@bongos/core 1.19.231 → 1.19.233

package/modules/government/board.js

@@ -42,8 +42,13 @@
 
 const api = require('../../src/module-api');
 const db = require('./db');
-const { loadGovernmentConfig } = require('./config');
-const { isBoardMember, resolveBoardMembers } = require('./board-membership');
+// config is required as a NAMESPACE so applyBoardAmendment resolves by property
+// lookup at CALL time — a test can redirect the instance-pack write to a temp
+// file (the reward-port delegation lesson: a destructured binding is frozen at
+// load and un-patchable).
+const governmentConfig = require('./config');
+const { loadGovernmentConfig, PASS_RULES, MAX_WINDOW_MINUTES } = governmentConfig;
+const { isBoardMember, resolveBoardMembers, parseMembershipPredicate } = require('./board-membership');
 
 // ADR 0175 §5: the completeness bar a Full Idea must clear to reach the board.
 // Held equal to economy's IDEA_FULL_PASS_BAR by test — see the header.
@@ -180,9 +185,19 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   const constitution = item.constitution || {};
   if (!(await isBoardMember(voterId, constitution))) return { ok: false, reason: 'not_board_member' };
 
-  const authorId = await db.getBoardItemAuthor(item);
-  if (authorId != null && String(authorId) === String(voterId)) {
-    return { ok: false, reason: 'anti_self_vote' };
+  // ANTI-SELF IS A FULL-IDEA RULE, NOT AN AMENDMENT RULE (R14, ADR 0175 §§7/11).
+  // The bright line exists because an idea's author GAINS from ratification
+  // (credits, legitimacy) — ceremonial self-ratification is what it prevents.
+  // An amendment pays nothing, and §7 explicitly blesses the monarchy act:
+  // under a one-Archon board with no clock, the proposer must be able to
+  // ratify their own amendment or the subject is dead on arrival — and adding
+  // a special escape for that case is the bootstrap exception §7 forbids.
+  // Skipping anti-self FOR AMENDMENTS is the rule that needs no exceptions.
+  if (item.subject_type === 'full_idea') {
+    const authorId = await db.getBoardItemAuthor(item);
+    if (authorId != null && String(authorId) === String(voterId)) {
+      return { ok: false, reason: 'anti_self_vote' };
+    }
   }
 
   const inserted = await db.insertBoardVote({
@@ -326,6 +341,24 @@ async function closeItem(item, { cause = 'vote' } = {}) {
 
   const authorKarma = outcome === 'passed' ? await awardAuthorRatifyKarma(closed) : null;
 
+  // R14: a PASSED amendment becomes the live constitution — applied AFTER the
+  // close commits (the board's decision is the durable record), loudly on
+  // failure, never silently absorbed. The apply is re-drivable from the passed
+  // item + amendment rows. A returned amendment applies nothing.
+  let appliedConstitution = null;
+  if (outcome === 'passed' && closed.subject_type === 'constitutional_amendment') {
+    try {
+      const amendment = await db.getAmendment(closed.subject_id);
+      if (amendment) {
+        appliedConstitution = governmentConfig.applyBoardAmendment(amendment.proposed);
+      } else {
+        console.error(`[government] passed amendment item ${closed.id} names amendment ${closed.subject_id}, which does not exist — NOT applied`);
+      }
+    } catch (applyErr) {
+      console.error(`[government] amendment ${closed.subject_id} ratified but NOT applied (re-drivable from the passed item): ${applyErr && applyErr.message}`);
+    }
+  }
+
   if (outcome === 'passed') {
     const payload = passPayload(closed, { authorId, completenessScore, passedAt: closed.closed_at });
     try {
@@ -333,7 +366,11 @@ async function closeItem(item, { cause = 'vote' } = {}) {
     } catch (_) { /* emitAsync isolates listener errors; nothing that moves credits subscribes */ }
   }
 
-  return { closed: true, item: closed, outcome, cause, author_karma: authorKarma, ...(credit ? { credit } : {}) };
+  return {
+    closed: true, item: closed, outcome, cause, author_karma: authorKarma,
+    ...(credit ? { credit } : {}),
+    ...(appliedConstitution ? { applied_constitution: appliedConstitution } : {}),
+  };
 }
 
 // The post-vote hook R08's route fires after a FRESH cast. Reads everything it
@@ -351,6 +388,138 @@ async function maybeCloseAfterVote(itemId) {
   return closeItem(item, { cause: 'vote' });
 }
 
+// ── proposing an amendment (BV1.R14 of goal 1000069, ADR 0175 §7) ────────────
+//
+// A proposal is validated STRICTLY, not sanitized. R05's sanitizer falls back
+// field-by-field because a config FILE must boot sane no matter what is in it;
+// a PROPOSAL is different — silently "correcting" it would put text before the
+// board that the proposer never wrote, and the board would ratify a lie. Every
+// field is required (a constitution is ratified whole, never by diff) and every
+// invalid field is a named refusal.
+function validateProposedConstitution(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { ok: false, reason: 'proposal_not_an_object' };
+  }
+  const known = ['membership', 'pass_rule', 'window_minutes', 'close_early_on_full_turnout'];
+  for (const k of Object.keys(raw)) {
+    if (!known.includes(k)) return { ok: false, reason: 'unknown_field', field: k };
+  }
+  if (!parseMembershipPredicate(raw.membership)) {
+    return { ok: false, reason: 'bad_membership', expected: "the predicate grammar rank:<key>" };
+  }
+  if (!PASS_RULES.includes(raw.pass_rule)) {
+    return { ok: false, reason: 'bad_pass_rule', expected: PASS_RULES };
+  }
+  const w = raw.window_minutes;
+  if (!(w === null || (Number.isInteger(w) && w > 0 && w <= MAX_WINDOW_MINUTES))) {
+    return { ok: false, reason: 'bad_window_minutes', expected: `null (no clock) or an integer 1..${MAX_WINDOW_MINUTES}` };
+  }
+  if (typeof raw.close_early_on_full_turnout !== 'boolean') {
+    return { ok: false, reason: 'bad_close_early', expected: 'boolean' };
+  }
+  return {
+    ok: true,
+    proposal: {
+      membership: raw.membership,
+      pass_rule: raw.pass_rule,
+      window_minutes: w,
+      close_early_on_full_turnout: raw.close_early_on_full_turnout,
+    },
+  };
+}
+
+// File the amendment and open its window IN THE SAME BREATH — a proposal that
+// exists but was never put to the board is a state nothing can act on. The
+// window runs under the constitution IN FORCE (snapshotted, like every item):
+// under monarchy that is first_ratifier with no clock, which §7 resolves to
+// "the Archon ratifies" — including the Archon's own proposal (see castVote's
+// anti-self note). Concurrent amendment windows are legal like any concurrent
+// windows; applies land in close order and the last close wins, deterministic
+// because applyBoardAmendment rewrites the whole block.
+async function proposeAmendment({ proposal, rationaleMd = null, proposedBy } = {}) {
+  const v = validateProposedConstitution(proposal);
+  if (!v.ok) return { ok: false, ...v };
+  if (proposedBy == null || proposedBy === '') return { ok: false, reason: 'missing_proposer' };
+  const amendment = await db.createAmendment({ proposed: v.proposal, rationaleMd, proposedBy });
+  const { board } = loadGovernmentConfig();
+  const item = await db.openBoardItem({
+    subjectType: 'constitutional_amendment',
+    subjectId: amendment.id,
+    openedBy: proposedBy, // an amendment HAS a human opener, unlike a grade-opened idea
+    constitution: board,
+    windowMinutes: board.window_minutes,
+  });
+  // A fresh amendment id can never collide with the one-open-per-subject index.
+  return { ok: true, amendment, item };
+}
+
+// ── the Board Room view (BV1.R16 of goal 1000069, ADR 0175 §9) ──────────────
+//
+// One assembled read for the room: open items with their clock, the OPEN
+// BALLOT (people, directions, timestamps, objections), and the bounded closed
+// history — enriched with what each subject IS (an idea's title, an
+// amendment's proposed constitution). Deliberately a VIEW, not a policy
+// surface: nothing here decides anything, and the payload carries the same
+// constitution SNAPSHOT the deciding paths use, so the room describes the rule
+// each item actually runs under. `remaining_seconds` comes from the database
+// clock per row — the client renders a countdown, it never does clock math.
+//
+// The subject AUTHOR rides along (an idea's captor / an amendment's proposer)
+// so R17's vote UI can grey out the anti-self case for ideas without a second
+// round trip — the SERVER still refuses regardless (castVote), this is only
+// the courtesy rendering.
+async function boardRoomView({ closedLimit = 20 } = {}) {
+  const [open, closed] = await Promise.all([
+    db.listOpenBoardItems(),
+    db.listClosedBoardItems(closedLimit),
+  ]);
+  const all = [...open, ...closed];
+  const votes = await db.getVotesForItems(all.map((i) => i.id));
+  const ideaIds = [...new Set(all.filter((i) => i.subject_type === 'full_idea').map((i) => i.subject_id))];
+  const amendmentIds = [...new Set(all.filter((i) => i.subject_type === 'constitutional_amendment').map((i) => i.subject_id))];
+  const [ideas, amendments] = await Promise.all([
+    db.getIdeaSubjects(ideaIds),
+    db.getAmendmentSubjects(amendmentIds),
+  ]);
+  const ideaById = new Map(ideas.map((r) => [String(r.id), r]));
+  const amendmentById = new Map(amendments.map((r) => [String(r.id), r]));
+  const votesByItem = new Map();
+  for (const v of votes) {
+    const key = String(v.item_id);
+    if (!votesByItem.has(key)) votesByItem.set(key, []);
+    votesByItem.get(key).push({
+      voter_id: String(v.voter_id),
+      github_login: v.github_login,
+      display_name: v.display_name,
+      direction: v.direction,
+      reason_md: v.reason_md,
+      section_key: v.section_key,
+      cast_at: v.cast_at,
+    });
+  }
+  const project = (item) => {
+    const subject = item.subject_type === 'full_idea'
+      ? (() => { const r = ideaById.get(String(item.subject_id)); return r ? { title: r.title, author_id: String(r.captured_by) } : null; })()
+      : (() => { const r = amendmentById.get(String(item.subject_id)); return r ? { proposed: r.proposed, rationale_md: r.rationale_md, author_id: r.proposed_by == null ? null : String(r.proposed_by) } : null; })();
+    return {
+      id: String(item.id),
+      subject_type: item.subject_type,
+      subject_id: String(item.subject_id),
+      subject, // null when the subject row is gone — the room says so honestly
+      opened_by: item.opened_by == null ? null : String(item.opened_by),
+      opened_at: item.opened_at,
+      closes_at: item.closes_at,
+      remaining_seconds: item.remaining_seconds ?? null,
+      expired: item.expired === true,
+      closed_at: item.closed_at || null,
+      outcome: item.outcome || null,
+      constitution: item.constitution || null,
+      votes: votesByItem.get(String(item.id)) || [],
+    };
+  };
+  return { open: open.map(project), closed: closed.map(project) };
+}
+
 // ── R13's read: the feedback a returned idea carries back to its author ─────
 //
 // One reasoned objection is what returns an idea (§3), so the feedback IS that
@@ -389,4 +558,7 @@ module.exports = {
   closeItem,
   maybeCloseAfterVote,
   latestRejectionForIdea,
+  validateProposedConstitution,
+  proposeAmendment,
+  boardRoomView,
 };

package/modules/government/config.js

@@ -256,11 +256,42 @@ function loadGovernmentConfig({ neutralPath = NEUTRAL_PATH, instancePath = INSTA
   });
 }
 
+// ── applying a RATIFIED amendment (BV1.R14 of goal 1000069, ADR 0175 §7) ────
+//
+// A passed amendment becomes the live constitution by writing the INSTANCE
+// pack's board block — the same file a human editing the constitution would
+// touch, so there is ONE resolution path (env → instance → neutral) and R05's
+// precedence story stays true. The write is atomic (tmp + rename), preserves
+// everything else in the instance pack, and re-runs sanitizeBoard as a belt —
+// the proposal was strictly validated at propose time, but a file on disk must
+// never hold a shape the resolver would have to guess at.
+//
+// WHY A FILE WRITE AND NOT A DB ROW: R05 made the constitution config-resolved
+// on purpose (the board block is a RULE SHAPE, not authority — who holds the
+// governing rank stays a DB row). Moving the live value into the DB on
+// ratification would fork the resolution into two paths, the exact thing the
+// board-snapshot design avoids. The instance pack is host-owned and untracked,
+// so a deploy pull never clobbers it.
+//
+// The caller (board.js closeItem) runs this AFTER the close commits — the
+// board's decision is the durable record; a failed apply is logged loudly and
+// re-appliable from the passed item + amendment rows, never silently absorbed.
+function applyBoardAmendment(proposed, { instancePath = INSTANCE_PATH } = {}) {
+  const instance = readJson(instancePath) || {};
+  const next = { ...instance, board: { ...sanitizeBoard(proposed) } };
+  const json = JSON.stringify(next, null, 2) + '\n';
+  const tmp = `${instancePath}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, json);
+  fs.renameSync(tmp, instancePath);
+  return next.board;
+}
+
 module.exports = {
   resolveGovernmentConfig,
   loadGovernmentConfig,
   grantableOnly,
   sanitizeBoard,
+  applyBoardAmendment,
   BOARD_DEFAULTS,
   PASS_RULES,
   MAX_WINDOW_MINUTES,

package/modules/government/db.js

@@ -437,6 +437,98 @@ async function getIdeaCompleteness(ideaId) {
   return rows[0] ? rows[0].completeness_score : null;
 }
 
+// --- the Board Room reads (BV1.R16 of goal 1000069) --------------------------
+//
+// The room's view: open items with their clock, the OPEN BALLOT (voter
+// identity, direction, timestamp, objection), and the closed history. Remaining
+// time is computed by the DATABASE clock per row (the same posture as expiry),
+// so the client never does clock math against its own skew. Concurrent windows
+// are normal — the reads are lists, ordered.
+
+async function listOpenBoardItems() {
+  const { rows } = await pool.query(
+    `SELECT *,
+            (closes_at IS NOT NULL AND closes_at < now()) AS expired,
+            CASE WHEN closes_at IS NULL THEN NULL
+                 ELSE GREATEST(0, EXTRACT(EPOCH FROM (closes_at - now()))::int) END AS remaining_seconds
+       FROM government_board_items
+      WHERE closed_at IS NULL
+      ORDER BY opened_at DESC`,
+  );
+  return rows;
+}
+
+// Bounded closed history, newest close first. Served by government_008's
+// closed-items index — the closed set grows forever (resubmission is
+// unbounded), and this runs on every Board Room page load.
+async function listClosedBoardItems(limit = 20) {
+  const { rows } = await pool.query(
+    `SELECT * FROM government_board_items
+      WHERE closed_at IS NOT NULL
+      ORDER BY closed_at DESC
+      LIMIT $1`,
+    [limit],
+  );
+  return rows;
+}
+
+// The open ballot for a SET of items in one query — voter identity joined so
+// the room shows people, not ids (§9: a board whose votes are invisible
+// constrains nobody).
+async function getVotesForItems(itemIds) {
+  if (!itemIds || !itemIds.length) return [];
+  const { rows } = await pool.query(
+    `SELECT v.*, b.github_login, b.display_name
+       FROM government_board_votes v
+       JOIN builders b ON b.id = v.voter_id
+      WHERE v.item_id = ANY($1::bigint[])
+      ORDER BY v.cast_at, v.id`,
+    [itemIds],
+  );
+  return rows;
+}
+
+// Subject enrichment, one query per subject family. Shared-table reads (the
+// boundary is code imports, not table access) — a full_idea shows its title,
+// an amendment its proposed block + rationale.
+async function getIdeaSubjects(ideaIds) {
+  if (!ideaIds || !ideaIds.length) return [];
+  const { rows } = await pool.query(
+    `SELECT id, title, captured_by FROM idea_inbox WHERE id = ANY($1::bigint[])`,
+    [ideaIds],
+  );
+  return rows;
+}
+
+async function getAmendmentSubjects(amendmentIds) {
+  if (!amendmentIds || !amendmentIds.length) return [];
+  const { rows } = await pool.query(
+    `SELECT id, proposed, rationale_md, proposed_by FROM government_amendments WHERE id = ANY($1::bigint[])`,
+    [amendmentIds],
+  );
+  return rows;
+}
+
+// --- amendments (BV1.R14 of goal 1000069) ------------------------------------
+
+async function createAmendment({ proposed, rationaleMd = null, proposedBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO government_amendments (proposed, rationale_md, proposed_by)
+     VALUES ($1::jsonb, $2, $3)
+     RETURNING *`,
+    [JSON.stringify(proposed), rationaleMd, proposedBy],
+  );
+  return rows[0];
+}
+
+async function getAmendment(id) {
+  const { rows } = await pool.query(
+    `SELECT * FROM government_amendments WHERE id = $1`,
+    [id],
+  );
+  return rows[0] || null;
+}
+
 // R13's read: the most recent RETURNED item for a subject, carrying its
 // objection (the single 'no' vote — one reasoned objection is what returns an
 // idea, ADR 0175 §3). LEFT JOIN because a returned-by-expiry item could in
@@ -531,4 +623,11 @@ module.exports = {
   getIdeaCompleteness,
   getExpiredOpenBoardItems,
   getLatestReturnedItemWithObjection,
+  createAmendment,
+  getAmendment,
+  listOpenBoardItems,
+  listClosedBoardItems,
+  getVotesForItems,
+  getIdeaSubjects,
+  getAmendmentSubjects,
 };

package/modules/government/migrations/government_007_amendments.sql

@@ -0,0 +1,25 @@
+-- government_007_amendments.sql — the board's second subject gets a home
+-- (task 1003027 / R14 of goal 1000069, ADR 0175 §7).
+--
+-- A constitutional amendment is a PROPOSED board block put to the board. The
+-- items table deliberately carries only (subject_type, subject_id) — a subject
+-- is a row somewhere else — so the proposal's text needs its own table. One row
+-- per proposal, immutable once filed: a revised proposal is a NEW row and a new
+-- window, the same never-edit-history posture as everything else on the board.
+--
+-- `proposed` is stored EXACTLY as validated at propose time (strict validation
+-- in board.js — a proposal is never silently corrected the way a config FILE
+-- is, because ratifying text the proposer did not write would be the board
+-- lying). The apply step re-runs the R05 sanitizer as a belt anyway.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS government_amendments (
+  id            bigserial   PRIMARY KEY,
+  proposed      jsonb       NOT NULL,
+  rationale_md  text,
+  proposed_by   bigint      REFERENCES builders(id) ON DELETE SET NULL,
+  created_at    timestamptz NOT NULL DEFAULT now()
+);
+
+COMMIT;

package/modules/government/migrations/government_008_closed_items_index.sql

@@ -0,0 +1,17 @@
+-- government_008_closed_items_index.sql — index the closed-history read
+-- (task 1003029 / R16 of goal 1000069).
+--
+-- The Board Room's closed history reads "newest closes first, LIMIT n" on every
+-- page load, and the closed set grows forever (one row per window; resubmission
+-- is unbounded by design). The table's other indexes are partial on OPEN items
+-- (the sweep, the one-open-per-subject wall) or on outcome alone — none order
+-- by close time. Same reasoning as government_006's returned-items index.
+-- Additive, idempotent, no rows touched.
+
+BEGIN;
+
+CREATE INDEX IF NOT EXISTS government_board_items_closed_by_time
+  ON government_board_items (closed_at DESC)
+  WHERE closed_at IS NOT NULL;
+
+COMMIT;

package/modules/government/routes/government.js

@@ -414,6 +414,61 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.vote.cast — the Board Room view: open items with their
+  // clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). Gated on
+  // the XENOS-floored vote atom, deliberately: seeing the ballot is part of
+  // casting (§9 — a board whose votes are invisible constrains nobody), and the
+  // room teaches as well as governs (criterion C5). NOT government.manage —
+  // that is the admin tab's atom; the room must be visible to whoever the
+  // constitution may enfranchise. Membership still gates nothing here: this is
+  // a read, and the write (the vote) re-checks membership in-handler.
+  router.get('/government/board/items', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    try {
+      const view = await board.boardRoomView({ closedLimit: 20 });
+      res.json({ ...view, viewer_id: String(req.builder.id) });
+    } catch (err) {
+      console.error('[gds] GET /government/board/items', err);
+      res.fail('board_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm board.item.open — put an AMENDMENT to the board (R14 of goal
+  // 1000069, ADR 0175 §7). The board's other subject never comes through here:
+  // a Full Idea's window opens AUTOMATICALLY on grade pass (R07), so requesting
+  // one is refused with the reason rather than silently doubling the paths —
+  // exactly what the catalog's own guards note predicted this route would be.
+  // The proposal is validated STRICTLY in board.js (never sanitized — the board
+  // must not ratify text the proposer did not write), and the window runs under
+  // the constitution IN FORCE, which under monarchy resolves to "the Archon
+  // ratifies" — their own proposal included (§7's no-bootstrap-exception).
+  router.post('/government/board/items', api.requireBuilder, api.requirePermission('board.item.open'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      subject_type: { required: true, type: 'string', maxLength: 32 },
+      proposal: { required: true, type: 'object' },
+      rationale_md: { type: 'string', maxLength: 5000 },
+    })) return;
+    if (req.body.subject_type !== 'constitutional_amendment') {
+      return res.fail('subject_opens_automatically', 409, {
+        subject_type: req.body.subject_type,
+        reason: 'a Full Idea window opens by itself when the idea passes the completeness grade (ADR 0175 §5); only a constitutional_amendment is proposed through this route',
+      });
+    }
+    try {
+      const out = await board.proposeAmendment({
+        proposal: req.body.proposal,
+        rationaleMd: req.body.rationale_md ?? null,
+        proposedBy: req.builder.id,
+      });
+      if (!out.ok) {
+        return res.fail('invalid_proposal', 400, { reason: out.reason, ...(out.field ? { field: out.field } : {}), ...(out.expected ? { expected: out.expected } : {}) });
+      }
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item });
+    } catch (err) {
+      console.error('[gds] POST /government/board/items', err);
+      res.fail('propose_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: perm board.vote.cast — cast a vote on an open board item (R08 of goal
   // 1000069, ADR 0175). The atom FLOORS AT XENOS deliberately (the R04 carry-
   // note): the permission is only the coarse gate, and the real wall is the

package/modules/hall-ui/public/government.html

@@ -99,6 +99,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/government.js?v=2026-08-18-government-ia"></script>
+<script src="/builders/government.js?v=2026-08-18-board-room"></script>
 </body>
 </html>