@bongos/core 1.19.220 → 1.19.221

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.220",
-  "core_contract": "1.19.220",
-  "source_commit": "c0428ccbca81e3243f981295653e2996e9cda202",
+  "core_version": "1.19.221",
+  "core_contract": "1.19.221",
+  "source_commit": "30b2efb16495a941d6a4b70fd03b772cd69bce23",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T03:14:10.378Z",
+  "built_at": "2026-08-18T03:23:47.936Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1635,
-  "tree_sha256": "aac7f97a1131f16c75b768382681a70085520bf75be38b35124497b3d734e097",
+  "tree_sha256": "aa35386f9d066c748b4374cf27b4dc5fbf48ccfef32dfb8ef8c60cf44fdb8c96",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1352,7 +1352,7 @@
     {
       "path": "docs/adr/0174-government-terminology-ranks-not-roles.md",
       "mode": "0000644",
-      "sha256": "c645ce8202fa8e8faa59d3aa00a8167477b5223817b760a733b38864d7625c1d"
+      "sha256": "2b813490fe355bfdb783d9b28eee01b97bfb6d7d4343a3f59aeeb6fac185b79b"
     },
     {
       "path": "docs/adr/0175-the-board-room-full-idea-ratification.md",
@@ -2997,7 +2997,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "c229aec4f02fe970f4a3f798d370eef9b080cd0837f906b574362abda57107ad"
+      "sha256": "872f144bcd788e36f8b8bc87e5bd31f2389169ffa5d930e03d74ba24a0264f3b"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4292,12 +4292,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "352bfdf3484cd27c33da65632970d50a1b99e164008d45b2689cb365fee16720"
+      "sha256": "5b55ea236b725452ef02e308616d3827927f68e82a483022a856e4066864dc99"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "719aa0ff0ff7323f96ad1257c3505c5929943f64d3e00f9cdb6f4fce78dc150e"
+      "sha256": "ec221145b014962cce2d2c9fc9e231a0b296bb65153ba8079e30f2f4e80b9df7"
     },
     {
       "path": "public-docs/index.html",
@@ -4922,7 +4922,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "5cc94859033c924884efa60f50f8a1f7810a85382c42d785d62b804181a195f5"
+      "sha256": "a255afac6eb4a2b8269e896032e8eabf10f104aed5a0f1e8d0a7348695625424"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5742,7 +5742,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "808b164783dae50e0be37f35dcbcae7b2d474868746a240a957b89130870f483"
+      "sha256": "277097c686b695688dee35d158c4bb8384b4a5a89c61f30c7bda7d9f4b477bee"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5777,7 +5777,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "422647dc473583a67509644b04e47b8fc2279bb117fa1b6db1030502b5287870"
+      "sha256": "af5bdd9e362923afc1b78a741b5254147678b34cecb7d92f879387cc94a05631"
     },
     {
       "path": "src/bongos/routes.js",
@@ -5912,7 +5912,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6f39901735ba86e7abd2b5770b36146104ac47dec250131ac24eeca6754ef5f2"
+      "sha256": "4aa9331871262decd3e4b2a16e1cd9ca58b4e4000228cde02086ad209a1bb4b7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6907,7 +6907,7 @@
     {
       "path": "tests/government_routes.mjs",
       "mode": "0000644",
-      "sha256": "3b2e0ca134737992590132f089d5f93b479ad6cec83a5d2a932412b3edaf4547"
+      "sha256": "7f406d5296489d08804eae5b431d07244e1f2f3464513cccccb72e7b33253c14"
     },
     {
       "path": "tests/government_seed.mjs",

package/docs/adr/0174-government-terminology-ranks-not-roles.md

@@ -55,3 +55,33 @@ This was the closest call in the directive, and it was decided against the alter
 **Rejected: renaming the ladder slugs to match.** `xenos`/`thetes`/`metic`/`archon` are referenced by `builders.rank`, `requireRank`, the protected-path enforcers, the Discord role map, and years of session logs. The directive did not ask for it, and bundling it here would turn a bounded rename into a trust-boundary migration.
 
 **Rejected: a compatibility shim kept indefinitely.** The old `/governance/*` route paths answer for exactly one release, logging each hit, and R05 records the removal release in this ADR's lineage. A permanent alias would mean both vocabularies stay correct forever, which is the state this ADR exists to end.
+
+## Lineage — the compatibility alias, and when it actually went
+
+The Decision above promised the old `/governance/*` route paths would answer for
+**exactly one release**, and that R05 would record the removal release here. That
+record was never written, and the alias outlived the promise by a wide margin.
+
+| | |
+|---|---|
+| Alias shipped | task 1003006 (R05), with the rename |
+| Promised life | one release |
+| Actually removed | **task 1003084**, core 1.19.219+ — many releases later |
+
+Two source comments (`src/bongos/module-scope-map.js`, and the `VOCAB_ALLOW`
+entry in `scripts/gds/fitness.js`) asserted the route aliases had already gone
+with the module-key alias in R05. They had not. A reader who trusted them —
+and the goal 1000068 criterion review nearly did — would conclude the
+compatibility surface no longer existed while production was still 308-ing on
+it. The alias was found by curling live, the same way all three of its original
+defects were.
+
+**The lesson, recorded because it generalises past this ADR:** a removal that is
+promised in prose and pinned by nothing does not happen. The shim had thorough
+tests, but they asserted the shim WORKED — so deleting the shim would have
+deleted its own evidence. Task 1003084 inverts them: `tests/government_routes.mjs`
+now asserts the legacy paths **404**, with a companion assertion that the current
+paths still route so the check cannot pass by everything being broken. A
+time-boxed compatibility surface should ship with the test of its ABSENCE
+written at the same time, disabled until the clock runs out — not with a
+calendar note in a comment.

package/modules/government/routes/government.js

@@ -182,61 +182,8 @@ module.exports = function buildGovernmentRouter() {
     return rank;
   }
   const ARCHON = 'archon';
-  const ARCHON_REASON = 'the Archon rank-rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
-  const ASSIGN_REASON = 'a seeded rank-rank is assigned by rank (R95b sync); change the builder\'s rank instead';
-
-  // ── the one-release LEGACY path aliases: /governance/* -> /government/* ────
-  // ADR 0174 committed to keeping the pre-rename paths answering for exactly one
-  // release. The case this actually protects is narrow but real: a browser that
-  // still has the OLD hall page open when the instance upgrades will keep calling
-  // the legacy /governance/* paths against the new server. Everything else that
-  // paths (the hall bundle, the generated client) ships INSIDE the same core
-  // package and moves in lockstep.
-  //
-  // A 308 preserves the method and body, so a PUT/DELETE grant toggle survives
-  // the hop. The alias carries NO gate of its own — it redirects, and the real
-  // route re-runs requireBuilder + requirePermission on the followed request, so
-  // this cannot become a way around the wall.
-  //
-  // REMOVE THIS BLOCK one release after the rename ships (goal 1000068 follow-up).
-  // The `alias` counter in the log line is how we tell whether anything still
-  // calls them before deleting.
-  //
-  // EXPRESS 4 WILDCARD SYNTAX. This is express 4.22 — the wildcard is a bare `*`
-  // and the captured tail is req.params[0]. Express 5's named form (`/*rest`) is
-  // NOT a wildcard here, it is a literal path segment, so it silently matches
-  // nothing and every legacy path 404s. It shipped that way once (task 1003006)
-  // and was only caught by curling the live site after the cutover — the module
-  // parsed fine, so nothing local failed.
-  const LEGACY_PATH_PREFIX = '/governance';
-  // The legacy noun -> the current one, as a NAMED DATA PAIR rather than an
-  // inline regex literal. An inline pattern here was silently rewritten by a
-  // repo-wide sweep so that both sides matched, turning the translation into an
-  // identity function that redirected to a path which does not exist. Naming the
-  // pair and asserting they differ makes that class of damage loud.
-  //
-  // Every line in this block that spells the legacy vocabulary carries the word
-  // LEGACY on purpose: that is what the ADR 0174 fitness allowlist keys on, so
-  // the shim can name what it is compatible with without excusing the whole file.
-  const LEGACY_SEGMENT = 'roles';   // legacy
-  const CURRENT_SEGMENT = 'ranks';
-  if (LEGACY_SEGMENT === CURRENT_SEGMENT) {
-    throw new Error('government legacy alias: the rename pair collapsed to an identity — a sweep has eaten it');
-  }
-  router.all(`${LEGACY_PATH_PREFIX}/*`, (req, res, next) => {
-    const tail = req.params[0] || '';            // express 4: bare * captures here
-    if (!tail) return next();
-    // Translate the leading segment, keep everything after it, keep the query.
-    const translated = tail === LEGACY_SEGMENT || tail.startsWith(`${LEGACY_SEGMENT}/`)
-      ? CURRENT_SEGMENT + tail.slice(LEGACY_SEGMENT.length)
-      : tail;
-    const qs = req.originalUrl.includes('?') ? req.originalUrl.slice(req.originalUrl.indexOf('?')) : '';
-    // req.baseUrl is the router's MOUNT point (/api/gds). Redirecting without it
-    // sends the caller to /government/... at the site root, which 404s.
-    const target = `${req.baseUrl}/government/${translated}${qs}`;
-    console.warn(`[government] legacy path hit: ${req.method} ${req.originalUrl} -> ${target} (ADR 0174 alias; remove one release after the rename)`);
-    return res.redirect(308, target);
-  });
+  const ARCHON_REASON = 'the Archon rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
+  const ASSIGN_REASON = 'a seeded rank is assigned by rank (R95b sync); change the builder\'s rank instead';
 
   // rank: perm government.manage — the full rank list with each rank's grants.
   router.get('/government/ranks', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
@@ -337,7 +284,7 @@ module.exports = function buildGovernmentRouter() {
             ? 'substrate-enforced (ADR 0043) — enforced outside the app by the pre-push hook / main-audit / the rank floor, so a grant row here would confer nothing. Non-grantable to EVERY rank.'
             : catalog.isPrincipalKey(permissionKey)
               ? 'a machine-principal permission — held by an exact builders.system_role identity, never by a rank (ADR 0151 §3)'
-              : 'a system (trust-boundary) permission is non-grantable to a CUSTOM rank; only a sub-Archon rank-rank may carry one (ADR 0172)',
+              : 'a system (trust-boundary) permission is non-grantable to a CUSTOM rank; only a sub-Archon rank may carry one (ADR 0172)',
         });
       }
       const granted = await db.grantRankPermission({ rankKey, permissionKey });
@@ -387,7 +334,7 @@ module.exports = function buildGovernmentRouter() {
       if (!rank.is_system || !catalog.RANK_ORDER.includes(rank.seeded_rank)) {
         return res.fail('rank_has_no_default', 400, {
           rank_key: rankKey,
-          reason: 'only a seeded rank-rank has a catalog default to reset to; revoke a custom rank\'s grants instead',
+          reason: 'only a seeded rank has a catalog default to reset to; revoke a custom rank\'s grants instead',
         });
       }
       // The seed is the floor derivation, which never contains a principal key and

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.220",
+  "version": "1.19.221",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.220",
+      "version": "1.19.221",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.220",
+  "version": "1.19.221",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1688,16 +1688,6 @@ const VOCAB_ALLOW = [
        + 'repo, so the old spelling is still read. Dropping it would silently stop '
        + 'honouring a label override someone already configured.',
   },
-  {
-    file: 'modules/government/routes/government.js',
-    match: 'legacy',
-    why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
-       + 'compatibility shim has to name the thing it is compatible with. The match is '
-       + 'the word LEGACY, and the shim block is written so that every line spelling the '
-       + 'old vocabulary carries it — so the exemption is scoped to the shim rather than '
-       + 'to the whole file, and a stray "role" elsewhere in this file still reds the '
-       + 'build. Delete with the alias block one release after the rename ships.',
-  },
   {
     file: 'modules/government/module.json',
     match: 'role',

package/src/bongos/module-scope-map.js

@@ -171,15 +171,18 @@ const MODULE_GLOBS = {
   //     module. `protected` DERIVES true — its 'modules/governance/' glob is in
   //     PROTECTED_GLOBS (the authz core) — so creating a goal scoped to governance is
   //     Archon-only (BV1.R57 / POST /goals). The config globs are the per-instance
-  //     role templates (R96), listed here as goal territory; the module code lands in
+  //     rank templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
   //     RENAMED governance → government (goal 1000068, ADR 0174). The
-  //     transitional `governance` alias key was removed in R05 (task 1003006)
-  //     together with the /governance/* route aliases — the same compatibility
-  //     window. The three live goals that named the old key (1000030, 1000057,
-  //     1000068) had it removed from goals.scope_modules in the same change, so
-  //     no stored row references a key the map no longer defines.
+  //     transitional `governance` alias key was removed in R05 (task 1003006).
+  //     The /governance/* ROUTE aliases outlived it: this comment claimed they
+  //     went in the same change, but they kept 308-ing on production for months
+  //     of releases past the one ADR 0174 allowed them, and the false claim here
+  //     is part of why nobody noticed. They were removed separately, in task
+  //     1003084. The three live goals that named the old key (1000030, 1000057,
+  //     1000068) had it removed from goals.scope_modules in R05, so no stored row
+  //     references a key the map no longer defines.
   government: [
     'modules/government/',
     'config/government.json', 'config/government.neutral.json',

package/src/bongos/route-rank-check.js

@@ -232,7 +232,11 @@ const EXPECTED_RANKS = {
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
-// governance→government in R05 (task 1003006); the module-key alias is gone.
+// governance→government in R05 (task 1003006), which also removed the module-key
+// alias. The /governance/* ROUTE aliases did NOT go with it — they kept 308-ing
+// in production for many releases past the single one ADR 0174 allowed, and were
+// removed separately in task 1003084. Nothing under /governance/* is routed now,
+// so every pin below is the only spelling of its surface.
 const GOVERNMENT_PINS = {
   'GET /government/ranks': 'perm:government.manage',
   'GET /government/permissions': 'perm:government.manage',

package/src/module-api.js

@@ -867,8 +867,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.218 with no explicit bump. run 32094215476. (task 1002620)
 //   1.19.220 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.219 with no explicit bump. run 32094701831. (task 1002620)
+//   1.19.221 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.220 with no explicit bump. run 32095276039. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.220'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.221'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_routes.mjs

@@ -396,27 +396,25 @@ test('DELETE /governance/assignments validates the builder id param', async () =
   assert.equal(r.status, 400);
 });
 
-// ── the one-release /governance/* compatibility alias (ADR 0174) ──────────────
+// ── the /governance/* alias is GONE (ADR 0174, task 1003084) ──────────────
 //
-// This block exists because the alias shipped BROKEN and nothing caught it.
-// Three independent defects, none visible to a parse check or a unit test that
-// only imports the module:
-//   1. it was written with express 5's named-wildcard syntax (`/*rest`) on an
-//      express 4.22 router, where that is a literal segment — so it matched
-//      nothing and every legacy path 404'd;
-//   2. the redirect omitted req.baseUrl, sending callers to /government/... at
-//      the site root instead of under the /api/gds mount;
-//   3. a repo-wide roles->ranks sweep rewrote the SOURCE side of the
-//      /^\/roles/ -> '/ranks' translation, turning it into an identity that
-//      redirected to a path which does not exist.
+// ADR 0174 gave the pre-rename paths exactly one release. They outlived it by
+// months of releases — still 308-ing on production long after two source
+// comments claimed they had been removed — because nothing asserted the
+// REMOVAL, only the shim's behaviour. Deleting the shim's tests with the shim
+// would have recreated exactly that hole, so the assertions are INVERTED
+// instead: the legacy paths must now 404.
 //
-// All three only surfaced when the running site was curled after the cutover.
-// These tests drive a real router so they cannot repeat that.
-
-// A SECOND server, mounted at /api/gds exactly as production does. The main
-// harness above mounts at the root, so it cannot see a missing req.baseUrl —
-// which was one of the three real defects. Mounting like production is the
-// whole point of these three tests.
+// The shim itself shipped broken three times over (express 5 wildcard syntax on
+// an express 4.22 router; a redirect that dropped req.baseUrl; a repo-wide
+// roles->ranks sweep that rewrote the SOURCE side of the translation into an
+// identity). Every one of those only surfaced when the running site was curled.
+// That is why this block still drives a REAL router mounted the way production
+// mounts it, rather than asserting on source text.
+
+// A SECOND server, mounted at /api/gds exactly as production does — the main
+// harness above mounts at the root, so it cannot tell "no route" from "route at
+// the wrong mount point".
 const aliasApp = express();
 aliasApp.use(express.json());
 aliasApp.use(attachFail);
@@ -429,33 +427,37 @@ after(() => aliasServer.close());
 const hop = (method, p) =>
   fetch(`${ALIAS_BASE}${p}`, { method, redirect: 'manual' });
 
-test('the legacy /governance/* alias redirects, under the mount, with the noun translated', async () => {
-  const cases = [
-    ['GET', '/api/gds/governance/roles', '/api/gds/government/ranks'],
-    ['GET', '/api/gds/governance/permissions', '/api/gds/government/permissions'],
-    ['GET', '/api/gds/governance/assignments', '/api/gds/government/assignments'],
-    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage',
-            '/api/gds/government/ranks/metic/permissions/idea.triage'],
-    ['POST', '/api/gds/governance/roles/metic/reset', '/api/gds/government/ranks/metic/reset'],
+test('every legacy /governance/* path is gone — no redirect, no route', async () => {
+  // The exact paths the removed shim used to translate. A 308 here means the
+  // alias is back; a 200 would mean something answers the old vocabulary
+  // directly, which is worse.
+  const legacy = [
+    ['GET', '/api/gds/governance/roles'],
+    ['GET', '/api/gds/governance/permissions'],
+    ['GET', '/api/gds/governance/assignments'],
+    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage'],
+    ['POST', '/api/gds/governance/roles/metic/reset'],
+    ['GET', '/api/gds/governance/ranks'],
   ];
-  for (const [method, from, expected] of cases) {
-    const r = await hop(method, from);
-    assert.equal(r.status, 308, `${method} ${from} must 308 — a 404 means the wildcard is not matching`);
-    assert.equal(r.headers.get('location'), expected,
-      `${method} ${from} must keep the /api/gds mount AND translate roles→ranks`);
+  for (const [method, p] of legacy) {
+    const r = await hop(method, p);
+    assert.equal(r.status, 404, `${method} ${p} must 404 — the one-release alias was removed in task 1003084`);
+    assert.equal(r.headers.get('location'), null, `${method} ${p} must not redirect anywhere`);
   }
 });
 
-test('the alias preserves the query string', async () => {
-  const r = await hop('GET', '/api/gds/governance/roles?x=1&y=2');
-  assert.equal(r.headers.get('location'), '/api/gds/government/ranks?x=1&y=2');
+test('the current /government/* paths still route (the removal took only the alias)', async () => {
+  // The guard against over-deletion: proving the old paths 404 is worthless if
+  // the new ones 404 too. These reach the real gate and are refused for lack of
+  // a session — a 401/403, never a 404.
+  for (const p of ['/api/gds/government/ranks', '/api/gds/government/permissions']) {
+    const r = await hop('GET', p);
+    assert.notEqual(r.status, 404, `${p} must still be routed`);
+  }
 });
 
-test('the alias carries no gate of its own — the followed request re-runs the real one', async () => {
-  // A 308 preserves method and body, so the wall is enforced on the FOLLOWED
-  // request by the real route. The alias must never become a way around it.
+test('no source line reintroduces a legacy path alias', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'), 'utf8');
-  const block = src.slice(src.indexOf('LEGACY_PATH_PREFIX'), src.indexOf('res.redirect(308'));
-  assert.ok(!/requirePermission|requireBuilder/.test(block),
-    'the alias must not carry its own gate — it redirects, and the real route gates the followed request');
+  assert.ok(!/LEGACY_PATH_PREFIX/.test(src), 'the alias block is gone — do not restore it');
+  assert.ok(!/redirect\(308/.test(src), 'no 308 vocabulary redirect belongs on this surface any more');
 });