@bongos/core 1.19.185 → 1.19.187

package/tests/{governance_resolver.mjs → government_resolver.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_resolver.mjs — the permission resolver (BV1.R95, ADR 0151).
+// tests/government_resolver.mjs — the permission resolver (BV1.R95, ADR 0151).
 //
 // DB-free: exercises the resolver's PURE core (effectivePermissions) plus the
 // fail-closed short-circuits and the kernel-port shape. The live DB join is
@@ -45,7 +45,7 @@ test('the result is frozen — a caller cannot mutate a resolved permission set'
 
 // R98 narrowed this: the role axis carries every catalog key EXCEPT the machine-
 // principal ones, which come from an identity and never from a role. The principal
-// axis has its own file (tests/governance_principals.mjs).
+// axis has its own file (tests/government_principals.mjs).
 test('every role-held catalog key survives resolution (the seed can grant anything defined)', () => {
   const roleHeld = catalog.permissionKeys().filter((k) => !catalog.isPrincipalKey(k));
   assert.deepEqual(effectivePermissions(catalog.permissionKeys()), [...roleHeld].sort());
@@ -74,10 +74,10 @@ test('the resolver holds no cache — authority is read fresh per request (ADR 0
 });
 
 test('the kernel port exposes the resolver without core importing the module', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
-  assert.equal(typeof governancePort.resolveBuilderPermissions, 'function');
-  assert.equal(typeof governancePort.builderHasPermissions, 'function');
-  assert.equal(typeof governancePort.isSystem, 'function');
+  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
+  assert.equal(typeof governmentPort.resolveBuilderPermissions, 'function');
+  assert.equal(typeof governmentPort.builderHasPermissions, 'function');
+  assert.equal(typeof governmentPort.isSystem, 'function');
   const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
   assert.ok(manifest.provides.includes('government'), 'module.json must declare the government port');
   assert.ok(manifest.contributes.routes.includes('government'), 'the port registers from the route factory');

package/tests/{governance_routes.mjs → government_routes.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_routes.mjs — the governance CRUD API (BV1.R110, ADR 0151).
+// tests/government_routes.mjs — the governance CRUD API (BV1.R110, ADR 0151).
 //
 // Two layers, both DB-free (the memory_isolation.mjs pattern):
 //
@@ -19,7 +19,7 @@
 //      ASSIGNMENT is still rank-derived (R95b); and every route denies without the
 //      `government.manage` grant.
 //
-// Run:  node tests/governance_routes.mjs
+// Run:  node tests/government_routes.mjs
 
 import { strict as assert } from 'node:assert';
 import { test, after } from 'node:test';
@@ -99,23 +99,23 @@ test('checkRouteRanks passes over the real tree (no governance findings)', () =>
 // The db stub: every function the routes call, recording args. Reset per test.
 const calls = [];
 const stub = {
-  listRolesWithGrants: async () => [{ rank_key: 'metic', label: 'Metic', description: null, is_system: true, seeded_rank: 'metic', created_by: null, created_at: 't', permissions: ['task.create'] }],
+  listRanksWithGrants: async () => [{ rank_key: 'metic', label: 'Metic', description: null, is_system: true, seeded_rank: 'metic', created_by: null, created_at: 't', permissions: ['task.create'] }],
   listAssignments: async () => [{ builder_id: 7, github_login: 'x', display_name: 'X', rank: 'metic', rank_key: 'metic', role_label: 'Metic', is_system: true, seeded_rank: 'metic', assigned_by: null, assigned_at: 't' }],
   // Every rank name is a seeded rank-role; anything else is a custom one. Keyed off
   // the catalog's ladder rather than a hand-listed pair, so a rank added to
   // RANK_ORDER is exercised here instead of quietly falling through as "custom".
-  getRoleByKey: async (k) => (k === 'missing' ? null : {
+  getRankByKey: async (k) => (k === 'missing' ? null : {
     rank_key: k,
     label: k,
     is_system: catalog.RANK_ORDER.includes(k),
     seeded_rank: catalog.RANK_ORDER.includes(k) ? k : null,
   }),
-  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
-  grantRolePermission: async () => true,
-  revokeRolePermission: async () => true,
-  resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
-  assignRole: async () => true,
-  unassignRole: async () => true,
+  createRank: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+  grantRankPermission: async () => true,
+  revokeRankPermission: async () => true,
+  resetRankGrants: async ({ permissionKeys }) => permissionKeys.length,
+  assignRank: async () => true,
+  unassignRank: async () => true,
 };
 const REAL = {};
 for (const k of Object.keys(stub)) {
@@ -135,11 +135,11 @@ function grant(keys) {
 }
 grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
+const buildGovernmentRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-app.use(buildGovernanceRouter());
+app.use(buildGovernmentRouter());
 const server = http.createServer(app);
 await new Promise((r) => server.listen(0, '127.0.0.1', r));
 const BASE = `http://127.0.0.1:${server.address().port}`;
@@ -189,8 +189,8 @@ test('without government.manage EVERY route 403s (reads included)', async () =>
 test('GET /government/ranks returns the role list with grants', async () => {
   const r = await call('GET', '/government/ranks');
   assert.equal(r.status, 200);
-  assert.equal(r.json.roles[0].rank_key, 'metic');
-  assert.deepEqual(r.json.roles[0].permissions, ['task.create']);
+  assert.equal(r.json.ranks[0].rank_key, 'metic');
+  assert.deepEqual(r.json.ranks[0].permissions, ['task.create']);
 });
 
 test('GET /government/permissions renders the catalog: grantable flags + principals, no DB call', async () => {
@@ -221,9 +221,9 @@ test('GET /government/assignments returns builder↔role rows', async () => {
 test('POST /government/ranks creates a custom role, created_by = the session builder', async () => {
   const r = await call('POST', '/government/ranks', { rank_key: 'triage-helper', label: 'Triage helper' });
   assert.equal(r.status, 201);
-  assert.equal(r.json.role.rank_key, 'triage-helper');
-  assert.equal(r.json.role.is_system, false);
-  const c = calls.find(([k]) => k === 'createRole');
+  assert.equal(r.json.rank.rank_key, 'triage-helper');
+  assert.equal(r.json.rank.is_system, false);
+  const c = calls.find(([k]) => k === 'createRank');
   assert.equal(c[1].createdBy, 42, 'created_by must be the session builder, never input');
 });
 
@@ -235,14 +235,14 @@ test('POST /government/ranks validates: label required, rank_key must be a slug'
     const r = await call('POST', '/government/ranks', { rank_key: bad, label: 'L' });
     assert.equal(r.status, 400, `rank_key "${bad}" must be rejected`);
   }
-  assert.equal(calls.filter(([k]) => k === 'createRole').length, 0, 'nothing reached the db');
+  assert.equal(calls.filter(([k]) => k === 'createRank').length, 0, 'nothing reached the db');
 });
 
 test('POST /government/ranks maps a unique-violation to rank_exists 409', async () => {
-  const prev = stub.createRole;
-  stub.createRole = async () => { const e = new Error('dup'); e.code = '23505'; throw e; };
+  const prev = stub.createRank;
+  stub.createRank = async () => { const e = new Error('dup'); e.code = '23505'; throw e; };
   const r = await call('POST', '/government/ranks', { rank_key: 'metic-two', label: 'L' });
-  stub.createRole = prev;
+  stub.createRank = prev;
   assert.equal(r.status, 409);
   assert.equal(r.json.error.code, 'rank_exists');
 });
@@ -252,7 +252,7 @@ test('POST /government/ranks maps a unique-violation to rank_exists 409', async
 test('PUT grant: an operational permission lands on a custom role', async () => {
   const r = await call('PUT', '/government/ranks/triage-helper/permissions/idea.triage');
   assert.equal(r.status, 200);
-  const c = calls.find(([k]) => k === 'grantRolePermission');
+  const c = calls.find(([k]) => k === 'grantRankPermission');
   assert.deepEqual(c[1], { rankKey: 'triage-helper', permissionKey: 'idea.triage' });
 });
 
@@ -261,7 +261,7 @@ test('PUT grant: a SYSTEM permission is rejected as non-grantable — the R110 w
     const r = await call('PUT', `/government/ranks/triage-helper/permissions/${sysKey}`);
     assert.equal(r.status, 400, `${sysKey} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable');
-    assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0, 'the refusal is BEFORE the db');
+    assert.equal(calls.filter(([k]) => k === 'grantRankPermission').length, 0, 'the refusal is BEFORE the db');
   }
 });
 
@@ -274,7 +274,7 @@ test('PUT grant: an unknown permission fails closed', async () => {
 test('PUT grant: a sub-Archon rank-role is EDITABLE (ADR 0172)', async () => {
   const r = await call('PUT', '/government/ranks/metic/permissions/idea.triage');
   assert.equal(r.status, 200);
-  const c = calls.find(([k]) => k === 'grantRolePermission');
+  const c = calls.find(([k]) => k === 'grantRankPermission');
   assert.deepEqual(c[1], { rankKey: 'metic', permissionKey: 'idea.triage' });
 });
 
@@ -293,7 +293,7 @@ test('PUT grant: a SUBSTRATE key is refused even on a rank-role (it would confer
     assert.equal(r.json.error.code, 'permission_not_grantable');
     assert.match(r.json.error.details.reason || '', /substrate/i,
       'the refusal must name the substrate wall, not the custom-role one — the two are a policy choice apart');
-    assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
+    assert.equal(calls.filter(([k]) => k === 'grantRankPermission').length, 0);
   }
 });
 
@@ -301,7 +301,7 @@ test('PUT grant: the ARCHON rank-role stays immutable (the lockout guard)', asyn
   const r = await call('PUT', '/government/ranks/archon/permissions/idea.triage');
   assert.equal(r.status, 403);
   assert.equal(r.json.error.code, 'archon_rank_immutable');
-  assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
+  assert.equal(calls.filter(([k]) => k === 'grantRankPermission').length, 0);
 });
 
 test('PUT grant: an unknown role 404s', async () => {
@@ -313,7 +313,7 @@ test('PUT grant: an unknown role 404s', async () => {
 test('DELETE grant revokes without consulting the catalog (stale keys stay removable)', async () => {
   const r = await call('DELETE', '/government/ranks/triage-helper/permissions/some.retired.key');
   assert.equal(r.status, 200);
-  const c = calls.find(([k]) => k === 'revokeRolePermission');
+  const c = calls.find(([k]) => k === 'revokeRankPermission');
   assert.deepEqual(c[1], { rankKey: 'triage-helper', permissionKey: 'some.retired.key' });
 });
 
@@ -324,7 +324,7 @@ test('DELETE grant: revocable on a sub-Archon rank-role, refused on the Archon o
   const archon = await call('DELETE', '/government/ranks/archon/permissions/idea.triage');
   assert.equal(archon.status, 403);
   assert.equal(archon.json.error.code, 'archon_rank_immutable');
-  assert.equal(calls.filter(([k]) => k === 'revokeRolePermission').length, 0);
+  assert.equal(calls.filter(([k]) => k === 'revokeRankPermission').length, 0);
 });
 
 // --- reset (ADR 0172) --------------------------------------------------------
@@ -333,7 +333,7 @@ test('POST reset: a rank-role goes back to its floor-derived catalog seed', asyn
   const r = await call('POST', '/government/ranks/thetes/reset');
   assert.equal(r.status, 200);
   assert.equal(r.json.seeded_rank, 'thetes');
-  const c = calls.find(([k]) => k === 'resetRoleGrants');
+  const c = calls.find(([k]) => k === 'resetRankGrants');
   assert.deepEqual([...c[1].permissionKeys].sort(), [...catalog.seedForRank('thetes')].sort());
 });
 
@@ -341,7 +341,7 @@ test('POST reset: refused on a custom role (no catalog default to return to)', a
   const r = await call('POST', '/government/ranks/triage-helper/reset');
   assert.equal(r.status, 400);
   assert.equal(r.json.error.code, 'rank_has_no_default');
-  assert.equal(calls.filter(([k]) => k === 'resetRoleGrants').length, 0);
+  assert.equal(calls.filter(([k]) => k === 'resetRankGrants').length, 0);
 });
 
 // --- assignments -------------------------------------------------------------
@@ -349,7 +349,7 @@ test('POST reset: refused on a custom role (no catalog default to return to)', a
 test('POST /government/assignments assigns a custom role, assigned_by = the session builder', async () => {
   const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: 'triage-helper' });
   assert.equal(r.status, 201);
-  const c = calls.find(([k]) => k === 'assignRole');
+  const c = calls.find(([k]) => k === 'assignRank');
   assert.deepEqual(c[1], { builderId: 7, rankKey: 'triage-helper', assignedBy: 42 });
 });
 
@@ -357,14 +357,14 @@ test('POST /government/assignments refuses a seeded rank-role (rank is the write
   const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: 'archon' });
   assert.equal(r.status, 403);
   assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden');
-  assert.equal(calls.filter(([k]) => k === 'assignRole').length, 0);
+  assert.equal(calls.filter(([k]) => k === 'assignRank').length, 0);
 });
 
 test('POST /government/assignments maps a missing builder (FK) to 404', async () => {
-  const prev = stub.assignRole;
-  stub.assignRole = async () => { const e = new Error('fk'); e.code = '23503'; throw e; };
+  const prev = stub.assignRank;
+  stub.assignRank = async () => { const e = new Error('fk'); e.code = '23503'; throw e; };
   const r = await call('POST', '/government/assignments', { builder_id: 999, rank_key: 'triage-helper' });
-  stub.assignRole = prev;
+  stub.assignRank = prev;
   assert.equal(r.status, 404);
   assert.equal(r.json.error.code, 'builder_not_found');
 });
@@ -378,7 +378,7 @@ test('POST /government/assignments validates builder_id and rank_key', async ()
 test('DELETE /government/assignments/:builderId/:rankKey unassigns a custom role', async () => {
   const r = await call('DELETE', '/government/assignments/7/triage-helper');
   assert.equal(r.status, 200);
-  const c = calls.find(([k]) => k === 'unassignRole');
+  const c = calls.find(([k]) => k === 'unassignRank');
   assert.deepEqual(c[1], { builderId: 7, rankKey: 'triage-helper' });
 });
 

package/tests/{governance_seed.mjs → government_seed.mjs}

@@ -1,8 +1,8 @@
-// tests/governance_seed.mjs — the compat-seed migration drift guard (BV1.R93, ADR 0151).
+// tests/government_seed.mjs — the compat-seed migration drift guard (BV1.R93, ADR 0151).
 //
 // The seed migration (governance_002_seed_and_backfill.sql) MATERIALISES the role→
 // permission grants as SQL. This parses that file and asserts the four role arrays
-// equal the code catalog's RANK_ROLE_SEED exactly — so the SQL snapshot can never
+// equal the code catalog's RANK_SEED exactly — so the SQL snapshot can never
 // silently drift from the catalog (the "no second list that drifts" discipline). If
 // you change catalog.js, this goes red until the migration is regenerated (a NEW
 // migration for a NEW grant — migrations are run-once).
@@ -15,7 +15,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { RANK_ROLE_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const { RANK_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const MIG_DIR = path.join(ROOT, 'modules', 'government', 'migrations');
 const seedSql = fs.readFileSync(path.join(MIG_DIR, 'governance_002_seed_and_backfill.sql'), 'utf8');
@@ -25,7 +25,7 @@ const tablesSql = fs.readFileSync(path.join(MIG_DIR, 'governance_001_tables.sql'
 // grant migration. Migrations are run-once, so a floor change in catalog.js can never
 // be made by editing 002 — an already-migrated database would keep the old grant. It
 // arrives as a follow-on migration instead (governance_003 = task.abandon → metic,
-// ADR 0152), and what must equal RANK_ROLE_SEED is the union of them all, not any one
+// ADR 0152), and what must equal RANK_SEED is the union of them all, not any one
 // file. Read in filename order; every file is scanned for `SELECT '<role>', unnest(…)`
 // blocks, so a new grant migration needs no change here.
 // Migrations that do NOT grant. Excluded by NAME rather than by "does it
@@ -69,7 +69,7 @@ function grantBlocksForRole(role) {
   return blocks;
 }
 
-test('the union of every grant migration matches RANK_ROLE_SEED exactly (no drift)', () => {
+test('the union of every grant migration matches RANK_SEED exactly (no drift)', () => {
   for (const role of RANK_ORDER) {
     const blocks = grantBlocksForRole(role);
     assert.ok(blocks.length > 0, `no grant block for ${role} in any governance migration`);
@@ -78,11 +78,11 @@ test('the union of every grant migration matches RANK_ROLE_SEED exactly (no drif
     }
     const granted = applyRenames(blocks.flatMap((b) => b.keys));
     // set-equality (order in SQL is illustrative; the grant set is what matters)
-    assert.deepEqual(new Set(granted), new Set(RANK_ROLE_SEED[role]),
-      `${role}: grant migrations drift from catalog RANK_ROLE_SEED`);
+    assert.deepEqual(new Set(granted), new Set(RANK_SEED[role]),
+      `${role}: grant migrations drift from catalog RANK_SEED`);
     // no key re-granted in a LATER migration (a no-op INSERT that muddies the ledger)
     assert.equal(granted.length, new Set(granted).size, `${role}: the same permission is granted twice across migrations`);
-    assert.equal(new Set(granted).size, RANK_ROLE_SEED[role].length, `${role}: grant count mismatch`);
+    assert.equal(new Set(granted).size, RANK_SEED[role].length, `${role}: grant count mismatch`);
   }
 });
 

package/tests/{governance_session_scope.mjs → government_session_scope.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_session_scope.mjs — session-scopes as a first-class axis
+// tests/government_session_scope.mjs — session-scopes as a first-class axis
 // (BV1.R99, ADR 0151 §3; the model behind ADR 0053). DB-free.
 //
 // A session-scope is capability attached to the TOKEN, not to the builder: a
@@ -75,7 +75,7 @@ const ARCHON_POWERS = [
 const METIC_POWERS = ['idea.triage', 'task.create', 'task.edit', 'goal.create', 'box.source.full'];
 
 // Stub the ONE DB read the resolver makes, so the composition is exercised
-// end-to-end without Postgres (the tests/governance_ownership_scope.mjs pattern).
+// end-to-end without Postgres (the tests/government_ownership_scope.mjs pattern).
 const realGetPermissionKeys = db.getPermissionKeysForBuilder;
 async function holding(keys, fn) {
   db.getPermissionKeysForBuilder = async () => keys;
@@ -370,7 +370,7 @@ test('G2: requireBuilder DENIES a session whose source the registry does not dec
 
 test('H1: R95/R98/R100 invariants still hold — the role answer is untouched', async () => {
   // R99 composes ON TOP of effectivePermissions; widening INSIDE it would red
-  // tests/governance_parity.mjs Parts A and C.
+  // tests/government_parity.mjs Parts A and C.
   assert.deepEqual(effectivePermissions(['principal.bfg', 'box.manage.own']), ['box.manage.own']);
   assert.deepEqual(effectivePermissions(['idea.triage', 'not.a.real.permission']), ['idea.triage']);
   for (const rank of RANK_ORDER) {
@@ -419,16 +419,16 @@ test('H3: the resolve is still per-request and frozen — no memoised session au
 // ═══ I — the ONE governance port carries the axis ════════════════════════════
 
 test('I1: the session-scope axis lands on the single governance port', () => {
-  const { governancePort } = require(path.join(GOV, 'routes', 'government.js'));
+  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
   for (const name of ['resolveSessionPermissions', 'narrowToSessionScope', 'sessionScopeFor', 'listSessionScopes']) {
-    assert.equal(typeof governancePort[name], 'function', `the port must expose ${name}`);
+    assert.equal(typeof governmentPort[name], 'function', `the port must expose ${name}`);
   }
   // still the same one object port the earlier slices registered
   for (const name of ['resolveBuilderPermissions', 'resolvePrincipalPermissions', 'authorizeOwned']) {
-    assert.equal(typeof governancePort[name], 'function');
+    assert.equal(typeof governmentPort[name], 'function');
   }
-  assert.deepEqual([...governancePort.sessionScopeFor('box').permissions], EXPECTED_BOX_SCOPE);
-  assert.equal(governancePort.sessionScopeFor('ghost'), null);
-  assert.deepEqual([...governancePort.narrowToSessionScope(seedForRank('archon'), 'box')], EXPECTED_BOX_SCOPE);
-  assert.ok(governancePort.listSessionScopes().length >= 2);
+  assert.deepEqual([...governmentPort.sessionScopeFor('box').permissions], EXPECTED_BOX_SCOPE);
+  assert.equal(governmentPort.sessionScopeFor('ghost'), null);
+  assert.deepEqual([...governmentPort.narrowToSessionScope(seedForRank('archon'), 'box')], EXPECTED_BOX_SCOPE);
+  assert.ok(governmentPort.listSessionScopes().length >= 2);
 });

package/tests/{governance_vanilla_boot.mjs → government_vanilla_boot.mjs}

@@ -1,9 +1,9 @@
-// tests/governance_vanilla_boot.mjs — the VANILLA BOOT proof (BV1.R102, ADR 0151).
+// tests/government_vanilla_boot.mjs — the VANILLA BOOT proof (BV1.R102, ADR 0151).
 //
 // The core/host split only holds if a FRESH instance — one that has never been
 // branded, with no config/government.json on disk and no rows in
 // governance_builder_roles — comes up sane, anonymous, and powerless. This file is
-// that proof. It is deliberately scoped to what R96's tests/governance_config.mjs
+// that proof. It is deliberately scoped to what R96's tests/government_config.mjs
 // does NOT cover: that file pins the config CONTRACT (precedence, per-field merge,
 // the three fail-closed strips) driven by INJECTED fixtures; this one boots the real
 // thing off disk and asserts the three vanilla properties:
@@ -23,7 +23,7 @@
 // outcome ADR 0016 exists to rule out, and this file is what would go red.
 //
 // DB-free throughout: the config layer is pure + disk, and the grant side is asserted
-// against catalog.RANK_ROLE_SEED (code) rather than a live join. Crucially the two
+// against catalog.RANK_SEED (code) rather than a live join. Crucially the two
 // sides read DIFFERENT sources — the seed side reads catalog.js, the config side
 // reads the neutral pack's raw bytes — so a change to either one moves only one side
 // and the assertion goes red.
@@ -39,7 +39,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
-const { loadGovernanceConfig, resolveGovernanceConfig, NEUTRAL_PATH, INSTANCE_PATH } = require(path.join(GOV, 'config.js'));
+const { loadGovernmentConfig, resolveGovernmentConfig, NEUTRAL_PATH, INSTANCE_PATH } = require(path.join(GOV, 'config.js'));
 const { effectivePermissions, resolveBuilderPermissions } = require(path.join(GOV, 'resolver.js'));
 const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
@@ -51,10 +51,10 @@ const NEUTRAL_TEXT = fs.readFileSync(NEUTRAL_PATH, 'utf8');
 
 // The vanilla boot, exactly as a fresh instance performs it: real neutral pack on
 // disk, no instance pack, no env.
-const vanilla = () => loadGovernanceConfig({ env: NO_ENV });
+const vanilla = () => loadGovernmentConfig({ env: NO_ENV });
 // Everything config hands the boot, flattened — the ONLY authority a file could
 // possibly contribute.
-const configUnion = (cfg) => [...new Set(Object.values(cfg.roles).flatMap((r) => r.permissions))].sort();
+const configUnion = (cfg) => [...new Set(Object.values(cfg.ranks).flatMap((r) => r.permissions))].sort();
 
 // Runs `fn(dir)` against a scratch dir, always cleaned up. Nothing under it exists
 // until the test writes it, so `path.join(dir, 'absent.json')` is a genuine ENOENT.
@@ -68,9 +68,9 @@ const withScratchDir = (fn) => {
 test('a fresh instance boots the four rank-roles with usable labels and descriptions', () => {
   assert.equal(fs.existsSync(INSTANCE_PATH), false, 'fixture guard: this checkout IS the vanilla case (no instance pack)');
   const out = vanilla();
-  assert.deepEqual(Object.keys(out.roles).sort(), [...catalog.RANK_ORDER].sort());
+  assert.deepEqual(Object.keys(out.ranks).sort(), [...catalog.RANK_ORDER].sort());
   for (const rank of catalog.RANK_ORDER) {
-    const role = out.roles[rank];
+    const role = out.ranks[rank];
     assert.equal(role.seeded, true, `${rank} must boot as a SEEDED rank-role, not a custom one`);
     assert.ok(role.label && role.label !== rank, `${rank} must carry a human label from the neutral pack, got "${role.label}"`);
     assert.ok(role.description.length > 10, `${rank} must carry a usable description, got "${role.description}"`);
@@ -83,13 +83,13 @@ test('a core with NO config packs at all still boots four roles rather than none
   // set must never shrink below them — a boot that dropped `archon` would leave the
   // instance with grants no template describes.
   withScratchDir((dir) => {
-    const out = loadGovernanceConfig({
+    const out = loadGovernmentConfig({
       neutralPath: path.join(dir, 'absent-neutral.json'),
       instancePath: path.join(dir, 'absent-instance.json'),
       env: NO_ENV,
     });
-    assert.deepEqual(Object.keys(out.roles).sort(), [...catalog.RANK_ORDER].sort());
-    for (const rank of catalog.RANK_ORDER) assert.equal(out.roles[rank].label, rank, 'a role with no template falls back to its canonical rank name');
+    assert.deepEqual(Object.keys(out.ranks).sort(), [...catalog.RANK_ORDER].sort());
+    for (const rank of catalog.RANK_ORDER) assert.equal(out.ranks[rank].label, rank, 'a role with no template falls back to its canonical rank name');
   });
 });
 
@@ -104,8 +104,8 @@ test('a malformed config pack fails LOUD — it never degrades into a silent gra
   withScratchDir((dir) => {
     const broken = path.join(dir, 'broken.json');
     fs.writeFileSync(broken, '{ not json');
-    assert.throws(() => loadGovernanceConfig({ instancePath: broken, env: NO_ENV }), SyntaxError);
-    assert.throws(() => loadGovernanceConfig({ neutralPath: broken, env: NO_ENV }), SyntaxError);
+    assert.throws(() => loadGovernmentConfig({ instancePath: broken, env: NO_ENV }), SyntaxError);
+    assert.throws(() => loadGovernmentConfig({ neutralPath: broken, env: NO_ENV }), SyntaxError);
   });
 });
 
@@ -126,7 +126,7 @@ test('the identity guard is not a no-op — a planted host brand in the neutral
   // The mutation test, kept permanent. Both host literals fitness knows about must
   // trip it, in the exact file this task is about.
   for (const brand of ['Off the Boats', 'amazonprimea.com']) {
-    const poisoned = NEUTRAL_TEXT.replace('"roles"', `"instance": "${brand}",\n  "roles"`);
+    const poisoned = NEUTRAL_TEXT.replace('"ranks"', `"instance": "${brand}",\n  "ranks"`);
     const found = fitness.scanPromptIdentity('config/government.neutral.json', poisoned, '.json');
     assert.ok(found.length >= 1, `a "${brand}" literal in the neutral pack must be caught`);
   }
@@ -141,7 +141,7 @@ test('a vanilla boot grants ZERO permissions through config', () => {
   const out = vanilla();
   assert.deepEqual(configUnion(out), [], 'config contributed authority to a vanilla boot');
   for (const key of catalog.systemKeys()) {
-    for (const role of Object.values(out.roles)) {
+    for (const role of Object.values(out.ranks)) {
       assert.ok(!role.permissions.includes(key), `vanilla boot handed role "${role.key}" the system permission "${key}"`);
     }
   }
@@ -158,10 +158,10 @@ test('the rank-roles’ grants derive from catalog floors, never from the neutra
   // (code), the file side is the pack's raw bytes. Moving either one moves one side
   // only, so this cannot pass vacuously.
   for (const rank of catalog.RANK_ORDER) {
-    assert.ok(catalog.RANK_ROLE_SEED[rank].length > 0, `${rank} must hold a floor-derived grant set`);
+    assert.ok(catalog.RANK_SEED[rank].length > 0, `${rank} must hold a floor-derived grant set`);
   }
-  assert.ok(catalog.RANK_ROLE_SEED.archon.includes('deploy.push_main'), 'fixture guard: archon holds the seed’s system power');
-  assert.ok(!catalog.RANK_ROLE_SEED.xenos.includes('deploy.push_main'), 'fixture guard: the floors are a real ladder');
+  assert.ok(catalog.RANK_SEED.archon.includes('deploy.push_main'), 'fixture guard: archon holds the seed’s system power');
+  assert.ok(!catalog.RANK_SEED.xenos.includes('deploy.push_main'), 'fixture guard: the floors are a real ladder');
   for (const key of catalog.permissionKeys()) {
     assert.ok(!NEUTRAL_TEXT.includes(key), `the neutral pack names the permission "${key}" — grants belong to governance_002's floors, never to a file`);
   }
@@ -173,22 +173,22 @@ test('a POISONED neutral pack still cannot grant on a vanilla boot', () => {
   // edit to it is the vanilla-boot threat. A seeded role may be relabelled and never
   // re-granted; a custom template may hold operational keys and never a system one.
   const poisoned = JSON.parse(NEUTRAL_TEXT);
-  for (const rank of catalog.RANK_ORDER) poisoned.roles[rank].permissions = [...catalog.permissionKeys()];
-  poisoned.roles.superuser = { label: 'Superuser', permissions: [...catalog.permissionKeys()] };
-  const out = resolveGovernanceConfig({ neutral: poisoned, env: NO_ENV });
+  for (const rank of catalog.RANK_ORDER) poisoned.ranks[rank].permissions = [...catalog.permissionKeys()];
+  poisoned.ranks.superuser = { label: 'Superuser', permissions: [...catalog.permissionKeys()] };
+  const out = resolveGovernmentConfig({ neutral: poisoned, env: NO_ENV });
   for (const rank of catalog.RANK_ORDER) {
-    assert.deepEqual(out.roles[rank].permissions, [], `a poisoned neutral pack re-granted the seeded role "${rank}"`);
+    assert.deepEqual(out.ranks[rank].permissions, [], `a poisoned neutral pack re-granted the seeded role "${rank}"`);
   }
   for (const key of catalog.systemKeys()) {
-    assert.ok(!out.roles.superuser.permissions.includes(key), `a neutral-pack template smuggled the system permission "${key}"`);
+    assert.ok(!out.ranks.superuser.permissions.includes(key), `a neutral-pack template smuggled the system permission "${key}"`);
   }
-  assert.deepEqual(out.roles.superuser.permissions, [...catalog.grantableKeys()].sort(), 'operational keys are all a template may ever propose');
+  assert.deepEqual(out.ranks.superuser.permissions, [...catalog.grantableKeys()].sort(), 'operational keys are all a template may ever propose');
 });
 
 test('the env layer cannot widen authority on a vanilla boot', () => {
   const env = { [`${envPrefix()}_GOVERNANCE_ROLE_LABELS`]: 'archon=Owner' };
-  const out = loadGovernanceConfig({ env });
-  assert.equal(out.roles.archon.label, 'Owner', 'env may relabel');
+  const out = loadGovernmentConfig({ env });
+  assert.equal(out.ranks.archon.label, 'Owner', 'env may relabel');
   assert.deepEqual(configUnion(out), [], 'env must never add a permission');
 });
 

package/tests/government_vocabulary.mjs

@@ -0,0 +1,94 @@
+// tests/government_vocabulary.mjs — the ADR 0174 vocabulary wall
+// (goal 1000068 R07, task 1003008).
+//
+// The rule under test says: "role" means a CRAFT — Artist, Ideator, or Builder —
+// and never a rank. `scripts/gds/fitness.js` checkVocabularyWall enforces it on
+// the government surface, in the CI `unit` check.
+//
+// WHY THIS FILE EXISTS AT ALL. A naming rule is the easiest kind of check to
+// ship broken: allowlist enough and it passes forever while proving nothing, and
+// nobody notices because green is green. So the load-bearing tests here are the
+// MUTATION tests — plant a violation, assert the build reds. A rule that cannot
+// be made to fail is not a rule.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+
+// ---------- the wall holds on the real tree ----------
+
+test('the government surface is clean today', () => {
+  const r = fitness.checkVocabularyWall();
+  assert.equal(r.ok, true,
+    `the vocabulary wall is failing on the real tree:\n${r.violations.join('\n')}`);
+  assert.ok(r.note.includes('file(s) scanned'), 'the check must report what it scanned');
+});
+
+// ---------- the mutation tests: the rule can actually fail ----------
+
+test('a planted "role" on the government surface REDS the build', () => {
+  const planted = withPlantedLine('// a custom role may hold this');
+  assert.ok(planted.some((v) => /"role"/.test(v)),
+    'a "role" on the government surface must be caught — otherwise this rule is decoration');
+});
+
+test('a planted "governance" on the government surface REDS the build', () => {
+  const planted = withPlantedLine('// see the governance tab');
+  assert.ok(planted.some((v) => /"governance"/.test(v)),
+    'the pre-rename name must be caught — it is how the old vocabulary creeps back');
+});
+
+// Plant a line into a real government-surface file, run the check, restore.
+// Uses the real file rather than a fixture so the test exercises the same path
+// resolution the CI gate does.
+function withPlantedLine(line) {
+  const fs = require('node:fs');
+  const target = path.join(ROOT, 'modules', 'government', 'resolver.js');
+  const original = fs.readFileSync(target, 'utf8');
+  try {
+    fs.writeFileSync(target, `${original}\n${line}\n`);
+    return fitness.checkVocabularyWall().violations;
+  } finally {
+    fs.writeFileSync(target, original);
+  }
+}
+
+// ---------- the allowlist is small, reasoned, and real ----------
+
+test('every allowlist entry carries a written reason', () => {
+  for (const a of fitness.VOCAB_ALLOW) {
+    assert.ok(a.file && a.match, 'an allowlist entry needs a file and a match');
+    assert.ok(a.why && a.why.length > 60,
+      `${a.file} (${a.match}) must record WHY it is excused — an undocumented `
+      + 'exemption is indistinguishable from giving up.');
+  }
+});
+
+test('the allowlist stays small — growth means finish the rename, not add a line', () => {
+  // Every current entry is a COMPATIBILITY surface that must name the old thing:
+  // the legacy instance-config key, the legacy env var, the 308 route alias, and
+  // the manifest sentence that states the ban itself. If this cap is in the way,
+  // the honest move is almost always to delete a compatibility shim whose window
+  // has closed — not to raise the number.
+  assert.ok(fitness.VOCAB_ALLOW.length <= 5,
+    `the allowlist has grown to ${fitness.VOCAB_ALLOW.length}. A naming rule that `
+    + 'needs a long allowlist has stopped being evidence. Finish the rename or '
+    + 'retire a shim instead of raising this cap.');
+});
+
+test('every allowlist entry still matches something — no stale exemptions', () => {
+  const fs = require('node:fs');
+  for (const a of fitness.VOCAB_ALLOW) {
+    const abs = path.join(ROOT, a.file);
+    assert.ok(fs.existsSync(abs), `${a.file} is allowlisted but does not exist`);
+    const body = fs.readFileSync(abs, 'utf8').toLowerCase();
+    assert.ok(body.includes(a.match.toLowerCase()),
+      `${a.file} no longer contains "${a.match}" — the exemption outlived its cause `
+      + 'and should be deleted, not carried.');
+  }
+});

package/tests/hall_nav.mjs

@@ -127,21 +127,22 @@ function hrefResolves(item) {
 
 test('sidebar groups read by audience, in order', () => {
   const nav = parseNav(boot().sidebarHtml);
-  // 'Archon' → 'Governance' in ADR 0157: the group's pages opened to Metic, so a header
+  // 'Archon' → 'Governance' in ADR 0157 (the group's pages opened to Metic, so a header
+  // naming the top rank was wrong), then → 'Government' by ADR 0174: a header
   // reading "Archon" over items a Metic can open would misdescribe the ladder.
-  assert.deepEqual(nav.map((g) => g.label), ['', 'You', 'Community', 'Docs', 'Governance']);
+  assert.deepEqual(nav.map((g) => g.label), ['', 'You', 'Community', 'Docs', 'Government']);
   assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.
   // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
-  // so the nav entry reads 'governance' since task 1002710 (it said 'archon', which
+  // so the nav entry reads 'government' since ADR 0174 (it said 'archon', then
   // was stricter than the wall). requireProjectCuratePage is the wall server-side.
   assert.deepEqual(nav[2].items.map((i) => i.id), ['leaderboard', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
-  // 'governance' (the Roles tab, BV1.R113) is the group's one archon-gated item.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'governance']);
+  // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {
@@ -190,11 +191,11 @@ test('Achievements has no nav entry, but #achievements still routes to Standing'
 
 test('collapsible groups carry a stable storage key (collapse persistence)', () => {
   const html = boot().sidebarHtml;
-  // 'archon' → 'governance' follows the ADR 0157 relabel. The slug is the
+  // 'archon' → 'governance' → 'government' follows ADR 0157 then ADR 0174. The slug is the
   // hall-nav-collapsed storage key, so any builder who had collapsed the old "archon"
   // group gets the new one expanded once — cosmetic, and preferable to keeping a stale
   // slug that no longer matches the visible label.
-  for (const g of ['you', 'community', 'docs', 'governance']) {
+  for (const g of ['you', 'community', 'docs', 'government']) {
     assert.match(html, new RegExp(`data-group="${g}"`), `${g} is collapsible (hall-nav-collapsed key)`);
   }
   assert.ok(!/nav-group--collapsible[^>]*>(?!<button)/.test(html.split('<div class="nav-group')[1] || ''),