@bongos/core 1.19.223 → 1.19.225

package/modules/government/db.js

@@ -281,6 +281,123 @@ async function builderHoldsRankActive(builderId, rankKey) {
   return rows.length > 0;
 }
 
+// --- the board WRITES (BV1.R07 of goal 1000069) ------------------------------
+
+// Open a window for a subject. The idempotency is STRUCTURAL: the INSERT
+// targets government_003's partial unique index (one OPEN item per subject),
+// so a concurrent double-open inserts exactly one row — the loser gets null and
+// the caller reads the winner back with getOpenBoardItem. closes_at is computed
+// by the DATABASE clock (now() + the window), absolute rather than a duration,
+// so changing the project's window length never moves an already-open deadline;
+// NULL windowMinutes means NO CLOCK (the monarchy configuration — the item
+// closes on the first vote, not on time).
+async function openBoardItem({ subjectType, subjectId, openedBy = null, constitution, windowMinutes = null }) {
+  const { rows } = await pool.query(
+    `INSERT INTO government_board_items (subject_type, subject_id, opened_by, closes_at, constitution)
+     VALUES ($1, $2, $3,
+             CASE WHEN $4::int IS NULL THEN NULL ELSE now() + make_interval(mins => $4::int) END,
+             $5::jsonb)
+     ON CONFLICT (subject_type, subject_id) WHERE closed_at IS NULL DO NOTHING
+     RETURNING *`,
+    [subjectType, subjectId, openedBy, windowMinutes, JSON.stringify(constitution || {})],
+  );
+  return rows[0] || null;
+}
+
+async function getOpenBoardItem(subjectType, subjectId) {
+  const { rows } = await pool.query(
+    `SELECT * FROM government_board_items
+      WHERE subject_type = $1 AND subject_id = $2 AND closed_at IS NULL
+      LIMIT 1`,
+    [subjectType, subjectId],
+  );
+  return rows[0] || null;
+}
+
+// --- the vote READS + WRITES (BV1.R08 of goal 1000069) -----------------------
+
+// One item, with the expiry computed on the DATABASE clock so the route never
+// compares a Postgres timestamptz against a process clock. NULL closes_at is
+// the no-clock configuration and never expires.
+async function getBoardItemForVote(itemId) {
+  const { rows } = await pool.query(
+    `SELECT *, (closes_at IS NOT NULL AND closes_at < now()) AS expired
+       FROM government_board_items
+      WHERE id = $1`,
+    [itemId],
+  );
+  return rows[0] || null;
+}
+
+// The anti-self rule's subject: who put this item up. A full_idea's author is
+// the idea's captor (idea_inbox is a shared core table — reading it directly is
+// the sanctioned pattern; the boundary is code imports, not table access). An
+// amendment's author is its proposer, already on the row as opened_by. NULL —
+// an auto-opened item whose idea row is somehow gone — means no self to refuse.
+async function getBoardItemAuthor(item) {
+  if (!item) return null;
+  if (item.subject_type === 'full_idea') {
+    const { rows } = await pool.query(
+      `SELECT captured_by FROM idea_inbox WHERE id = $1`,
+      [item.subject_id],
+    );
+    return rows[0] ? rows[0].captured_by : null;
+  }
+  return item.opened_by ?? null;
+}
+
+// The open ballot's one write. Idempotency is STRUCTURAL — UNIQUE(item_id,
+// voter_id); the loser of a double-cast gets null and the caller reads the
+// standing vote back.
+async function insertBoardVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null }) {
+  const { rows } = await pool.query(
+    `INSERT INTO government_board_votes (item_id, voter_id, direction, reason_md, section_key)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (item_id, voter_id) DO NOTHING
+     RETURNING *`,
+    [itemId, voterId, direction, reasonMd, sectionKey],
+  );
+  return rows[0] || null;
+}
+
+async function getBoardVote(itemId, voterId) {
+  const { rows } = await pool.query(
+    `SELECT * FROM government_board_votes WHERE item_id = $1 AND voter_id = $2`,
+    [itemId, voterId],
+  );
+  return rows[0] || null;
+}
+
+// Voter karma (+1 in-window, owner decision 8) — rides the FRESH insert only,
+// so the idempotent re-cast can never double-pay. granted_by NULL: earned from
+// the system by the act, not granted by a person (the governance_002 backfill
+// convention). karma_log is a shared core table; same access rule as above.
+// Author-ratification karma (+3, board.js AUTHOR_RATIFY_KARMA_DELTA) — fired by
+// the R10 close on a passed item. IDEMPOTENT: the reason key is unique per item
+// and the INSERT is one atomic WHERE-NOT-EXISTS statement (the economy
+// credit-lane idiom — karma_log carries no unique constraint, so the predicate
+// IS the guard). Returns whether a row was actually written.
+async function insertAuthorRatifyKarma({ authorId, itemId, delta }) {
+  const reason = `board.item.ratified:${itemId}`;
+  const { rowCount } = await pool.query(
+    `INSERT INTO karma_log (builder_id, delta, reason, granted_by)
+     SELECT $1, $2, $3, NULL
+      WHERE NOT EXISTS (
+        SELECT 1 FROM karma_log WHERE builder_id = $1 AND reason = $3
+      )`,
+    [authorId, delta, reason],
+  );
+  return rowCount > 0;
+}
+
+async function insertVoteKarma({ voterId, itemId, delta }) {
+  await pool.query(
+    `INSERT INTO karma_log (builder_id, delta, reason, granted_by)
+     VALUES ($1, $2, $3, NULL)`,
+    [voterId, delta, `board.vote.cast:${itemId}`],
+  );
+}
+
 module.exports = {
   getPermissionKeysForBuilder,
   getRankKeysForBuilder,
@@ -298,4 +415,12 @@ module.exports = {
   unassignRank,
   getActiveBuildersWithRank,
   builderHoldsRankActive,
+  openBoardItem,
+  getOpenBoardItem,
+  getBoardItemForVote,
+  getBoardItemAuthor,
+  insertBoardVote,
+  getBoardVote,
+  insertVoteKarma,
+  insertAuthorRatifyKarma,
 };

package/modules/government/routes/government.js

@@ -24,6 +24,7 @@ const catalog = require('../catalog');
 const db = require('../db');
 const sessionScopes = require('../session-scopes');
 const boardMembership = require('../board-membership');
+const board = require('../board');
 
 // The port surface. Deliberately narrow: resolution + the catalog reads a gate or
 // the Archon tab needs. It grows with R98-R101 (principals, session-scopes,
@@ -86,6 +87,10 @@ const governmentPort = {
   parseMembershipPredicate: boardMembership.parseMembershipPredicate,
   resolveBoardMembers: boardMembership.resolveBoardMembers,
   isBoardMember: boardMembership.isBoardMember,
+  // R07: the ideas capture path fires this when a Full Idea's grade lands — the
+  // bar gate lives INSIDE board.js (a sub-bar idea never reaches the board, and
+  // no caller is trusted to pre-filter). Returns, never throws into capture.
+  openBoardWindowForIdea: board.openWindowForFullIdea,
 };
 
 function registerSeams() {
@@ -405,6 +410,55 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.vote.cast — cast a vote on an open board item (R08 of goal
+  // 1000069, ADR 0175). The atom FLOORS AT XENOS deliberately (the R04 carry-
+  // note): the permission is only the coarse gate, and the real wall is the
+  // in-handler membership re-check against the constitution SNAPSHOTTED on the
+  // item — do not "tighten" the floor to archon; that would fork authority
+  // truth and make widening the franchise a migration instead of a config
+  // change. Open ballot, anti-self, idempotent (UNIQUE(item_id, voter_id)),
+  // voter karma +1 on a fresh in-window cast. The policy lives in board.js
+  // castVote; this handler is the HTTP mapping.
+  router.post('/government/board/items/:itemId/votes', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    const itemId = parseId(req, res, { param: 'itemId', code: 'bad_item_id', positiveInt: true });
+    if (itemId === null) return;
+    if (validateOrRespond(req, res, {
+      direction: { required: true, type: 'string', maxLength: 3 },
+      reason_md: { type: 'string', maxLength: 5000 },
+      section_key: { type: 'string', maxLength: 32 },
+    })) return;
+    try {
+      const out = await board.castVote({
+        itemId,
+        voterId: req.builder.id,
+        direction: req.body.direction,
+        reasonMd: req.body.reason_md ?? null,
+        sectionKey: req.body.section_key ?? null,
+      });
+      if (!out.ok) {
+        const status =
+          out.reason === 'item_not_found' ? 404 :
+          out.reason === 'not_board_member' ? 403 :
+          out.reason === 'anti_self_vote' ? 403 :
+          out.reason === 'item_closed' ? 409 :
+          out.reason === 'vote_window_expired' ? 409 :
+          400; // bad_direction / yes_carries_nothing / objection_needs_reason / objection_needs_section
+        return res.fail(out.reason, status, { item_id: itemId });
+      }
+      // Idempotent re-cast reads back the standing vote — 200, not 201, and no
+      // karma line: nothing new was recorded.
+      res.status(out.fresh ? 201 : 200).json({
+        ok: true,
+        vote: out.vote,
+        already_voted: !out.fresh,
+        ...(out.fresh ? { karma_delta: out.karma_delta } : {}),
+      });
+    } catch (err) {
+      console.error('[gds] POST /government/board/items/:itemId/votes', err);
+      res.fail('vote_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };
 

package/modules/hall-ui/public/government.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Government — {{worldName}}</title>
-  <meta name="description" content="Ranks and permissions — create a custom rank, grant everyday permissions, assign it to a builder. Trust-boundary powers stay locked.">
+  <meta name="description" content="How this project is governed — the constitution it runs, the Board Room where Full Ideas are ratified, and the ranks &amp; permissions that administer it.">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -26,6 +26,30 @@
         <p class="gov-sealed" id="gov-sealed" hidden>Archons only.</p>
 
         <section id="gov-body" hidden>
+          <!-- The three-section IA (R15 of goal 1000069, ADR 0175): the page that
+               answers "how is this project governed". Tabs are OTBKit.makeTabs
+               (the work.js idiom) with hash deep links — #constitution,
+               #board-room, #ranks. -->
+          <div id="gov-tabs"></div>
+
+          <!-- §1 Constitution — what this project runs. The live view (today's
+               values + the change history) and the charter library land with
+               R18/R19; until then the section frames the model honestly. -->
+          <section id="gov-panel-constitution" hidden>
+            <h2 class="gov-h">Constitution</h2>
+            <p class="gov-grid-note">Three dials decide how this project is governed: <strong>who sits on the board</strong> (a rank — everyone holding it is a member), <strong>what counts as passing</strong> (a first ratifier, or the consent of the sitting), and <strong>how long a vote stays open</strong> (a timed sitting, or no clock at all). They are configuration on the same machinery at every setting — a project starts with the founder ratifying alone and opens up by changing numbers, not code.</p>
+            <div id="gov-constitution"></div>
+          </section>
+
+          <!-- §2 Board Room — open items, the clock, your vote (R16/R17). -->
+          <section id="gov-panel-board" hidden>
+            <h2 class="gov-h">Board Room</h2>
+            <p class="gov-grid-note">Where a Full Idea that cleared the completeness grade comes to be ratified — and where the constitution itself is amended. Open items appear here with their clock and a live tally; an objection must carry a reason and name the section it faults, which is why votes are cast here and only mirrored to chat.</p>
+            <div id="gov-board"></div>
+          </section>
+
+          <!-- §3 Ranks & Permissions — the administration surface, unchanged. -->
+          <section id="gov-panel-ranks" hidden>
           <div class="gov-layout">
             <div class="gov-ranks-col">
               <h2 class="gov-h">Ranks</h2>
@@ -59,6 +83,7 @@
           <h2 class="gov-h">Machine principals</h2>
           <p class="gov-grid-note">Capabilities held by a machine identity, never by a person or a rank. Shown for completeness — nothing here can be granted.</p>
           <div id="gov-principals"></div>
+          </section>
         </section>
       </main>
 
@@ -73,6 +98,7 @@
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
-<script src="/builders/government.js?v=2026-08-16-government"></script>
+<script src="/builders/hall-kit.js"></script>
+<script src="/builders/government.js?v=2026-08-18-government-ia"></script>
 </body>
 </html>

package/modules/hall-ui/public/government.js

@@ -25,9 +25,16 @@
 // gated server-side on the `government.manage` atom (archon floor). On 401 →
 // web sign-in.
 //
-// DELIBERATELY NOT IN THE SIDEBAR YET: the nav entry + the server page gate are
-// R113 (the next slice) — tests/hall_nav.mjs pins the Government nav group and
-// grows with that slice, not this one. Until then the page is reached by URL.
+// SINCE R15 (goal 1000069, ADR 0175) this page carries the three-section IA —
+// Constitution · Board Room · Ranks & Permissions — because Government is the
+// page that answers "how is this project governed", and administration is only
+// the third part of that answer. Tabs are OTBKit.makeTabs with hash deep links
+// (#constitution / #board-room / #ranks). The first two sections are FRAMES
+// until their build-out lands: R18 fills Constitution with the live values +
+// change history, R19 adds the charter library, R16/R17 fill the Board Room
+// with open items and the vote. Until then each frame states what belongs there
+// and shows an honest kit empty state — never a fake or a hardcoded value that
+// could drift from the real config.
 
 (() => {
   'use strict';
@@ -392,6 +399,34 @@
     });
   }
 
+  // ---- the three-section IA (R15) -------------------------------------------
+
+  // Tab order is the spec's — Constitution · Board Room · Ranks & Permissions —
+  // but the INITIAL tab is Ranks until R16/R18 fill the other two: landing the
+  // Archon on a frame when the working surface is one tab over would be IA
+  // winning over usefulness. Flip `initial` to 'constitution' when R18 lands.
+  function wireTabs() {
+    window.OTBKit.makeTabs({
+      mount: document.getElementById('gov-tabs'),
+      hash: true,
+      initial: 'ranks',
+      tabs: [
+        { id: 'constitution', label: 'Constitution', panel: 'gov-panel-constitution' },
+        { id: 'board-room', label: 'Board Room', panel: 'gov-panel-board' },
+        { id: 'ranks', label: 'Ranks & Permissions', panel: 'gov-panel-ranks' },
+      ],
+    });
+    // The frames' empty states — kit-standard, one line, no fake data. What this
+    // project actually RUNS is config the server owns; rendering it here before
+    // the R18 read exists would mean hardcoding a value that drifts.
+    document.getElementById('gov-constitution').innerHTML = window.OTBKit.emptyStateHtml(
+      'The live constitution — what this project runs today, and how it has changed — appears here when the Board Room opens.',
+    );
+    document.getElementById('gov-board').innerHTML = window.OTBKit.emptyStateHtml(
+      'Nothing is before the board. When a Full Idea clears the completeness grade, its window opens here.',
+    );
+  }
+
   // ---- init ----------------------------------------------------------------
 
   function showSealed() {
@@ -416,8 +451,9 @@
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
     if (rank !== 'archon') { showSealed(); return; }
 
-    document.getElementById('gov-sub').textContent = 'Ranks, permissions, and who holds them. Ranks below Archon are yours to shape; what the substrate enforces stays locked.';
+    document.getElementById('gov-sub').textContent = 'How this project is governed — the constitution it runs, the Board Room, and the ranks & permissions that administer it.';
     document.getElementById('gov-body').hidden = false;
+    wireTabs();
     wireForms();
     try {
       await load();

package/modules/hall-ui/public/palette.js

@@ -13,7 +13,7 @@
 //   1. Pages — read live from the sidebar shell.js rendered, so rank + module
 //      gating come for free and can never drift from the nav. A hidden nav item
 //      is a hidden destination. (Cosmetic only; the server still gates each page.)
-//   2. Sections — the sub-destinations of the three pages that have them. These
+//   2. Sections — the sub-destinations of the four pages that have them. These
 //      cannot be read from another page's DOM, so they are declared below and
 //      held to the real ids by tests/hall_palette.mjs.
 //   3. Records — id syntax: `1234`, `g 12`, `b 7`, `i 42`.
@@ -28,9 +28,10 @@
   // element whose visibility decides whether the group is offered — the nav item
   // itself for pages, the profile chip for Settings (which is not a nav item).
   // Anchors must stay in step with their source of truth; the test asserts it:
-  //   standing → builders.js STANDING_GROUPS (+ shell.js VIEW_ALIASES)
-  //   work     → work.js makeTabs ids
-  //   settings → settings.js RAIL_GROUPS
+  //   standing   → builders.js STANDING_GROUPS (+ shell.js VIEW_ALIASES)
+  //   work       → work.js makeTabs ids
+  //   government → government.js makeTabs ids (the R15 three-section IA)
+  //   settings   → settings.js RAIL_GROUPS
   var SECTIONS = [
     { parent: 'Standing', gate: 'nav-standing', items: [
       { label: 'Work', href: '/#standing-work' },
@@ -44,6 +45,11 @@
       { label: 'Backlog', href: '/work#backlog' },
       { label: 'Completed', href: '/work#completed' },
     ] },
+    { parent: 'Government', gate: 'nav-government', items: [
+      { label: 'Constitution', href: '/government#constitution' },
+      { label: 'Board Room', href: '/government#board-room' },
+      { label: 'Ranks & Permissions', href: '/government#ranks' },
+    ] },
     { parent: 'Settings', gate: 'shell-user', items: [
       { label: 'Account', href: '/settings#account' },
       { label: 'Access', href: '/settings#access' },

package/modules/ideas/module.json

@@ -17,6 +17,7 @@
     "ideas.capture"
   ],
   "consumes": [
-    "reward"
+    "reward",
+    "government"
   ]
 }

package/modules/ideas/routes/inbox.js

@@ -146,6 +146,33 @@ module.exports = function buildInboxRouter() {
             // no warning surfaced — the idea and its grade are intact; the credit
             // is the only thing missed, and a reconcile/re-grade path can pay it.
           }
+
+          // R07 (goal 1000069, ADR 0175 §5): a Full Idea crossing the
+          // completeness bar automatically opens its ratification window in the
+          // Board Room. Resolved through the `government` port (declared in
+          // consumes), never a direct import — and the BAR GATE lives on the
+          // government side (board.js refuses a sub-bar score), so this hook
+          // fires unconditionally with the stored score and the board decides.
+          // FAIL-OPEN like the credit above: the idea and its grade are already
+          // stored, and a board hiccup must never lose a capture. The open is
+          // idempotent (one open window per subject, structural in the schema),
+          // so a retry or re-capture can never open two.
+          try {
+            const government = api.resolveOptional && api.resolveOptional('government');
+            if (government && government.openBoardWindowForIdea) {
+              const w = await government.openBoardWindowForIdea({
+                ideaId: idea.id,
+                completenessScore: row.completeness_score,
+              });
+              if (w && w.opened && w.item) {
+                idea.board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+              }
+            }
+          } catch (boardErr) {
+            console.error('[gds] POST /inbox board-window open failed (idea captured + graded, window skipped):', boardErr);
+            // R11's expiry poller sweeps open items, not missed opens; a missed
+            // open is recoverable by resubmission (R13) — capture stays intact.
+          }
         } catch (gradeErr) {
           console.error('[gds] POST /inbox full-grade write failed (idea captured, landing as quick):', gradeErr);
           grade_warning = 'captured_but_ungraded';

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.223",
+  "version": "1.19.225",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.223",
+      "version": "1.19.225",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.223",
+  "version": "1.19.225",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -247,6 +247,10 @@ const GOVERNMENT_PINS = {
   'POST /government/ranks/:rankKey/reset': 'perm:government.manage',
   'POST /government/assignments': 'perm:government.manage',
   'DELETE /government/assignments/:builderId/:rankKey': 'perm:government.manage',
+  // The Board Room's first route (R08 of goal 1000069 — the R04-carried pin).
+  // The XENOS-floored atom is the COARSE gate by design; the real wall is the
+  // in-handler membership re-check against the item's snapshotted constitution.
+  'POST /government/board/items/:itemId/votes': 'perm:board.vote.cast',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE

package/src/module-api.js

@@ -873,8 +873,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.221 with no explicit bump. run 32096034408. (task 1002620)
 //   1.19.223 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.222 with no explicit bump. run 32097491676. (task 1002620)
+//   1.19.224 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.223 with no explicit bump. run 32098083321. (task 1002620)
+//   1.19.225 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.224 with no explicit bump. run 32099793591. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.223'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.225'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');