@bongos/core 1.19.186 → 1.19.187

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.186",
-  "core_contract": "1.19.186",
-  "source_commit": "6cbbcc0e845fce8a100732deadbed810ed8b7a0c",
+  "core_version": "1.19.187",
+  "core_contract": "1.19.187",
+  "source_commit": "403b66bde87b5b97d9aec89a8ab95794d525cb0d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T22:45:57.773Z",
+  "built_at": "2026-08-16T23:14:43.477Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 308,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1281,
+    "functional_verbatim": 1282,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1610,
-  "tree_sha256": "18131419ad0fd9f0d498fad1bd304caefa22719a484a3e7c92d50ad798a5dfb4",
+  "file_count": 1611,
+  "tree_sha256": "3d648b4ac642a80bde4746eaaab7f61fc06cd888117fc17bc66751d8f1e15fc8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -397,7 +397,7 @@
     {
       "path": "config/government.neutral.json",
       "mode": "0000644",
-      "sha256": "1d285d78452558c995d2c0568190f4377ac4ecfddea642f5a94949298a1e48b1"
+      "sha256": "70fe731d06dd9744178a27ec4379ee8c769f9a45d9a585f095b1765433767afc"
     },
     {
       "path": "config/modules.neutral.json",
@@ -1337,7 +1337,7 @@
     {
       "path": "docs/adr/0172-editable-rank-roles-substrate-axis.md",
       "mode": "0000644",
-      "sha256": "0bfe5ce46139bf9ee236868317cc80ee10eb8747d5606d0dd0fe9f2580ea5177"
+      "sha256": "2b813d75d1fb2aa3f9978a6dee7855f963444f1734bed5766ef269dae7637a2c"
     },
     {
       "path": "docs/adr/0172-per-craft-compensation-ideator-credit-lane.md",
@@ -1362,12 +1362,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "683e1e4a67d553e5ac75a4593c936ba8e273e07eace3ae623cb5a08b4d73c81c"
+      "sha256": "32c6c5fe14cf8684d353f0c73cde4b09d84ba61eabcb13e75c11bd5b7f9be2b7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "051c79468a982cd07b8a398b81346aed6c366b3d35347243891a2cebe79805fb"
+      "sha256": "7892d449572d19f058c6ac364d5b697e28d76bcd922d25d33b5203f5e1b5b7aa"
     },
     {
       "path": "docs/architecture.md",
@@ -2452,7 +2452,7 @@
     {
       "path": "modules/builder-settings/wandering-prefs.js",
       "mode": "0000644",
-      "sha256": "1e47da4c8a0db204baf3cbfaae516e254a3a273e37a0e1d68e4c0108b3fa7450"
+      "sha256": "e84c11a506bcd47b1f9b6be16bcd262d69aa7162f283c41da63687c5dd611845"
     },
     {
       "path": "modules/dev-box/CLAUDE.md",
@@ -2887,17 +2887,17 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "461a836f14eef90c2e1fcb2f6a3641e952a5904ef95fd0adc64bbf24d2bdc908"
+      "sha256": "b7073912e1aea3da33f876999a6beaae028142f0bf7bf66c1f95efc261b41272"
     },
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "57086a188ac6557b2f7c2c52e4a75f3960dfd1b7a54ce6fa3c0ce3a216411703"
+      "sha256": "183bca92e8ba897871287aeb58e6f9cfebcf9510b15d6cd9701066ce7c108edd"
     },
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "250edf5a95aadb06b6b4229bb202ae138c13585caa09f5d8cfeff4c1a982bcc9"
+      "sha256": "0e84802af9d1dd4c139548d4e621fc11896513415abf4e9eadfacbae33c40952"
     },
     {
       "path": "modules/government/migrations/governance_001_tables.sql",
@@ -2952,42 +2952,42 @@
     {
       "path": "modules/government/protected-surfaces.js",
       "mode": "0000644",
-      "sha256": "1855c8cd74b7aa00e6f87fb9d402a4be440ecbb26691a84418b6725b83dd2cf9"
+      "sha256": "f2acc38f5d9a361522944334f6db046a96b1d49aa2030f91391ab80752f42274"
     },
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "d7423da998a11b30cf8015dd5fd537c262f3e3d739ed02a1473debbc5eeb4e6c"
+      "sha256": "6d9a7520b2565b34bf002df016598543101639ccc384d81a622d313ed688acbc"
     },
     {
       "path": "modules/government/ranks.js",
       "mode": "0000644",
-      "sha256": "3b217eea2db398db99d580a3d3b2cef8574e3f14b2737e5764fe32d93a1ffc3d"
+      "sha256": "fb0903c3b885a81c99136cc6f080aaf7fc00f86bd1c45c235e37c7c45a462ffc"
     },
     {
       "path": "modules/government/resolver.js",
       "mode": "0000644",
-      "sha256": "7c86e964b457bb21192aaacd9f014ec1afabea1779c751fc1682f30fb9a8ac81"
+      "sha256": "bc30290bd0726f643f37984e4e537f503b89a3013bc8319d39d3af116dd08d94"
     },
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "8fd54465c050cd1e648e419df89ed4c39a853068fd792c5321e10f2ae691bf1d"
+      "sha256": "63e80d002e09d05a93238e15491a82dd733baea219814e8f7e2961ecb5373e1f"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
       "mode": "0000644",
-      "sha256": "55b6e1c2c5d02c71b319b40f19676f2e780c58fba5e4767a9b335919bfa13ff0"
+      "sha256": "e7fd1b378d48e93b946237261713a5791f7506dfdd7fcef2d843fe0e2ae8b370"
     },
     {
       "path": "modules/government/session-scopes.js",
       "mode": "0000644",
-      "sha256": "d27dc4b14eeaa2e06f7a8ea175b7928d972f424a1165f9ec3e6577ccdd2faf35"
+      "sha256": "1452e5a0480e7c3e1692ec210cb4d85f724d7ebb8dcf38048fb3369c483be46b"
     },
     {
       "path": "modules/government/session-scopes.json",
       "mode": "0000644",
-      "sha256": "813e4ddb324363278bfbd6b65260a54697673ac20f0df8e8992dd4ece57efea8"
+      "sha256": "acf5d2391c2228d09c33e6c9a5cfe850dcf8986abb80b30b0c7ff778795938b2"
     },
     {
       "path": "modules/grading/CLAUDE.md",
@@ -3212,17 +3212,17 @@
     {
       "path": "modules/hall-ui/public/government.css",
       "mode": "0000644",
-      "sha256": "0b59d6379cb7c61f270676db628c738aadfb24141ee7fdc29d194fae4e63637e"
+      "sha256": "5d58516ae9a07e045de49c7d2bad2b024dbea5207f9cf84cb2928ebd995cbd4e"
     },
     {
       "path": "modules/hall-ui/public/government.html",
       "mode": "0000644",
-      "sha256": "7c923d794a0c69e5e4ed48eeae326ce9ae070c896a693264de2882a99583ca52"
+      "sha256": "91c14637adc59dde39f47e51cfd243ddc1796b0a4108491f46aa64e68eea4a0d"
     },
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "98e28a3a54fddc29481645223e5f15bd295899cdbdc557c20a3b37f56335f978"
+      "sha256": "b7504f63fc1086c4367dbd76da7ac96ac4297a23f74456f90c5aebe5e974e034"
     },
     {
       "path": "modules/hall-ui/public/hall-kit.js",
@@ -3527,7 +3527,7 @@
     {
       "path": "modules/lifecycle/claim-eligibility.js",
       "mode": "0000644",
-      "sha256": "14fcf797d47f5a194fd316efc6f670c7beabed0d9102741a324850cdad59a596"
+      "sha256": "0c52ae165d304f0f08ca04c9a288ef7d8ffb07288282dcd7b2d503fced7cd744"
     },
     {
       "path": "modules/lifecycle/conflict-resolve.js",
@@ -3542,7 +3542,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "4408fc7ed6a7f82e7a55c96b260497e4c36eeaf703d1646cecb28514f1150643"
+      "sha256": "7fa58e9a9c09ba4857d57fe7cc1ed36d827d34f8cc1119ae42dc9dffdd4653b5"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -4257,12 +4257,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "169da149860df789f1900e847fa5f87394e13bddd9399eddd6e015d8b0290a26"
+      "sha256": "436a51acc58194d24659f69a9db624e06296dde02416cc2c3bf2ef2086f35ff4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f42ff0f356c3390d07015cc5c3fdebc8352e62f329f891ea25027739f0178bb2"
+      "sha256": "5dfe0314cb6157006b6eeb88e03cb8c2d2d20a6535d1f303903cb336cd06ae86"
     },
     {
       "path": "public-docs/index.html",
@@ -4887,7 +4887,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "887cf9daf51448f1ca031b4cc26d0695dd6e7577bb62bba6b619c91ea8e3024b"
+      "sha256": "65648d6d05b73dafc08194e843850b460b738a17b565a69a5234dd817386eea8"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "0d173ce76410884480e5545aad4201da26ff661516e6096de7a2ff2bd2a4015c"
+      "sha256": "8fd6f6ce798ebcde76cd2ac0ccf7129a60555506ce3d2fed818deb1eb331d42b"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5867,7 +5867,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8381e5e0b51bce1387c53e9518d693e74ac93f640d29dee0daa35931cdf2d4f5"
+      "sha256": "5034caf71ab288ff969e2ca31c4b80c5c97e62b327711f5de6e6e53e13ce6c13"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6062,7 +6062,7 @@
     {
       "path": "tests/auth_page_gate.mjs",
       "mode": "0000644",
-      "sha256": "3d4fd12068c6256ed2b74930fce0fd43ba1ed28f323cd80d4c24a984ca0eeba4"
+      "sha256": "3ed218eada5e36170217ded839fdc80d1cbad4ec71086d9707f00115d6c622d2"
     },
     {
       "path": "tests/auth_resolve_failure.mjs",
@@ -6770,99 +6770,104 @@
       "sha256": "412ca7c0bdc10abc90146b777571bcc7a180e19f0e3d058c6998ac2d33941940"
     },
     {
-      "path": "tests/governance_abuse_matrix.mjs",
+      "path": "tests/government_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "ddec9f958d49c45e140006d97f91ff9ffdcd0cf49b6041cc5098f6f46ee27597"
+      "sha256": "8f5354cbacf15c9b49500f96b265fe52f5c0d4500a4ec7b41b4819a149782893"
     },
     {
-      "path": "tests/governance_catalog.mjs",
+      "path": "tests/government_catalog.mjs",
       "mode": "0000644",
-      "sha256": "5611b3eeabcf98b37a6e36f131af2a8d1086b672017df12bb520d2471761bbee"
+      "sha256": "74cfbd482b689df40348af3bdaf050f056e216ff18fdd6add4136d4589b7cd92"
     },
     {
-      "path": "tests/governance_claim_eligibility.mjs",
+      "path": "tests/government_claim_eligibility.mjs",
       "mode": "0000644",
-      "sha256": "33cb7e88aaf45dac176216c29eb41d2ba5152779e53cb91779d81006f2e6c043"
+      "sha256": "2750f75bc0ef7f5286a2abe1d59e49ff2ea6ea300d3c1760dda31ae8ad74dc61"
     },
     {
-      "path": "tests/governance_config.mjs",
+      "path": "tests/government_config.mjs",
       "mode": "0000644",
-      "sha256": "c71ac0c7a7b519dac0fed1557f6ce5de52bf29bb830ee940e7cfcb29ce483205"
+      "sha256": "979deef4473243dc86ab13b9284104bce71f6a1ee839acc6c5a6db04770cd62c"
     },
     {
-      "path": "tests/governance_fold.mjs",
+      "path": "tests/government_fold.mjs",
       "mode": "0000644",
-      "sha256": "9a4feed7e93183e1558ef4c2012c94f1d93786abc2fcca429534d5248b00bebd"
+      "sha256": "5ea27c3008f17597984c72cf504e8e934a76a3ff76323c94b7ccb65e01c84ead"
     },
     {
-      "path": "tests/governance_fold_bench.mjs",
+      "path": "tests/government_fold_bench.mjs",
       "mode": "0000644",
-      "sha256": "ee9dd3cd6a9965272305cf3ddffab45a860efbe6cf6f0f4209fd458cd1dd5c16"
+      "sha256": "52f32270eff1105ca1164398c4a1ef279657573d9bb50c7588bd03981f2354a9"
     },
     {
-      "path": "tests/governance_live_proof.mjs",
+      "path": "tests/government_live_proof.mjs",
       "mode": "0000644",
-      "sha256": "29196719cfa414945a2eeec5b4f8fab30bcdc5bc24a7c184e0c5223d108ec67e"
+      "sha256": "af6423ac87819ff344c8a7804c0eda903a3e8c7633d1e4182e7d4f446d30cec0"
     },
     {
-      "path": "tests/governance_ownership_scope.mjs",
+      "path": "tests/government_ownership_scope.mjs",
       "mode": "0000644",
-      "sha256": "737343cc8955211c15215a155ed67e20047b5082283f33941f1a027dd435d602"
+      "sha256": "ad627c69ede0d79a2f38030d762cbd5bcf630cd6b067441f5763f261b829d1ba"
     },
     {
-      "path": "tests/governance_page_gates.mjs",
+      "path": "tests/government_page_gates.mjs",
       "mode": "0000644",
-      "sha256": "a1ef5da5f04e3bd82584e618b5be830c470d3c7f319de81d6ed41bddd954c8c0"
+      "sha256": "a0e02201ecc2ab17fc05dd8e20ce106c90dcffd936aa057f4a44cebe01109e4a"
     },
     {
-      "path": "tests/governance_parity.mjs",
+      "path": "tests/government_parity.mjs",
       "mode": "0000644",
-      "sha256": "12c821eb8c1e051b9de43a9759ea0c5954433b89a88ed4f83699e8cf726979dc"
+      "sha256": "7e1cc047dc75b9574bd64329974f8d1ae59b474d8719fbaae00314c7b2cc88e5"
     },
     {
-      "path": "tests/governance_principals.mjs",
+      "path": "tests/government_principals.mjs",
       "mode": "0000644",
-      "sha256": "d41e822485d4830e9c5e2154527ca5ebf63bda6281eace6ed7d77f380b74c28b"
+      "sha256": "c2a7d6b6d644b44ca2248fa0247261a4a548e25bd744fa7e029db550231d9da7"
     },
     {
-      "path": "tests/governance_protected_surfaces.mjs",
+      "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "875978b1f2b9a25b9345a6652ff6b7eb48325ec94e11408c45b15e2c0b21fa9a"
+      "sha256": "fd05f72404be0d007222793a6ed3a49904239f8bb354cddab6b052d74288b3b1"
     },
     {
-      "path": "tests/governance_require_permission.mjs",
+      "path": "tests/government_rank_sync.mjs",
       "mode": "0000644",
-      "sha256": "c546c5d7924031867fa90ebfed8cb9ee5f6906ab199ebb5e837c3ec25920e15c"
+      "sha256": "83462482dff692a3587edecd0e57e0d7638fa08076329a7591c0cb2222d50e47"
     },
     {
-      "path": "tests/governance_resolver.mjs",
+      "path": "tests/government_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "9153ae65a4f9f4a92fe7ccea791149137c7ec62bed7220bb61421b5c75af8de8"
+      "sha256": "36596b8870d2edc60bd810af5e10fa864d7f35e62e358d2dff58ed85b69922c0"
     },
     {
-      "path": "tests/governance_role_sync.mjs",
+      "path": "tests/government_resolver.mjs",
       "mode": "0000644",
-      "sha256": "79f837585e89c5f55ad523b4ab2e6e02507c40c1020d387df9fae72557425f29"
+      "sha256": "1e37f1902b59676c1004d4790078ddb39ad6dacd74a5e9ac861982fc33fe2b6d"
     },
     {
-      "path": "tests/governance_routes.mjs",
+      "path": "tests/government_routes.mjs",
       "mode": "0000644",
-      "sha256": "efc7bfe423db45280ae2ccdfccec2ab1e15e29b604052f1a36b732ac8edf9a73"
+      "sha256": "099954d8dbfa1fd3d503ee1b4825f9a3f10d5ae1e3694c600dd3f06e6a21a127"
     },
     {
-      "path": "tests/governance_seed.mjs",
+      "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "2543dcac04230360ce311fc13da51134ef1f4e879cb24046457337d2160e50bb"
+      "sha256": "97c9728181f98dcf2daed14a4f87b8acb0fa9fa1d6d55e628eaa06c60c539094"
     },
     {
-      "path": "tests/governance_session_scope.mjs",
+      "path": "tests/government_session_scope.mjs",
       "mode": "0000644",
-      "sha256": "084d6c0c1af8434a225a0ad9d770a36709debb04938ae70cc7a02e13187da5a4"
+      "sha256": "7aea1db75ada98b9e3756695c743516a3aac5f12a71d654adc383ae886c2568c"
     },
     {
-      "path": "tests/governance_vanilla_boot.mjs",
+      "path": "tests/government_vanilla_boot.mjs",
       "mode": "0000644",
-      "sha256": "ee9c6fe61ef2b747a7aebd2cc1a000282def4e9c8bd40c181f726c3494c8660c"
+      "sha256": "da3ebb855209f5de20b7d9ec45a9b09a068e251bc644e3090818e5a3f063b356"
+    },
+    {
+      "path": "tests/government_vocabulary.mjs",
+      "mode": "0000644",
+      "sha256": "71bd23242e53b1acd15fddedcb093790a847471c8c55485614d379d29e3065f3"
     },
     {
       "path": "tests/grade_aggregates_unavailable.mjs",
@@ -6937,7 +6942,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "9488c26f674a3e76ea3e7d4319f9c20ad392d1b7376dfb60dba18183c2d04e3e"
+      "sha256": "cb23b7a54220c3c53906fed559fb0c8a8e97375aa48dfc3cf64a1af88339e110"
     },
     {
       "path": "tests/hall_palette.mjs",

package/config/government.neutral.json

@@ -1,21 +1,21 @@
 {
-  "_note": "Neutral governance starter — the role TEMPLATES a fresh instance inherits (BV1.R96, ADR 0151). Resolved by modules/governance/config.js with the branding precedence: env override -> config/governance.json (instance) -> this file. TEMPLATES AND DEFAULTS ONLY. Live roles, grants, and per-builder assignments are DB rows (governance_roles / governance_role_permissions / governance_builder_roles), resolved server-side per request by resolver.js — putting a live grant here would make config a second source of authority truth and break ADR 0016. The four seeded rank-roles carry label + description only: their grants derive from catalog.js floors and are materialised by governance_002, so config may relabel a seeded role, never re-grant it. A CUSTOM role template may propose a `permissions` array, but a `system: true` key or a key the catalog does not define is stripped fail-closed — a config file is editable by anyone who can write the checkout, so it is not a trust boundary. Carries NO host identity: a vanilla instance boots sane from this file alone (proved by R102). To customise, copy to config/governance.json and edit there.",
-  "roles": {
+  "_note": "Neutral governance starter \u2014 the rank TEMPLATES a fresh instance inherits (BV1.R96, ADR 0151). Resolved by modules/government/config.js with the branding precedence: env override -> config/government.json (instance) -> this file. TEMPLATES AND DEFAULTS ONLY. Live ranks, grants, and per-builder assignments are DB rows (government_ranks / government_rank_permissions / government_builder_ranks), resolved server-side per request by resolver.js \u2014 putting a live grant here would make config a second source of authority truth and break ADR 0016. The four seeded ranks carry label + description only: their grants derive from catalog.js floors and are materialised by governance_002, so config may relabel a seeded rank, never re-grant it. A CUSTOM rank template may propose a `permissions` array, but a `system: true` key or a key the catalog does not define is stripped fail-closed \u2014 a config file is editable by anyone who can write the checkout, so it is not a trust boundary. Carries NO host identity: a vanilla instance boots sane from this file alone (proved by R102). To customise, copy to config/government.json and edit there.",
+  "ranks": {
     "xenos": {
       "label": "Xenos",
-      "description": "Seeded rank-role — the sandboxed entry rank. Own-work + public read."
+      "description": "Seeded rank \u2014 the sandboxed entry rank. Own-work + public read."
     },
     "thetes": {
       "label": "Thetes",
-      "description": "Seeded rank-role — graduated newcomer. Adds the general claim queue."
+      "description": "Seeded rank \u2014 graduated newcomer. Adds the general claim queue."
     },
     "metic": {
       "label": "Metic",
-      "description": "Seeded rank-role — the trusted working rank. Adds review/triage/authoring."
+      "description": "Seeded rank \u2014 the trusted working rank. Adds review/triage/authoring."
     },
     "archon": {
       "label": "Archon",
-      "description": "Seeded rank-role — top authority. Adds the admin + system (non-grantable) powers."
+      "description": "Seeded rank \u2014 top authority. Adds the admin + system (non-grantable) powers."
     }
   }
 }

package/docs/adr/0172-editable-rank-roles-substrate-axis.md

@@ -13,7 +13,7 @@ The governance tab (BV1.R110/R111) let an Archon build custom roles and toggle t
 Three facts made this cheaper and narrower than the read-only rendering suggested:
 
 1. **The rank roles' grants were already ordinary rows.** `<redacted>.sql` writes them into `governance_role_permissions` exactly like a custom role's. The immutability was a route-level refusal (`loadMutableRole` → `seeded_role_immutable`) plus a disabled toggle — policy, not structure. Nothing had to be remodelled to make them editable.
-2. **The `system` flag was carrying two different meanings.** ADR 0151 used one boolean for "trust-boundary power," but the twelve `system:true` keys split cleanly in two. Seven are **in-app**: a real route reads them through `requirePermission`, so a grant row genuinely confers them (`builder.rank.set`, `version.close`, `task.confirm.grade_bypass`, `dependency.cross_tier.manage`, `goal.scope.manage`, `governance.manage`, `gate_approval.decide`). Three are **substrate**: `deploy.push_main`, `path.protected.modify`, `infra.ssh` are enforced entirely outside the app by the pre-push hook, `main-audit.js`, the grader pre-pass and credential placement (ADR 0043) — `tests/governance_abuse_matrix.mjs` V10 asserts *no route consumes them* at all. Two are **principal** keys, held by an exact `builders.system_role` identity and by no role ever.
+2. **The `system` flag was carrying two different meanings.** ADR 0151 used one boolean for "trust-boundary power," but the twelve `system:true` keys split cleanly in two. Seven are **in-app**: a real route reads them through `requirePermission`, so a grant row genuinely confers them (`builder.rank.set`, `version.close`, `task.confirm.grade_bypass`, `dependency.cross_tier.manage`, `goal.scope.manage`, `governance.manage`, `gate_approval.decide`). Three are **substrate**: `deploy.push_main`, `path.protected.modify`, `infra.ssh` are enforced entirely outside the app by the pre-push hook, `main-audit.js`, the grader pre-pass and credential placement (ADR 0043) — `tests/government_abuse_matrix.mjs` V10 asserts *no route consumes them* at all. Two are **principal** keys, held by an exact `builders.system_role` identity and by no role ever.
 3. **A grant row for a substrate key is inert.** It resolves honestly and admits nothing (abuse matrix V8/V10/V11). So the interesting question was never "is it dangerous to allow" but "would allowing it be *true*" — and it would not be.
 
 The owner was presented with the choice and chose to delegate the in-app Archon powers as well as the operational ones, having been told the escalation consequence explicitly.

package/docs/api/openapi.json

@@ -5108,7 +5108,7 @@
           "government"
         ],
         "summary": "GET /government/assignments",
-        "description": "government.manage — every builder↔role assignment row.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — every builder↔rank assignment row.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5147,7 +5147,7 @@
           "government"
         ],
         "summary": "POST /government/assignments",
-        "description": "government.manage — assign a CUSTOM role to a builder. assigned_by is ALWAYS the session builder, never input (the audit trail's \"who did this\" must be the authenticated actor).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — assign a CUSTOM rank to a builder. assigned_by is ALWAYS the session builder, never input (the audit trail's \"who did this\" must be the authenticated actor).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5192,7 +5192,7 @@
           "government"
         ],
         "summary": "DELETE /government/assignments/:builderId/:rankKey",
-        "description": "government.manage — remove a custom-role assignment. Idempotent: `removed` says whether a row went away.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — remove a custom-rank assignment. Idempotent: `removed` says whether a row went away.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5256,7 +5256,7 @@
           "government"
         ],
         "summary": "GET /government/permissions",
-        "description": "government.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. Principals are read-only by construction. Three flags the tab renders its locks from, and the tab must read all three rather than just `grantable`, because since ADR 0172 grantability depends on WHICH role is selected: • `grantable` — the CUSTOM-role answer (system:false). Unchanged meaning. • `system` — an in-app Archon power: locked on a custom role, togglable on a sub-Archon rank-role. • `substrate` — locked EVERYWHERE, on every role, forever (ADR 0043).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. Principals are read-only by construction. Three flags the tab renders its locks from, and the tab must read all three rather than just `grantable`, because since ADR 0172 grantability depends on WHICH rank is selected: • `grantable` — the CUSTOM-rank answer (system:false). Unchanged meaning. • `system` — an in-app Archon power: locked on a custom rank, togglable on a sub-Archon rank. • `substrate` — locked EVERYWHERE, on every rank, forever (ADR 0043).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5297,7 +5297,7 @@
           "government"
         ],
         "summary": "GET /government/ranks",
-        "description": "government.manage — the full role list with each role's grants.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — the full rank list with each rank's grants.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5336,7 +5336,7 @@
           "government"
         ],
         "summary": "POST /government/ranks",
-        "description": "government.manage — create a CUSTOM role (is_system false, no seeded_rank — the seeded four exist only via governance_002). Grants are added one at a time via the toggle below, so creation carries none.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — create a CUSTOM rank (is_system false, no seeded_rank — the seeded four exist only via governance_002). Grants are added one at a time via the toggle below, so creation carries none.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5388,7 +5388,7 @@
           "government"
         ],
         "summary": "PUT /government/ranks/:rankKey/permissions/:permissionKey",
-        "description": "government.manage — grant one permission to a role (the toggle's ON half). The order of refusals is the authority order: role exists → role is not the Archon one → the key exists → the key is grantable TO THIS ROLE.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — grant one permission to a rank (the toggle's ON half). The order of refusals is the authority order: rank exists → rank is not the Archon one → the key exists → the key is grantable TO THIS RANK.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -5514,7 +5514,7 @@
           "government"
         ],
         "summary": "POST /government/ranks/:rankKey/reset",
-        "description": "government.manage — restore a SEEDED rank-role to its catalog default (ADR 0172). The counterweight to making the rank-roles editable: a rank's grant set is ~60 rows, so an owner who drifts one has no practical way back by clicking, and \"what does Trusted mean by default\" is a question only the catalog can answer. Restores catalog.seedForRank(role.seeded_rank) — the same derivation governance_002 seeded from, so the answer cannot drift from the floors even after later catalog edits. Deliberately NOT offered for a CUSTOM role: a custom role has no catalog default to return to (its \"default\" is the empty set it was created with), so the honest verb there is revoking the grants, which the toggle already does.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — restore a SEEDED rank to its catalog default (ADR 0172). The counterweight to making the ranks editable: a rank's grant set is ~60 rows, so an owner who drifts one has no practical way back by clicking, and \"what does Trusted mean by default\" is a question only the catalog can answer. Restores catalog.seedForRank(rank.seeded_rank) — the same derivation governance_002 seeded from, so the answer cannot drift from the floors even after later catalog edits. Deliberately NOT offered for a CUSTOM rank: a custom rank has no catalog default to return to (its \"default\" is the empty set it was created with), so the honest verb there is revoking the grants, which the toggle already does.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [

package/docs/api-reference.md

@@ -218,15 +218,15 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/government/assignments` | `archon` | — | government.manage — every builder↔role assignment row. |
-| POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM role to a builder. |
-| DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-role assignment. |
+| GET | `/api/bongos/government/assignments` | `archon` | — | government.manage — every builder↔rank assignment row. |
+| POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM rank to a builder. |
+| DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-rank assignment. |
 | GET | `/api/bongos/government/permissions` | `archon` | — | government.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. |
-| GET | `/api/bongos/government/ranks` | `archon` | — | government.manage — the full role list with each role's grants. |
-| POST | `/api/bongos/government/ranks` | `archon` | `rank_key`, `label`, `description` | government.manage — create a CUSTOM role (is_system false, no seeded_rank — the seeded four exist only via governance_002). |
-| PUT | `/api/bongos/government/ranks/:rankKey/permissions/:permissionKey` | `archon` | — | government.manage — grant one permission to a role (the toggle's ON half). |
+| GET | `/api/bongos/government/ranks` | `archon` | — | government.manage — the full rank list with each rank's grants. |
+| POST | `/api/bongos/government/ranks` | `archon` | `rank_key`, `label`, `description` | government.manage — create a CUSTOM rank (is_system false, no seeded_rank — the seeded four exist only via governance_002). |
+| PUT | `/api/bongos/government/ranks/:rankKey/permissions/:permissionKey` | `archon` | — | government.manage — grant one permission to a rank (the toggle's ON half). |
 | DELETE | `/api/bongos/government/ranks/:rankKey/permissions/:permissionKey` | `archon` | — | government.manage — revoke a grant (the toggle's OFF half). |
-| POST | `/api/bongos/government/ranks/:rankKey/reset` | `archon` | — | government.manage — restore a SEEDED rank-role to its catalog default (ADR 0172). |
+| POST | `/api/bongos/government/ranks/:rankKey/reset` | `archon` | — | government.manage — restore a SEEDED rank to its catalog default (ADR 0172). |
 
 ## `grades` (1)
 

package/modules/builder-settings/wandering-prefs.js

@@ -125,27 +125,27 @@ const LEVEL_CONTRACT = Object.freeze({
 // not name carries NO wandering metadata and resolves to the safest floor
 // (Locked), the same fail-closed posture the resolver takes for a rank with no
 // seeded role.
-const ROLE_WANDERING = Object.freeze({
+const RANK_WANDERING = Object.freeze({
   xenos: Object.freeze({ default: 0, ceiling: 0 }),
   thetes: Object.freeze({ default: 1, ceiling: 1 }),
   metic: Object.freeze({ default: 2, ceiling: 3 }),
   archon: Object.freeze({ default: 3, ceiling: 3 }),
 });
-const NO_ROLE_WANDERING = Object.freeze({ default: 0, ceiling: 0 });
+const NO_RANK_WANDERING = Object.freeze({ default: 0, ceiling: 0 });
 
-function roleWandering(roleKey) {
-  return Object.prototype.hasOwnProperty.call(ROLE_WANDERING, roleKey)
-    ? ROLE_WANDERING[roleKey]
-    : NO_ROLE_WANDERING;
+function rankWandering(rankKey) {
+  return Object.prototype.hasOwnProperty.call(RANK_WANDERING, rankKey)
+    ? RANK_WANDERING[rankKey]
+    : NO_RANK_WANDERING;
 }
 
 // DERIVED projections of the metadata above, kept because scripts/gds/session-eval.js
 // and the /me payload read them by rank. Deriving them means the two views cannot drift.
 const RANK_DEFAULT = Object.freeze(
-  Object.fromEntries(Object.entries(ROLE_WANDERING).map(([role, meta]) => [role, meta.default])),
+  Object.fromEntries(Object.entries(RANK_WANDERING).map(([role, meta]) => [role, meta.default])),
 );
 const RANK_MAX = Object.freeze(
-  Object.fromEntries(Object.entries(ROLE_WANDERING).map(([role, meta]) => [role, meta.ceiling])),
+  Object.fromEntries(Object.entries(RANK_WANDERING).map(([role, meta]) => [role, meta.ceiling])),
 );
 
 const TOP_LEVEL = LEVELS.length - 1; // 3
@@ -160,7 +160,7 @@ for (const key of LEVELS) {
 for (let i = 0; i < LEVELS.length; i++) {
   if (LEVEL_META[LEVELS[i]].n !== i) throw new Error(`wandering-prefs: LEVEL_META.${LEVELS[i]}.n must equal its index ${i}`);
 }
-for (const [role, meta] of Object.entries(ROLE_WANDERING)) {
+for (const [role, meta] of Object.entries(RANK_WANDERING)) {
   if (!isLevelInt(meta.default)) throw new Error(`wandering-prefs: role '${role}' has a non-level default`);
   if (!isLevelInt(meta.ceiling)) throw new Error(`wandering-prefs: role '${role}' has a non-level ceiling`);
   if (meta.default > meta.ceiling) throw new Error(`wandering-prefs: default > ceiling for role '${role}'`);
@@ -182,11 +182,11 @@ function levelIndex(key) {
 }
 
 function defaultLevelForRank(rank) {
-  return roleWandering(rank).default;
+  return rankWandering(rank).default;
 }
 
 function maxLevelForRank(rank) {
-  return roleWandering(rank).ceiling;
+  return rankWandering(rank).ceiling;
 }
 
 // The override a builder has stored (the raw 'wandering' key off behavior_prefs),
@@ -303,8 +303,8 @@ module.exports = {
   LEVELS,
   LEVEL_META,
   LEVEL_CONTRACT,
-  ROLE_WANDERING,
-  roleWandering,
+  RANK_WANDERING,
+  rankWandering,
   RANK_DEFAULT,
   RANK_MAX,
   TOP_LEVEL,