default must not exceed the ceiling`);

package/tests/{governance_parity.mjs → government_parity.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_parity.mjs — the compat-seed PARITY proof (BV1.R103, ADR 0151).
+// tests/government_parity.mjs — the compat-seed PARITY proof (BV1.R103, ADR 0151).
 //
 // The promise the whole governance cutover rests on: once governance_002 seeds the
 // four rank-roles and backfills every builder the role matching their rank, each
@@ -24,10 +24,10 @@
 //     R104-R107 migration shifts coverage between oracles instead of erasing it.
 //   PART C — the two REAL middlewares, requirePermission vs requireRank, over the
 //     whole catalog rather than the four hand-picked keys in
-//     tests/governance_require_permission.mjs.
+//     tests/government_require_permission.mjs.
 //   PART D — the deliberate fail-closed divergence governance_002 documents.
 //
-// A third oracle already exists and is NOT duplicated here: tests/governance_seed.mjs
+// A third oracle already exists and is NOT duplicated here: tests/government_seed.mjs
 // pins the catalog against the materialised migration SQL, so a floor edit that
 // reaches no new migration reds there.
 //

package/tests/{governance_principals.mjs → government_principals.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_principals.mjs — machine principals as a first-class type
+// tests/government_principals.mjs — machine principals as a first-class type
 // (BV1.R98, ADR 0151 §3). DB-free.
 //
 // A builder's authority is the UNION of their ROLES. A machine principal's authority
@@ -26,7 +26,7 @@ const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const resolver = require(path.join(GOV, 'resolver.js'));
 
-const { PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, PRINCIPALS, principalKeys, principalRoles, isPrincipalKey, principalByRole, seedForRank, isGrantable, isSystem, systemKeys, grantableKeys, permissionKeys } = catalog;
+const { PERMISSIONS, RANK_ORDER, RANK_SEED, PRINCIPALS, principalKeys, principalRoles, isPrincipalKey, principalByRole, seedForRank, isGrantable, isSystem, systemKeys, grantableKeys, permissionKeys } = catalog;
 const { effectivePermissions, resolvePrincipalPermissions, principalHasPermission } = resolver;
 
 // ── the catalog side: principals are a distinct, well-formed type ───────────────
@@ -71,7 +71,7 @@ test('isPrincipalKey separates the axes; an unknown key fails closed', () => {
 
 test('no rank-role holds a principal permission — an Archon must not hold principal.bfg', () => {
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_ROLE_SEED[rank]);
+    const held = new Set(RANK_SEED[rank]);
     for (const key of principalKeys()) {
       assert.ok(!held.has(key), `the ${rank} rank-role must not hold ${key}`);
     }
@@ -81,7 +81,7 @@ test('no rank-role holds a principal permission — an Archon must not hold prin
       assert.ok(!derived.has(key), `seedForRank('${rank}') must not derive ${key}`);
     }
   }
-  assert.ok(!RANK_ROLE_SEED.archon.includes('principal.bfg'),
+  assert.ok(!RANK_SEED.archon.includes('principal.bfg'),
     'the top rank is the case that matters: identity is not seniority');
 });
 
@@ -149,10 +149,10 @@ test('resolved principal sets are frozen — a caller cannot widen one', () => {
 // ── show, never grant ───────────────────────────────────────────────────────────
 
 test('the tab surface is a read-only projection: shown, flagged non-grantable', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
-  assert.equal(typeof governancePort.listPrincipals, 'function');
-  assert.equal(typeof governancePort.resolvePrincipalPermissions, 'function');
-  const listed = governancePort.listPrincipals();
+  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
+  assert.equal(typeof governmentPort.listPrincipals, 'function');
+  assert.equal(typeof governmentPort.resolvePrincipalPermissions, 'function');
+  const listed = governmentPort.listPrincipals();
   assert.deepEqual(listed.map((p) => p.system_role).sort(), ['bfg', 'discord_bot']);
   for (const p of listed) {
     assert.equal(p.grantable, false, `${p.system_role} must be rendered non-grantable`);
@@ -162,9 +162,9 @@ test('the tab surface is a read-only projection: shown, flagged non-grantable',
 });
 
 test('the governance port exposes no way to create, grant, or assign a principal', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
+  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
   const mutator = /(create|grant|assign|add|set|write|provision|revoke|delete|update)/i;
-  for (const name of Object.keys(governancePort)) {
+  for (const name of Object.keys(governmentPort)) {
     if (!/principal/i.test(name)) continue;
     assert.ok(!mutator.test(name), `port method "${name}" looks like a principal mutator — principals are provisioned out-of-band only`);
   }
@@ -208,14 +208,14 @@ test('the catalog models exactly the principals the substrate can provision', ()
 
 test('the rank-role seed is still cumulative and floor-derived (R94 invariants hold)', () => {
   for (let i = 1; i < RANK_ORDER.length; i++) {
-    const lower = new Set(RANK_ROLE_SEED[RANK_ORDER[i - 1]]);
-    for (const k of RANK_ROLE_SEED[RANK_ORDER[i]]) assert.ok(typeof k === 'string');
+    const lower = new Set(RANK_SEED[RANK_ORDER[i - 1]]);
+    for (const k of RANK_SEED[RANK_ORDER[i]]) assert.ok(typeof k === 'string');
     for (const k of lower) {
-      assert.ok(RANK_ROLE_SEED[RANK_ORDER[i]].includes(k), `${RANK_ORDER[i]} lost ${k}`);
+      assert.ok(RANK_SEED[RANK_ORDER[i]].includes(k), `${RANK_ORDER[i]} lost ${k}`);
     }
   }
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_ROLE_SEED[rank]);
+    const held = new Set(RANK_SEED[rank]);
     const tier = RANK_ORDER.indexOf(rank);
     for (const p of PERMISSIONS) {
       assert.equal(held.has(p.key), p.floor !== null && RANK_ORDER.indexOf(p.floor) <= tier,

package/tests/{governance_protected_surfaces.mjs → government_protected_surfaces.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_protected_surfaces.mjs — the protected-surface registry
+// tests/government_protected_surfaces.mjs — the protected-surface registry
 // (BV1.R101, ADR 0151 §4).
 //
 // DB-free. The registry is the data the OUT-OF-BAND substrate reads (a git

package/tests/{governance_role_sync.mjs → government_rank_sync.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_role_sync.mjs — rank→role assignment stays in sync (BV1.R95b, ADR 0151).
+// tests/government_rank_sync.mjs — rank→role assignment stays in sync (BV1.R95b, ADR 0151).
 //
 // DB-free. The decision the writer executes is a pure function (modules/government/
 // ranks.js planRankSync), so these exercise PRODUCTION logic directly rather
@@ -214,7 +214,7 @@ test('the repair migration removes stale seeded roles and is idempotent', () =>
 });
 
 test('the repair migration touches ASSIGNMENTS, never GRANTS', () => {
-  // tests/governance_seed.mjs builds RANK_ROLE_SEED as the UNION of every grant
+  // tests/government_seed.mjs builds RANK_SEED as the UNION of every grant
   // migration and fails loudly if one ever revokes. This migration must stay out of
   // that model entirely: it never writes governance_role_permissions.
   const code = stripSqlComments(repairSql);

package/tests/{governance_require_permission.mjs → government_require_permission.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_require_permission.mjs — the requirePermission gate (BV1.R97, ADR 0151).
+// tests/government_require_permission.mjs — the requirePermission gate (BV1.R97, ADR 0151).
 //
 // DB-free. The gate reaches the resolver through the `governance` KERNEL PORT
 // (the one-way rule — core never requires modules/government/), so a stub