@bongos/core 1.19.231 → 1.19.232

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.231",
-  "core_contract": "1.19.231",
-  "source_commit": "b18388dcbf0bad79948e1c7ca4aad4ea23ca1592",
+  "core_version": "1.19.232",
+  "core_contract": "1.19.232",
+  "source_commit": "0410dea5ee4d77aab90467679874cc5abee21963",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T11:44:02.712Z",
+  "built_at": "2026-08-18T11:50:40.699Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1313,
+    "functional_verbatim": 1315,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1645,
-  "tree_sha256": "d185e1d9643a34a36c1849857bad6ff42e549a614f201b4bab6ed3266668321e",
+  "file_count": 1647,
+  "tree_sha256": "94232cdfd24e7ff58e77b2642499e86fad84a4d09483c8b5150028b363080d4d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "ad3ebff5e165c917f14840844032150cacfb40335e29df7f23d51dbb0d475d21"
+      "sha256": "6be7d91bb8c0b620f3a67e071e96435946413330e05c97bf901fd7241bbd10f9"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "e474bac9faa5da4da5098b736fd694a9a7ee327d7b952d08a4c366e70e253d84"
+      "sha256": "6af213e35ced87effe655c14a220b472768551c37f0cd7abddebcbdbcb7d81a9"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "b0bd3bbad51ea1b68f7fd36165d77fce12939cde82b37cd2266a00c103002f4b"
+      "sha256": "18f00d369a1689973e2eeb33034302142884cb2836d3f1ea76b882f3379d0cf8"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "7b1983354a89000e6d630d69c896515bac844a2e23a9b8c0da66e6c9b1f386d6"
+      "sha256": "ed6940e45f5634264705869043f0a795ddb4bea264f036789b3c80cc08424b97"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "d61a7546173a2212e72c6cbee2ec67b193c3ef506d17ddbfe84e3786fb17cbab"
+      "sha256": "e3d388b90604d290b3e6346129701b7f2a0a15b4c3b6abe915a43c8702daa1e8"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1372,12 +1372,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0f5532248c4c9554c20a6fc11bc60e696fadf996e1d6f7d049553b02614d5a2a"
+      "sha256": "3212eaeaaf4f1f64889fa6b144fcc48845ed12c4fe08b2a74d3c2bcffc503064"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "a983685efd08503f73301bf509dda382191aba27321116e064562c8d895ecc73"
+      "sha256": "0709c0e537931a75055afea96cf48dd9f3820faa09cd781f07028b7d0b1f26c8"
     },
     {
       "path": "docs/architecture.md",
@@ -2902,7 +2902,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "5db387128d2f7a1ebc15fefaf1e97aabeda9196df34c91bdeb4a12e9301087f0"
+      "sha256": "359de8efb5ec1365e6114a8c5b3d62aadd484ca7d94d1a36684b6c0c640aaa99"
     },
     {
       "path": "modules/government/catalog.js",
@@ -2912,12 +2912,12 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "dc4784b8d1f39c10c62ee935c6ff7d2d85db42f80479750e2ca2b8ca2877ebc6"
+      "sha256": "56bd51c927220b6bc0dc749ad1d591addbed25870e532b8d95da6ba5eab3f763"
     },
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "e4ff648d5a9d83048214ff111768e5a2ae5e254f4b0a2f8f2fc966ce04138e21"
+      "sha256": "cb5c481fcd1a9f6becb63b88a1f0ca4004e592a2f70e02c968a3cc10378dabd5"
     },
     {
       "path": "modules/government/migrations/governance_001_tables.sql",
@@ -2984,6 +2984,11 @@
       "mode": "0000644",
       "sha256": "b2c06a954e93487f7df85eb7333c65284e364499fb96c31aad30a263c36b8f73"
     },
+    {
+      "path": "modules/government/migrations/government_007_amendments.sql",
+      "mode": "0000644",
+      "sha256": "5629112a9bb932873a00b8ddefa847d9a21ed0f8f59cc8a77ffb9c9c5e0eea49"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -3017,7 +3022,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "34ff36c8ab99797a51b44cceacea2be00d73a5d2a1750d71d815a7c9111b1a3a"
+      "sha256": "2bde6d18afc3f24ae2eaeac08b16d83d3ab6ddb22b61da4b9b2f261ee4e844a6"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4312,12 +4317,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2c9b747091dee3bd21f2e369c573458da89d2fc26e9327a8d10c5a441ee3e4c5"
+      "sha256": "de0ff156427786537d3a4231d4fae7721d52027b9a25d6185bc53efac35b24d2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ad8ec75b4bda8cf394b62310f9ce5d383f3f069444bf750c66ad5efdf95a6ef3"
+      "sha256": "c5fa9bf830e64903a205cf28feabd9255772343cc1f002f344fa92ede02f7f7d"
     },
     {
       "path": "public-docs/index.html",
@@ -5797,7 +5802,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "a37f6723510eb9d3a4adc3a927213336716810c8814ec82b4b9547eed1983188"
+      "sha256": "34850de6361ab78ce8788e20c483ded22d3de9ff9fb42bf14497509b0870f66c"
     },
     {
       "path": "src/bongos/routes.js",
@@ -5932,7 +5937,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b2ca81272e675b77c99707ff4e31f9c5ce7d54f20236bb56bb2145c4a8bde1e7"
+      "sha256": "1302cbcd4f4b6b35032165625c203741ccc846304680876d3789ce212d0bc746"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6854,6 +6859,11 @@
       "mode": "0000644",
       "sha256": "8f5354cbacf15c9b49500f96b265fe52f5c0d4500a4ec7b41b4819a149782893"
     },
+    {
+      "path": "tests/government_board_amendment.mjs",
+      "mode": "0000644",
+      "sha256": "7b20463f4d0940c43a5555a7b63d156202d334477267b7d2bc045e27e964d253"
+    },
     {
       "path": "tests/government_board_close.mjs",
       "mode": "0000644",
@@ -6957,7 +6967,7 @@
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "94e10e6d635ee8a4b16b33559bdfa30b7112bcc4a1fcfa59c30ee3648278f6a4"
+      "sha256": "9c0c1049180013f30a3403a4e308112ed871119d9e60c459e9573108b35a5a27"
     },
     {
       "path": "tests/government_session_scope.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 282 operations across 46 resource groups
+- 283 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -349,6 +349,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/items — rank: metic+archon — POST /government/board/items
+      postGovernmentBoardItems: (args) => request("POST", "/government/board/items", { hasBody: true }, args),
       // POST /government/board/items/{itemId}/votes — rank: any-builder — POST /government/board/items/:itemId/votes
       postGovernmentBoardItemsItemIdVotes: (args) => request("POST", "/government/board/items/{itemId}/votes", { hasBody: true }, args),
       // GET /government/permissions — rank: archon — GET /government/permissions

package/clients/bongos-client/index.cjs

@@ -348,6 +348,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/items — rank: metic+archon — POST /government/board/items
+      postGovernmentBoardItems: (args) => request("POST", "/government/board/items", { hasBody: true }, args),
       // POST /government/board/items/{itemId}/votes — rank: any-builder — POST /government/board/items/:itemId/votes
       postGovernmentBoardItemsItemIdVotes: (args) => request("POST", "/government/board/items/{itemId}/votes", { hasBody: true }, args),
       // GET /government/permissions — rank: archon — GET /government/permissions

package/clients/bongos-client/index.d.ts

@@ -233,6 +233,8 @@ export interface PostGoalsRequest { version_id: string; title: string; descripti
 export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
+export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string }
+export interface PostGovernmentBoardItemsResponse { ok: boolean; amendment: unknown; item: unknown }
 export interface PostGovernmentRanksRankKeyResetResponse { ok: boolean; rank_key: unknown; seeded_rank: unknown; permission_count: unknown }
 export interface PostGovernmentRanksRequest { rank_key: string; label: string; description?: string }
 export interface PostGovernmentRanksResponse { rank: unknown }
@@ -601,6 +603,8 @@ export interface BongosClient {
     postGovernmentAssignments(args: RequestArgs & { body: PostGovernmentAssignmentsRequest }): Promise<ApiResponse>;
     /** DELETE /government/assignments/{builderId}/{rankKey} — rank: archon */
     deleteGovernmentAssignmentsBuilderIdRankKey(args?: RequestArgs): Promise<DeleteGovernmentAssignmentsBuilderIdRankKeyResponse>;
+    /** POST /government/board/items — rank: metic+archon */
+    postGovernmentBoardItems(args: RequestArgs & { body: PostGovernmentBoardItemsRequest }): Promise<PostGovernmentBoardItemsResponse>;
     /** POST /government/board/items/{itemId}/votes — rank: any-builder */
     postGovernmentBoardItemsItemIdVotes(args: RequestArgs & { body: PostGovernmentBoardItemsItemIdVotesRequest }): Promise<ApiResponse>;
     /** GET /government/permissions — rank: archon */

package/clients/bongos-client/index.mjs

@@ -345,6 +345,8 @@ export function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/items — rank: metic+archon — POST /government/board/items
+      postGovernmentBoardItems: (args) => request("POST", "/government/board/items", { hasBody: true }, args),
       // POST /government/board/items/{itemId}/votes — rank: any-builder — POST /government/board/items/:itemId/votes
       postGovernmentBoardItemsItemIdVotes: (args) => request("POST", "/government/board/items/{itemId}/votes", { hasBody: true }, args),
       // GET /government/permissions — rank: archon — GET /government/permissions

package/docs/api/openapi.json

@@ -5336,6 +5336,58 @@
         ]
       }
     },
+    "/government/board/items": {
+      "post": {
+        "operationId": "post_government_board_items",
+        "tags": [
+          "government"
+        ],
+        "summary": "POST /government/board/items",
+        "description": "board.item.open — put an AMENDMENT to the board (R14 of goal 1000069, ADR 0175 §7). The board's other subject never comes through here: a Full Idea's window opens AUTOMATICALLY on grade pass (R07), so requesting one is refused with the reason rather than silently doubling the paths — exactly what the catalog's own guards note predicted this route would be. The proposal is validated STRICTLY in board.js (never sanitized — the board must not ratify text the proposer did not write), and the window runs under the constitution IN FORCE, which under monarchy resolves to \"the Archon ratifies\" — their own proposal included (§7's no-bootstrap-exception).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `board.item.open` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/government/routes/government.js",
+        "x-permissions": [
+          "board.item.open"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGovernmentBoardItemsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostGovernmentBoardItemsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/government/board/items/{itemId}/votes": {
       "post": {
         "operationId": "post_government_board_items_itemId_votes",
@@ -16098,6 +16150,42 @@
         ],
         "additionalProperties": false
       },
+      "PostGovernmentBoardItemsRequest": {
+        "type": "object",
+        "properties": {
+          "subject_type": {
+            "type": "string",
+            "maxLength": 32
+          },
+          "proposal": {
+            "type": "object"
+          },
+          "rationale_md": {
+            "type": "string",
+            "maxLength": 5000
+          }
+        },
+        "required": [
+          "subject_type",
+          "proposal"
+        ],
+        "additionalProperties": false
+      },
+      "PostGovernmentBoardItemsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "amendment": {},
+          "item": {}
+        },
+        "required": [
+          "ok",
+          "amendment",
+          "item"
+        ]
+      },
       "PostGovernmentRanksRankKeyResetResponse": {
         "type": "object",
         "properties": {
@@ -17881,9 +17969,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 282,
-  "x-schema-count": 319,
+  "x-endpoint-count": 283,
+  "x-schema-count": 321,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 214,
+  "x-response-schemas": 215,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 282 endpoints across 46 route files.
+> **Generated from the live route files** — the route file is authoritative. 283 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -216,13 +216,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/goals/inbox` | `any-builder` | — | GET /goals/inbox — the caller's private-goals inbox (task 1952 / ADR 0112): { invitations: invites addressed to me (accept/decline); join… |
 | POST | `/api/bongos/goals/reorder` | `metic+archon` | `version_id`, `ordered_ids` | POST /goals/reorder — Archon drag-to-reorder: set the priority order of every goal WITHIN one version (task 1760). |
 
-## `government` (10)
+## `government` (11)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/government/assignments` | `archon` | — | government.manage — every builder↔rank assignment row. |
 | POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM rank to a builder. |
 | DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-rank assignment. |
+| POST | `/api/bongos/government/board/items` | `metic+archon` | `subject_type`, `proposal`, `rationale_md` | board.item.open — put an AMENDMENT to the board (R14 of goal 1000069, ADR 0175 §7). |
 | POST | `/api/bongos/government/board/items/:itemId/votes` | `any-builder` | `direction`, `reason_md`, `section_key` | board.vote.cast — cast a vote on an open board item (R08 of goal 1000069, ADR 0175). |
 | GET | `/api/bongos/government/permissions` | `archon` | — | government.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. |
 | GET | `/api/bongos/government/ranks` | `archon` | — | government.manage — the full rank list with each rank's grants. |

package/modules/government/board.js

@@ -42,8 +42,13 @@
 
 const api = require('../../src/module-api');
 const db = require('./db');
-const { loadGovernmentConfig } = require('./config');
-const { isBoardMember, resolveBoardMembers } = require('./board-membership');
+// config is required as a NAMESPACE so applyBoardAmendment resolves by property
+// lookup at CALL time — a test can redirect the instance-pack write to a temp
+// file (the reward-port delegation lesson: a destructured binding is frozen at
+// load and un-patchable).
+const governmentConfig = require('./config');
+const { loadGovernmentConfig, PASS_RULES, MAX_WINDOW_MINUTES } = governmentConfig;
+const { isBoardMember, resolveBoardMembers, parseMembershipPredicate } = require('./board-membership');
 
 // ADR 0175 §5: the completeness bar a Full Idea must clear to reach the board.
 // Held equal to economy's IDEA_FULL_PASS_BAR by test — see the header.
@@ -180,9 +185,19 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   const constitution = item.constitution || {};
   if (!(await isBoardMember(voterId, constitution))) return { ok: false, reason: 'not_board_member' };
 
-  const authorId = await db.getBoardItemAuthor(item);
-  if (authorId != null && String(authorId) === String(voterId)) {
-    return { ok: false, reason: 'anti_self_vote' };
+  // ANTI-SELF IS A FULL-IDEA RULE, NOT AN AMENDMENT RULE (R14, ADR 0175 §§7/11).
+  // The bright line exists because an idea's author GAINS from ratification
+  // (credits, legitimacy) — ceremonial self-ratification is what it prevents.
+  // An amendment pays nothing, and §7 explicitly blesses the monarchy act:
+  // under a one-Archon board with no clock, the proposer must be able to
+  // ratify their own amendment or the subject is dead on arrival — and adding
+  // a special escape for that case is the bootstrap exception §7 forbids.
+  // Skipping anti-self FOR AMENDMENTS is the rule that needs no exceptions.
+  if (item.subject_type === 'full_idea') {
+    const authorId = await db.getBoardItemAuthor(item);
+    if (authorId != null && String(authorId) === String(voterId)) {
+      return { ok: false, reason: 'anti_self_vote' };
+    }
   }
 
   const inserted = await db.insertBoardVote({
@@ -326,6 +341,24 @@ async function closeItem(item, { cause = 'vote' } = {}) {
 
   const authorKarma = outcome === 'passed' ? await awardAuthorRatifyKarma(closed) : null;
 
+  // R14: a PASSED amendment becomes the live constitution — applied AFTER the
+  // close commits (the board's decision is the durable record), loudly on
+  // failure, never silently absorbed. The apply is re-drivable from the passed
+  // item + amendment rows. A returned amendment applies nothing.
+  let appliedConstitution = null;
+  if (outcome === 'passed' && closed.subject_type === 'constitutional_amendment') {
+    try {
+      const amendment = await db.getAmendment(closed.subject_id);
+      if (amendment) {
+        appliedConstitution = governmentConfig.applyBoardAmendment(amendment.proposed);
+      } else {
+        console.error(`[government] passed amendment item ${closed.id} names amendment ${closed.subject_id}, which does not exist — NOT applied`);
+      }
+    } catch (applyErr) {
+      console.error(`[government] amendment ${closed.subject_id} ratified but NOT applied (re-drivable from the passed item): ${applyErr && applyErr.message}`);
+    }
+  }
+
   if (outcome === 'passed') {
     const payload = passPayload(closed, { authorId, completenessScore, passedAt: closed.closed_at });
     try {
@@ -333,7 +366,11 @@ async function closeItem(item, { cause = 'vote' } = {}) {
     } catch (_) { /* emitAsync isolates listener errors; nothing that moves credits subscribes */ }
   }
 
-  return { closed: true, item: closed, outcome, cause, author_karma: authorKarma, ...(credit ? { credit } : {}) };
+  return {
+    closed: true, item: closed, outcome, cause, author_karma: authorKarma,
+    ...(credit ? { credit } : {}),
+    ...(appliedConstitution ? { applied_constitution: appliedConstitution } : {}),
+  };
 }
 
 // The post-vote hook R08's route fires after a FRESH cast. Reads everything it
@@ -351,6 +388,71 @@ async function maybeCloseAfterVote(itemId) {
   return closeItem(item, { cause: 'vote' });
 }
 
+// ── proposing an amendment (BV1.R14 of goal 1000069, ADR 0175 §7) ────────────
+//
+// A proposal is validated STRICTLY, not sanitized. R05's sanitizer falls back
+// field-by-field because a config FILE must boot sane no matter what is in it;
+// a PROPOSAL is different — silently "correcting" it would put text before the
+// board that the proposer never wrote, and the board would ratify a lie. Every
+// field is required (a constitution is ratified whole, never by diff) and every
+// invalid field is a named refusal.
+function validateProposedConstitution(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { ok: false, reason: 'proposal_not_an_object' };
+  }
+  const known = ['membership', 'pass_rule', 'window_minutes', 'close_early_on_full_turnout'];
+  for (const k of Object.keys(raw)) {
+    if (!known.includes(k)) return { ok: false, reason: 'unknown_field', field: k };
+  }
+  if (!parseMembershipPredicate(raw.membership)) {
+    return { ok: false, reason: 'bad_membership', expected: "the predicate grammar rank:<key>" };
+  }
+  if (!PASS_RULES.includes(raw.pass_rule)) {
+    return { ok: false, reason: 'bad_pass_rule', expected: PASS_RULES };
+  }
+  const w = raw.window_minutes;
+  if (!(w === null || (Number.isInteger(w) && w > 0 && w <= MAX_WINDOW_MINUTES))) {
+    return { ok: false, reason: 'bad_window_minutes', expected: `null (no clock) or an integer 1..${MAX_WINDOW_MINUTES}` };
+  }
+  if (typeof raw.close_early_on_full_turnout !== 'boolean') {
+    return { ok: false, reason: 'bad_close_early', expected: 'boolean' };
+  }
+  return {
+    ok: true,
+    proposal: {
+      membership: raw.membership,
+      pass_rule: raw.pass_rule,
+      window_minutes: w,
+      close_early_on_full_turnout: raw.close_early_on_full_turnout,
+    },
+  };
+}
+
+// File the amendment and open its window IN THE SAME BREATH — a proposal that
+// exists but was never put to the board is a state nothing can act on. The
+// window runs under the constitution IN FORCE (snapshotted, like every item):
+// under monarchy that is first_ratifier with no clock, which §7 resolves to
+// "the Archon ratifies" — including the Archon's own proposal (see castVote's
+// anti-self note). Concurrent amendment windows are legal like any concurrent
+// windows; applies land in close order and the last close wins, deterministic
+// because applyBoardAmendment rewrites the whole block.
+async function proposeAmendment({ proposal, rationaleMd = null, proposedBy } = {}) {
+  const v = validateProposedConstitution(proposal);
+  if (!v.ok) return { ok: false, ...v };
+  if (proposedBy == null || proposedBy === '') return { ok: false, reason: 'missing_proposer' };
+  const amendment = await db.createAmendment({ proposed: v.proposal, rationaleMd, proposedBy });
+  const { board } = loadGovernmentConfig();
+  const item = await db.openBoardItem({
+    subjectType: 'constitutional_amendment',
+    subjectId: amendment.id,
+    openedBy: proposedBy, // an amendment HAS a human opener, unlike a grade-opened idea
+    constitution: board,
+    windowMinutes: board.window_minutes,
+  });
+  // A fresh amendment id can never collide with the one-open-per-subject index.
+  return { ok: true, amendment, item };
+}
+
 // ── R13's read: the feedback a returned idea carries back to its author ─────
 //
 // One reasoned objection is what returns an idea (§3), so the feedback IS that
@@ -389,4 +491,6 @@ module.exports = {
   closeItem,
   maybeCloseAfterVote,
   latestRejectionForIdea,
+  validateProposedConstitution,
+  proposeAmendment,
 };

package/modules/government/config.js

@@ -256,11 +256,42 @@ function loadGovernmentConfig({ neutralPath = NEUTRAL_PATH, instancePath = INSTA
   });
 }
 
+// ── applying a RATIFIED amendment (BV1.R14 of goal 1000069, ADR 0175 §7) ────
+//
+// A passed amendment becomes the live constitution by writing the INSTANCE
+// pack's board block — the same file a human editing the constitution would
+// touch, so there is ONE resolution path (env → instance → neutral) and R05's
+// precedence story stays true. The write is atomic (tmp + rename), preserves
+// everything else in the instance pack, and re-runs sanitizeBoard as a belt —
+// the proposal was strictly validated at propose time, but a file on disk must
+// never hold a shape the resolver would have to guess at.
+//
+// WHY A FILE WRITE AND NOT A DB ROW: R05 made the constitution config-resolved
+// on purpose (the board block is a RULE SHAPE, not authority — who holds the
+// governing rank stays a DB row). Moving the live value into the DB on
+// ratification would fork the resolution into two paths, the exact thing the
+// board-snapshot design avoids. The instance pack is host-owned and untracked,
+// so a deploy pull never clobbers it.
+//
+// The caller (board.js closeItem) runs this AFTER the close commits — the
+// board's decision is the durable record; a failed apply is logged loudly and
+// re-appliable from the passed item + amendment rows, never silently absorbed.
+function applyBoardAmendment(proposed, { instancePath = INSTANCE_PATH } = {}) {
+  const instance = readJson(instancePath) || {};
+  const next = { ...instance, board: { ...sanitizeBoard(proposed) } };
+  const json = JSON.stringify(next, null, 2) + '\n';
+  const tmp = `${instancePath}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, json);
+  fs.renameSync(tmp, instancePath);
+  return next.board;
+}
+
 module.exports = {
   resolveGovernmentConfig,
   loadGovernmentConfig,
   grantableOnly,
   sanitizeBoard,
+  applyBoardAmendment,
   BOARD_DEFAULTS,
   PASS_RULES,
   MAX_WINDOW_MINUTES,

package/modules/government/db.js

@@ -437,6 +437,26 @@ async function getIdeaCompleteness(ideaId) {
   return rows[0] ? rows[0].completeness_score : null;
 }
 
+// --- amendments (BV1.R14 of goal 1000069) ------------------------------------
+
+async function createAmendment({ proposed, rationaleMd = null, proposedBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO government_amendments (proposed, rationale_md, proposed_by)
+     VALUES ($1::jsonb, $2, $3)
+     RETURNING *`,
+    [JSON.stringify(proposed), rationaleMd, proposedBy],
+  );
+  return rows[0];
+}
+
+async function getAmendment(id) {
+  const { rows } = await pool.query(
+    `SELECT * FROM government_amendments WHERE id = $1`,
+    [id],
+  );
+  return rows[0] || null;
+}
+
 // R13's read: the most recent RETURNED item for a subject, carrying its
 // objection (the single 'no' vote — one reasoned objection is what returns an
 // idea, ADR 0175 §3). LEFT JOIN because a returned-by-expiry item could in
@@ -531,4 +551,6 @@ module.exports = {
   getIdeaCompleteness,
   getExpiredOpenBoardItems,
   getLatestReturnedItemWithObjection,
+  createAmendment,
+  getAmendment,
 };

package/modules/government/migrations/government_007_amendments.sql

@@ -0,0 +1,25 @@
+-- government_007_amendments.sql — the board's second subject gets a home
+-- (task 1003027 / R14 of goal 1000069, ADR 0175 §7).
+--
+-- A constitutional amendment is a PROPOSED board block put to the board. The
+-- items table deliberately carries only (subject_type, subject_id) — a subject
+-- is a row somewhere else — so the proposal's text needs its own table. One row
+-- per proposal, immutable once filed: a revised proposal is a NEW row and a new
+-- window, the same never-edit-history posture as everything else on the board.
+--
+-- `proposed` is stored EXACTLY as validated at propose time (strict validation
+-- in board.js — a proposal is never silently corrected the way a config FILE
+-- is, because ratifying text the proposer did not write would be the board
+-- lying). The apply step re-runs the R05 sanitizer as a belt anyway.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS government_amendments (
+  id            bigserial   PRIMARY KEY,
+  proposed      jsonb       NOT NULL,
+  rationale_md  text,
+  proposed_by   bigint      REFERENCES builders(id) ON DELETE SET NULL,
+  created_at    timestamptz NOT NULL DEFAULT now()
+);
+
+COMMIT;

package/modules/government/routes/government.js

@@ -414,6 +414,43 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.item.open — put an AMENDMENT to the board (R14 of goal
+  // 1000069, ADR 0175 §7). The board's other subject never comes through here:
+  // a Full Idea's window opens AUTOMATICALLY on grade pass (R07), so requesting
+  // one is refused with the reason rather than silently doubling the paths —
+  // exactly what the catalog's own guards note predicted this route would be.
+  // The proposal is validated STRICTLY in board.js (never sanitized — the board
+  // must not ratify text the proposer did not write), and the window runs under
+  // the constitution IN FORCE, which under monarchy resolves to "the Archon
+  // ratifies" — their own proposal included (§7's no-bootstrap-exception).
+  router.post('/government/board/items', api.requireBuilder, api.requirePermission('board.item.open'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      subject_type: { required: true, type: 'string', maxLength: 32 },
+      proposal: { required: true, type: 'object' },
+      rationale_md: { type: 'string', maxLength: 5000 },
+    })) return;
+    if (req.body.subject_type !== 'constitutional_amendment') {
+      return res.fail('subject_opens_automatically', 409, {
+        subject_type: req.body.subject_type,
+        reason: 'a Full Idea window opens by itself when the idea passes the completeness grade (ADR 0175 §5); only a constitutional_amendment is proposed through this route',
+      });
+    }
+    try {
+      const out = await board.proposeAmendment({
+        proposal: req.body.proposal,
+        rationaleMd: req.body.rationale_md ?? null,
+        proposedBy: req.builder.id,
+      });
+      if (!out.ok) {
+        return res.fail('invalid_proposal', 400, { reason: out.reason, ...(out.field ? { field: out.field } : {}), ...(out.expected ? { expected: out.expected } : {}) });
+      }
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item });
+    } catch (err) {
+      console.error('[gds] POST /government/board/items', err);
+      res.fail('propose_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: perm board.vote.cast — cast a vote on an open board item (R08 of goal
   // 1000069, ADR 0175). The atom FLOORS AT XENOS deliberately (the R04 carry-
   // note): the permission is only the coarse gate, and the real wall is the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.231",
+  "version": "1.19.232",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.231",
+      "version": "1.19.232",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.231",
+  "version": "1.19.232",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -251,6 +251,9 @@ const GOVERNMENT_PINS = {
   // The XENOS-floored atom is the COARSE gate by design; the real wall is the
   // in-handler membership re-check against the item's snapshotted constitution.
   'POST /government/board/items/:itemId/votes': 'perm:board.vote.cast',
+  // R14: propose a constitutional amendment (the board's only proposed subject —
+  // a Full Idea's window opens automatically on grade pass).
+  'POST /government/board/items': 'perm:board.item.open',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE

package/src/module-api.js

@@ -889,8 +889,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.229 with no explicit bump. run 32131450528. (task 1002620)
 //   1.19.231 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.230 with no explicit bump. run 32133132988. (task 1002620)
+//   1.19.232 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.231 with no explicit bump. run 32133691409. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.231'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.232'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_amendment.mjs

@@ -0,0 +1,226 @@
+// tests/government_board_amendment.mjs — constitutional amendments as the
+// board's second subject (BV1.R14 of goal 1000069, ADR 0175 §7).
+//
+// DB-free (db monkeypatched; the apply runs against a REAL temp file so the
+// atomic-write path is exercised, not stubbed). The invariants:
+//
+//   1. A PROPOSAL IS VALIDATED STRICTLY, NEVER SANITIZED — a config file falls
+//      back field-by-field so a boot never breaks; a proposal that fell back
+//      would put text before the board its proposer never wrote. Every field
+//      required, every refusal named.
+//   2. THE MONARCHY ACT WORKS END TO END — the sole Archon proposes, votes on
+//      their OWN amendment (anti-self is a full_idea rule; §7 blesses this and
+//      forbids a bootstrap exception), first_ratifier closes it, and the
+//      instance pack now carries the new constitution.
+//   3. ANTI-SELF STILL BINDS FOR IDEAS — the carve-out is subject-typed, and
+//      the full_idea case is re-pinned right here beside it.
+//   4. A RETURNED AMENDMENT APPLIES NOTHING; a passed one books NO credit
+//      (the R12 contract's subject_type filter) and applies AFTER the close.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+
+const { validateProposedConstitution, proposeAmendment, castVote, maybeCloseAfterVote } = board;
+
+const CONSENT_90 = Object.freeze({
+  membership: 'rank:archon', pass_rule: 'consent', window_minutes: 90, close_early_on_full_turnout: true,
+});
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+// ── invariant 1: strict validation ──────────────────────────────────────────
+
+test('every field is required and every refusal is named — no silent correction', () => {
+  assert.equal(validateProposedConstitution(CONSENT_90).ok, true);
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, window_minutes: null }).ok, true, 'null clock is a legal explicit choice');
+
+  const cases = [
+    [null, 'proposal_not_an_object'],
+    ['consent', 'proposal_not_an_object'],
+    [{ ...CONSENT_90, extra: true }, 'unknown_field'],
+    [{ ...CONSENT_90, membership: 'everyone' }, 'bad_membership'],
+    [{ ...CONSENT_90, membership: undefined }, 'bad_membership'],
+    [{ ...CONSENT_90, pass_rule: 'majority' }, 'bad_pass_rule'],
+    [{ ...CONSENT_90, window_minutes: 0 }, 'bad_window_minutes'],
+    [{ ...CONSENT_90, window_minutes: 1.5 }, 'bad_window_minutes'],
+    [{ ...CONSENT_90, close_early_on_full_turnout: 'yes' }, 'bad_close_early'],
+  ];
+  for (const [raw, reason] of cases) {
+    const v = validateProposedConstitution(raw);
+    assert.equal(v.ok, false, `${JSON.stringify(raw)} must be refused`);
+    assert.equal(v.reason, reason);
+  }
+  // THE CONTRAST WITH THE SANITIZER, stated as an assertion: the sanitizer
+  // silently corrects a bad pass_rule; the proposal validator refuses it.
+  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'majority' }).pass_rule, 'first_ratifier');
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'majority' }).ok, false);
+});
+
+// ── propose: files the row and opens the window in the same breath ──────────
+
+test('a proposal files the amendment and opens its window under the constitution IN FORCE', async () => {
+  let opened = null;
+  await withDb({
+    createAmendment: async (args) => ({ id: '5', proposed: args.proposed, rationale_md: args.rationaleMd, proposed_by: args.proposedBy }),
+    openBoardItem: async (args) => { opened = args; return { id: '21', ...args }; },
+  }, async () => {
+    const out = await proposeAmendment({ proposal: CONSENT_90, rationaleMd: 'time to open up', proposedBy: '42' });
+    assert.equal(out.ok, true);
+    assert.equal(out.amendment.id, '5');
+  });
+  assert.equal(opened.subjectType, 'constitutional_amendment');
+  assert.equal(opened.subjectId, '5');
+  assert.equal(opened.openedBy, '42', 'an amendment HAS a human opener, unlike a grade-opened idea');
+  assert.equal(opened.constitution.pass_rule, 'first_ratifier',
+    'the window runs under the constitution IN FORCE (this checkout: monarchy), not the proposed one');
+});
+
+test('an invalid proposal files NOTHING — refused before any write', async () => {
+  await withDb({
+    createAmendment: async () => { throw new Error('must not be reached'); },
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'majority' }, proposedBy: '42' })).ok, false);
+    assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
+  });
+});
+
+// ── invariants 2+3: the monarchy act, and the subject-typed anti-self ────────
+
+const MONARCHY = Object.freeze({ membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true });
+const amendmentItem = (over = {}) => ({
+  id: '21', subject_type: 'constitutional_amendment', subject_id: '5',
+  opened_by: '42', closed_at: null, expired: false, constitution: MONARCHY, ...over,
+});
+
+test('the monarchy act end to end: the sole Archon ratifies their OWN amendment and the pack changes', async () => {
+  const tmp = path.join(os.tmpdir(), `gov-instance-${process.pid}-${Math.floor(performance.now() * 1000)}.json`);
+  // Redirect the instance-pack write to a temp file — board.js resolves
+  // applyBoardAmendment by property lookup at call time for exactly this.
+  const origApply = config.applyBoardAmendment;
+  config.applyBoardAmendment = (proposed) => origApply(proposed, { instancePath: tmp });
+  try {
+    const karma = [];
+    let votes = [];
+    let authorAsked = 0;
+    await withDb({
+      getBoardItemForVote: async () => amendmentItem(),
+      builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+      insertBoardVote: async (args) => { const v = { id: '1', voter_id: args.voterId, direction: args.direction }; votes.push(v); return v; },
+      insertVoteKarma: async () => {},
+      getVotesForItem: async () => votes,
+      getActiveBuildersWithRank: async () => [{ builder_id: '42', github_login: 'sole-archon', display_name: 'Sole Archon' }],
+      closeBoardItem: async ({ outcome, afterClose }) => {
+        const closed = { ...amendmentItem(), closed_at: 'T', outcome };
+        assert.equal(afterClose, null, 'an amendment books NO credit — the R12 contract filter');
+        return closed;
+      },
+      getAmendment: async (id) => { assert.equal(id, '5'); return { id: '5', proposed: CONSENT_90 }; },
+      insertAuthorRatifyKarma: async (args) => { karma.push(args); return true; },
+      // reached ONLY by the post-close ratify karma, never by the vote's
+      // anti-self (the carve-out) — the counter proves the order.
+      getBoardItemAuthor: async () => { authorAsked += 1; return '42'; },
+    }, async () => {
+      // The PROPOSER casts on their own amendment — legal (§7) — and it closes
+      // immediately under first_ratifier.
+      const cast = await castVote({ itemId: 21, voterId: '42', direction: 'yes' });
+      assert.equal(cast.ok, true, `the sole Archon's vote on their own amendment must land: ${JSON.stringify(cast)}`);
+      assert.equal(authorAsked, 0, 'anti-self was not even consulted for the amendment vote');
+      const closed = await maybeCloseAfterVote(21);
+      assert.equal(closed.closed, true);
+      assert.equal(closed.outcome, 'passed');
+      assert.ok(closed.applied_constitution, 'the amendment was applied on close');
+      assert.equal(closed.applied_constitution.pass_rule, 'consent', 'the project now runs consent');
+      assert.equal(closed.applied_constitution.window_minutes, 90);
+      assert.ok(authorAsked >= 1, 'the ratify karma DID resolve the author, after the close');
+    });
+    assert.equal(karma.length, 1, 'the proposer earned the ratification karma (+3, same act as an idea ratify)');
+    const onDisk = JSON.parse(fs.readFileSync(tmp, 'utf8'));
+    assert.equal(onDisk.board.pass_rule, 'consent', 'the TEMP instance pack carries the new constitution');
+  } finally {
+    config.applyBoardAmendment = origApply;
+    try { fs.unlinkSync(tmp); } catch (_) { /* not created */ }
+  }
+});
+
+test('anti-self STILL binds for a full_idea — the carve-out is subject-typed', async () => {
+  await withDb({
+    getBoardItemForVote: async () => amendmentItem({ subject_type: 'full_idea', subject_id: '7' }),
+    builderHoldsRankActive: async () => true,
+    getBoardItemAuthor: async () => '42',
+    insertBoardVote: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    assert.deepEqual(await castVote({ itemId: 21, voterId: '42', direction: 'yes' }),
+      { ok: false, reason: 'anti_self_vote' });
+  });
+});
+
+test('a RETURNED amendment applies nothing', async () => {
+  await withDb({
+    getVotesForItem: async () => [{ voter_id: '9', direction: 'no', reason_md: 'r', section_key: 'fit' }],
+    closeBoardItem: async ({ outcome, afterClose }) => {
+      assert.equal(afterClose, null, 'no credit hook for an amendment either way');
+      return { ...amendmentItem(), closed_at: 'T', outcome };
+    },
+    getAmendment: async () => { throw new Error('must not be reached — a return applies nothing'); },
+    getBoardItemAuthor: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    const out = await board.closeItem(amendmentItem());
+    assert.equal(out.outcome, 'returned');
+    assert.equal(out.applied_constitution, undefined);
+  });
+});
+
+// ── the apply itself, against a real file ─────────────────────────────────────
+
+test('applyBoardAmendment writes the instance pack atomically and preserves its other keys', () => {
+  const tmp = path.join(os.tmpdir(), `gov-apply-${process.pid}-${Math.floor(performance.now() * 1000)}.json`);
+  try {
+    fs.writeFileSync(tmp, JSON.stringify({ ranks: { metic: { label: 'Trusted' } } }, null, 2));
+    const applied = config.applyBoardAmendment(CONSENT_90, { instancePath: tmp });
+    assert.equal(applied.pass_rule, 'consent');
+    const onDisk = JSON.parse(fs.readFileSync(tmp, 'utf8'));
+    assert.equal(onDisk.ranks.metic.label, 'Trusted', 'the pack\'s OTHER keys survive the apply');
+    assert.deepEqual(onDisk.board, { ...CONSENT_90 });
+    // and the resolver now serves it — one resolution path, R05's precedence intact
+    const resolved = config.resolveGovernmentConfig({ neutral: {}, instance: onDisk, env: {} });
+    assert.equal(resolved.board.pass_rule, 'consent');
+    // a missing instance pack is created whole
+    fs.unlinkSync(tmp);
+    config.applyBoardAmendment(MONARCHY, { instancePath: tmp });
+    assert.equal(JSON.parse(fs.readFileSync(tmp, 'utf8')).board.pass_rule, 'first_ratifier');
+  } finally {
+    try { fs.unlinkSync(tmp); } catch (_) { /* gone */ }
+  }
+});
+
+test('the route pin names board.item.open, and the catalog predicted this exact route', () => {
+  const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  assert.equal(rrc.MODULE_EXPECTED_RANKS.government['POST /government/board/items'],
+    `${rrc.PERM_PIN_PREFIX}board.item.open`);
+  const catalog = fs.readFileSync(path.join(GOV, 'catalog.js'), 'utf8');
+  assert.ok(catalog.includes('in practice this guards an amendment'),
+    'the R04 catalog guards note called it: the only proposed subject is an amendment');
+});
+
+
+test('this checkout stays vanilla: no test may leave a real config/government.json behind', () => {
+  assert.equal(fs.existsSync(path.join(ROOT, 'config', 'government.json')), false,
+    'the instance pack is host-owned and ABSENT here — a test that writes it pollutes the vanilla-boot fixtures (government_config.mjs guards the same fact)');
+});

package/tests/government_seed.mjs

@@ -39,6 +39,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_003_board_tables.sql',               // ADR 0175 Board Room schema (task 1003016)
   'government_005_seeded_rank_descriptions.sql',   // ADR 0174 seeded-description text fix (task 1003083)
   'government_006_returned_items_index.sql',      // R13 returned-item lookup index (task 1003026)
+  'government_007_amendments.sql',                 // R14 amendment proposals table (task 1003027)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.