@bongos/core 1.19.221 → 1.19.223

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.221",
-  "core_contract": "1.19.221",
-  "source_commit": "30b2efb16495a941d6a4b70fd03b772cd69bce23",
+  "core_version": "1.19.223",
+  "core_contract": "1.19.223",
+  "source_commit": "f9d11234723ed42c73cf2eff487deabe34464ab5",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T03:23:47.936Z",
+  "built_at": "2026-08-18T04:00:41.918Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1303,
+    "functional_verbatim": 1305,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1635,
-  "tree_sha256": "aa35386f9d066c748b4374cf27b4dc5fbf48ccfef32dfb8ef8c60cf44fdb8c96",
+  "file_count": 1637,
+  "tree_sha256": "149332598cd294f2de39adf373feaa298158120232a1dfebbd58e5ee56207689",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -397,7 +397,7 @@
     {
       "path": "config/government.neutral.json",
       "mode": "0000644",
-      "sha256": "70fe731d06dd9744178a27ec4379ee8c769f9a45d9a585f095b1765433767afc"
+      "sha256": "7ab2f7aff4bc52d09ee1a4aa3b76a7646ff2ee462bbc459941a468a9cc1246eb"
     },
     {
       "path": "config/modules.neutral.json",
@@ -2894,6 +2894,11 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
+    {
+      "path": "modules/government/board-membership.js",
+      "mode": "0000644",
+      "sha256": "5bf474bee95bc8a8982e4a52c9e5b19955a20195dc1affd51c07e99540c8c059"
+    },
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
@@ -2902,12 +2907,12 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "183bca92e8ba897871287aeb58e6f9cfebcf9510b15d6cd9701066ce7c108edd"
+      "sha256": "dc4784b8d1f39c10c62ee935c6ff7d2d85db42f80479750e2ca2b8ca2877ebc6"
     },
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "0e84802af9d1dd4c139548d4e621fc11896513415abf4e9eadfacbae33c40952"
+      "sha256": "581d1b67c4765ec3f1d98a7af06afaefb2b6904f84d4fbb8be79f3d0008d4712"
     },
     {
       "path": "modules/government/migrations/governance_001_tables.sql",
@@ -2997,7 +3002,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "872f144bcd788e36f8b8bc87e5bd31f2389169ffa5d930e03d74ba24a0264f3b"
+      "sha256": "120877f860336de8bb010fe09872348257967b79a51951e5914fc32e907b5886"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4292,12 +4297,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5b55ea236b725452ef02e308616d3827927f68e82a483022a856e4066864dc99"
+      "sha256": "886be125dcb957387fea954c943d27f852347b7f38662905d59e2146cbb17e0b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ec221145b014962cce2d2c9fc9e231a0b296bb65153ba8079e30f2f4e80b9df7"
+      "sha256": "7e5374d7ead5886cd5b376a95724500196a0e9dc748617a99af436b2863a235c"
     },
     {
       "path": "public-docs/index.html",
@@ -5912,7 +5917,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4aa9331871262decd3e4b2a16e1cd9ca58b4e4000228cde02086ad209a1bb4b7"
+      "sha256": "ea7ae52689115222eeafffffbcf8fb1f9fcf13b6e01f90f1153e133928d52dea"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6834,6 +6839,11 @@
       "mode": "0000644",
       "sha256": "8f5354cbacf15c9b49500f96b265fe52f5c0d4500a4ec7b41b4819a149782893"
     },
+    {
+      "path": "tests/government_board_membership.mjs",
+      "mode": "0000644",
+      "sha256": "1a6f90e319c88ecd3e5588d5a6df44a9848c0adf08efd13bfcc52ac99e84d5d0"
+    },
     {
       "path": "tests/government_catalog.mjs",
       "mode": "0000644",
@@ -6847,7 +6857,7 @@
     {
       "path": "tests/government_config.mjs",
       "mode": "0000644",
-      "sha256": "979deef4473243dc86ab13b9284104bce71f6a1ee839acc6c5a6db04770cd62c"
+      "sha256": "330372412c80d8d33698eba68a5c19e79daff17b0d820a9a797c883071a5641f"
     },
     {
       "path": "tests/government_fold.mjs",

package/config/government.neutral.json

@@ -17,5 +17,12 @@
       "label": "Archon",
       "description": "Seeded rank \u2014 top authority. Adds the admin + system (non-grantable) powers."
     }
+  },
+  "_board_note": "The CONSTITUTION \u2014 the Board Room's rule set (BV1.R05 of goal 1000069, ADR 0175). Day one runs the real machinery configured to MONARCHY: membership 'rank:archon', pass_rule 'first_ratifier', no clock. That is a set of VALUES, never a separate code path \u2014 the same resolver, tally and window run whatever the numbers say, so flipping to a full board later changes configuration and not a branch that has never executed. RECOMMENDED once a project has a board worth sitting: all Archons, one vote each, pass_rule 'consent', window_minutes 90 \u2014 documented here, deliberately not the default. membership is the predicate 'rank:<key>'; it may name a CUSTOM rank, and WHO HOLDS that rank stays a DB row resolved per request (this file grants nobody anything). pass_rule is one of first_ratifier | consent. window_minutes is null for no clock, else whole minutes up to 7 days. Every unreadable field falls back to ITS OWN default, and the fallbacks are the STRICT end of both axes, so a malformed constitution can never resolve to a board that is wider or easier to pass than this one. To customise, copy to config/government.json and edit there \u2014 not by env var: a label is cosmetic, a constitution is not.",
+  "board": {
+    "membership": "rank:archon",
+    "pass_rule": "first_ratifier",
+    "window_minutes": null,
+    "close_early_on_full_turnout": true
   }
 }

package/modules/government/board-membership.js

@@ -0,0 +1,85 @@
+'use strict';
+
+// modules/government/board-membership.js — WHO SITS ON THE BOARD, right now
+// (BV1.R06 of goal 1000069, ADR 0175).
+//
+// Resolves the constitution's membership predicate (R05: `board.membership`,
+// grammar `rank:<key>`) to the live member list. Consumed by R07 (who to
+// announce a window to), R08 (the live membership re-check before a vote
+// counts), and R10 (the tally's denominator).
+//
+// It preserves ADR 0016 exactly, the same three ways resolver.js does:
+//   • server-side — membership is computed from government_builder_ranks rows,
+//     never from a token claim or a client-supplied list;
+//   • per request — the caller asks on the request that needs the answer, so a
+//     demoted Archon is off the board on their very next request, and a vote
+//     they attempt after the demotion does not count (R08's re-check);
+//   • UNCACHED — no memo, no TTL, no process-local map. A cached member list
+//     would keep a demoted builder governing, which is the precise failure the
+//     trust boundary exists to prevent. If the join ever profiles hot, the
+//     answer is a DB index, not a cache.
+//
+// WHY RANK, NEVER CRAFT (the spec's rejected craft-chamber model): PATCH
+// /me/disciplines is deliberately ungated — a builder owns their own profile
+// (src/bongos/routes/me.js) — so a craft-derived franchise (Artist / Ideator /
+// Builder as voting chambers) would be one-request self-enfranchisement. Rank
+// is written only through the Archon-gated rank-set path with the R95b rank
+// rotation, so deriving membership from rank inherits that write gate for free.
+//
+// Fail-closed throughout, in the same direction as R05's config sanitizer: a
+// predicate this file cannot parse resolves to NOBODY, never to everybody. An
+// unknown grammar must not quietly widen the franchise — an empty board under
+// `first_ratifier` simply means no one can ratify until the constitution is
+// fixed, which is loud, visible, and reversible by fixing the config.
+
+const db = require('./db');
+
+// The one predicate grammar v1 defines, mirrored from config.js's MEMBERSHIP_RE
+// (the two must agree; tests/government_board_membership.mjs pins that). The
+// rank key is validated by SHAPE only — whether it names a live rank is the
+// DB's question, answered by the query returning nobody for a key with no
+// assignment rows. Config deliberately cannot see custom ranks (R05), so this
+// is where `rank:some-custom-rank` becomes real or resolves to an empty board.
+const PREDICATE_RE = /^rank:([a-z][a-z0-9_-]*)$/;
+
+// Pure: predicate string -> { rankKey } or null. Null means "unparseable", and
+// every caller must treat null as NOBODY. Exported so R07/R08 can validate a
+// snapshotted constitution's predicate without touching the DB.
+function parseMembershipPredicate(predicate) {
+  if (typeof predicate !== 'string') return null;
+  const m = PREDICATE_RE.exec(predicate);
+  return m ? Object.freeze({ rankKey: m[1] }) : null;
+}
+
+// The resolve entry point: constitution board block -> the live member list, as
+// a frozen array of { builder_id, github_login, display_name } rows sorted by
+// id. Takes the BOARD BLOCK (not the whole config) because R07-R10 operate on
+// the constitution SNAPSHOT stored on the item (government_board_items
+// .constitution), not on the live config — an amendment must not rewrite who
+// may vote on an already-open item mid-sitting.
+async function resolveBoardMembers(board) {
+  const parsed = parseMembershipPredicate(board && board.membership);
+  if (!parsed) return Object.freeze([]); // unparseable predicate → nobody governs
+  const rows = await db.getActiveBuildersWithRank(parsed.rankKey);
+  return Object.freeze(rows.map((r) => Object.freeze({
+    builder_id: String(r.builder_id),
+    github_login: r.github_login,
+    display_name: r.display_name,
+  })));
+}
+
+// The R08 re-check: is THIS builder on the board defined by THIS constitution,
+// right now? One indexed lookup rather than materializing the whole list —
+// same rows, same filters, same fail-closed null handling.
+async function isBoardMember(builderId, board) {
+  if (builderId === null || builderId === undefined || builderId === '') return false;
+  const parsed = parseMembershipPredicate(board && board.membership);
+  if (!parsed) return false;
+  return db.builderHoldsRankActive(builderId, parsed.rankKey);
+}
+
+module.exports = {
+  parseMembershipPredicate,
+  resolveBoardMembers,
+  isBoardMember,
+};

package/modules/government/config.js

@@ -126,6 +126,78 @@ function sanitizeRole(key, raw) {
   });
 }
 
+// ── the constitution: who governs, how an item passes, how long a sitting runs ──
+// BV1.R05 of goal 1000069 (ADR 0175). The Board Room's rule set is CONFIGURATION on
+// the real machinery, never a separate code path: day one runs the same resolver,
+// the same tally and the same window as a full consent board, with the numbers set
+// to monarchy (owner decision 1). Flipping the switch later changes values, not a
+// branch that has never executed.
+//
+// It lives here, beside the rank templates, for the same reason ADR 0175 put the
+// board tables inside modules/government/: this is an AUTHORITY question, and
+// authority is this module's territory.
+//
+// STILL NOT A SOURCE OF AUTHORITY TRUTH. Same wall as the rest of this file — the
+// predicate says which RANK governs; who actually holds that rank stays a DB row,
+// resolved per request by R06's membership resolver. Nothing here names a builder,
+// and a config edit cannot make anyone a board member.
+const BOARD_DEFAULTS = Object.freeze({
+  membership: 'rank:archon',
+  pass_rule: 'first_ratifier',
+  window_minutes: null,          // null = no clock; monarchy does not sit
+  close_early_on_full_turnout: true,
+});
+
+// The pass rules that EXIST, not the ones a project should pick. `consent` is the
+// documented recommendation once a project has a board worth sitting (all Archons,
+// one vote each, consent, a 90-minute window); `first_ratifier` is the day-one
+// default and what an unreadable value falls back to.
+const PASS_RULES = Object.freeze(['first_ratifier', 'consent']);
+
+// A membership predicate is `rank:<key>` — the only grammar v1 defines. It is NOT
+// validated against catalog.RANK_ORDER on purpose: a project may govern by a CUSTOM
+// rank, and custom ranks are DB rows this file cannot see (checking here would make
+// config authoritative over a live rank list, which is exactly the inversion the
+// header forbids). R06 resolves the predicate against the live ranks and yields an
+// empty board if it names nothing — fail-closed there, shape-checked here.
+const MEMBERSHIP_RE = /^rank:[a-z][a-z0-9_-]*$/;
+
+// A sitting longer than a week is indistinguishable from no clock at all, and a
+// zero/negative window would close every item the instant it opened. Both are far
+// likelier to be a typo than an intent, so both fall back to the default.
+const MAX_WINDOW_MINUTES = 7 * 24 * 60;
+
+// Sanitize the board block. Every unreadable field falls back to ITS OWN default
+// independently, so one typo costs one setting rather than the whole constitution.
+//
+// THE INVARIANT THAT MATTERS: a malformed constitution must never resolve to a board
+// that is WIDER or EASIER to pass than the platform default. `rank:archon` is the
+// narrowest membership this project can express, and `first_ratifier` demands an
+// affirmative act by a member where `consent` lets an empty window pass unopposed
+// (owner decision 6). So the fallbacks are the strict end of both axes — a broken
+// config cannot quietly enfranchise anyone or lower the bar.
+function sanitizeBoard(raw) {
+  const r = isObj(raw) ? raw : {};
+  const membership = typeof r.membership === 'string' && MEMBERSHIP_RE.test(r.membership)
+    ? r.membership
+    : BOARD_DEFAULTS.membership;
+  const passRule = PASS_RULES.includes(r.pass_rule) ? r.pass_rule : BOARD_DEFAULTS.pass_rule;
+  // null is a MEANINGFUL value (no clock), so it is accepted rather than defaulted.
+  // Anything else must be a whole number of minutes inside the sane band.
+  const w = r.window_minutes;
+  const windowMinutes = w === null ? null
+    : (Number.isInteger(w) && w > 0 && w <= MAX_WINDOW_MINUTES ? w : BOARD_DEFAULTS.window_minutes);
+  const closeEarly = typeof r.close_early_on_full_turnout === 'boolean'
+    ? r.close_early_on_full_turnout
+    : BOARD_DEFAULTS.close_early_on_full_turnout;
+  return Object.freeze({
+    membership,
+    pass_rule: passRule,
+    window_minutes: windowMinutes,
+    close_early_on_full_turnout: closeEarly,
+  });
+}
+
 // Pure resolver — all inputs injected, so tests drive it with zero I/O (the
 // resolveBranding pattern).
 function resolveGovernmentConfig({ neutral, instance, env = process.env } = {}) {
@@ -146,7 +218,16 @@ function resolveGovernmentConfig({ neutral, instance, env = process.env } = {})
   for (const key of catalog.RANK_ORDER) {
     if (!ranks[key]) ranks[key] = sanitizeRole(key, {});
   }
-  return Object.freeze({ ranks: Object.freeze(ranks) });
+  // The board block merges FIELD BY FIELD, neutral under instance, so a project that
+  // wants only a different window keeps the platform's answer for everything else
+  // rather than having to restate the whole constitution to change one number.
+  //
+  // Deliberately NOT env-overridable. applyLabelOverrides exists because a label is
+  // cosmetic; the constitution is not, and an env var that could change who governs
+  // would be a way to alter authority from outside the checkout AND outside the DB.
+  // Changing the constitution is a board act (owner decision 11), not a deploy flag.
+  const board = sanitizeBoard({ ...((neutral || {}).board || {}), ...((instance || {}).board || {}) });
+  return Object.freeze({ ranks: Object.freeze(ranks), board });
 }
 
 // READ, never require(): a bare require('../../config/X.json') of a boundary-excluded
@@ -179,6 +260,10 @@ module.exports = {
   resolveGovernmentConfig,
   loadGovernmentConfig,
   grantableOnly,
+  sanitizeBoard,
+  BOARD_DEFAULTS,
+  PASS_RULES,
+  MAX_WINDOW_MINUTES,
   NEUTRAL_PATH,
   INSTANCE_PATH,
 };

package/modules/government/db.js

@@ -239,6 +239,48 @@ async function unassignRank({ builderId, rankKey }) {
   return rowCount > 0;
 }
 
+// --- the board membership READS (BV1.R06 of goal 1000069) --------------------
+//
+// Both filters are load-bearing, and both must appear in BOTH queries below —
+// board-membership.js's list and its single-member re-check must be the same
+// question at two granularities, never two questions:
+//   • b.status = 'active' — a deactivated builder is off the board the moment
+//     builder-exit flips them (their rank also drops to xenos, but membership
+//     must not depend on that ordering);
+//   • b.system_role IS NULL — a machine principal never governs. Today's two
+//     principals are xenos+inactive so the status filter would catch them, but
+//     that is circumstance, not a rule; this makes it structural, mirroring the
+//     resolver's principal-key drop (R98).
+
+async function getActiveBuildersWithRank(rankKey) {
+  const { rows } = await pool.query(
+    `SELECT br.builder_id, b.github_login, b.display_name
+       FROM government_builder_ranks br
+       JOIN builders b ON b.id = br.builder_id
+      WHERE br.rank_key = $1
+        AND b.status = 'active'
+        AND b.system_role IS NULL
+      ORDER BY br.builder_id`,
+    [rankKey],
+  );
+  return rows;
+}
+
+async function builderHoldsRankActive(builderId, rankKey) {
+  const { rows } = await pool.query(
+    `SELECT 1
+       FROM government_builder_ranks br
+       JOIN builders b ON b.id = br.builder_id
+      WHERE br.builder_id = $1
+        AND br.rank_key = $2
+        AND b.status = 'active'
+        AND b.system_role IS NULL
+      LIMIT 1`,
+    [builderId, rankKey],
+  );
+  return rows.length > 0;
+}
+
 module.exports = {
   getPermissionKeysForBuilder,
   getRankKeysForBuilder,
@@ -254,4 +296,6 @@ module.exports = {
   listAssignments,
   assignRank,
   unassignRank,
+  getActiveBuildersWithRank,
+  builderHoldsRankActive,
 };

package/modules/government/routes/government.js

@@ -23,6 +23,7 @@ const resolver = require('../resolver');
 const catalog = require('../catalog');
 const db = require('../db');
 const sessionScopes = require('../session-scopes');
+const boardMembership = require('../board-membership');
 
 // The port surface. Deliberately narrow: resolution + the catalog reads a gate or
 // the Archon tab needs. It grows with R98-R101 (principals, session-scopes,
@@ -78,6 +79,13 @@ const governmentPort = {
   narrowToSessionScope: resolver.narrowToSessionScope,
   sessionScopeFor: sessionScopes.scopeFor,
   listSessionScopes: () => sessionScopes.SESSION_SCOPES,
+  // The Board Room's membership axis (R06 of goal 1000069): who governs, right
+  // now, under a given constitution's board block — per request, uncached, the
+  // same ADR 0016 posture as the resolves above. On the port because R21 (the
+  // Discord announcer) needs the member list from outside this module.
+  parseMembershipPredicate: boardMembership.parseMembershipPredicate,
+  resolveBoardMembers: boardMembership.resolveBoardMembers,
+  isBoardMember: boardMembership.isBoardMember,
 };
 
 function registerSeams() {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.221",
+  "version": "1.19.223",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.221",
+      "version": "1.19.223",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.221",
+  "version": "1.19.223",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -869,8 +869,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.219 with no explicit bump. run 32094701831. (task 1002620)
 //   1.19.221 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.220 with no explicit bump. run 32095276039. (task 1002620)
+//   1.19.222 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.221 with no explicit bump. run 32096034408. (task 1002620)
+//   1.19.223 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.222 with no explicit bump. run 32097491676. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.221'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.223'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_membership.mjs

@@ -0,0 +1,183 @@
+// tests/government_board_membership.mjs — who sits on the board (BV1.R06 of
+// goal 1000069, ADR 0175).
+//
+// DB-free: the pure predicate parser is exercised directly, and the two resolve
+// entry points run against a monkeypatched db module (the government_routes.mjs
+// idiom), so the invariants here are testable without Postgres. What must hold:
+//
+//   1. FAIL-CLOSED — an unparseable predicate resolves to NOBODY, never to
+//      everybody. Membership widening by typo is the board-shaped version of the
+//      config file granting a permission, and it fails the same direction.
+//   2. THE TWO GRAMMARS AGREE — config.js (R05) decides which predicates SURVIVE
+//      sanitization; this file decides which predicates RESOLVE. A string the
+//      config keeps but the resolver cannot parse would be a constitution that
+//      validates and then seats nobody, silently.
+//   3. NO CACHE — the member list is computed per call from the db module's
+//      CURRENT answer. A demotion between two calls changes the second answer.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const membership = require(path.join(GOV, 'board-membership.js'));
+const db = require(path.join(GOV, 'db.js'));
+const { sanitizeBoard, BOARD_DEFAULTS } = require(path.join(GOV, 'config.js'));
+
+const { parseMembershipPredicate, resolveBoardMembers, isBoardMember } = membership;
+
+// ── the pure parser ──────────────────────────────────────────────────────────
+
+test('the one v1 grammar parses: rank:<key>', () => {
+  assert.deepEqual(parseMembershipPredicate('rank:archon'), { rankKey: 'archon' });
+  assert.deepEqual(parseMembershipPredicate('rank:metic'), { rankKey: 'metic' });
+  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKey: 'triage-helper' },
+    'a CUSTOM rank is legal by shape — whether it seats anyone is the DB\'s answer');
+  assert.deepEqual(parseMembershipPredicate('rank:board_member'), { rankKey: 'board_member' });
+});
+
+test('everything else parses to null — the fail-closed value', () => {
+  const junk = [
+    undefined, null, 42, {}, [], '',
+    'archon',                       // bare rank, no axis prefix
+    'rank:',                        // empty key
+    'RANK:ARCHON',                  // grammar is lowercase
+    'rank:Archon',
+    'role:builder',                 // the rejected role-chamber model — must never parse
+    'rank:archon;metic',            // no lists in v1
+    'rank: archon',                 // no whitespace
+    'builder:3',                    // naming a PERSON is config-as-authority — refused by shape
+  ];
+  for (const p of junk) {
+    assert.equal(parseMembershipPredicate(p), null, `${JSON.stringify(p)} must not parse`);
+  }
+});
+
+test('the parser and the config sanitizer agree on every sample — no validate-then-seat-nobody gap', () => {
+  // Property: config KEEPS a membership string ⇔ this file PARSES it. A predicate
+  // that survives R05's sanitizer but fails R06's parse would be a constitution
+  // that looks valid and silently seats nobody; the reverse would mean the
+  // resolver honours strings config would have replaced with the default.
+  const samples = [
+    'rank:archon', 'rank:metic', 'rank:xenos', 'rank:triage-helper', 'rank:a1_b-c',
+    'archon', 'rank:', 'RANK:ARCHON', 'role:builder', 'builder:3', '', 'rank: archon',
+    'rank:Archon', 'rank:archon;metic',
+  ];
+  for (const s of samples) {
+    const kept = sanitizeBoard({ membership: s }).membership === s;
+    const parses = parseMembershipPredicate(s) !== null;
+    assert.equal(kept, parses, `config and resolver disagree on ${JSON.stringify(s)}`);
+  }
+});
+
+// ── the resolve entry points, against a stubbed db ───────────────────────────
+
+// board-membership.js reads db.* by property lookup at CALL time, so replacing
+// the shared module object's methods (and restoring in finally) drives both
+// entry points without Postgres.
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+const MONARCHY = Object.freeze({ ...BOARD_DEFAULTS });
+
+test('resolveBoardMembers: the happy path — rows come back frozen, ids as strings', async () => {
+  await withDb({
+    getActiveBuildersWithRank: async (rankKey) => {
+      assert.equal(rankKey, 'archon', 'the predicate\'s rank key reaches the query verbatim');
+      return [
+        { builder_id: 42n, github_login: 'first-member', display_name: 'First Member' },
+        { builder_id: '1000099', github_login: 'second-member', display_name: 'Second Member' },
+      ];
+    },
+  }, async () => {
+    const members = await resolveBoardMembers(MONARCHY);
+    assert.equal(members.length, 2);
+    assert.deepEqual(members.map((m) => m.builder_id), ['42', '1000099'],
+      'ids are normalized to strings — Postgres bigints and JS numbers must compare equal downstream');
+    assert.ok(Object.isFrozen(members) && Object.isFrozen(members[0]));
+  });
+});
+
+test('an unparseable predicate resolves to NOBODY without touching the db', async () => {
+  await withDb({
+    getActiveBuildersWithRank: async () => { throw new Error('must not be called'); },
+    builderHoldsRankActive: async () => { throw new Error('must not be called'); },
+  }, async () => {
+    for (const board of [undefined, null, {}, { membership: 'everyone' }, { membership: 'role:builder' }]) {
+      assert.deepEqual(await resolveBoardMembers(board), [], `${JSON.stringify(board)} seats nobody`);
+      assert.equal(await isBoardMember('42', board), false);
+    }
+  });
+});
+
+test('a predicate naming a rank with no assignments seats an EMPTY board — loud, not widened', async () => {
+  await withDb({ getActiveBuildersWithRank: async () => [] }, async () => {
+    const members = await resolveBoardMembers({ ...MONARCHY, membership: 'rank:board-of-directors' });
+    assert.deepEqual(members, []);
+  });
+});
+
+test('isBoardMember: fail-closed on a missing builder id, true only on a live row', async () => {
+  await withDb({
+    builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+  }, async () => {
+    assert.equal(await isBoardMember('42', MONARCHY), true);
+    assert.equal(await isBoardMember('999', MONARCHY), false);
+    for (const bad of [null, undefined, '']) {
+      assert.equal(await isBoardMember(bad, MONARCHY), false, `${String(bad)} is nobody`);
+    }
+  });
+});
+
+test('NO CACHE: a demotion between two calls changes the second answer', async () => {
+  // The ADR 0016 instant-demotion property, observed rather than asserted from
+  // source text: the same call against a db whose answer changed returns the
+  // changed answer. A memo anywhere in the path would fail this.
+  let demoted = false;
+  await withDb({
+    getActiveBuildersWithRank: async () => (demoted
+      ? []
+      : [{ builder_id: '42', github_login: 'demoted-archon', display_name: 'Demoted Archon' }]),
+    builderHoldsRankActive: async () => !demoted,
+  }, async () => {
+    assert.equal((await resolveBoardMembers(MONARCHY)).length, 1);
+    assert.equal(await isBoardMember('42', MONARCHY), true);
+    demoted = true;
+    assert.deepEqual(await resolveBoardMembers(MONARCHY), [], 'off the board on the very next request');
+    assert.equal(await isBoardMember('42', MONARCHY), false);
+  });
+});
+
+test('the membership queries exclude machines and the deactivated — structurally, in the SQL', () => {
+  // The db half is one query away from Postgres, so its two load-bearing filters
+  // are pinned as source: b.status = 'active' (builder-exit takes effect without
+  // depending on the rank drop's ordering) and b.system_role IS NULL (a machine
+  // principal never governs — today's principals happen to be inactive xenos,
+  // but that is circumstance; this is the rule). Both must appear in BOTH reads.
+  const fs = require('node:fs');
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const start = src.indexOf('getActiveBuildersWithRank');
+  assert.ok(start > -1);
+  const block = src.slice(start);
+  assert.equal((block.match(/b\.status = 'active'/g) || []).length, 2, 'both reads filter status');
+  assert.equal((block.match(/b\.system_role IS NULL/g) || []).length, 2, 'both reads exclude principals');
+});
+
+test('the government port carries the membership axis for cross-module consumers (R21)', () => {
+  const routes = require(path.join(GOV, 'routes', 'government.js'));
+  assert.equal(typeof routes, 'function', 'the router factory registers the port');
+  const api = require(path.join(ROOT, 'src', 'module-api.js'));
+  routes(); // registering twice is a no-op (hasProvider guard)
+  const port = api.resolveOptional('government');
+  assert.ok(port, 'the government port is registered');
+  for (const method of ['parseMembershipPredicate', 'resolveBoardMembers', 'isBoardMember']) {
+    assert.equal(typeof port[method], 'function', `port.${method} must be callable`);
+  }
+});

package/tests/government_config.mjs

@@ -18,7 +18,8 @@ const GOV = path.join(ROOT, 'modules', 'government');
 const config = require(path.join(GOV, 'config.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
-const { resolveGovernmentConfig, loadGovernmentConfig, grantableOnly, NEUTRAL_PATH, INSTANCE_PATH } = config;
+const { resolveGovernmentConfig, loadGovernmentConfig, grantableOnly, sanitizeBoard,
+        BOARD_DEFAULTS, PASS_RULES, MAX_WINDOW_MINUTES, NEUTRAL_PATH, INSTANCE_PATH } = config;
 
 const NEUTRAL = JSON.parse(fs.readFileSync(NEUTRAL_PATH, 'utf8'));
 // No env by default — every precedence test injects exactly the env it is asserting on.
@@ -158,11 +159,20 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
   const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
   assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
-  // And it carries only templates — never a live per-builder assignment.
-  assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['ranks']);
+  // And it carries only templates — never a live per-builder assignment. The key list
+  // is an ALLOWLIST on purpose: a new top-level key has to be justified here before it
+  // can ship, which is what stops a live grant or assignment arriving unnoticed.
+  // `board` joined it in R05 (goal 1000069) — it is the CONSTITUTION, a rule shape, and
+  // the assertion below pins that it names no builder. `_`-prefixed keys are prose notes.
+  assert.deepEqual(Object.keys(NEUTRAL).filter((k) => !k.startsWith('_')).sort(), ['board', 'ranks']);
   for (const rank of Object.values(NEUTRAL.ranks)) {
     assert.ok(!('permissions' in rank), 'the neutral seeded ranks carry labels only, never grants');
   }
+  // The constitution says which RANK governs, never WHO. A builder id, login or handle
+  // here would make config authoritative over membership, which is R06's DB question.
+  assert.match(NEUTRAL.board.membership, /^rank:/, 'membership is a rank predicate, not a person');
+  assert.equal(JSON.stringify(NEUTRAL.board).includes('builder'), false,
+    'the neutral constitution must not reference any builder');
 });
 
 test('the two config paths are the branding-shaped neutral/instance pair under config/', () => {
@@ -185,3 +195,137 @@ test('the neutral starter publishes with the core (a packaged vanilla instance n
   assert.equal(isPublishable('config/government.neutral.json'), true);
   assert.equal(isPublishable('config/government.json'), false, "a host's filled-in pack is instance content");
 });
+
+// ── the constitution (BV1.R05 of goal 1000069, ADR 0175) ────────────────────────
+//
+// The board block is CONFIGURATION on the real machinery, not a second code path.
+// These tests pin the two things that make that safe: the platform default really is
+// monarchy, and a malformed constitution can never resolve to a board that is WIDER
+// or EASIER to pass than that default. A config file is editable by anyone who can
+// write the checkout — the same trust argument the permission tests above make.
+
+test('day one is monarchy: the neutral starter ships the Archon-ratifies constitution', () => {
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: NO_ENV });
+  assert.deepEqual(out.board, {
+    membership: 'rank:archon',
+    pass_rule: 'first_ratifier',
+    window_minutes: null,               // no clock — monarchy does not sit
+    close_early_on_full_turnout: true,
+  }, 'owner decision 1: the real machinery, configured to monarchy');
+  assert.deepEqual(NEUTRAL.board, out.board, 'the shipped file and the resolved value must agree');
+});
+
+test('a project with no board block at all still gets the full default constitution', () => {
+  // The vanilla-boot case, and the upgrade case: an instance whose config predates
+  // R05 has no board key. It must resolve to monarchy, not to undefined fields that
+  // R06 would then have to guess at.
+  const out = resolveGovernmentConfig({ neutral: {}, instance: {}, env: NO_ENV });
+  assert.deepEqual(out.board, BOARD_DEFAULTS);
+});
+
+test('the instance pack overrides the constitution FIELD BY FIELD', () => {
+  // Changing one number must not require restating the whole constitution.
+  const out = resolveGovernmentConfig({
+    neutral: NEUTRAL,
+    instance: { board: { pass_rule: 'consent', window_minutes: 90 } },
+    env: NO_ENV,
+  });
+  assert.equal(out.board.pass_rule, 'consent');
+  assert.equal(out.board.window_minutes, 90);
+  assert.equal(out.board.membership, 'rank:archon', 'untouched fields keep the neutral answer');
+  assert.equal(out.board.close_early_on_full_turnout, true);
+});
+
+test('the documented recommendation is expressible as pure configuration', () => {
+  // "all Archons, one vote each, consent, a 90-minute window" — the spec's recommended
+  // starting point. If this could not be reached by config alone, the "values not code
+  // paths" claim would be false.
+  const out = resolveGovernmentConfig({
+    neutral: NEUTRAL,
+    instance: { board: { membership: 'rank:archon', pass_rule: 'consent', window_minutes: 90 } },
+    env: NO_ENV,
+  });
+  assert.deepEqual(out.board, {
+    membership: 'rank:archon',
+    pass_rule: 'consent',
+    window_minutes: 90,
+    close_early_on_full_turnout: true,
+  });
+});
+
+test('a malformed constitution can never widen the franchise or lower the bar', () => {
+  // The invariant, enumerated over every junk shape a hand-edited file can take.
+  // rank:archon is the narrowest membership expressible; first_ratifier demands an
+  // affirmative act by a member where consent lets an empty window pass (decision 6).
+  const junk = [
+    undefined, null, 42, 'consent', [],
+    { membership: 'everyone' },
+    { membership: 'rank:' },
+    { membership: 'RANK:ARCHON' },          // grammar is lowercase
+    { membership: '' },
+    { membership: { rank: 'archon' } },
+    { pass_rule: 'unanimous' },
+    { pass_rule: 'majority' },
+    { pass_rule: null },
+    { membership: 'rank:xenos; DROP TABLE government_ranks' },
+  ];
+  for (const raw of junk) {
+    const b = sanitizeBoard(raw);
+    assert.equal(b.membership, BOARD_DEFAULTS.membership, `${JSON.stringify(raw)} must not widen membership`);
+    assert.equal(b.pass_rule, BOARD_DEFAULTS.pass_rule, `${JSON.stringify(raw)} must not lower the pass bar`);
+  }
+});
+
+test('one unreadable field costs one setting, not the whole constitution', () => {
+  const b = sanitizeBoard({ membership: 'rank:metic', pass_rule: 'nonsense', window_minutes: 30 });
+  assert.equal(b.membership, 'rank:metic', 'a VALID field survives its neighbour being junk');
+  assert.equal(b.window_minutes, 30);
+  assert.equal(b.pass_rule, BOARD_DEFAULTS.pass_rule, 'only the broken field falls back');
+});
+
+test('membership accepts a CUSTOM rank — config cannot be authoritative over the live rank list', () => {
+  // Deliberately NOT validated against catalog.RANK_ORDER: custom ranks are DB rows
+  // this file cannot see, and checking here would invert the config/DB boundary.
+  // R06 resolves the predicate against live ranks and yields an empty board if it
+  // names nothing, so the fail-closed step happens where the truth lives.
+  assert.equal(sanitizeBoard({ membership: 'rank:triage-helper' }).membership, 'rank:triage-helper');
+  assert.equal(sanitizeBoard({ membership: 'rank:board_member' }).membership, 'rank:board_member');
+});
+
+test('window_minutes: null means no clock, and only a sane whole-minute band is accepted', () => {
+  assert.equal(sanitizeBoard({ window_minutes: null }).window_minutes, null, 'null is MEANINGFUL, not missing');
+  assert.equal(sanitizeBoard({ window_minutes: 90 }).window_minutes, 90);
+  assert.equal(sanitizeBoard({ window_minutes: MAX_WINDOW_MINUTES }).window_minutes, MAX_WINDOW_MINUTES);
+  for (const bad of [0, -5, 1.5, '90', NaN, Infinity, MAX_WINDOW_MINUTES + 1]) {
+    assert.equal(sanitizeBoard({ window_minutes: bad }).window_minutes, BOARD_DEFAULTS.window_minutes,
+      `window_minutes ${String(bad)} must fall back — a zero window closes on open, a huge one is not a sitting`);
+  }
+});
+
+test('no env var can change the constitution', () => {
+  // applyLabelOverrides exists because a label is cosmetic. Authority is not: an env
+  // var that could move the board would be a way to change who governs from outside
+  // both the checkout and the DB. Changing it is a board act (owner decision 11).
+  const p = envPrefix();
+  const hostile = {
+    [`${p}_GOVERNMENT_BOARD_MEMBERSHIP`]: 'rank:xenos',
+    [`${p}_GOVERNMENT_BOARD_PASS_RULE`]: 'consent',
+    [`${p}_GOVERNMENT_BOARD`]: JSON.stringify({ membership: 'rank:xenos' }),
+    [`${p}_GOVERNMENT_RANK_LABELS`]: 'archon=Owner',
+  };
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: hostile });
+  assert.deepEqual(out.board, NEUTRAL.board, 'the constitution is untouched by env');
+  assert.equal(out.ranks.archon.label, 'Owner', 'while the LABEL override still works — proving env was read');
+});
+
+test('the resolved constitution is frozen, like the rest of the config contract', () => {
+  const out = resolveGovernmentConfig({ neutral: NEUTRAL, env: NO_ENV });
+  assert.ok(Object.isFrozen(out.board));
+  assert.throws(() => { 'use strict'; out.board.membership = 'rank:xenos'; });
+});
+
+test('PASS_RULES is the closed set the rest of the goal codes against', () => {
+  assert.deepEqual([...PASS_RULES].sort(), ['consent', 'first_ratifier']);
+  assert.ok(Object.isFrozen(PASS_RULES));
+  assert.ok(PASS_RULES.includes(BOARD_DEFAULTS.pass_rule), 'the default must be a member of the set');
+});