@bongos/core 1.19.189 → 1.19.191

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.189",
-  "core_contract": "1.19.189",
-  "source_commit": "106408b1519091ef056ef82d9bd542a68308e363",
+  "core_version": "1.19.191",
+  "core_contract": "1.19.191",
+  "source_commit": "0a30e8955f1b4904fc8eca19d56228a7dff4b32e",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T00:49:35.464Z",
+  "built_at": "2026-08-17T01:01:06.099Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 309,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1282,
+    "functional_verbatim": 1283,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1612,
-  "tree_sha256": "386f81ead8236148579f8ab7743305bf0e2edbd8d0349ad9125e23d90eba84fe",
+  "file_count": 1613,
+  "tree_sha256": "234f75ccb67ec7927d6010bbcbd597c9f256e10615cce8d0cbda596850bc0e34",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2977,7 +2977,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "63e80d002e09d05a93238e15491a82dd733baea219814e8f7e2961ecb5373e1f"
+      "sha256": "c229aec4f02fe970f4a3f798d370eef9b080cd0837f906b574362abda57107ad"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4262,12 +4262,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "15ace363831ad92eff83b61408618af68029feb1701bc757dc007390cfbc13f7"
+      "sha256": "ecea40048b1e131835510177f7e19c5cff45b3449c8115b1f1303bde7961a1a4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "31315335f0107717d68755300632cd57b25f62b6d58a6b5309ba82030bf894ce"
+      "sha256": "7f2cdbd17679eff46f8f1d19f593e2f75e909c25e536094b650fe47529547ba7"
     },
     {
       "path": "public-docs/index.html",
@@ -4892,7 +4892,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "65648d6d05b73dafc08194e843850b460b738a17b565a69a5234dd817386eea8"
+      "sha256": "5cc94859033c924884efa60f50f8a1f7810a85382c42d785d62b804181a195f5"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5284,6 +5284,11 @@
       "mode": "0000644",
       "sha256": "15d4d176f561e408c6116208b295fe5f03fc5e06ca8bb713f023fb1950d1a89a"
     },
+    {
+      "path": "scripts/gds/seed-board-room-tasks.js",
+      "mode": "0000644",
+      "sha256": "a079b2422e842deed0bbcd7ad5ae3ab7e1ec4576a26689a80f67e9a56a2411ba"
+    },
     {
       "path": "scripts/gds/seed-bongos-app-tasks.js",
       "mode": "0000644",
@@ -5872,7 +5877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a47c1e24a6e69d6b109956b1fe0e9acc34905fc148de1199a132301d66e3d597"
+      "sha256": "1ecbb2895d1ef012f455fe9827f59dade9bfee689b9a86230122a0334c4bff9d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6852,7 +6857,7 @@
     {
       "path": "tests/government_routes.mjs",
       "mode": "0000644",
-      "sha256": "099954d8dbfa1fd3d503ee1b4825f9a3f10d5ae1e3694c600dd3f06e6a21a127"
+      "sha256": "3b2e0ca134737992590132f089d5f93b479ad6cec83a5d2a932412b3edaf4547"
     },
     {
       "path": "tests/government_seed.mjs",

package/modules/government/routes/government.js

@@ -185,11 +185,11 @@ module.exports = function buildGovernmentRouter() {
   const ARCHON_REASON = 'the Archon rank-rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
   const ASSIGN_REASON = 'a seeded rank-rank is assigned by rank (R95b sync); change the builder\'s rank instead';
 
-  // ── one-release compatibility aliases: /governance/* -> /government/* ──────
+  // ── the one-release LEGACY path aliases: /governance/* -> /government/* ────
   // ADR 0174 committed to keeping the pre-rename paths answering for exactly one
   // release. The case this actually protects is narrow but real: a browser that
   // still has the OLD hall page open when the instance upgrades will keep calling
-  // /governance/* against the new server. Everything else that consumed these
+  // the legacy /governance/* paths against the new server. Everything else that
   // paths (the hall bundle, the generated client) ships INSIDE the same core
   // package and moves in lockstep.
   //
@@ -201,11 +201,39 @@ module.exports = function buildGovernmentRouter() {
   // REMOVE THIS BLOCK one release after the rename ships (goal 1000068 follow-up).
   // The `alias` counter in the log line is how we tell whether anything still
   // calls them before deleting.
+  //
+  // EXPRESS 4 WILDCARD SYNTAX. This is express 4.22 — the wildcard is a bare `*`
+  // and the captured tail is req.params[0]. Express 5's named form (`/*rest`) is
+  // NOT a wildcard here, it is a literal path segment, so it silently matches
+  // nothing and every legacy path 404s. It shipped that way once (task 1003006)
+  // and was only caught by curling the live site after the cutover — the module
+  // parsed fine, so nothing local failed.
   const LEGACY_PATH_PREFIX = '/governance';
-  router.all(`${LEGACY_PATH_PREFIX}/*rest`, (req, res, next) => {
-    const rest = req.originalUrl.slice(req.originalUrl.indexOf(LEGACY_PATH_PREFIX) + LEGACY_PATH_PREFIX.length);
-    if (!rest) return next();
-    const target = `/government${rest.replace(/^\/ranks(?=\/|$)/, '/ranks')}`;
+  // The legacy noun -> the current one, as a NAMED DATA PAIR rather than an
+  // inline regex literal. An inline pattern here was silently rewritten by a
+  // repo-wide sweep so that both sides matched, turning the translation into an
+  // identity function that redirected to a path which does not exist. Naming the
+  // pair and asserting they differ makes that class of damage loud.
+  //
+  // Every line in this block that spells the legacy vocabulary carries the word
+  // LEGACY on purpose: that is what the ADR 0174 fitness allowlist keys on, so
+  // the shim can name what it is compatible with without excusing the whole file.
+  const LEGACY_SEGMENT = 'roles';   // legacy
+  const CURRENT_SEGMENT = 'ranks';
+  if (LEGACY_SEGMENT === CURRENT_SEGMENT) {
+    throw new Error('government legacy alias: the rename pair collapsed to an identity — a sweep has eaten it');
+  }
+  router.all(`${LEGACY_PATH_PREFIX}/*`, (req, res, next) => {
+    const tail = req.params[0] || '';            // express 4: bare * captures here
+    if (!tail) return next();
+    // Translate the leading segment, keep everything after it, keep the query.
+    const translated = tail === LEGACY_SEGMENT || tail.startsWith(`${LEGACY_SEGMENT}/`)
+      ? CURRENT_SEGMENT + tail.slice(LEGACY_SEGMENT.length)
+      : tail;
+    const qs = req.originalUrl.includes('?') ? req.originalUrl.slice(req.originalUrl.indexOf('?')) : '';
+    // req.baseUrl is the router's MOUNT point (/api/gds). Redirecting without it
+    // sends the caller to /government/... at the site root, which 404s.
+    const target = `${req.baseUrl}/government/${translated}${qs}`;
     console.warn(`[government] legacy path hit: ${req.method} ${req.originalUrl} -> ${target} (ADR 0174 alias; remove one release after the rename)`);
     return res.redirect(308, target);
   });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.189",
+  "version": "1.19.191",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.189",
+      "version": "1.19.191",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.189",
+  "version": "1.19.191",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1690,11 +1690,13 @@ const VOCAB_ALLOW = [
   },
   {
     file: 'modules/government/routes/government.js',
-    match: '/governance',
+    match: 'legacy',
     why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
-       + 'compatibility shim has to name the thing it is compatible with. Note the '
-       + 'match requires the leading SLASH — this permits citing the legacy PATH, not '
-       + 'the bare word. Delete with the alias block one release after the rename ships.',
+       + 'compatibility shim has to name the thing it is compatible with. The match is '
+       + 'the word LEGACY, and the shim block is written so that every line spelling the '
+       + 'old vocabulary carries it — so the exemption is scoped to the shim rather than '
+       + 'to the whole file, and a stray "role" elsewhere in this file still reds the '
+       + 'build. Delete with the alias block one release after the rename ships.',
   },
   {
     file: 'modules/government/module.json',

package/scripts/gds/seed-board-room-tasks.js

@@ -0,0 +1,196 @@
+// Seed the tasks for goal 1000069 "Governance & voting — the Board Room" (BONGOS-V1).
+// Source of truth: docs/specs/bongos-v1-board-room.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+//
+// Run: node scripts/gds/seed-board-room-tasks.js
+const os = require('os');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000069;
+const SRC = 'planning-session';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(500); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/gds${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// Criterion slugs (position-independent — see the spec's Criteria table).
+const C1 = 'board-full-idea-ratification';
+const C2 = 'rejection-returns-with-reason';
+const C3 = 'who-governs-is-config';
+const C4 = 'timed-sitting-absence-never-blocks';
+const C5 = 'board-room-and-charter-library';
+const C6 = 'discord-notification-mirror';
+
+const SPEC = 'See docs/specs/bongos-v1-board-room.md (status: final).';
+
+const TASKS = [
+  // ---- Phase A — decide + foundation (P5) ----
+  { ref:'R01', kind:'decision', disc:'engineer', prio:5, est:150, crit:[C1,C3,C4], deps:[],
+    title:'R01 · ADR: the Board Room government model',
+    desc:`Record the government model as one decision so the schema has something to encode.\n\nMUST STATE: the board's TWO subjects (a Full Idea, and a change to the constitution itself) and why nothing else is votable; membership as a configured predicate resolved per request and uncached; the timed SITTING (absent votes are nulled, not blocking) and why that replaces quorum — the clock IS the deadlock exit; CONSENT rather than majority, with silence as consent and one reasoned objection returning the idea; a zero-vote close PASSING; the OPEN ballot; Discord as an outbound notification mirror that casts nothing; and the amendment rule — a constitutional change is decided under whatever rule the CURRENT constitution names, so flipping out of monarchy is a legal monarchy act.\n\nAlso record the two owner decisions taken against recommendation with their trade-offs intact: vote-karma (yes-clicking bias, accepted because item volume is too low to farm) and automatic window-open on grade pass (author loses timing control; concurrent windows become normal).\n\nGrounding: idea 1000738, idea 1000754, the Six Variables of Governance synthesis, ADR 0151 (permissions-as-atoms), ADR 0157, ADR 0162 (verdicts advisory), ADR 0174 (government/ranks/roles). ${SPEC}` },
+
+  { ref:'R02', kind:'decision', disc:'engineer', prio:5, est:90, crit:[C1], deps:['R01'],
+    title:'R02 · The pass-event contract the ideator credit lane consumes',
+    desc:`Agree the pass-event shape with goal 1000067 (IC5, task 1002999) BEFORE the emitter is built, so no parallel vote is invented — ADR 0172 (per-craft compensation) is explicit that stream 3 "consumes the Board Room's pass event; invents no parallel vote".\n\nDone-when: payload fields, the idempotency key, and once-per-idea semantics are written down and referenced by both goals. Stream 3 pays max(30, round(completeness% x 100)) once per idea, reason 'idea.credit.governance_pass'. economy stays OUT of this goal's scope — we emit, 1000067 pays. Deps R01. ${SPEC}` },
+
+  { ref:'R03', kind:'feature', disc:'engineer', prio:5, est:210, crit:[C1,C2,C4], deps:['R01'],
+    title:'R03 · Schema: board items, votes, and rejections',
+    desc:`Module-owned migration under modules/government/. NOTE the fitness rule derives a module migration's legal table namespace from the DIRECTORY NAME (this is what forced tasks 1003004+1003005 to land together), so tables are government_*.\n\nMUST include subject_type ('full_idea' | 'constitutional_amendment') FROM DAY ONE — cheap now, expensive to bolt on. A vote row carries voter, direction, timestamp, and for an objection the free-text reason plus exactly one of the five Full Idea section keys. UNIQUE(item, voter) on the peer_votes precedent (migration 058). Item carries opened_at, closes_at, closed_at, outcome.\n\nRe-read modules/ideas/templates.js for the five section keys — they are the owner's own wording and must not be re-invented. Deps R01. ${SPEC}` },
+
+  { ref:'R04', kind:'feature', disc:'engineer', prio:5, est:150, crit:[C1,C3], deps:['R03'],
+    title:'R04 · Permission catalog + grant migration for the board keys',
+    desc:`Add board.item.open, board.vote.cast, board.config.manage following modules/government/catalog.js's five-step recipe EXACTLY. All three are operational (system:false) — creating or casting confers no authority on anyone; compare the version.create comment which argues this against a symmetry reading.\n\nThe grant migration is LOAD-BEARING not bookkeeping: an already-migrated DB never learns a key added only in code, and the new route then 403s everyone. Copy governance_006_version_create.sql's shape verbatim — one INSERT...SELECT '<rank>', unnest(ARRAY[...]) block PER RANK, because the drift guard tests/governance_seed.mjs scans for that literal form and a combined unnest parses as zero grants.\n\nPin every write route in src/bongos/route-rank-check.js. WATCH THE DEPLOY BOUNDARY: the grant rows and the code constant must land in the SAME deploy (ADR 0174 §Consequences) or the check fails closed. Deps R03. ${SPEC}` },
+
+  // ---- Phase B — the rule engine (P5 spine, P4 tail) ----
+  { ref:'R05', kind:'feature', disc:'engineer', prio:5, est:180, crit:[C3], deps:['R04'],
+    title:'R05 · The constitution: membership, pass rule, and window as config',
+    desc:`config/government.json + config/government.neutral.json gain a board block: membership predicate, pass_rule, window_minutes, close_early_on_full_turnout. Platform default and this instance's day-one value are MONARCHY — membership 'rank:archon', pass_rule 'first_ratifier', no clock — expressed as configuration on the real machinery, never as a separate code path.\n\nThe recommended starting point documented alongside it is: all Archons, one vote each, consent, 90-minute window. Deps R04. ${SPEC}` },
+
+  { ref:'R06', kind:'feature', disc:'engineer', prio:5, est:150, crit:[C3], deps:['R05'],
+    title:'R06 · Board membership resolver — per request, uncached',
+    desc:`Resolve the configured predicate to a live member list on every request with NO caching, preserving ADR 0016's instant-demotion property the permission resolver already guarantees.\n\nMembership derives from RANK, never from role: PATCH /me/disciplines is deliberately ungated ("a builder owns their own profile", src/bongos/routes/me.js:311), so a role-derived franchise would be one-request privilege escalation. The spec records why the role-chamber model was rejected. Deps R05. ${SPEC}` },
+
+  { ref:'R07', kind:'feature', disc:'engineer', prio:5, est:150, crit:[C1,C4], deps:['R06'],
+    title:'R07 · A window opens automatically when a Full Idea passes the grade',
+    desc:`The completeness grade is the FLOOR, the vote is the MERIT. A Full Idea crossing the pass bar (60, ADR 0172 per-craft) automatically opens a voting window; a sub-bar idea never reaches the board and instead returns to its author via R13.\n\nConcurrent windows are normal and expected — a direct consequence of automatic opening at a 90-minute default. Reuse modules/ideas/completeness.js; do not re-implement scoring. Deps R06. ${SPEC}` },
+
+  { ref:'R08', kind:'feature', disc:'engineer', prio:5, est:210, crit:[C1,C4], deps:['R06'],
+    title:'R08 · Cast a vote: open ballot, anti-self, live re-check, karma',
+    desc:`POST a vote gated on board.vote.cast. HARD RULES: an author may NOT vote on their own item (server-side, the peer_votes anti-self precedent) — this is the bright line that keeps ratification from being ceremonial; membership is re-checked LIVE on every write; the write is idempotent on (item, voter).\n\nOpen ballot: member, direction and timestamp are visible to all members, which is what makes the vote-karma auditable. Award the voter karma for a vote cast IN-WINDOW (proposed +1 — surface the constant for confirmation). The Full Idea's author earns karma on ratification, mirroring KARMA_RATIFY_DELTA (+3, tuned down from +5 in V3.R28 — do NOT copy the stale +5 still printed in planning-session/SKILL.md and openapi.json). Deps R06. ${SPEC}` },
+
+  { ref:'R09', kind:'feature', disc:'engineer', prio:5, est:120, crit:[C2], deps:['R03'],
+    title:'R09 · Rejection payload: a reason plus one of the five sections',
+    desc:`An objection carries free-text plus EXACTLY ONE of the five Full Idea section keys as the cause. This is the mechanism that makes the hall the only possible voting surface — a Discord reaction cannot express it, so reaction-voting would make every rejection feedback-free.\n\nA sub-bar completeness grade flags its weakest section automatically, using the per-field scores completeness.js already computes. Section keys come from modules/ideas/templates.js. Deps R03. ${SPEC}` },
+
+  { ref:'R10', kind:'feature', disc:'engineer', prio:5, est:210, crit:[C4], deps:['R08','R09'],
+    title:'R10 · Close + tally: consent, nulled absences, zero-vote pass',
+    desc:`Closing rules, all declared rather than emergent: absent members are NULLED — dropped from the denominator, never counted as a no, so absence can never block; silence is consent; ONE reasoned objection returns the idea under C2; a window closing with ZERO votes PASSES (the idea already cleared the grade gate, and absence never blocks); and the window closes EARLY the moment every member has voted, so latency is min(full turnout, window).\n\nThe monarchy pass_rule 'first_ratifier' resolves through this same path. Deps R08,R09. ${SPEC}` },
+
+  { ref:'R12', kind:'feature', disc:'engineer', prio:5, est:120, crit:[C1], deps:['R10'],
+    title:'R12 · Emit the pass event exactly once per ratified idea',
+    desc:`Fire R02's agreed contract on a passing close. Idempotent — a replay, a re-close, or a resubmission that passes again must never double-fire. This is the event goal 1000067 (IC5, task 1002999) is BLOCKED on; shipping it unblocks stream 3. Deps R10. ${SPEC}` },
+
+  { ref:'R11', kind:'feature', disc:'engineer', prio:4, est:150, crit:[C4], deps:['R10'],
+    title:'R11 · The window expiry poller',
+    desc:`A window closes on time with nobody touching it. Nothing in-tree expires a vote today; the nearest precedents are the 7-day lagged peer-vote tally and the ~5-minute publish reconciler — follow the reconciler's per-sweep disposition-logging habit so a stuck window is visible rather than silent. Must handle concurrent windows. Deps R10. ${SPEC}` },
+
+  { ref:'R13', kind:'feature', disc:'engineer', prio:4, est:180, crit:[C2], deps:['R09','R10'],
+    title:'R13 · Return-to-originator, and resubmission',
+    desc:`A vote fail OR a sub-bar grade sends the idea back to its ORIGINATOR carrying its feedback — it never dies and never stalls. The author revises and resubmits, which re-opens a window.\n\nBecause completeness.js scores the five fields per-field, a resubmission can be checked against the flagged section — surface whether the flagged section actually changed. Resubmission is unbounded in v1 (the grade gate already bounds spam) and every past rejection stays visible on the item history. Deps R09,R10. ${SPEC}` },
+
+  { ref:'R14', kind:'feature', disc:'engineer', prio:4, est:180, crit:[C3], deps:['R10'],
+    title:'R14 · Constitutional amendments as the board\'s second subject',
+    desc:`Propose a change to the constitution, then ratify it under whatever rule the CURRENT constitution names. Under monarchy that resolves to "the Archon ratifies", so flipping OUT of monarchy is a legal monarchy act; every change after that belongs to the consent board. This is how a constitution's own amendment procedure normally works, and it is why no bootstrap special case is needed.\n\nThis is the owner's answer to the loophole that motivated the whole feature — the rule that constrains the owner can no longer be weakened by the owner alone. Deps R10. ${SPEC}` },
+
+  // ---- Phase C — the hall (P4) ----
+  { ref:'R15', kind:'feature', disc:'engineer', prio:4, est:150, crit:[C5], deps:['R05'],
+    title:'R15 · Government page IA: Constitution / Board Room / Ranks & Permissions',
+    desc:`Government becomes the page that answers "how is this project governed", in three sections: Constitution (what we run + the charter library), Board Room (open items, your vote, the clock), and Ranks & Permissions (today's administration surface, unchanged).\n\nThe tab was renamed from Governance under task 1003007 — build on that, do not re-litigate the naming. Deps R05. ${SPEC}` },
+
+  { ref:'R16', kind:'feature', disc:'engineer', prio:4, est:240, crit:[C1,C4,C5], deps:['R08','R15'],
+    title:'R16 · The Board Room: open items, the clock, the tally',
+    desc:`Open items with their remaining time, your own vote state, a LIVE open-ballot tally (who voted which way and when), and the closed history with outcomes. Must read sensibly with several concurrent windows, which are normal at a 90-minute default with automatic opening. Deps R08,R15. ${SPEC}` },
+
+  { ref:'R17', kind:'feature', disc:'engineer', prio:4, est:180, crit:[C2,C5], deps:['R09','R16'],
+    title:'R17 · The vote UI: cast, reason box, five-section picker',
+    desc:`Cast a vote, and for an objection write the reason and pick exactly one of the five Full Idea sections. The full idea and its five sections must be in front of the voter while they decide — that context is the entire reason voting happens in the hall rather than on a Discord reaction. Deps R09,R16. ${SPEC}` },
+
+  { ref:'R18', kind:'feature', disc:'engineer', prio:4, est:150, crit:[C3,C5], deps:['R14','R15'],
+    title:'R18 · The Constitution section: what we run, and how it changed',
+    desc:`Show the active constitution in plain language — who may vote, how an item passes, how long a window runs — plus the full change history, so a switch can never be flipped quietly. Deps R14,R15. ${SPEC}` },
+
+  { ref:'R19', kind:'feature', disc:'engineer', prio:4, est:210, crit:[C5], deps:['R15'],
+    title:'R19 · The charter library: seven constitutions and the ladder',
+    desc:`Present all seven government structures (Monarchy/BDFL, Timocratic Republic, Direct Democracy, Presidential, Cooperative, Federation, Foundation), the three trajectories (Locked, Laddered, Scheduled), and the developmental ladder's thresholds (~9 named executive, ~25, ~50 written charter + council, ~150 adjudication separates / federate beyond).\n\nMark which are SELECTABLE TODAY versus documented-for-later, so nobody is misled. Name which is recommended at this project's CURRENT builder count. This is the half of the surface that earns its keep at two builders — the owner's stated purpose is getting a team up to speed before deciding when to flip the switch.\n\nSource: the Six Variables of Governance synthesis (Parts III and IV). Deps R15. ${SPEC}` },
+
+  // ---- Phase D — the mirror (P3) ----
+  { ref:'R20', kind:'feature', disc:'engineer', prio:3, est:90, crit:[C6], deps:['R01'],
+    title:'R20 · The board channel, with per-rank view access',
+    desc:`Add the board channel to docs/discord/channels.json with per-rank view access (ADR 0037 — the bot creates/edits channels, topics and access from that config file). Independent of the whole rule engine, so this is good early parallel work for a second builder. Deps R01. ${SPEC}` },
+
+  { ref:'R21', kind:'feature', disc:'engineer', prio:3, est:180, crit:[C6], deps:['R07','R20'],
+    title:'R21 · Announce a window: mention the members, deep-link the hall',
+    desc:`On window open, post to the board channel mentioning the members whose vote is wanted, carrying a deep link straight to that item in the hall. The mention IS the "vote within X" notice, and Discord's own mobile app IS the mobile push — no new surface is needed and the bot has no DM capability today (verified).\n\nFollow modules/discord/approval-broadcast + discord-approvals.js for the BROADCAST shape only. Discord is outbound-only here: it reads nothing inbound and casts no vote. Deps R07,R20. ${SPEC}` },
+
+  { ref:'R22', kind:'feature', disc:'engineer', prio:3, est:120, crit:[C6], deps:['R10','R21'],
+    title:'R22 · Mirror state: closed, and the outcome',
+    desc:`Edit the announcement in place as the item closes and resolves, so the channel never shows a stale open window. The item's state lives in the DATABASE — Discord is a mirror of it, never a source. Deps R10,R21. ${SPEC}` },
+
+  // ---- Phase E — proofs (P3) ----
+  { ref:'R23', kind:'verify', disc:'engineer', prio:3, est:150, crit:[C1,C3], deps:['R12','R17','R22'],
+    title:'R23 · PROOF: day-one monarchy, end to end',
+    desc:`On the live configuration: a Full Idea passes the completeness grade, a window opens automatically, the Archon ratifies in the hall, and the pass event fires exactly once with the payload IC5 expects. Proves C1 and the day-one half of C3 — and proves the board path really is the code path monarchy runs through. Deps R12,R17,R22. ${SPEC}` },
+
+  { ref:'R24', kind:'verify', disc:'engineer', prio:3, est:120, crit:[C2], deps:['R13','R17'],
+    title:'R24 · PROOF: a rejection round-trip',
+    desc:`Reject a Full Idea with a reason and a flagged section, confirm the author sees both, revise that section, resubmit, and pass. Also confirm the sub-bar-grade path flags the weakest section automatically. Proves C2 end to end. Deps R13,R17. ${SPEC}` },
+
+  { ref:'R25', kind:'verify', disc:'engineer', prio:3, est:180, crit:[C3,C4], deps:['R11','R14','R18'],
+    title:'R25 · PROOF: flip the switch, then run a real sitting',
+    desc:`Change the constitution from monarchy to the consent board BY RATIFICATION under the monarchy rule, then run a timed sitting through to expiry — verifying an absent member's vote is nulled rather than blocking, that a zero-vote close passes, and that a window closes early on full turnout. The single most important proof in the goal: it is the only thing that shows the switch actually works before you need it. Deps R11,R14,R18. ${SPEC}` },
+
+  { ref:'R26', kind:'verify', disc:'engineer', prio:3, est:90, crit:[C5], deps:['R19'],
+    title:'R26 · PROOF: the charter library reads right at this headcount',
+    desc:`Confirm the library's recommendation matches this project's actual builder count, that selectable-today is honestly marked, and that a newcomer can answer "what are we running, and what could we run" from the page alone. Deps R19. ${SPEC}` },
+];
+
+async function main() {
+  const idByRef = {};
+  console.log(`Seeding ${TASKS.length} tasks → ${VER} / goal ${GOAL}\n`);
+
+  for (const t of TASKS) {
+    const source_ref = `board-room-${t.ref}`;
+    const body = {
+      version_id: VER, goal_id: GOAL, source: SRC, source_ref,
+      title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, status: 'backlog',
+      priority: t.prio, est_minutes: t.est,
+      criterion_ids: t.crit,
+    };
+    const r = await api('POST', '/tasks', body);
+    if (r.ok && r.json.task) {
+      idByRef[t.ref] = r.json.task.id;
+      console.log(`  ${t.ref} → ${r.json.task.id}  ${t.title.slice(0, 62)}`);
+    } else if (r.status === 409 && r.json.task) {
+      idByRef[t.ref] = r.json.task.id;
+      console.log(`  ${t.ref} → ${r.json.task.id}  (already seeded)`);
+    } else {
+      console.error(`  ${t.ref} FAILED ${r.status}`, JSON.stringify(r.json).slice(0, 400));
+    }
+  }
+
+  console.log('\nWiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    const id = idByRef[t.ref];
+    if (!id || !t.deps.length) continue;
+    for (const ref of t.deps) {
+      const dep = idByRef[ref];
+      if (!dep) { console.error(`  ${t.ref} dep ${ref} unresolved`); continue; }
+      const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_id: dep });
+      if (r.ok || r.status === 409) { edges++; console.log(`  ${t.ref} ← ${ref}`); }
+      else console.error(`  ${t.ref} ← ${ref} FAILED ${r.status}`, JSON.stringify(r.json).slice(0, 300));
+    }
+  }
+
+  console.log(`\nDone. ${Object.keys(idByRef).length}/${TASKS.length} tasks, ${edges} dependency edges.`);
+  console.log('Zero-dep layer (promote to ready): R01');
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });

package/src/module-api.js

@@ -805,8 +805,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.187 with no explicit bump. run 31978931152. (task 1002620)
 //   1.19.189 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.188 with no explicit bump. run 31983108640. (task 1002620)
+//   1.19.190 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.189 with no explicit bump. run 31983360426. (task 1002620)
+//   1.19.191 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.190 with no explicit bump. run 31983663234. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.189'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.191'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_routes.mjs

@@ -151,16 +151,19 @@ after(() => {
   seams._reset();
 });
 
-async function call(method, p, body) {
+async function call(method, p, body, opts = {}) {
   calls.length = 0;
   const res = await fetch(`${BASE}${p}`, {
     method,
     headers: body === undefined ? {} : { 'content-type': 'application/json' },
     body: body === undefined ? undefined : JSON.stringify(body),
+    // `redirect: 'manual'` lets a caller assert the 308 itself rather than
+    // silently following it — required by the legacy-alias tests at the bottom.
+    ...(opts.redirect ? { redirect: opts.redirect } : {}),
   });
   let json = null;
   try { json = await res.json(); } catch { /* no body */ }
-  return { status: res.status, json };
+  return { status: res.status, json, headers: res.headers };
 }
 
 // --- the deny wall -----------------------------------------------------------
@@ -392,3 +395,67 @@ test('DELETE /governance/assignments validates the builder id param', async () =
   const r = await call('DELETE', '/government/assignments/not-a-number/triage-helper');
   assert.equal(r.status, 400);
 });
+
+// ── the one-release /governance/* compatibility alias (ADR 0174) ──────────────
+//
+// This block exists because the alias shipped BROKEN and nothing caught it.
+// Three independent defects, none visible to a parse check or a unit test that
+// only imports the module:
+//   1. it was written with express 5's named-wildcard syntax (`/*rest`) on an
+//      express 4.22 router, where that is a literal segment — so it matched
+//      nothing and every legacy path 404'd;
+//   2. the redirect omitted req.baseUrl, sending callers to /government/... at
+//      the site root instead of under the /api/gds mount;
+//   3. a repo-wide roles->ranks sweep rewrote the SOURCE side of the
+//      /^\/roles/ -> '/ranks' translation, turning it into an identity that
+//      redirected to a path which does not exist.
+//
+// All three only surfaced when the running site was curled after the cutover.
+// These tests drive a real router so they cannot repeat that.
+
+// A SECOND server, mounted at /api/gds exactly as production does. The main
+// harness above mounts at the root, so it cannot see a missing req.baseUrl —
+// which was one of the three real defects. Mounting like production is the
+// whole point of these three tests.
+const aliasApp = express();
+aliasApp.use(express.json());
+aliasApp.use(attachFail);
+aliasApp.use('/api/gds', buildGovernmentRouter());
+const aliasServer = aliasApp.listen(0);
+await new Promise((r) => aliasServer.once('listening', r));
+const ALIAS_BASE = `http://127.0.0.1:${aliasServer.address().port}`;
+after(() => aliasServer.close());
+
+const hop = (method, p) =>
+  fetch(`${ALIAS_BASE}${p}`, { method, redirect: 'manual' });
+
+test('the legacy /governance/* alias redirects, under the mount, with the noun translated', async () => {
+  const cases = [
+    ['GET', '/api/gds/governance/roles', '/api/gds/government/ranks'],
+    ['GET', '/api/gds/governance/permissions', '/api/gds/government/permissions'],
+    ['GET', '/api/gds/governance/assignments', '/api/gds/government/assignments'],
+    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage',
+            '/api/gds/government/ranks/metic/permissions/idea.triage'],
+    ['POST', '/api/gds/governance/roles/metic/reset', '/api/gds/government/ranks/metic/reset'],
+  ];
+  for (const [method, from, expected] of cases) {
+    const r = await hop(method, from);
+    assert.equal(r.status, 308, `${method} ${from} must 308 — a 404 means the wildcard is not matching`);
+    assert.equal(r.headers.get('location'), expected,
+      `${method} ${from} must keep the /api/gds mount AND translate roles→ranks`);
+  }
+});
+
+test('the alias preserves the query string', async () => {
+  const r = await hop('GET', '/api/gds/governance/roles?x=1&y=2');
+  assert.equal(r.headers.get('location'), '/api/gds/government/ranks?x=1&y=2');
+});
+
+test('the alias carries no gate of its own — the followed request re-runs the real one', async () => {
+  // A 308 preserves method and body, so the wall is enforced on the FOLLOWED
+  // request by the real route. The alias must never become a way around it.
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'), 'utf8');
+  const block = src.slice(src.indexOf('LEGACY_PATH_PREFIX'), src.indexOf('res.redirect(308'));
+  assert.ok(!/requirePermission|requireBuilder/.test(block),
+    'the alias must not carry its own gate — it redirects, and the real route gates the followed request');
+});