@bongos/core 1.19.194 → 1.19.196

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.194",
-  "core_contract": "1.19.194",
-  "source_commit": "51e36d9f794eb0037aa09c1e1730e1e840809121",
+  "core_version": "1.19.196",
+  "core_contract": "1.19.196",
+  "source_commit": "057ae65d085a223a3f09f796164eee79e35242d6",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T02:24:40.175Z",
+  "built_at": "2026-08-17T02:44:35.952Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 309,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1284,
+    "functional_verbatim": 1285,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1614,
-  "tree_sha256": "01783a610e639ab5b32fc23d453417b70b8a9277f80e987926c0b0e95a12b225",
+  "file_count": 1615,
+  "tree_sha256": "0bab078fb9153e86b9ebaf32900bd0c90ba911bc05100fd25ce101dc5e4342b7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2892,7 +2892,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "b7073912e1aea3da33f876999a6beaae028142f0bf7bf66c1f95efc261b41272"
+      "sha256": "ed853e83a9765e0a5de90195a15dea6b0bf1f6d07be0b6ad740d54a7c79c2c7d"
     },
     {
       "path": "modules/government/config.js",
@@ -2954,6 +2954,11 @@
       "mode": "0000644",
       "sha256": "e4802709d31031f2a7b66e1c3a07fd71def94b2eaf4eff7ad8a0f22bf6eeaf5e"
     },
+    {
+      "path": "modules/government/migrations/government_004_board_permissions.sql",
+      "mode": "0000644",
+      "sha256": "75913af702d6529c9a5cf2e2c42d9c329eea92ae99274fb71f2524520de4cfbf"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -3332,7 +3337,7 @@
     {
       "path": "modules/hall-ui/public/people.js",
       "mode": "0000644",
-      "sha256": "5439654ddbc1ad6be7944dc198eca5094ec5978ad3b73b7196215ad3dc781dca"
+      "sha256": "65240ee6f7c1dd4a73282f82a659e5906edbe612500e2e4ed9930f31f7e3f377"
     },
     {
       "path": "modules/hall-ui/public/primer.css",
@@ -4267,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "426eec8097d4ca14acea9859a254673f9d51fe2c644ef013229b1efe46a2d389"
+      "sha256": "ee80b4cb2114c56ba516f47f2e883ebaab71a1369863ce1c5f96cb982bd636eb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "07bf17d0989db9908ddc62823f0f46c03806aaa0e01add72f0073d8cc86ec158"
+      "sha256": "43f68be2f5fa45a19e658f124d5b70c535990e6b40a01abc9fc67e4daf9c28f1"
     },
     {
       "path": "public-docs/index.html",
@@ -5882,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c670dfda30a263cdef49ff035bb9e6739346fca361b38f5e4fea67eea76dd423"
+      "sha256": "d789e8fcee6eed4ab2bf9badfaed68832830493d1d6b76f9d9263fae5c1d4163"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/government/catalog.js

@@ -198,6 +198,22 @@ const PERMISSIONS = [
   { key: 'override_request.decide', system: false, floor: 'metic', guards: 'GET /override-requests, POST .../:id/decide (ADR 0157, was archon)' },
   { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
   { key: 'idea.ratify', system: false, floor: 'metic', guards: 'POST /inbox/:id/ratify (ADR 0157, was archon)' },
+  // ── the Board Room (ADR 0175, goal 1000069) ──────────────────────────────────
+  // Declared BEFORE their routes exist (R07/R08 add them), and deliberately so:
+  // for a NEW key the unsafe order is code-first. A grant row naming a key no
+  // route reads is INERT; a route reading a key with no grant rows 403s everyone.
+  // ADR 0174's Consequences record that failure landing on the Government tab
+  // itself. So grants lead, routes follow — inside this goal, not across releases.
+  { key: 'board.item.open', system: false, floor: 'metic', guards: 'POST /board/items — put a subject to the board (ADR 0175; a Full Idea window opens automatically on grade pass, so in practice this guards an amendment)' },
+  // floor 'xenos' is NOT a mistake and must not be "tightened". Who may vote is
+  // the CONSTITUTION's membership predicate, resolved per request from config
+  // (ADR 0175 §6) — today `rank:archon`. Encoding that rank here too would fork
+  // authority truth into a second place and, worse, would make widening the
+  // franchise a MIGRATION rather than the config change ADR 0175 §6 promises it
+  // is. So the atom says only "this route exists for authenticated builders" and
+  // the predicate does the real gating — the `criterion.create` pattern above,
+  // where the floor is real but explicitly not the whole gate.
+  { key: 'board.vote.cast', system: false, floor: 'xenos', guards: 'POST /board/items/:id/vote — floor is the coarse gate; board membership is the configured predicate (ADR 0175 §6), checked in-handler' },
   { key: 'task.newcomer_restock', system: false, floor: 'metic', guards: 'POST /tasks/newcomer-restock (ADR 0157, was archon)' },
   { key: 'task.peer_votes.tally', system: false, floor: 'metic', guards: 'POST /tasks/peer-votes/tally (ADR 0157, was archon)' },
   { key: 'goal.reorder', system: false, floor: 'metic', guards: 'POST /goals/reorder (ADR 0157, was archon)' },

package/modules/government/migrations/government_004_board_permissions.sql

@@ -0,0 +1,87 @@
+-- government_004_board_permissions.sql — grant the two Board Room atoms
+-- (task 1003017 / R04 of goal 1000069). Decision of record: ADR 0175.
+--
+-- catalog.js now carries `board.item.open` (floor 'metic') and `board.vote.cast`
+-- (floor 'xenos'). Both are operational (system:false) — creating an item or
+-- casting a vote confers authority on nobody, which is the same argument the
+-- `version.create` row makes against a symmetry-with-`version.close` reading.
+--
+-- ── THIS MIGRATION IS LOAD-BEARING, not bookkeeping ─────────────────────────
+-- The compat seed (governance_002) is run-once, so a database that has already
+-- migrated would never learn a key added only in code: no rank would hold these,
+-- and the routes R07/R08 add would 403 every builder including the Archon. The
+-- grant has to arrive as its own migration for the change to be behaviour-
+-- identical in practice and not just on a fresh install. `governance_006` is the
+-- worked example this copies.
+--
+-- ── WHY THE GRANTS LAND BEFORE THE ROUTES ───────────────────────────────────
+-- The consuming routes do not exist yet (R07 opens a window, R08 casts a vote).
+-- That order is deliberate, and it is the safe one: a grant row naming a key no
+-- route reads is INERT, while a route reading a key with no grant rows fails
+-- closed for everyone. ADR 0174's Consequences record what the inverse costs —
+-- the key that gates the Government tab failing closed on the very surface an
+-- owner would use to investigate. So grants lead and routes follow, inside this
+-- goal rather than across releases.
+--
+-- ── WHY `board.vote.cast` GOES TO EVERY RANK, INCLUDING xenos ───────────────
+-- This is the row most likely to be "corrected" by a later reader, so: it is
+-- correct. Who may vote is the CONSTITUTION's membership predicate, resolved per
+-- request from config (ADR 0175 §6) — today `rank:archon`. Encoding that rank
+-- here as well would fork authority truth into a second place, and would make
+-- widening the franchise a MIGRATION rather than the config change ADR 0175 §6
+-- promises. The atom therefore says only "this route exists for authenticated
+-- builders"; the predicate does the real gating, in-handler. This is exactly the
+-- shape `criterion.create` already uses, where the floor is real but explicitly
+-- not the whole gate.
+--
+-- ── NOT GRANTED: there is no `board.config.manage` ──────────────────────────
+-- The planning outline named a third key for changing the constitution. It is
+-- deliberately absent, because the constitution is FILE config: config.js reads
+-- config/government.json and config/government.neutral.json with readFileSync
+-- and there is no write route — every write route in this module edits DB rows
+-- (ranks, grants, assignments), never config. A key no route consumes does not
+-- exist (catalog.js's first rule), so minting one would have made the catalog
+-- describe authority nothing can exercise. Amending the constitution stays what
+-- ADR 0175 §7 describes: the board RATIFIES, and the file edit + merge executes
+-- — which is also ADR 0162's "advisory, never self-executing" holding.
+--
+-- ── ONE BLOCK PER RANK, and the form is load-bearing ────────────────────────
+-- The drift guard (tests/government_seed.mjs) scans for the literal
+-- `SELECT '<rank>', unnest(ARRAY[…])`, so a combined
+-- `unnest(ARRAY['metic','archon'])` form parses as ZERO grants and reds the
+-- build. Four blocks because the seed is a cumulative superset: a 'xenos'-floored
+-- key is held by every rank, a 'metic'-floored key by metic and archon.
+--
+-- Additive only: two new permission keys granted; nothing is revoked (the union
+-- model in tests/government_seed.mjs cannot express a revoke). Idempotent
+-- (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'xenos', unnest(ARRAY[
+  'board.vote.cast'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'thetes', unnest(ARRAY[
+  'board.vote.cast'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'board.vote.cast',
+  'board.item.open'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'board.vote.cast',
+  'board.item.open'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/people.js

@@ -58,6 +58,25 @@
 
   function mountDirectory(builders) {
     all = Array.isArray(builders) ? builders : [];
+    // An EMPTY directory is almost never missing data — it is ADR 0171's
+    // fail-closed consent boundary doing exactly what it was ratified to do.
+    // `listScoutingRollup` filters on `profile_state = 'active'`, every account
+    // starts `'provisional'`, and an account activates ONLY when its human signs
+    // in at the hub itself (P03, ratified by the owner 2026-08-16: no backfill
+    // activation). This builders hall predates the hub flow, so its builders stay
+    // unlisted until each has signed in there once.
+    //
+    // Reporting that as "no cross-project activity reported yet" is actively
+    // misleading — the activity exists and is visible on every project's own
+    // leaderboard; the accounts simply are not publicly listed — and that wrong
+    // explanation is why an empty directory got filed as a bug (task 1002937).
+    // Say which of the two it is, so the page is never mistaken for broken.
+    if (!all.length) {
+      notice('Nobody is publicly listed here yet. A builder joins this directory once they have '
+        + 'signed in on the main platform site at least once — accounts stay unlisted until then, '
+        + 'and none are listed without it. Their work still shows on each project’s own ledger.');
+      return;
+    }
     kit.makeFilterBar({
       mount: document.getElementById('people-filters'),
       search: { id: 'people-q', label: 'Search', placeholder: 'name or discipline' },
@@ -73,7 +92,9 @@
       columns: ['Builder', { label: 'Projects', class: 'num' }, { label: 'Credits', class: 'num' },
         { label: 'Ships', class: 'num' }, { label: 'Karma', class: 'num' }, 'Disciplines', 'Last active'],
       rowHtml: rowHtml,
-      emptyMsg: 'No cross-project activity reported yet.',
+      // Reached only when the directory HAS builders and the search excluded them
+      // all — the empty-API case returns above with its own explanation.
+      emptyMsg: 'No listed builder matches that search.',
       pager: pager,
     });
     rerender();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.194",
+  "version": "1.19.196",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.194",
+      "version": "1.19.196",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.194",
+  "version": "1.19.196",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -815,8 +815,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.192 with no explicit bump. run 31985689267. (task 1002620)
 //   1.19.194 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.193 with no explicit bump. run 31987857242. (task 1002620)
+//   1.19.195 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.194 with no explicit bump. run 31988381869. (task 1002620)
+//   1.19.196 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.195 with no explicit bump. run 31988890305. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.194'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.196'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');