@bongos/core 1.19.186 → 1.19.188

package/modules/government/session-scopes.json

@@ -1,12 +1,12 @@
 {
   "_comment": [
     "The SESSION-SCOPE registry (BV1.R99, ADR 0151 §3; the model behind ADR 0053).",
-    "A session's scope is capability attached to the TOKEN, orthogonal to the builder's roles.",
+    "A session's scope is capability attached to the TOKEN, orthogonal to the builder's ranks.",
     "Each row declares EITHER unscoped:true (the session narrows nothing) OR a deny-by-default",
     "permissions allow-list (unlisted => denied). A scope can only ever NARROW: effective",
-    "authority is (the builder's role permissions) INTERSECT (this allow-list), never a union.",
-    "Every key here is validated against modules/governance/catalog.js at load by",
-    "modules/governance/session-scopes.js — unknown, system:true and principal keys are refused.",
+    "authority is (the builder's rank permissions) INTERSECT (this allow-list), never a union.",
+    "Every key here is validated against modules/government/catalog.js at load by",
+    "modules/government/session-scopes.js — unknown, system:true and principal keys are refused.",
     "Read as DATA by src/bongos/auth.js (fs, never require — ADR 0083's one-way rule)."
   ],
   "scopes": [
@@ -14,7 +14,7 @@
       "source": "cli",
       "label": "CLI session",
       "unscoped": true,
-      "note": "Device Flow token on a builder's own machine — inside the trust boundary, carries the builder's full role authority."
+      "note": "Device Flow token on a builder's own machine — inside the trust boundary, carries the builder's full rank authority."
     },
     {
       "source": "web",

package/modules/hall-ui/public/government.css

@@ -1,4 +1,4 @@
-/* governance.css — Page-local styles for the Governance page (roles /
+/* government.css — Page-local styles for the Government page (ranks /
    permissions / assignments — BV1.R111, ADR 0151). Built on the shared design
    tokens (style.css), mirroring gate.css's card + pill idiom; the ?v= cache-bust
    is stamped from this file's content hash at boot (src/asset-version.js). */

package/modules/hall-ui/public/government.html

@@ -73,6 +73,6 @@
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
-<script src="/builders/government.js?v=2026-08-06-governance"></script>
+<script src="/builders/government.js?v=2026-08-16-government"></script>
 </body>
 </html>

package/modules/hall-ui/public/government.js

@@ -26,7 +26,7 @@
 // web sign-in.
 //
 // DELIBERATELY NOT IN THE SIDEBAR YET: the nav entry + the server page gate are
-// R113 (the next slice) — tests/hall_nav.mjs pins the Governance nav group and
+// R113 (the next slice) — tests/hall_nav.mjs pins the Government nav group and
 // grows with that slice, not this one. Until then the page is reached by URL.
 
 (() => {
@@ -402,7 +402,7 @@
 
   async function init() {
     // Confirm rank for a friendly sealed notice; the server gates the page and
-    // every /governance endpoint on `government.manage` regardless (cosmetic
+    // every /government endpoint on `government.manage` regardless (cosmetic
     // defence-in-depth). government.manage is system:true, so only the archon
     // rank can hold it — rank is an accurate client-side proxy.
     let me;
@@ -424,7 +424,7 @@
     } catch (err) {
       if (err && err.kind === '401') return;
       if (err && err.kind === '403') { showSealed(); return; }
-      document.getElementById('gov-grid').innerHTML = `<p class="gov-empty">Could not load governance data just now.</p>`;
+      document.getElementById('gov-grid').innerHTML = `<p class="gov-empty">Could not load government data just now.</p>`;
     }
   }
 

package/modules/lifecycle/claim-eligibility.js

@@ -21,7 +21,7 @@
 // separate, consecutive gates — see claimTask / claimTasksBatch /
 // validateClaimBatch.
 //
-// Pure + DB-free so tests/governance_claim_eligibility.mjs can exercise every
+// Pure + DB-free so tests/government_claim_eligibility.mjs can exercise every
 // rank × permission × requires_rank combination without Postgres.
 
 // The two catalog keys this axis reads (modules/governance/catalog.js). Exported

package/modules/lifecycle/db.js

@@ -197,7 +197,7 @@ const GENERAL_QUEUE_RANKS = new Set(LIVE_RANK_LADDER.filter((r) => r !== 'xenos'
 // `task.claim.newcomer` (claim-eligibility.js) and keep this as the fallback for a
 // builder whose role row the run-once compat backfill never created. It stays
 // exported: tests/rank_gate.mjs pins it, and it is the oracle the parity test in
-// tests/governance_claim_eligibility.mjs compares the permission predicate against.
+// tests/government_claim_eligibility.mjs compares the permission predicate against.
 
 function xenosClaimAllowed(rank, newcomerFriendly) {
   if (GENERAL_QUEUE_RANKS.has(rank)) return true;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.186",
+  "version": "1.19.188",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.186",
+      "version": "1.19.188",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.186",
+  "version": "1.19.188",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1640,6 +1640,141 @@ function checkWriteRoutesValidated() {
 
 // ---- runner ----------------------------------------------------------------
 
+
+// ── Check 19 — the ADR 0174 vocabulary wall (goal 1000068 R07, task 1003008) ──
+//
+// "Role" means ONE thing in this codebase: a craft — Artist, Ideator, or Builder.
+// The permission system is the GOVERNMENT and the positions in it are RANKS.
+// Before ADR 0174 the same word named both, and goal 1000066 was about to claim
+// it for the crafts while modules/governance/ still used it for the ladder. This
+// check is what stops that collision reforming the first time someone copies an
+// old file.
+//
+// TWO RULES, both scoped to the GOVERNMENT SURFACE — not the whole repo. A repo-
+// wide ban would be wrong: `builders.system_role` is a core column for machine
+// identities, Discord's API owns its own "role" noun, and the crafts are supposed
+// to use the word.
+//
+//   1. no "role" under modules/government/ or on the Government hall page
+//   2. no "governance" there either — the old name of the same surface
+//
+// EXCLUDED BY CONSTRUCTION (not by allowlist):
+//   • modules/government/migrations/governance_*.sql — the already-applied
+//     migrations keep their filenames forever (schema_migrations is stem-keyed;
+//     renaming one re-runs it, and governance_002 is a seed/backfill). Their
+//     bodies necessarily name the pre-rename tables they created.
+//   • docs/adr/, docs/session-logs/, docs/governance/ — the historical record.
+//     An ADR describes a decision at a point in time; rewriting it to match
+//     today's vocabulary would erase the evidence that the words changed.
+//
+// The ALLOWLIST below is deliberately tiny and each entry carries its reason. A
+// rule that passes because everything is suppressed reads as evidence while
+// proving nothing — if this list grows, that is the signal to finish the rename,
+// not to add a line.
+const VOCAB_ALLOW = [
+  {
+    file: 'modules/government/config.js',
+    match: 'roles',
+    why: 'the legacy INSTANCE-config key fallback. The core ships `ranks`, but an '
+       + 'external self-hosted instance may still have a config/government.json '
+       + 'authored as `roles`; reading it is what stops their templates vanishing '
+       + 'on upgrade. Removing this line would break them silently.',
+  },
+  {
+    file: 'modules/government/config.js',
+    match: 'governance_role_labels',
+    why: 'the legacy ENV-VAR fallback. <PREFIX>_GOVERNMENT_RANK_LABELS is the current '
+       + 'name, but an operator sets this in their own shell or env file, outside this '
+       + 'repo, so the old spelling is still read. Dropping it would silently stop '
+       + 'honouring a label override someone already configured.',
+  },
+  {
+    file: 'modules/government/routes/government.js',
+    match: '/governance',
+    why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
+       + 'compatibility shim has to name the thing it is compatible with. Note the '
+       + 'match requires the leading SLASH — this permits citing the legacy PATH, not '
+       + 'the bare word. Delete with the alias block one release after the rename ships.',
+  },
+  {
+    file: 'modules/government/module.json',
+    match: 'role',
+    why: 'the manifest states the rule itself — "The word `role` is deliberately '
+       + 'absent here". Meta-commentary about the ban has to be able to name it.',
+  },
+];
+
+// A line CITING a historical artifact by its real name: an ADR filename, the
+// docs/governance/ evidence folder, or one of the already-applied
+// governance_NNN migrations. These names are permanent (see the header), so a
+// reference to one is a citation, not drift.
+const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|governance_0\d\d/;
+
+const VOCAB_SURFACE = [
+  'modules/government',
+  'modules/hall-ui/public/government.js',
+  'modules/hall-ui/public/government.html',
+  'modules/hall-ui/public/government.css',
+];
+const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
+const VOCAB_BANNED = [
+  { re: /\brole/i,       label: 'role',       hint: '"role" is reserved for the crafts (Artist / Ideator / Builder). On this surface the noun is RANK.' },
+  { re: /governance/i,    label: 'governance', hint: 'the pre-ADR-0174 name of this surface. It is the GOVERNMENT now.' },
+];
+
+function vocabFilesToScan() {
+  const out = [];
+  const walk = (abs, rel) => {
+    let st;
+    try { st = fs.statSync(abs); } catch { return; }
+    if (st.isDirectory()) {
+      // the historical migrations keep their names + bodies (see header)
+      if (rel.endsWith('/migrations')) return;
+      for (const e of fs.readdirSync(abs)) walk(path.join(abs, e), `${rel}/${e}`);
+      return;
+    }
+    if (VOCAB_EXTS.has(path.extname(abs))) out.push({ abs, rel });
+  };
+  for (const s of VOCAB_SURFACE) walk(path.join(CORE_ROOT, s), s);
+  return out;
+}
+
+function checkVocabularyWall() {
+  const violations = [];
+  let scanned = 0;
+  for (const { abs, rel } of vocabFilesToScan()) {
+    scanned += 1;
+    const lines = fs.readFileSync(abs, 'utf8').split('\n');
+    lines.forEach((line, i) => {
+      // `role="…"` is HTML's own ARIA attribute — a different word that happens to
+      // be spelled the same. Strip attributes before matching rather than
+      // allowlisting each occurrence: this is a property of HTML, not of any one file.
+      const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
+      for (const b of VOCAB_BANNED) {
+        if (!b.re.test(scanLine)) continue;
+        // A REFERENCE to a historical artifact by its real name is not a
+        // vocabulary violation — it is a citation. The artifacts themselves are
+        // excluded by construction (see the header); naming one has to be legal
+        // too, or the code could not point at the migration that created its own
+        // tables. Same principle, applied to the line rather than the file.
+        if (VOCAB_HISTORICAL_REF.test(scanLine)) continue;
+        const excused = VOCAB_ALLOW.some((a) => a.file === rel && scanLine.toLowerCase().includes(a.match));
+        if (excused) continue;
+        violations.push(`${rel}:${i + 1}: "${b.label}" — ${b.hint}  →  ${line.trim().slice(0, 90)}`);
+      }
+    });
+  }
+  return {
+    name: 'the word "role" means a craft, never a rank (ADR 0174)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} government-surface file(s) scanned for "role"/"governance"; `
+        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies). Historical migrations + docs/adr are excluded by construction, not suppressed.`,
+  };
+}
+
 const CHECKS = [
   checkCoreHostBoundary,
   checkClaudeMdBudget,
@@ -1661,6 +1796,7 @@ const CHECKS = [
   checkCoreRequiresExcludedConfig, // task 1824 — core→instance-config require guard
   checkCoreRequiresExcludedModule, // Check 16b — task 2135: core→excluded-module require guard (R89 split)
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
+  checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
 ];
 
@@ -1690,6 +1826,8 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
+  checkVocabularyWall,
+  VOCAB_ALLOW,
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/src/bongos/auth.js

@@ -1191,7 +1191,7 @@ async function resolveSession(req) {
 // inside the session's scope at all". That projection is deliberately the ROLE-FREE
 // half — folding the builder's roles in here would change who can reach the
 // bootstrap routes (a builder on a rank with no seeded governance role resolves to
-// zero permissions by design — see tests/governance_parity.mjs Part D), and R99 is
+// zero permissions by design — see tests/government_parity.mjs Part D), and R99 is
 // a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
 //
 // GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
@@ -1442,7 +1442,7 @@ function signInWithReturn(req) {
 // page.view.government's floor archon→metic and the name stopped being true; the
 // floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
-// (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
+// (tests/government_parity.mjs Part D): a builder on a reserved/divine rank holds
 // no seeded role, so they now fail a page gate a bare rank test would have
 // admitted. That is a TIGHTENING, never a widening.
 //

package/src/module-api.js

@@ -799,8 +799,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.184 with no explicit bump. run 31976564067. (task 1002620)
 //   1.19.186 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.185 with no explicit bump. run 31977207459. (task 1002620)
+//   1.19.187 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.186 with no explicit bump. run 31978548058. (task 1002620)
+//   1.19.188 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.187 with no explicit bump. run 31978931152. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.186'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.188'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -31,8 +31,8 @@ const auth = require('../src/bongos/auth.js');
 
 // BV1.R107: the page gate now also resolves a permission (page.view.public) through
 // the `governance` kernel port, so an authenticated request needs the port stubbed —
-// exactly as tests/governance_require_permission.mjs stubs it for requirePermission.
-// The audience is unchanged; tests/governance_page_gates.mjs is the parity proof.
+// exactly as tests/government_require_permission.mjs stubs it for requirePermission.
+// The audience is unchanged; tests/government_page_gates.mjs is the parity proof.
 const seams = require('../src/module-seams.js');
 const catalog = require('../modules/government/catalog.js');
 seams._reset();

package/tests/{governance_abuse_matrix.mjs → government_abuse_matrix.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_abuse_matrix.mjs — the abuse matrix (BV1.R112, ADR 0151).
+// tests/government_abuse_matrix.mjs — the abuse matrix (BV1.R112, ADR 0151).
 //
 // Mechanically proves the safety guarantee the governance module asserts in
 // prose: NO configuration surface can grant a `system: true` (trust-boundary)
@@ -32,10 +32,10 @@
 //     V12 seed integrity: no rank-role below archon holds a system key; no
 //         rank-role at all holds a principal key
 //
-// DB-free (the governance_routes.mjs pattern): real router + real
+// DB-free (the government_routes.mjs pattern): real router + real
 // requirePermission over a stub `governance` port, db sibling monkeypatched.
 //
-// Run:  node tests/governance_abuse_matrix.mjs
+// Run:  node tests/government_abuse_matrix.mjs
 
 import { strict as assert } from 'node:assert';
 import { test, after } from 'node:test';
@@ -108,16 +108,16 @@ test('every system permission floors at archon or is a principal (never seeded l
 
 const calls = [];
 const stub = {
-  getRoleByKey: async (k) => (SEEDED_ROLES.includes(k)
+  getRankByKey: async (k) => (SEEDED_ROLES.includes(k)
     ? { rank_key: k, label: k, is_system: true, seeded_rank: k }
     : { rank_key: k, label: k, is_system: false, seeded_rank: null }),
-  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
-  grantRolePermission: async () => true,
-  revokeRolePermission: async () => true,
-  resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
-  assignRole: async () => true,
-  unassignRole: async () => true,
-  listRolesWithGrants: async () => [],
+  createRank: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+  grantRankPermission: async () => true,
+  revokeRankPermission: async () => true,
+  resetRankGrants: async ({ permissionKeys }) => permissionKeys.length,
+  assignRank: async () => true,
+  unassignRank: async () => true,
+  listRanksWithGrants: async () => [],
   listAssignments: async () => [],
 };
 const REAL = {};
@@ -138,11 +138,11 @@ function grant(keys) {
 }
 grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
+const buildGovernmentRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-app.use(buildGovernanceRouter());
+app.use(buildGovernmentRouter());
 const server = http.createServer(app);
 await new Promise((r) => server.listen(0, '127.0.0.1', r));
 const BASE = `http://127.0.0.1:${server.address().port}`;
@@ -171,7 +171,7 @@ test('V1: EVERY system permission is refused onto a custom role, before the db',
     const r = await call('PUT', `/government/ranks/custom-role/permissions/${k}`);
     assert.equal(r.status, 400, `${k} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable', k);
-    assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
+    assert.equal(calls.filter(([c]) => c === 'grantRankPermission').length, 0,
       `${k}: the refusal must land BEFORE any db write`);
   }
 });
@@ -188,13 +188,13 @@ test('V2a: the ARCHON rank-role refuses EVERY write — grant, revoke and reset
       const r = await call(method, `/government/ranks/archon/permissions/${k}`);
       assert.equal(r.status, 403, `archon ← ${method} ${k} must be refused`);
       assert.equal(r.json.error.code, 'archon_rank_immutable', `archon ← ${method} ${k}`);
-      assert.equal(calls.filter(([c]) => c === 'grantRolePermission' || c === 'revokeRolePermission').length, 0);
+      assert.equal(calls.filter(([c]) => c === 'grantRankPermission' || c === 'revokeRankPermission').length, 0);
     }
   }
   const r = await call('POST', '/government/ranks/archon/reset');
   assert.equal(r.status, 403, 'reset must not be a back door into the archon role');
   assert.equal(r.json.error.code, 'archon_rank_immutable');
-  assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
+  assert.equal(calls.filter(([c]) => c === 'resetRankGrants').length, 0);
 });
 
 test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL key', async () => {
@@ -204,7 +204,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
       const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 400, `${role} ← ${k} must be refused`);
       assert.equal(r.json.error.code, 'permission_not_grantable', `${role} ← ${k}`);
-      assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
+      assert.equal(calls.filter(([c]) => c === 'grantRankPermission').length, 0,
         `${role} ← ${k}: the refusal must land BEFORE any db write`);
     }
   }
@@ -215,7 +215,7 @@ test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 l
     for (const k of [...OWNER_POWERS, 'idea.triage']) {
       const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 200, `${role} ← ${k} must be ACCEPTED — this delegation is the owner's decision (ADR 0172)`);
-      assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 1, `${role} ← ${k} must reach the db`);
+      assert.equal(calls.filter(([c]) => c === 'grantRankPermission').length, 1, `${role} ← ${k} must reach the db`);
     }
   }
 });
@@ -224,7 +224,7 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
     const r = await call('POST', `/government/ranks/${role}/reset`);
     assert.equal(r.status, 200, `${role} must be resettable`);
-    const [, args] = calls.find(([c]) => c === 'resetRoleGrants');
+    const [, args] = calls.find(([c]) => c === 'resetRankGrants');
     assert.deepEqual([...args.permissionKeys].sort(), [...catalog.seedForRank(role)].sort(),
       `${role} reset must write exactly the floor-derived seed`);
     for (const k of args.permissionKeys) {
@@ -236,7 +236,7 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   const r = await call('POST', '/government/ranks/custom-role/reset');
   assert.equal(r.status, 400);
   assert.equal(r.json.error.code, 'rank_has_no_default');
-  assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
+  assert.equal(calls.filter(([c]) => c === 'resetRankGrants').length, 0);
 });
 
 test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer — R95b)', async () => {
@@ -244,7 +244,7 @@ test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer —
     const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: role });
     assert.equal(r.status, 403, `assigning seeded role ${role} must be refused`);
     assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden', role);
-    assert.equal(calls.filter(([c]) => c === 'assignRole').length, 0);
+    assert.equal(calls.filter(([c]) => c === 'assignRank').length, 0);
   }
 });
 
@@ -267,10 +267,10 @@ test('V4: a clean role create is never system and carries no grants', async () =
   assert.equal(r.json.rank.is_system, false, 'a created role is never system');
   assert.equal(r.json.rank.seeded_rank, null);
   assert.deepEqual(r.json.rank.permissions, [], 'creation carries no grants');
-  const c = calls.find(([k]) => k === 'createRole');
+  const c = calls.find(([k]) => k === 'createRank');
   assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'rankKey'],
     'nothing beyond the four whitelisted fields reaches the db');
-  assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
+  assert.equal(calls.filter(([k]) => k === 'grantRankPermission').length, 0);
 });
 
 test('V5: a caller without government.manage cannot reach ANY write vector at all', async () => {
@@ -295,35 +295,35 @@ test('V5: a caller without government.manage cannot reach ANY write vector at al
 // ===========================================================================
 
 test('V6: a config template proposing EVERY system key resolves with all of them stripped', () => {
-  const resolved = govConfig.resolveGovernanceConfig({
-    instance: { roles: { 'evil-template': { label: 'Evil', permissions: [...SYSTEM_KEYS, 'no.such.key', 'idea.triage'] } } },
+  const resolved = govConfig.resolveGovernmentConfig({
+    instance: { ranks: { 'evil-template': { label: 'Evil', permissions: [...SYSTEM_KEYS, 'no.such.key', 'idea.triage'] } } },
     env: {},
   });
-  const evil = resolved.roles['evil-template'];
+  const evil = resolved.ranks['evil-template'];
   assert.deepEqual([...evil.permissions], ['idea.triage'],
     'only the operational key survives; every system + unknown key is stripped');
 });
 
 test('V6: a seeded rank-role template cannot re-grant — its permissions drop wholesale', () => {
-  const resolved = govConfig.resolveGovernanceConfig({
-    instance: { roles: { thetes: { label: 'Upgraded', permissions: ['idea.triage', ...SYSTEM_KEYS] } } },
+  const resolved = govConfig.resolveGovernmentConfig({
+    instance: { ranks: { thetes: { label: 'Upgraded', permissions: ['idea.triage', ...SYSTEM_KEYS] } } },
     env: {},
   });
-  assert.deepEqual([...resolved.roles.thetes.permissions], [],
+  assert.deepEqual([...resolved.ranks.thetes.permissions], [],
     'a seeded role takes NO permissions from config, operational ones included');
 });
 
 test('V6: the env layer relabels only — it cannot add a permission or a role', () => {
   // The role must exist in the merged config for the relabel to land (an env
   // var can only RELABEL a declared role) — mirror the neutral starter's shape.
-  const resolved = govConfig.resolveGovernanceConfig({
-    neutral: { roles: { metic: { label: 'Metic' } } },
+  const resolved = govConfig.resolveGovernmentConfig({
+    neutral: { ranks: { metic: { label: 'Metic' } } },
     instance: {},
     env: { OTB_GOVERNANCE_ROLE_LABELS: 'metic=Overlord,ghost-role=Ghost' },
   });
-  assert.equal(resolved.roles.metic.label, 'Overlord', 'relabeling works');
-  assert.equal(resolved.roles['ghost-role'], undefined, 'an env var cannot mint a role');
-  assert.deepEqual([...resolved.roles.metic.permissions], [],
+  assert.equal(resolved.ranks.metic.label, 'Overlord', 'relabeling works');
+  assert.equal(resolved.ranks['ghost-role'], undefined, 'an env var cannot mint a role');
+  assert.deepEqual([...resolved.ranks.metic.permissions], [],
     'the relabeled seeded role still takes no grants from config or env');
 });
 
@@ -438,7 +438,7 @@ test('V11: the substrate checker is structurally grant-blind (node builtins only
 
 test('V12: no rank-role below archon holds a system key; none holds a principal key', () => {
   for (const rank of SEEDED_ROLES) {
-    const seed = catalog.RANK_ROLE_SEED[rank];
+    const seed = catalog.RANK_SEED[rank];
     for (const k of seed) {
       assert.equal(catalog.isPrincipalKey(k), false, `${rank} seeds principal key ${k}`);
       if (rank !== 'archon') {
@@ -446,7 +446,7 @@ test('V12: no rank-role below archon holds a system key; none holds a principal
       }
     }
   }
-  const archonSystem = catalog.RANK_ROLE_SEED.archon.filter((k) => catalog.isSystem(k)).sort();
+  const archonSystem = catalog.RANK_SEED.archon.filter((k) => catalog.isSystem(k)).sort();
   const expected = SYSTEM_KEYS.filter((k) => catalog.byKey(k).floor === 'archon').sort();
   assert.deepEqual(archonSystem, expected,
     'archon holds exactly the archon-floored system keys — principals stay out of every rank-role');

package/tests/{governance_catalog.mjs → government_catalog.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_catalog.mjs — the permission catalog + compat seed (BV1.R94, ADR 0151).
+// tests/government_catalog.mjs — the permission catalog + compat seed (BV1.R94, ADR 0151).
 //
 // Guards the "zero day-one behavior change" promise structurally: the seed is
 // DERIVED from per-permission floors, so these invariants prove the derivation is
@@ -12,7 +12,7 @@ import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const cat = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
-const { PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
+const { PERMISSIONS, RANK_ORDER, RANK_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
 
 test('every permission is well-formed (key, boolean system, valid floor)', () => {
   assert.ok(PERMISSIONS.length >= 60, `expected a substantial catalog, saw ${PERMISSIONS.length}`);
@@ -98,17 +98,17 @@ test('isGrantableTo fails closed on every unrecognised input', () => {
 });
 
 test('the four rank-roles exist; seed keys all reference real permissions', () => {
-  assert.deepEqual(Object.keys(RANK_ROLE_SEED).sort(), [...RANK_ORDER].sort());
+  assert.deepEqual(Object.keys(RANK_SEED).sort(), [...RANK_ORDER].sort());
   const all = new Set(permissionKeys());
   for (const rank of RANK_ORDER) {
-    for (const k of RANK_ROLE_SEED[rank]) assert.ok(all.has(k), `seed[${rank}] references unknown ${k}`);
+    for (const k of RANK_SEED[rank]) assert.ok(all.has(k), `seed[${rank}] references unknown ${k}`);
   }
 });
 
 test('seed is cumulative: archon ⊇ metic ⊇ thetes ⊇ xenos (nested supersets)', () => {
   for (let i = 1; i < RANK_ORDER.length; i++) {
-    const lower = new Set(RANK_ROLE_SEED[RANK_ORDER[i - 1]]);
-    const higher = new Set(RANK_ROLE_SEED[RANK_ORDER[i]]);
+    const lower = new Set(RANK_SEED[RANK_ORDER[i - 1]]);
+    const higher = new Set(RANK_SEED[RANK_ORDER[i]]);
     for (const k of lower) assert.ok(higher.has(k), `${RANK_ORDER[i]} missing ${k} that ${RANK_ORDER[i - 1]} has`);
     assert.ok(higher.size > lower.size, `${RANK_ORDER[i]} should strictly extend ${RANK_ORDER[i - 1]}`);
   }
@@ -116,7 +116,7 @@ test('seed is cumulative: archon ⊇ metic ⊇ thetes ⊇ xenos (nested superset
 
 test('a role holds a permission iff its floor is a real rank at-or-below (derivation is faithful)', () => {
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_ROLE_SEED[rank]);
+    const held = new Set(RANK_SEED[rank]);
     const tier = RANK_ORDER.indexOf(rank);
     for (const p of PERMISSIONS) {
       const shouldHold = p.floor !== null && RANK_ORDER.indexOf(p.floor) <= tier;
@@ -127,12 +127,12 @@ test('a role holds a permission iff its floor is a real rank at-or-below (deriva
 
 test('system permissions are Archon-only in the seed (never in xenos/thetes/metic)', () => {
   for (const rank of ['xenos', 'thetes', 'metic']) {
-    for (const k of RANK_ROLE_SEED[rank]) {
+    for (const k of RANK_SEED[rank]) {
       assert.equal(isSystem(k), false, `${rank} seed must not hold system perm ${k}`);
     }
   }
   // and archon DOES hold the archon-floored system perms (that is how Archon gets its power)
-  const archon = new Set(RANK_ROLE_SEED.archon);
+  const archon = new Set(RANK_SEED.archon);
   assert.ok(archon.has('builder.rank.set'));
   assert.ok(archon.has('deploy.push_main'));
 });
@@ -142,14 +142,14 @@ test('machine principals are held by NO rank-role and are system + floor null',
     assert.equal(p.system, true, `${p.key} must be system`);
     assert.equal(p.floor, null, `${p.key} must have floor null (held by no rank-role)`);
     for (const rank of RANK_ORDER) {
-      assert.ok(!RANK_ROLE_SEED[rank].includes(p.key), `${rank} must not hold principal ${p.key}`);
+      assert.ok(!RANK_SEED[rank].includes(p.key), `${rank} must not hold principal ${p.key}`);
     }
   }
   assert.ok(PERMISSIONS.some((p) => p.key === 'principal.bfg'));
 });
 
 test('threshold spot-checks reproduce today\'s requireRank floors', () => {
-  const has = (rank, k) => RANK_ROLE_SEED[rank].includes(k);
+  const has = (rank, k) => RANK_SEED[rank].includes(k);
   // idea.triage: metic+ only (requireRank('metic','archon'))
   assert.equal(has('xenos', 'idea.triage'), false);
   assert.equal(has('thetes', 'idea.triage'), false);

package/tests/{governance_claim_eligibility.mjs → government_claim_eligibility.mjs}

@@ -1,4 +1,4 @@
-// tests/governance_claim_eligibility.mjs — claim eligibility as PERMISSIONS
+// tests/government_claim_eligibility.mjs — claim eligibility as PERMISSIONS
 // (BV1.R106, ADR 0151).
 //
 // DB-free. The whole point of R106 is that the queue half of claim-time authority
@@ -23,7 +23,7 @@
 //          GENERAL_QUEUE_RANKS and knows nothing about catalog floors.
 //      The new side reads catalog.seedForRank. A check whose two sides both read
 //      catalog.floor would pass while proving nothing (the lesson tests/
-//      governance_parity.mjs writes down); neither oracle here does.
+//      government_parity.mjs writes down); neither oracle here does.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';