@bongos/core 1.19.195 → 1.19.196

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.195",
-  "core_contract": "1.19.195",
-  "source_commit": "6f4385930d135df297276b8621d06766d37a31f4",
+  "core_version": "1.19.196",
+  "core_contract": "1.19.196",
+  "source_commit": "057ae65d085a223a3f09f796164eee79e35242d6",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T02:34:38.864Z",
+  "built_at": "2026-08-17T02:44:35.952Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 309,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1284,
+    "functional_verbatim": 1285,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1614,
-  "tree_sha256": "8116719f0704b34ec16115f9e0134e61f13a8dbdcf965a215c6696d637c7ed91",
+  "file_count": 1615,
+  "tree_sha256": "0bab078fb9153e86b9ebaf32900bd0c90ba911bc05100fd25ce101dc5e4342b7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2892,7 +2892,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "b7073912e1aea3da33f876999a6beaae028142f0bf7bf66c1f95efc261b41272"
+      "sha256": "ed853e83a9765e0a5de90195a15dea6b0bf1f6d07be0b6ad740d54a7c79c2c7d"
     },
     {
       "path": "modules/government/config.js",
@@ -2954,6 +2954,11 @@
       "mode": "0000644",
       "sha256": "e4802709d31031f2a7b66e1c3a07fd71def94b2eaf4eff7ad8a0f22bf6eeaf5e"
     },
+    {
+      "path": "modules/government/migrations/government_004_board_permissions.sql",
+      "mode": "0000644",
+      "sha256": "75913af702d6529c9a5cf2e2c42d9c329eea92ae99274fb71f2524520de4cfbf"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4267,12 +4272,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7b801c937ba9dd1e63dd47500431d689b484386e24ce7dd4a170e8aad9fe3795"
+      "sha256": "ee80b4cb2114c56ba516f47f2e883ebaab71a1369863ce1c5f96cb982bd636eb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "41ec69a812063ad9f24f616976b4492e2b651cfb5bdc4242ebd5873b7a9e8c2f"
+      "sha256": "43f68be2f5fa45a19e658f124d5b70c535990e6b40a01abc9fc67e4daf9c28f1"
     },
     {
       "path": "public-docs/index.html",
@@ -5882,7 +5887,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "719cefa356719d4cbe09a49186afae9e5cc116eece82c2c2694ab93706effd54"
+      "sha256": "d789e8fcee6eed4ab2bf9badfaed68832830493d1d6b76f9d9263fae5c1d4163"
     },
     {
       "path": "src/module-loader/catalog.js",

package/modules/government/catalog.js

@@ -198,6 +198,22 @@ const PERMISSIONS = [
   { key: 'override_request.decide', system: false, floor: 'metic', guards: 'GET /override-requests, POST .../:id/decide (ADR 0157, was archon)' },
   { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
   { key: 'idea.ratify', system: false, floor: 'metic', guards: 'POST /inbox/:id/ratify (ADR 0157, was archon)' },
+  // ── the Board Room (ADR 0175, goal 1000069) ──────────────────────────────────
+  // Declared BEFORE their routes exist (R07/R08 add them), and deliberately so:
+  // for a NEW key the unsafe order is code-first. A grant row naming a key no
+  // route reads is INERT; a route reading a key with no grant rows 403s everyone.
+  // ADR 0174's Consequences record that failure landing on the Government tab
+  // itself. So grants lead, routes follow — inside this goal, not across releases.
+  { key: 'board.item.open', system: false, floor: 'metic', guards: 'POST /board/items — put a subject to the board (ADR 0175; a Full Idea window opens automatically on grade pass, so in practice this guards an amendment)' },
+  // floor 'xenos' is NOT a mistake and must not be "tightened". Who may vote is
+  // the CONSTITUTION's membership predicate, resolved per request from config
+  // (ADR 0175 §6) — today `rank:archon`. Encoding that rank here too would fork
+  // authority truth into a second place and, worse, would make widening the
+  // franchise a MIGRATION rather than the config change ADR 0175 §6 promises it
+  // is. So the atom says only "this route exists for authenticated builders" and
+  // the predicate does the real gating — the `criterion.create` pattern above,
+  // where the floor is real but explicitly not the whole gate.
+  { key: 'board.vote.cast', system: false, floor: 'xenos', guards: 'POST /board/items/:id/vote — floor is the coarse gate; board membership is the configured predicate (ADR 0175 §6), checked in-handler' },
   { key: 'task.newcomer_restock', system: false, floor: 'metic', guards: 'POST /tasks/newcomer-restock (ADR 0157, was archon)' },
   { key: 'task.peer_votes.tally', system: false, floor: 'metic', guards: 'POST /tasks/peer-votes/tally (ADR 0157, was archon)' },
   { key: 'goal.reorder', system: false, floor: 'metic', guards: 'POST /goals/reorder (ADR 0157, was archon)' },

package/modules/government/migrations/government_004_board_permissions.sql

@@ -0,0 +1,87 @@
+-- government_004_board_permissions.sql — grant the two Board Room atoms
+-- (task 1003017 / R04 of goal 1000069). Decision of record: ADR 0175.
+--
+-- catalog.js now carries `board.item.open` (floor 'metic') and `board.vote.cast`
+-- (floor 'xenos'). Both are operational (system:false) — creating an item or
+-- casting a vote confers authority on nobody, which is the same argument the
+-- `version.create` row makes against a symmetry-with-`version.close` reading.
+--
+-- ── THIS MIGRATION IS LOAD-BEARING, not bookkeeping ─────────────────────────
+-- The compat seed (governance_002) is run-once, so a database that has already
+-- migrated would never learn a key added only in code: no rank would hold these,
+-- and the routes R07/R08 add would 403 every builder including the Archon. The
+-- grant has to arrive as its own migration for the change to be behaviour-
+-- identical in practice and not just on a fresh install. `governance_006` is the
+-- worked example this copies.
+--
+-- ── WHY THE GRANTS LAND BEFORE THE ROUTES ───────────────────────────────────
+-- The consuming routes do not exist yet (R07 opens a window, R08 casts a vote).
+-- That order is deliberate, and it is the safe one: a grant row naming a key no
+-- route reads is INERT, while a route reading a key with no grant rows fails
+-- closed for everyone. ADR 0174's Consequences record what the inverse costs —
+-- the key that gates the Government tab failing closed on the very surface an
+-- owner would use to investigate. So grants lead and routes follow, inside this
+-- goal rather than across releases.
+--
+-- ── WHY `board.vote.cast` GOES TO EVERY RANK, INCLUDING xenos ───────────────
+-- This is the row most likely to be "corrected" by a later reader, so: it is
+-- correct. Who may vote is the CONSTITUTION's membership predicate, resolved per
+-- request from config (ADR 0175 §6) — today `rank:archon`. Encoding that rank
+-- here as well would fork authority truth into a second place, and would make
+-- widening the franchise a MIGRATION rather than the config change ADR 0175 §6
+-- promises. The atom therefore says only "this route exists for authenticated
+-- builders"; the predicate does the real gating, in-handler. This is exactly the
+-- shape `criterion.create` already uses, where the floor is real but explicitly
+-- not the whole gate.
+--
+-- ── NOT GRANTED: there is no `board.config.manage` ──────────────────────────
+-- The planning outline named a third key for changing the constitution. It is
+-- deliberately absent, because the constitution is FILE config: config.js reads
+-- config/government.json and config/government.neutral.json with readFileSync
+-- and there is no write route — every write route in this module edits DB rows
+-- (ranks, grants, assignments), never config. A key no route consumes does not
+-- exist (catalog.js's first rule), so minting one would have made the catalog
+-- describe authority nothing can exercise. Amending the constitution stays what
+-- ADR 0175 §7 describes: the board RATIFIES, and the file edit + merge executes
+-- — which is also ADR 0162's "advisory, never self-executing" holding.
+--
+-- ── ONE BLOCK PER RANK, and the form is load-bearing ────────────────────────
+-- The drift guard (tests/government_seed.mjs) scans for the literal
+-- `SELECT '<rank>', unnest(ARRAY[…])`, so a combined
+-- `unnest(ARRAY['metic','archon'])` form parses as ZERO grants and reds the
+-- build. Four blocks because the seed is a cumulative superset: a 'xenos'-floored
+-- key is held by every rank, a 'metic'-floored key by metic and archon.
+--
+-- Additive only: two new permission keys granted; nothing is revoked (the union
+-- model in tests/government_seed.mjs cannot express a revoke). Idempotent
+-- (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'xenos', unnest(ARRAY[
+  'board.vote.cast'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'thetes', unnest(ARRAY[
+  'board.vote.cast'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'board.vote.cast',
+  'board.item.open'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'board.vote.cast',
+  'board.item.open'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.195",
+  "version": "1.19.196",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.195",
+      "version": "1.19.196",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.195",
+  "version": "1.19.196",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -817,8 +817,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.193 with no explicit bump. run 31987857242. (task 1002620)
 //   1.19.195 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.194 with no explicit bump. run 31988381869. (task 1002620)
+//   1.19.196 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.195 with no explicit bump. run 31988890305. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.195'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.196'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');