@bongos/core 1.19.220 → 1.19.222

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.220",
-  "core_contract": "1.19.220",
-  "source_commit": "c0428ccbca81e3243f981295653e2996e9cda202",
+  "core_version": "1.19.222",
+  "core_contract": "1.19.222",
+  "source_commit": "4425d4ace9a3b996b50be1b59002e4cf85f027db",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T03:14:10.378Z",
+  "built_at": "2026-08-18T03:36:13.104Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1635,
-  "tree_sha256": "aac7f97a1131f16c75b768382681a70085520bf75be38b35124497b3d734e097",
+  "tree_sha256": "6bf87d2a8bb013b102f3ae8287a56fd6fe7ed99ed49b48f4607abcb047f59f74",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -397,7 +397,7 @@
     {
       "path": "config/government.neutral.json",
       "mode": "0000644",
-      "sha256": "70fe731d06dd9744178a27ec4379ee8c769f9a45d9a585f095b1765433767afc"
+      "sha256": "7ab2f7aff4bc52d09ee1a4aa3b76a7646ff2ee462bbc459941a468a9cc1246eb"
     },
     {
       "path": "config/modules.neutral.json",
@@ -1352,7 +1352,7 @@
     {
       "path": "docs/adr/0174-government-terminology-ranks-not-roles.md",
       "mode": "0000644",
-      "sha256": "c645ce8202fa8e8faa59d3aa00a8167477b5223817b760a733b38864d7625c1d"
+      "sha256": "2b813490fe355bfdb783d9b28eee01b97bfb6d7d4343a3f59aeeb6fac185b79b"
     },
     {
       "path": "docs/adr/0175-the-board-room-full-idea-ratification.md",
@@ -2902,7 +2902,7 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "183bca92e8ba897871287aeb58e6f9cfebcf9510b15d6cd9701066ce7c108edd"
+      "sha256": "dc4784b8d1f39c10c62ee935c6ff7d2d85db42f80479750e2ca2b8ca2877ebc6"
     },
     {
       "path": "modules/government/db.js",
@@ -2997,7 +2997,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "c229aec4f02fe970f4a3f798d370eef9b080cd0837f906b574362abda57107ad"
+      "sha256": "872f144bcd788e36f8b8bc87e5bd31f2389169ffa5d930e03d74ba24a0264f3b"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4292,12 +4292,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "352bfdf3484cd27c33da65632970d50a1b99e164008d45b2689cb365fee16720"
+      "sha256": "44f9bf150c24b1bed1d68bcd0a9661b4c659a32e5087a268a21b7b4370d7099a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "719aa0ff0ff7323f96ad1257c3505c5929943f64d3e00f9cdb6f4fce78dc150e"
+      "sha256": "231179c4f9a0fffdd0ecdb48ceb161e99e7aab4e3058296762561d510f15281a"
     },
     {
       "path": "public-docs/index.html",
@@ -4922,7 +4922,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "5cc94859033c924884efa60f50f8a1f7810a85382c42d785d62b804181a195f5"
+      "sha256": "a255afac6eb4a2b8269e896032e8eabf10f104aed5a0f1e8d0a7348695625424"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5742,7 +5742,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "808b164783dae50e0be37f35dcbcae7b2d474868746a240a957b89130870f483"
+      "sha256": "277097c686b695688dee35d158c4bb8384b4a5a89c61f30c7bda7d9f4b477bee"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5777,7 +5777,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "422647dc473583a67509644b04e47b8fc2279bb117fa1b6db1030502b5287870"
+      "sha256": "af5bdd9e362923afc1b78a741b5254147678b34cecb7d92f879387cc94a05631"
     },
     {
       "path": "src/bongos/routes.js",
@@ -5912,7 +5912,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6f39901735ba86e7abd2b5770b36146104ac47dec250131ac24eeca6754ef5f2"
+      "sha256": "e999662a04f1981cbf01b2a9b5d18d33e71034311702fac6e5a6e0a0a209dcc0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6847,7 +6847,7 @@
     {
       "path": "tests/government_config.mjs",
       "mode": "0000644",
-      "sha256": "979deef4473243dc86ab13b9284104bce71f6a1ee839acc6c5a6db04770cd62c"
+      "sha256": "330372412c80d8d33698eba68a5c19e79daff17b0d820a9a797c883071a5641f"
     },
     {
       "path": "tests/government_fold.mjs",
@@ -6907,7 +6907,7 @@
     {
       "path": "tests/government_routes.mjs",
       "mode": "0000644",
-      "sha256": "3b2e0ca134737992590132f089d5f93b479ad6cec83a5d2a932412b3edaf4547"
+      "sha256": "7f406d5296489d08804eae5b431d07244e1f2f3464513cccccb72e7b33253c14"
     },
     {
       "path": "tests/government_seed.mjs",

package/config/government.neutral.json

@@ -17,5 +17,12 @@
       "label": "Archon",
       "description": "Seeded rank \u2014 top authority. Adds the admin + system (non-grantable) powers."
     }
+  },
+  "_board_note": "The CONSTITUTION \u2014 the Board Room's rule set (BV1.R05 of goal 1000069, ADR 0175). Day one runs the real machinery configured to MONARCHY: membership 'rank:archon', pass_rule 'first_ratifier', no clock. That is a set of VALUES, never a separate code path \u2014 the same resolver, tally and window run whatever the numbers say, so flipping to a full board later changes configuration and not a branch that has never executed. RECOMMENDED once a project has a board worth sitting: all Archons, one vote each, pass_rule 'consent', window_minutes 90 \u2014 documented here, deliberately not the default. membership is the predicate 'rank:<key>'; it may name a CUSTOM rank, and WHO HOLDS that rank stays a DB row resolved per request (this file grants nobody anything). pass_rule is one of first_ratifier | consent. window_minutes is null for no clock, else whole minutes up to 7 days. Every unreadable field falls back to ITS OWN default, and the fallbacks are the STRICT end of both axes, so a malformed constitution can never resolve to a board that is wider or easier to pass than this one. To customise, copy to config/government.json and edit there \u2014 not by env var: a label is cosmetic, a constitution is not.",
+  "board": {
+    "membership": "rank:archon",
+    "pass_rule": "first_ratifier",
+    "window_minutes": null,
+    "close_early_on_full_turnout": true
   }
 }

package/docs/adr/0174-government-terminology-ranks-not-roles.md

@@ -55,3 +55,33 @@ This was the closest call in the directive, and it was decided against the alter
 **Rejected: renaming the ladder slugs to match.** `xenos`/`thetes`/`metic`/`archon` are referenced by `builders.rank`, `requireRank`, the protected-path enforcers, the Discord role map, and years of session logs. The directive did not ask for it, and bundling it here would turn a bounded rename into a trust-boundary migration.
 
 **Rejected: a compatibility shim kept indefinitely.** The old `/governance/*` route paths answer for exactly one release, logging each hit, and R05 records the removal release in this ADR's lineage. A permanent alias would mean both vocabularies stay correct forever, which is the state this ADR exists to end.
+
+## Lineage — the compatibility alias, and when it actually went
+
+The Decision above promised the old `/governance/*` route paths would answer for
+**exactly one release**, and that R05 would record the removal release here. That
+record was never written, and the alias outlived the promise by a wide margin.
+
+| | |
+|---|---|
+| Alias shipped | task 1003006 (R05), with the rename |
+| Promised life | one release |
+| Actually removed | **task 1003084**, core 1.19.219+ — many releases later |
+
+Two source comments (`src/bongos/module-scope-map.js`, and the `VOCAB_ALLOW`
+entry in `scripts/gds/fitness.js`) asserted the route aliases had already gone
+with the module-key alias in R05. They had not. A reader who trusted them —
+and the goal 1000068 criterion review nearly did — would conclude the
+compatibility surface no longer existed while production was still 308-ing on
+it. The alias was found by curling live, the same way all three of its original
+defects were.
+
+**The lesson, recorded because it generalises past this ADR:** a removal that is
+promised in prose and pinned by nothing does not happen. The shim had thorough
+tests, but they asserted the shim WORKED — so deleting the shim would have
+deleted its own evidence. Task 1003084 inverts them: `tests/government_routes.mjs`
+now asserts the legacy paths **404**, with a companion assertion that the current
+paths still route so the check cannot pass by everything being broken. A
+time-boxed compatibility surface should ship with the test of its ABSENCE
+written at the same time, disabled until the clock runs out — not with a
+calendar note in a comment.

package/modules/government/config.js

@@ -126,6 +126,78 @@ function sanitizeRole(key, raw) {
   });
 }
 
+// ── the constitution: who governs, how an item passes, how long a sitting runs ──
+// BV1.R05 of goal 1000069 (ADR 0175). The Board Room's rule set is CONFIGURATION on
+// the real machinery, never a separate code path: day one runs the same resolver,
+// the same tally and the same window as a full consent board, with the numbers set
+// to monarchy (owner decision 1). Flipping the switch later changes values, not a
+// branch that has never executed.
+//
+// It lives here, beside the rank templates, for the same reason ADR 0175 put the
+// board tables inside modules/government/: this is an AUTHORITY question, and
+// authority is this module's territory.
+//
+// STILL NOT A SOURCE OF AUTHORITY TRUTH. Same wall as the rest of this file — the
+// predicate says which RANK governs; who actually holds that rank stays a DB row,
+// resolved per request by R06's membership resolver. Nothing here names a builder,
+// and a config edit cannot make anyone a board member.
+const BOARD_DEFAULTS = Object.freeze({
+  membership: 'rank:archon',
+  pass_rule: 'first_ratifier',
+  window_minutes: null,          // null = no clock; monarchy does not sit
+  close_early_on_full_turnout: true,
+});
+
+// The pass rules that EXIST, not the ones a project should pick. `consent` is the
+// documented recommendation once a project has a board worth sitting (all Archons,
+// one vote each, consent, a 90-minute window); `first_ratifier` is the day-one
+// default and what an unreadable value falls back to.
+const PASS_RULES = Object.freeze(['first_ratifier', 'consent']);
+
+// A membership predicate is `rank:<key>` — the only grammar v1 defines. It is NOT
+// validated against catalog.RANK_ORDER on purpose: a project may govern by a CUSTOM
+// rank, and custom ranks are DB rows this file cannot see (checking here would make
+// config authoritative over a live rank list, which is exactly the inversion the
+// header forbids). R06 resolves the predicate against the live ranks and yields an
+// empty board if it names nothing — fail-closed there, shape-checked here.
+const MEMBERSHIP_RE = /^rank:[a-z][a-z0-9_-]*$/;
+
+// A sitting longer than a week is indistinguishable from no clock at all, and a
+// zero/negative window would close every item the instant it opened. Both are far
+// likelier to be a typo than an intent, so both fall back to the default.
+const MAX_WINDOW_MINUTES = 7 * 24 * 60;
+
+// Sanitize the board block. Every unreadable field falls back to ITS OWN default
+// independently, so one typo costs one setting rather than the whole constitution.
+//
+// THE INVARIANT THAT MATTERS: a malformed constitution must never resolve to a board
+// that is WIDER or EASIER to pass than the platform default. `rank:archon` is the
+// narrowest membership this project can express, and `first_ratifier` demands an
+// affirmative act by a member where `consent` lets an empty window pass unopposed
+// (owner decision 6). So the fallbacks are the strict end of both axes — a broken
+// config cannot quietly enfranchise anyone or lower the bar.
+function sanitizeBoard(raw) {
+  const r = isObj(raw) ? raw : {};
+  const membership = typeof r.membership === 'string' && MEMBERSHIP_RE.test(r.membership)
+    ? r.membership
+    : BOARD_DEFAULTS.membership;
+  const passRule = PASS_RULES.includes(r.pass_rule) ? r.pass_rule : BOARD_DEFAULTS.pass_rule;
+  // null is a MEANINGFUL value (no clock), so it is accepted rather than defaulted.
+  // Anything else must be a whole number of minutes inside the sane band.
+  const w = r.window_minutes;
+  const windowMinutes = w === null ? null
+    : (Number.isInteger(w) && w > 0 && w <= MAX_WINDOW_MINUTES ? w : BOARD_DEFAULTS.window_minutes);
+  const closeEarly = typeof r.close_early_on_full_turnout === 'boolean'
+    ? r.close_early_on_full_turnout
+    : BOARD_DEFAULTS.close_early_on_full_turnout;
+  return Object.freeze({
+    membership,
+    pass_rule: passRule,
+    window_minutes: windowMinutes,
+    close_early_on_full_turnout: closeEarly,
+  });
+}
+
 // Pure resolver — all inputs injected, so tests drive it with zero I/O (the
 // resolveBranding pattern).
 function resolveGovernmentConfig({ neutral, instance, env = process.env } = {}) {
@@ -146,7 +218,16 @@ function resolveGovernmentConfig({ neutral, instance, env = process.env } = {})
   for (const key of catalog.RANK_ORDER) {
     if (!ranks[key]) ranks[key] = sanitizeRole(key, {});
   }
-  return Object.freeze({ ranks: Object.freeze(ranks) });
+  // The board block merges FIELD BY FIELD, neutral under instance, so a project that
+  // wants only a different window keeps the platform's answer for everything else
+  // rather than having to restate the whole constitution to change one number.
+  //
+  // Deliberately NOT env-overridable. applyLabelOverrides exists because a label is
+  // cosmetic; the constitution is not, and an env var that could change who governs
+  // would be a way to alter authority from outside the checkout AND outside the DB.
+  // Changing the constitution is a board act (owner decision 11), not a deploy flag.
+  const board = sanitizeBoard({ ...((neutral || {}).board || {}), ...((instance || {}).board || {}) });
+  return Object.freeze({ ranks: Object.freeze(ranks), board });
 }
 
 // READ, never require(): a bare require('../../config/X.json') of a boundary-excluded
@@ -179,6 +260,10 @@ module.exports = {
   resolveGovernmentConfig,
   loadGovernmentConfig,
   grantableOnly,
+  sanitizeBoard,
+  BOARD_DEFAULTS,
+  PASS_RULES,
+  MAX_WINDOW_MINUTES,
   NEUTRAL_PATH,
   INSTANCE_PATH,
 };

package/modules/government/routes/government.js

@@ -182,61 +182,8 @@ module.exports = function buildGovernmentRouter() {
     return rank;
   }
   const ARCHON = 'archon';
-  const ARCHON_REASON = 'the Archon rank-rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
-  const ASSIGN_REASON = 'a seeded rank-rank is assigned by rank (R95b sync); change the builder\'s rank instead';
-
-  // ── the one-release LEGACY path aliases: /governance/* -> /government/* ────
-  // ADR 0174 committed to keeping the pre-rename paths answering for exactly one
-  // release. The case this actually protects is narrow but real: a browser that
-  // still has the OLD hall page open when the instance upgrades will keep calling
-  // the legacy /governance/* paths against the new server. Everything else that
-  // paths (the hall bundle, the generated client) ships INSIDE the same core
-  // package and moves in lockstep.
-  //
-  // A 308 preserves the method and body, so a PUT/DELETE grant toggle survives
-  // the hop. The alias carries NO gate of its own — it redirects, and the real
-  // route re-runs requireBuilder + requirePermission on the followed request, so
-  // this cannot become a way around the wall.
-  //
-  // REMOVE THIS BLOCK one release after the rename ships (goal 1000068 follow-up).
-  // The `alias` counter in the log line is how we tell whether anything still
-  // calls them before deleting.
-  //
-  // EXPRESS 4 WILDCARD SYNTAX. This is express 4.22 — the wildcard is a bare `*`
-  // and the captured tail is req.params[0]. Express 5's named form (`/*rest`) is
-  // NOT a wildcard here, it is a literal path segment, so it silently matches
-  // nothing and every legacy path 404s. It shipped that way once (task 1003006)
-  // and was only caught by curling the live site after the cutover — the module
-  // parsed fine, so nothing local failed.
-  const LEGACY_PATH_PREFIX = '/governance';
-  // The legacy noun -> the current one, as a NAMED DATA PAIR rather than an
-  // inline regex literal. An inline pattern here was silently rewritten by a
-  // repo-wide sweep so that both sides matched, turning the translation into an
-  // identity function that redirected to a path which does not exist. Naming the
-  // pair and asserting they differ makes that class of damage loud.
-  //
-  // Every line in this block that spells the legacy vocabulary carries the word
-  // LEGACY on purpose: that is what the ADR 0174 fitness allowlist keys on, so
-  // the shim can name what it is compatible with without excusing the whole file.
-  const LEGACY_SEGMENT = 'roles';   // legacy
-  const CURRENT_SEGMENT = 'ranks';
-  if (LEGACY_SEGMENT === CURRENT_SEGMENT) {
-    throw new Error('government legacy alias: the rename pair collapsed to an identity — a sweep has eaten it');
-  }
-  router.all(`${LEGACY_PATH_PREFIX}/*`, (req, res, next) => {
-    const tail = req.params[0] || '';            // express 4: bare * captures here
-    if (!tail) return next();
-    // Translate the leading segment, keep everything after it, keep the query.
-    const translated = tail === LEGACY_SEGMENT || tail.startsWith(`${LEGACY_SEGMENT}/`)
-      ? CURRENT_SEGMENT + tail.slice(LEGACY_SEGMENT.length)
-      : tail;
-    const qs = req.originalUrl.includes('?') ? req.originalUrl.slice(req.originalUrl.indexOf('?')) : '';
-    // req.baseUrl is the router's MOUNT point (/api/gds). Redirecting without it
-    // sends the caller to /government/... at the site root, which 404s.
-    const target = `${req.baseUrl}/government/${translated}${qs}`;
-    console.warn(`[government] legacy path hit: ${req.method} ${req.originalUrl} -> ${target} (ADR 0174 alias; remove one release after the rename)`);
-    return res.redirect(308, target);
-  });
+  const ARCHON_REASON = 'the Archon rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
+  const ASSIGN_REASON = 'a seeded rank is assigned by rank (R95b sync); change the builder\'s rank instead';
 
   // rank: perm government.manage — the full rank list with each rank's grants.
   router.get('/government/ranks', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
@@ -337,7 +284,7 @@ module.exports = function buildGovernmentRouter() {
             ? 'substrate-enforced (ADR 0043) — enforced outside the app by the pre-push hook / main-audit / the rank floor, so a grant row here would confer nothing. Non-grantable to EVERY rank.'
             : catalog.isPrincipalKey(permissionKey)
               ? 'a machine-principal permission — held by an exact builders.system_role identity, never by a rank (ADR 0151 §3)'
-              : 'a system (trust-boundary) permission is non-grantable to a CUSTOM rank; only a sub-Archon rank-rank may carry one (ADR 0172)',
+              : 'a system (trust-boundary) permission is non-grantable to a CUSTOM rank; only a sub-Archon rank may carry one (ADR 0172)',
         });
       }
       const granted = await db.grantRankPermission({ rankKey, permissionKey });
@@ -387,7 +334,7 @@ module.exports = function buildGovernmentRouter() {
       if (!rank.is_system || !catalog.RANK_ORDER.includes(rank.seeded_rank)) {
         return res.fail('rank_has_no_default', 400, {
           rank_key: rankKey,
-          reason: 'only a seeded rank-rank has a catalog default to reset to; revoke a custom rank\'s grants instead',
+          reason: 'only a seeded rank has a catalog default to reset to; revoke a custom rank\'s grants instead',
         });
       }
       // The seed is the floor derivation, which never contains a principal key and

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.220",
+  "version": "1.19.222",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.220",
+      "version": "1.19.222",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.220",
+  "version": "1.19.222",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1688,16 +1688,6 @@ const VOCAB_ALLOW = [
        + 'repo, so the old spelling is still read. Dropping it would silently stop '
        + 'honouring a label override someone already configured.',
   },
-  {
-    file: 'modules/government/routes/government.js',
-    match: 'legacy',
-    why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
-       + 'compatibility shim has to name the thing it is compatible with. The match is '
-       + 'the word LEGACY, and the shim block is written so that every line spelling the '
-       + 'old vocabulary carries it — so the exemption is scoped to the shim rather than '
-       + 'to the whole file, and a stray "role" elsewhere in this file still reds the '
-       + 'build. Delete with the alias block one release after the rename ships.',
-  },
   {
     file: 'modules/government/module.json',
     match: 'role',

package/src/bongos/module-scope-map.js

@@ -171,15 +171,18 @@ const MODULE_GLOBS = {
   //     module. `protected` DERIVES true — its 'modules/governance/' glob is in
   //     PROTECTED_GLOBS (the authz core) — so creating a goal scoped to governance is
   //     Archon-only (BV1.R57 / POST /goals). The config globs are the per-instance
-  //     role templates (R96), listed here as goal territory; the module code lands in
+  //     rank templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
   //     RENAMED governance → government (goal 1000068, ADR 0174). The
-  //     transitional `governance` alias key was removed in R05 (task 1003006)
-  //     together with the /governance/* route aliases — the same compatibility
-  //     window. The three live goals that named the old key (1000030, 1000057,
-  //     1000068) had it removed from goals.scope_modules in the same change, so
-  //     no stored row references a key the map no longer defines.
+  //     transitional `governance` alias key was removed in R05 (task 1003006).
+  //     The /governance/* ROUTE aliases outlived it: this comment claimed they
+  //     went in the same change, but they kept 308-ing on production for months
+  //     of releases past the one ADR 0174 allowed them, and the false claim here
+  //     is part of why nobody noticed. They were removed separately, in task
+  //     1003084. The three live goals that named the old key (1000030, 1000057,
+  //     1000068) had it removed from goals.scope_modules in R05, so no stored row
+  //     references a key the map no longer defines.
   government: [
     'modules/government/',
     'config/government.json', 'config/government.neutral.json',

package/src/bongos/route-rank-check.js

@@ -232,7 +232,11 @@ const EXPECTED_RANKS = {
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
-// governance→government in R05 (task 1003006); the module-key alias is gone.
+// governance→government in R05 (task 1003006), which also removed the module-key
+// alias. The /governance/* ROUTE aliases did NOT go with it — they kept 308-ing
+// in production for many releases past the single one ADR 0174 allowed, and were
+// removed separately in task 1003084. Nothing under /governance/* is routed now,
+// so every pin below is the only spelling of its surface.
 const GOVERNMENT_PINS = {
   'GET /government/ranks': 'perm:government.manage',
   'GET /government/permissions': 'perm:government.manage',

package/src/module-api.js

@@ -867,8 +867,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.218 with no explicit bump. run 32094215476. (task 1002620)
 //   1.19.220 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.219 with no explicit bump. run 32094701831. (task 1002620)
+//   1.19.221 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.220 with no explicit bump. run 32095276039. (task 1002620)
+//   1.19.222 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.221 with no explicit bump. run 32096034408. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.220'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.222'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_config.mjs

@@ -18,7 +18,8 @@ const GOV = path.join(ROOT, 'modules', 'government');
 const config = require(path.join(GOV, 'config.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
-const { resolveGovernmentConfig, loadGovernmentConfig, grantableOnly, NEUTRAL_PATH, INSTANCE_PATH } = config;
+const { resolveGovernmentConfig, loadGovernmentConfig, grantableOnly, sanitizeBoard,
+        BOARD_DEFAULTS, PASS_RULES, MAX_WINDOW_MINUTES, NEUTRAL_PATH, INSTANCE_PATH } = config;
 
 const NEUTRAL = JSON.parse(fs.readFileSync(NEUTRAL_PATH, 'utf8'));
 // No env by default — every precedence test injects exactly the env it is asserting on.
@@ -158,11 +159,20 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
   const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
   assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
-  // And it carries only templates — never a live per-builder assignment.
-  assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['ranks']);
+  // And it carries only templates — never a live per-builder assignment. The key list
+  // is an ALLOWLIST on purpose: a new top-level key has to be justified here before it
+  // can ship, which is what stops a live grant or assignment arriving unnoticed.
+  // `board` joined it in R05 (goal 1000069) — it is the CONSTITUTION, a rule shape, and
+  // the assertion below pins that it names no builder. `_`-prefixed keys are prose notes.
+  assert.deepEqual(Object.keys(NEUTRAL).filter((k) => !k.startsWith('_')).sort(), ['board', 'ranks']);
   for (const rank of Object.values(NEUTRAL.ranks)) {
     assert.ok(!('permissions' in rank), 'the neutral seeded ranks carry labels only, never grants');
   }
+  // The constitution says which RANK governs, never WHO. A builder id, login or handle
+  // here would make config authoritative over membership, which is R06's DB question.
+  assert.match(NEUTRAL.board.membership, /^rank:/, 'membership is a rank predicate, not a person');
+  assert.equal(JSON.stringify(NEUTRAL.board).includes('builder'), false,
+    'the neutral constitution must not reference any builder');
 });
 
 test('the two config paths are the branding-shaped neutral/instance pair under config/', () => {
@@ -185,3 +195,137 @@ test('the neutral starter publishes with the core (a packaged vanilla instance n
   assert.equal(isPublishable('config/government.neutral.json'), true);
   assert.equal(isPublishable('config/government.json'), false, "a host's filled-in pack is instance content");
 });
+
+// ── the constitution (BV1.R05 of goal 1000069, ADR 0175) ────────────────────────
+//
+// The board block is CONFIGURATION on the real machinery, not a second code path.
+// These tests pin the two things that make that safe: the platform default really is
+// monarchy, and a malformed constitution can never resolve to a board that is WIDER
+// or EASIER to pass than that default. A config file is editable by anyone who can
+// write the checkout — the same trust argument the permission tests above make.
+
+test('day one is monarchy: the neutral starter ships the Archon-ratifies constitution', () => {
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: NO_ENV });
+  assert.deepEqual(out.board, {
+    membership: 'rank:archon',
+    pass_rule: 'first_ratifier',
+    window_minutes: null,               // no clock — monarchy does not sit
+    close_early_on_full_turnout: true,
+  }, 'owner decision 1: the real machinery, configured to monarchy');
+  assert.deepEqual(NEUTRAL.board, out.board, 'the shipped file and the resolved value must agree');
+});
+
+test('a project with no board block at all still gets the full default constitution', () => {
+  // The vanilla-boot case, and the upgrade case: an instance whose config predates
+  // R05 has no board key. It must resolve to monarchy, not to undefined fields that
+  // R06 would then have to guess at.
+  const out = resolveGovernmentConfig({ neutral: {}, instance: {}, env: NO_ENV });
+  assert.deepEqual(out.board, BOARD_DEFAULTS);
+});
+
+test('the instance pack overrides the constitution FIELD BY FIELD', () => {
+  // Changing one number must not require restating the whole constitution.
+  const out = resolveGovernmentConfig({
+    neutral: NEUTRAL,
+    instance: { board: { pass_rule: 'consent', window_minutes: 90 } },
+    env: NO_ENV,
+  });
+  assert.equal(out.board.pass_rule, 'consent');
+  assert.equal(out.board.window_minutes, 90);
+  assert.equal(out.board.membership, 'rank:archon', 'untouched fields keep the neutral answer');
+  assert.equal(out.board.close_early_on_full_turnout, true);
+});
+
+test('the documented recommendation is expressible as pure configuration', () => {
+  // "all Archons, one vote each, consent, a 90-minute window" — the spec's recommended
+  // starting point. If this could not be reached by config alone, the "values not code
+  // paths" claim would be false.
+  const out = resolveGovernmentConfig({
+    neutral: NEUTRAL,
+    instance: { board: { membership: 'rank:archon', pass_rule: 'consent', window_minutes: 90 } },
+    env: NO_ENV,
+  });
+  assert.deepEqual(out.board, {
+    membership: 'rank:archon',
+    pass_rule: 'consent',
+    window_minutes: 90,
+    close_early_on_full_turnout: true,
+  });
+});
+
+test('a malformed constitution can never widen the franchise or lower the bar', () => {
+  // The invariant, enumerated over every junk shape a hand-edited file can take.
+  // rank:archon is the narrowest membership expressible; first_ratifier demands an
+  // affirmative act by a member where consent lets an empty window pass (decision 6).
+  const junk = [
+    undefined, null, 42, 'consent', [],
+    { membership: 'everyone' },
+    { membership: 'rank:' },
+    { membership: 'RANK:ARCHON' },          // grammar is lowercase
+    { membership: '' },
+    { membership: { rank: 'archon' } },
+    { pass_rule: 'unanimous' },
+    { pass_rule: 'majority' },
+    { pass_rule: null },
+    { membership: 'rank:xenos; DROP TABLE government_ranks' },
+  ];
+  for (const raw of junk) {
+    const b = sanitizeBoard(raw);
+    assert.equal(b.membership, BOARD_DEFAULTS.membership, `${JSON.stringify(raw)} must not widen membership`);
+    assert.equal(b.pass_rule, BOARD_DEFAULTS.pass_rule, `${JSON.stringify(raw)} must not lower the pass bar`);
+  }
+});
+
+test('one unreadable field costs one setting, not the whole constitution', () => {
+  const b = sanitizeBoard({ membership: 'rank:metic', pass_rule: 'nonsense', window_minutes: 30 });
+  assert.equal(b.membership, 'rank:metic', 'a VALID field survives its neighbour being junk');
+  assert.equal(b.window_minutes, 30);
+  assert.equal(b.pass_rule, BOARD_DEFAULTS.pass_rule, 'only the broken field falls back');
+});
+
+test('membership accepts a CUSTOM rank — config cannot be authoritative over the live rank list', () => {
+  // Deliberately NOT validated against catalog.RANK_ORDER: custom ranks are DB rows
+  // this file cannot see, and checking here would invert the config/DB boundary.
+  // R06 resolves the predicate against live ranks and yields an empty board if it
+  // names nothing, so the fail-closed step happens where the truth lives.
+  assert.equal(sanitizeBoard({ membership: 'rank:triage-helper' }).membership, 'rank:triage-helper');
+  assert.equal(sanitizeBoard({ membership: 'rank:board_member' }).membership, 'rank:board_member');
+});
+
+test('window_minutes: null means no clock, and only a sane whole-minute band is accepted', () => {
+  assert.equal(sanitizeBoard({ window_minutes: null }).window_minutes, null, 'null is MEANINGFUL, not missing');
+  assert.equal(sanitizeBoard({ window_minutes: 90 }).window_minutes, 90);
+  assert.equal(sanitizeBoard({ window_minutes: MAX_WINDOW_MINUTES }).window_minutes, MAX_WINDOW_MINUTES);
+  for (const bad of [0, -5, 1.5, '90', NaN, Infinity, MAX_WINDOW_MINUTES + 1]) {
+    assert.equal(sanitizeBoard({ window_minutes: bad }).window_minutes, BOARD_DEFAULTS.window_minutes,
+      `window_minutes ${String(bad)} must fall back — a zero window closes on open, a huge one is not a sitting`);
+  }
+});
+
+test('no env var can change the constitution', () => {
+  // applyLabelOverrides exists because a label is cosmetic. Authority is not: an env
+  // var that could move the board would be a way to change who governs from outside
+  // both the checkout and the DB. Changing it is a board act (owner decision 11).
+  const p = envPrefix();
+  const hostile = {
+    [`${p}_GOVERNMENT_BOARD_MEMBERSHIP`]: 'rank:xenos',
+    [`${p}_GOVERNMENT_BOARD_PASS_RULE`]: 'consent',
+    [`${p}_GOVERNMENT_BOARD`]: JSON.stringify({ membership: 'rank:xenos' }),
+    [`${p}_GOVERNMENT_RANK_LABELS`]: 'archon=Owner',
+  };
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: hostile });
+  assert.deepEqual(out.board, NEUTRAL.board, 'the constitution is untouched by env');
+  assert.equal(out.ranks.archon.label, 'Owner', 'while the LABEL override still works — proving env was read');
+});
+
+test('the resolved constitution is frozen, like the rest of the config contract', () => {
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: NO_ENV });
+  assert.ok(Object.isFrozen(out.board));
+  assert.throws(() => { 'use strict'; out.board.membership = 'rank:xenos'; });
+});
+
+test('PASS_RULES is the closed set the rest of the goal codes against', () => {
+  assert.deepEqual([...PASS_RULES].sort(), ['consent', 'first_ratifier']);
+  assert.ok(Object.isFrozen(PASS_RULES));
+  assert.ok(PASS_RULES.includes(BOARD_DEFAULTS.pass_rule), 'the default must be a member of the set');
+});

package/tests/government_routes.mjs

@@ -396,27 +396,25 @@ test('DELETE /governance/assignments validates the builder id param', async () =
   assert.equal(r.status, 400);
 });
 
-// ── the one-release /governance/* compatibility alias (ADR 0174) ──────────────
+// ── the /governance/* alias is GONE (ADR 0174, task 1003084) ──────────────
 //
-// This block exists because the alias shipped BROKEN and nothing caught it.
-// Three independent defects, none visible to a parse check or a unit test that
-// only imports the module:
-//   1. it was written with express 5's named-wildcard syntax (`/*rest`) on an
-//      express 4.22 router, where that is a literal segment — so it matched
-//      nothing and every legacy path 404'd;
-//   2. the redirect omitted req.baseUrl, sending callers to /government/... at
-//      the site root instead of under the /api/gds mount;
-//   3. a repo-wide roles->ranks sweep rewrote the SOURCE side of the
-//      /^\/roles/ -> '/ranks' translation, turning it into an identity that
-//      redirected to a path which does not exist.
+// ADR 0174 gave the pre-rename paths exactly one release. They outlived it by
+// months of releases — still 308-ing on production long after two source
+// comments claimed they had been removed — because nothing asserted the
+// REMOVAL, only the shim's behaviour. Deleting the shim's tests with the shim
+// would have recreated exactly that hole, so the assertions are INVERTED
+// instead: the legacy paths must now 404.
 //
-// All three only surfaced when the running site was curled after the cutover.
-// These tests drive a real router so they cannot repeat that.
-
-// A SECOND server, mounted at /api/gds exactly as production does. The main
-// harness above mounts at the root, so it cannot see a missing req.baseUrl —
-// which was one of the three real defects. Mounting like production is the
-// whole point of these three tests.
+// The shim itself shipped broken three times over (express 5 wildcard syntax on
+// an express 4.22 router; a redirect that dropped req.baseUrl; a repo-wide
+// roles->ranks sweep that rewrote the SOURCE side of the translation into an
+// identity). Every one of those only surfaced when the running site was curled.
+// That is why this block still drives a REAL router mounted the way production
+// mounts it, rather than asserting on source text.
+
+// A SECOND server, mounted at /api/gds exactly as production does — the main
+// harness above mounts at the root, so it cannot tell "no route" from "route at
+// the wrong mount point".
 const aliasApp = express();
 aliasApp.use(express.json());
 aliasApp.use(attachFail);
@@ -429,33 +427,37 @@ after(() => aliasServer.close());
 const hop = (method, p) =>
   fetch(`${ALIAS_BASE}${p}`, { method, redirect: 'manual' });
 
-test('the legacy /governance/* alias redirects, under the mount, with the noun translated', async () => {
-  const cases = [
-    ['GET', '/api/gds/governance/roles', '/api/gds/government/ranks'],
-    ['GET', '/api/gds/governance/permissions', '/api/gds/government/permissions'],
-    ['GET', '/api/gds/governance/assignments', '/api/gds/government/assignments'],
-    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage',
-            '/api/gds/government/ranks/metic/permissions/idea.triage'],
-    ['POST', '/api/gds/governance/roles/metic/reset', '/api/gds/government/ranks/metic/reset'],
+test('every legacy /governance/* path is gone — no redirect, no route', async () => {
+  // The exact paths the removed shim used to translate. A 308 here means the
+  // alias is back; a 200 would mean something answers the old vocabulary
+  // directly, which is worse.
+  const legacy = [
+    ['GET', '/api/gds/governance/roles'],
+    ['GET', '/api/gds/governance/permissions'],
+    ['GET', '/api/gds/governance/assignments'],
+    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage'],
+    ['POST', '/api/gds/governance/roles/metic/reset'],
+    ['GET', '/api/gds/governance/ranks'],
   ];
-  for (const [method, from, expected] of cases) {
-    const r = await hop(method, from);
-    assert.equal(r.status, 308, `${method} ${from} must 308 — a 404 means the wildcard is not matching`);
-    assert.equal(r.headers.get('location'), expected,
-      `${method} ${from} must keep the /api/gds mount AND translate roles→ranks`);
+  for (const [method, p] of legacy) {
+    const r = await hop(method, p);
+    assert.equal(r.status, 404, `${method} ${p} must 404 — the one-release alias was removed in task 1003084`);
+    assert.equal(r.headers.get('location'), null, `${method} ${p} must not redirect anywhere`);
   }
 });
 
-test('the alias preserves the query string', async () => {
-  const r = await hop('GET', '/api/gds/governance/roles?x=1&y=2');
-  assert.equal(r.headers.get('location'), '/api/gds/government/ranks?x=1&y=2');
+test('the current /government/* paths still route (the removal took only the alias)', async () => {
+  // The guard against over-deletion: proving the old paths 404 is worthless if
+  // the new ones 404 too. These reach the real gate and are refused for lack of
+  // a session — a 401/403, never a 404.
+  for (const p of ['/api/gds/government/ranks', '/api/gds/government/permissions']) {
+    const r = await hop('GET', p);
+    assert.notEqual(r.status, 404, `${p} must still be routed`);
+  }
 });
 
-test('the alias carries no gate of its own — the followed request re-runs the real one', async () => {
-  // A 308 preserves method and body, so the wall is enforced on the FOLLOWED
-  // request by the real route. The alias must never become a way around it.
+test('no source line reintroduces a legacy path alias', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'), 'utf8');
-  const block = src.slice(src.indexOf('LEGACY_PATH_PREFIX'), src.indexOf('res.redirect(308'));
-  assert.ok(!/requirePermission|requireBuilder/.test(block),
-    'the alias must not carry its own gate — it redirects, and the real route gates the followed request');
+  assert.ok(!/LEGACY_PATH_PREFIX/.test(src), 'the alias block is gone — do not restore it');
+  assert.ok(!/redirect\(308/.test(src), 'no 308 vocabulary redirect belongs on this surface any more');
 });