@bongos/core 1.19.191 → 1.19.192

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.191",
-  "core_contract": "1.19.191",
-  "source_commit": "0a30e8955f1b4904fc8eca19d56228a7dff4b32e",
+  "core_version": "1.19.192",
+  "core_contract": "1.19.192",
+  "source_commit": "d87e3afc4422bfa953d231c4d7bfefca3a6f05bd",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T01:01:06.099Z",
+  "built_at": "2026-08-17T01:19:26.923Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 309,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1283,
+    "functional_verbatim": 1284,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1613,
-  "tree_sha256": "234f75ccb67ec7927d6010bbcbd597c9f256e10615cce8d0cbda596850bc0e34",
+  "file_count": 1614,
+  "tree_sha256": "6589484df659db7863875d9e249da97f452a6f76b2875410ba1084dfa5dd3394",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2949,6 +2949,11 @@
       "mode": "0000644",
       "sha256": "6c8bad4aace2518459c78afc808852e1e00ebf070a57d1240b1b411f4ea15704"
     },
+    {
+      "path": "modules/government/migrations/government_003_board_tables.sql",
+      "mode": "0000644",
+      "sha256": "e4802709d31031f2a7b66e1c3a07fd71def94b2eaf4eff7ad8a0f22bf6eeaf5e"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4262,12 +4267,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ecea40048b1e131835510177f7e19c5cff45b3449c8115b1f1303bde7961a1a4"
+      "sha256": "38cf20e4ca4bfe7aa88598c2fa00a115a477538f21ae1570358bbac79cd52732"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7f2cdbd17679eff46f8f1d19f593e2f75e909c25e536094b650fe47529547ba7"
+      "sha256": "e35863cc6ec37b4c3fc096f58db91936fde9fba4737d363aadecc132bf094003"
     },
     {
       "path": "public-docs/index.html",
@@ -5877,7 +5882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1ecbb2895d1ef012f455fe9827f59dade9bfee689b9a86230122a0334c4bff9d"
+      "sha256": "e0f3b40f12f5a425d4113216fc666af615452e1b82342a8485beb5c7fbe8ce93"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6862,7 +6867,7 @@
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "97c9728181f98dcf2daed14a4f87b8acb0fa9fa1d6d55e628eaa06c60c539094"
+      "sha256": "e7f980f02abfb057d725beaf5730fdd71f4e8249af2180bf4a355632481330d6"
     },
     {
       "path": "tests/government_session_scope.mjs",

package/modules/government/migrations/government_003_board_tables.sql

@@ -0,0 +1,149 @@
+-- government_003_board_tables.sql — the Board Room's items and votes
+-- (task 1003016 / R03 of goal 1000069). Decision of record: ADR 0175.
+--
+-- The Board Room is the first UPWARD-pointing gate in a system where every other
+-- gate points down the rank ladder. Its subjects are exactly TWO, both rare by
+-- construction: a Full Idea, and a change to the constitution itself.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is government_-prefixed, there is no down-migration, and the filename is
+-- government_-prefixed (ADR 0108 §5) so its stem never collides across repos. NEW
+-- migrations in this module must use the `government_` prefix — the historical
+-- `governance_` files keep theirs forever, because `schema_migrations` is keyed by
+-- filename stem and renaming an applied migration makes it look unapplied and
+-- RE-RUNS it. Idempotent: safe to re-run.
+--
+-- ── WHY TWO TABLES AND NOT THREE ────────────────────────────────────────────
+-- A rejection is not its own entity. ADR 0175 §3 makes one reasoned objection
+-- sufficient to return an idea, so the objection IS the vote, and its reason lives
+-- on the vote row. The other half of criterion C2 — a SUB-BAR idea returning with
+-- its weakest section flagged — never reaches the board at all, because ADR 0175
+-- §5 gates window-opening on the completeness bar. That path is modules/ideas
+-- work under R13 (task 1003026), not schema here.
+--
+-- ── WHAT IS DELIBERATELY NOT IN THE SCHEMA ──────────────────────────────────
+-- ANTI-SELF-VOTE (ADR 0175 §11) is enforced in the route, not by a constraint: it
+-- needs the subject's author, which lives in another module's table
+-- (`ideas.captured_by`), and a government migration may not reach across that
+-- boundary. `peer_votes` (migration 058) has the same shape and enforces
+-- server-side for the same reason. R08 (task 1003021) owns it.
+--
+-- MEMBERSHIP is a CONFIGURED PREDICATE resolved per request and uncached
+-- (ADR 0175 §6), so it is absent by design. Storing who may vote would fork
+-- authority truth and defeat ADR 0016's instant-demotion property — the same rule
+-- that forbids memoising the resolver.
+--
+-- THE COUNTING RULE (consent, nulled absences, the zero-vote pass — ADR 0175 §3)
+-- is R10's logic. Nothing here presumes a tally, which is exactly what lets the
+-- constitution be amended without a migration.
+
+BEGIN;
+
+-- ---------------------------------------------------------------------------
+-- government_board_items — one row per thing put to the board.
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS government_board_items (
+  id             bigserial PRIMARY KEY,
+
+  -- ADR 0175 §1. Present FROM DAY ONE precisely so a third subject is a row
+  -- rather than a migration. Also load-bearing downstream: an amendment travels
+  -- the same close path as an idea and must book NO credits, so the economy
+  -- consumer filters on this column and never on `subject_id IS NOT NULL`
+  -- (docs/specs/board-room-pass-event-contract.md, Decision 2).
+  subject_type   text        NOT NULL
+                 CHECK (subject_type IN ('full_idea', 'constitutional_amendment')),
+  subject_id     bigint      NOT NULL,
+
+  -- NULLABLE by design. A full_idea window opens AUTOMATICALLY the moment the
+  -- idea clears the completeness bar (ADR 0175 §5), so there is no human opener
+  -- to record; an amendment is proposed by a person and this is set. Do not
+  -- backfill a system id — "the grade opened this, nobody did" is the true fact.
+  opened_by      bigint      REFERENCES builders(id) ON DELETE SET NULL,
+
+  opened_at      timestamptz NOT NULL DEFAULT now(),
+
+  -- The sitting's clock (ADR 0175 §2). Absolute rather than a duration, so
+  -- changing the project's window length never moves an already-open deadline.
+  -- NULL means NO CLOCK — the day-one monarchy configuration, where pass_rule is
+  -- `first_ratifier` and the item closes on the first vote instead of on time.
+  closes_at      timestamptz,
+
+  closed_at      timestamptz,
+  outcome        text        CHECK (outcome IN ('passed', 'returned')),
+
+  -- The rule IN FORCE when this item opened, snapshotted. ADR 0175 §7 lets the
+  -- constitution be amended by the board itself, so the live config is not a
+  -- reliable account of how a past item was decided — without this, an amendment
+  -- silently rewrites the history of every closed item. Shape:
+  --   { membership, pass_rule, window_minutes, close_early_on_full_turnout }
+  constitution   jsonb       NOT NULL,
+
+  -- An item is either open (no outcome, no closed_at) or closed (both set).
+  CONSTRAINT government_board_items_closed_consistent
+    CHECK ((closed_at IS NULL) = (outcome IS NULL))
+);
+
+-- At most ONE open item per subject. PARTIAL, so the many CLOSED items a
+-- resubmitted idea accumulates are all legal — ADR 0175 §4 makes resubmission
+-- unbounded and keeps every past rejection visible on the history.
+CREATE UNIQUE INDEX IF NOT EXISTS government_board_items_one_open_per_subject
+  ON government_board_items (subject_type, subject_id)
+  WHERE closed_at IS NULL;
+
+-- Serves the expiry poller (R11) and the re-drive sweep the pass-event contract
+-- requires — "callable in a sweep over items WHERE outcome = 'passed'", so a
+-- missed credit is reconcilable without replaying an event.
+CREATE INDEX IF NOT EXISTS government_board_items_open_by_deadline
+  ON government_board_items (closes_at)
+  WHERE closed_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS government_board_items_by_outcome
+  ON government_board_items (outcome)
+  WHERE outcome IS NOT NULL;
+
+-- ---------------------------------------------------------------------------
+-- government_board_votes — open ballot (ADR 0175 §9), one vote per member.
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS government_board_votes (
+  id           bigserial   PRIMARY KEY,
+  item_id      bigint      NOT NULL
+               REFERENCES government_board_items(id) ON DELETE CASCADE,
+  voter_id     bigint      NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+
+  direction    text        NOT NULL CHECK (direction IN ('yes', 'no')),
+
+  -- ADR 0175 §4. A 'no' MUST carry free text AND exactly one of the five Full
+  -- Idea sections. This pair is the reason the hall is the only possible voting
+  -- surface: a Discord reaction can express direction and nothing else, so
+  -- reaction-voting would make every rejection feedback-free — the precise thing
+  -- criterion C2 exists to prevent.
+  --
+  -- Section keys are the `base-v1` template in modules/ideas/templates.js — the
+  -- owner's own wording. A CHECK rather than a foreign key because that template
+  -- is a code declaration, not a table. If a project ever defines its own idea
+  -- shape (the goal-1000062 "simple base, built to be altered" promise), this
+  -- constraint is what must move, and it should move deliberately.
+  reason_md    text,
+  section_key  text        CHECK (section_key IN
+                 ('purpose', 'big_picture', 'why_had', 'why_matters', 'fit')),
+
+  cast_at      timestamptz NOT NULL DEFAULT now(),
+
+  -- An objection without a reason and a flagged section is not an objection; a
+  -- 'yes' carries neither. Enforced here so no route can forget it.
+  CONSTRAINT government_board_votes_objection_is_reasoned
+    CHECK (
+      (direction = 'no'  AND reason_md IS NOT NULL AND btrim(reason_md) <> ''
+                         AND section_key IS NOT NULL)
+      OR
+      (direction = 'yes' AND reason_md IS NULL AND section_key IS NULL)
+    ),
+
+  -- One vote per member per item, on the `peer_votes` precedent (migration 058).
+  CONSTRAINT government_board_votes_one_per_voter UNIQUE (item_id, voter_id)
+);
+
+CREATE INDEX IF NOT EXISTS government_board_votes_by_item
+  ON government_board_votes (item_id);
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.191",
+  "version": "1.19.192",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.191",
+      "version": "1.19.192",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.191",
+  "version": "1.19.192",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -809,8 +809,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.189 with no explicit bump. run 31983360426. (task 1002620)
 //   1.19.191 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.190 with no explicit bump. run 31983663234. (task 1002620)
+//   1.19.192 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.191 with no explicit bump. run 31984583069. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.191'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.192'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_seed.mjs

@@ -36,6 +36,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'governance_001_tables.sql',                     // creates the three tables
   'government_001_rename_from_governance.sql',     // ADR 0174 table rename (task 1003004)
   'government_002_rename_permission_keys.sql',     // ADR 0174 key rename (task 1003006)
+  'government_003_board_tables.sql',               // ADR 0175 Board Room schema (task 1003016)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.