@bongos/core 1.19.231 → 1.19.233

package/modules/hall-ui/public/government.js

@@ -401,30 +401,121 @@
 
   // ---- the three-section IA (R15) -------------------------------------------
 
-  // Tab order is the spec's — Constitution · Board Room · Ranks & Permissions —
-  // but the INITIAL tab is Ranks until R16/R18 fill the other two: landing the
-  // Archon on a frame when the working surface is one tab over would be IA
-  // winning over usefulness. Flip `initial` to 'constitution' when R18 lands.
-  function wireTabs() {
+  // Tab order is the spec's — Constitution · Board Room · Ranks & Permissions.
+  // Since R16 the Board Room is furnished, so a non-archon (who cannot use the
+  // admin tab) lands there; the Archon still lands on Ranks, their working
+  // surface. Flip the non-archon initial to 'constitution' when R18 lands.
+  function wireTabs({ isArchon }) {
     window.OTBKit.makeTabs({
       mount: document.getElementById('gov-tabs'),
       hash: true,
-      initial: 'ranks',
+      initial: isArchon ? 'ranks' : 'board-room',
       tabs: [
         { id: 'constitution', label: 'Constitution', panel: 'gov-panel-constitution' },
         { id: 'board-room', label: 'Board Room', panel: 'gov-panel-board' },
         { id: 'ranks', label: 'Ranks & Permissions', panel: 'gov-panel-ranks' },
       ],
     });
-    // The frames' empty states — kit-standard, one line, no fake data. What this
-    // project actually RUNS is config the server owns; rendering it here before
-    // the R18 read exists would mean hardcoding a value that drifts.
+    // The Constitution frame stays an empty state until R18's read exists —
+    // rendering live values without it would mean hardcoding what drifts.
     document.getElementById('gov-constitution').innerHTML = window.OTBKit.emptyStateHtml(
       'The live constitution — what this project runs today, and how it has changed — appears here when the Board Room opens.',
     );
-    document.getElementById('gov-board').innerHTML = window.OTBKit.emptyStateHtml(
-      'Nothing is before the board. When a Full Idea clears the completeness grade, its window opens here.',
-    );
+  }
+
+  // ---- the Board Room panel (R16) --------------------------------------------
+
+  // The room renders what the server assembled: open items with the database's
+  // own countdown, the OPEN BALLOT (people, directions, timestamps, objections),
+  // and the closed history. Nothing here decides anything — casting arrives with
+  // R17; this panel is the accountability surface (§9: a board whose votes are
+  // invisible constrains nobody).
+
+  function fmtRemaining(seconds) {
+    if (seconds === null || seconds === undefined) return null;
+    const s = Number(seconds);
+    if (!Number.isFinite(s) || s <= 0) return 'closing…';
+    if (s < 90) return `closes in ${Math.max(1, Math.round(s))}s`;
+    if (s < 5400) return `closes in ${Math.round(s / 60)}m`;
+    return `closes in ${(s / 3600).toFixed(1)}h`;
+  }
+
+  function subjectLine(item) {
+    if (item.subject_type === 'full_idea') {
+      const title = item.subject ? item.subject.title : `idea ${item.subject_id}`;
+      return `<a href="/#/idea/${escapeHtml(String(item.subject_id))}">${escapeHtml(title)}</a> <span class="gov-pill gov-pill--floor">Full Idea</span>`;
+    }
+    return `Constitutional amendment <span class="gov-pill gov-pill--floor">amendment</span>`;
+  }
+
+  function clockLine(item) {
+    if (item.closes_at) {
+      const rem = fmtRemaining(item.remaining_seconds);
+      return rem || 'timed sitting';
+    }
+    const rule = item.constitution && item.constitution.pass_rule;
+    return rule === 'first_ratifier'
+      ? 'no clock — closes on the first vote'
+      : 'no clock';
+  }
+
+  function ballotHtml(item, viewerId) {
+    if (!item.votes.length) {
+      return `<p class="gov-empty">No votes yet${item.closed_at ? ' — closed unopposed' : ''}.</p>`;
+    }
+    const rows = item.votes.map((v) => {
+      const who = escapeHtml(v.display_name || v.github_login || `builder ${v.voter_id}`);
+      const mine = String(v.voter_id) === String(viewerId) ? ' <span class="gov-held-note">your vote</span>' : '';
+      const when = escapeHtml(String(v.cast_at).slice(0, 16).replace('T', ' '));
+      const objection = v.direction === 'no'
+        ? `<div class="gov-perm__guards">objected to <code>${escapeHtml(v.section_key || '')}</code> — ${escapeHtml(v.reason_md || '')}</div>`
+        : '';
+      return `<div class="gov-assign-row"><span class="gov-assign-row__who">${who}${mine}</span>
+        <span class="gov-pill ${v.direction === 'no' ? 'gov-pill--locked' : 'gov-pill--seeded'}">${v.direction}</span>
+        <span class="muted">${when}</span>${objection}</div>`;
+    }).join('');
+    return `<div class="gov-section">${rows}</div>`;
+  }
+
+  function itemCard(item, viewerId) {
+    const yes = item.votes.filter((v) => v.direction === 'yes').length;
+    const no = item.votes.filter((v) => v.direction === 'no').length;
+    const state = item.closed_at
+      ? `<span class="gov-pill ${item.outcome === 'passed' ? 'gov-pill--seeded' : 'gov-pill--locked'}">${escapeHtml(item.outcome || '')}</span>`
+      : `<span class="gov-pill gov-pill--custom">open</span> <span class="muted">${escapeHtml(clockLine(item))}</span>`;
+    const amendmentDetail = item.subject_type === 'constitutional_amendment' && item.subject
+      ? `<div class="gov-perm__guards">proposes: <code>${escapeHtml(JSON.stringify(item.subject.proposed))}</code>${item.subject.rationale_md ? ` — ${escapeHtml(item.subject.rationale_md)}` : ''}</div>`
+      : '';
+    const mine = item.votes.find((v) => String(v.voter_id) === String(viewerId));
+    const myLine = item.closed_at ? '' : (mine
+      ? `<p class="gov-grid-note">You voted <strong>${escapeHtml(mine.direction)}</strong>. One vote per member — no changes.</p>`
+      : `<p class="gov-grid-note">You have not voted on this item. Casting arrives with the vote form.</p>`);
+    return `<section class="gov-section">
+      <div class="gov-section__head">${subjectLine(item)} ${state}</div>
+      ${amendmentDetail}
+      <p class="gov-grid-note">tally: ${yes} yes · ${no} no — sitting under <code>${escapeHtml((item.constitution && item.constitution.pass_rule) || '?')}</code>, membership <code>${escapeHtml((item.constitution && item.constitution.membership) || '?')}</code></p>
+      ${myLine}
+      ${ballotHtml(item, viewerId)}
+    </section>`;
+  }
+
+  async function loadBoard() {
+    const box = document.getElementById('gov-board');
+    let data;
+    try {
+      data = await fetchJson('/government/board/items');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      box.innerHTML = `<p class="gov-empty">Could not load the Board Room just now.</p>`;
+      return;
+    }
+    const viewerId = data.viewer_id;
+    const open = (data.open || []).map((i) => itemCard(i, viewerId)).join('');
+    const closed = (data.closed || []).map((i) => itemCard(i, viewerId)).join('');
+    box.innerHTML =
+      (open || window.OTBKit.emptyStateHtml('Nothing is before the board. When a Full Idea clears the completeness grade, its window opens here.'))
+      + `<h2 class="gov-h">Closed sittings</h2>`
+      + (closed || `<p class="gov-empty">No sitting has closed yet.</p>`);
   }
 
   // ---- init ----------------------------------------------------------------
@@ -435,11 +526,20 @@
     document.getElementById('gov-sub').textContent = 'Restricted.';
   }
 
+  // Since R16 the page shell admits page.view.government (metic+), and only the
+  // RANKS tab is the archon admin surface — so the seal narrowed from the whole
+  // page to that one panel. Cosmetic defence-in-depth as ever: every
+  // /government/* CRUD endpoint still gates on government.manage server-side,
+  // and the board read carries its own atom.
+  function sealRanksPanel() {
+    const panel = document.getElementById('gov-panel-ranks');
+    const body = document.getElementById('gov-body');
+    // Replace the admin surface with the sealed note, inside its own tab only.
+    panel.innerHTML = '<p class="gov-sealed">Ranks & Permissions is the Archon administration surface. The Constitution and the Board Room are yours to read.</p>';
+    body.hidden = false;
+  }
+
   async function init() {
-    // Confirm rank for a friendly sealed notice; the server gates the page and
-    // every /government endpoint on `government.manage` regardless (cosmetic
-    // defence-in-depth). government.manage is system:true, so only the archon
-    // rank can hold it — rank is an accurate client-side proxy.
     let me;
     try {
       me = await fetchJson('/me');
@@ -449,17 +549,20 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    if (rank !== 'archon') { showSealed(); return; }
+    const isArchon = rank === 'archon';
 
     document.getElementById('gov-sub').textContent = 'How this project is governed — the constitution it runs, the Board Room, and the ranks & permissions that administer it.';
     document.getElementById('gov-body').hidden = false;
-    wireTabs();
+    wireTabs({ isArchon });
+    loadBoard(); // the room loads for everyone the page admits
+
+    if (!isArchon) { sealRanksPanel(); return; }
     wireForms();
     try {
       await load();
     } catch (err) {
       if (err && err.kind === '401') return;
-      if (err && err.kind === '403') { showSealed(); return; }
+      if (err && err.kind === '403') { sealRanksPanel(); return; }
       document.getElementById('gov-grid').innerHTML = `<p class="gov-empty">Could not load government data just now.</p>`;
     }
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.231",
+  "version": "1.19.233",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.231",
+      "version": "1.19.233",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.231",
+  "version": "1.19.233",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -251,6 +251,12 @@ const GOVERNMENT_PINS = {
   // The XENOS-floored atom is the COARSE gate by design; the real wall is the
   // in-handler membership re-check against the item's snapshotted constitution.
   'POST /government/board/items/:itemId/votes': 'perm:board.vote.cast',
+  // R14: propose a constitutional amendment (the board's only proposed subject —
+  // a Full Idea's window opens automatically on grade pass).
+  'POST /government/board/items': 'perm:board.item.open',
+  // R16: the Board Room view — the open ballot is visible to whoever may cast
+  // (xenos-floored atom; the room teaches as well as governs, criterion C5).
+  'GET /government/board/items': 'perm:board.vote.cast',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE

package/src/bongos/serve-internal.js

@@ -789,8 +789,15 @@ function mountInternalSurfaces(app) {
       || SESSIONS_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernmentPage(req, res, next);
     }
+    // R16 (goal 1000069) widened the government shell from the manage atom
+    // (archon) to page.view.government (metic+): since R15 the page is THREE
+    // rooms — Constitution, Board Room, Ranks & Permissions — and only the
+    // third is the archon admin surface. Its DATA routes all still gate on
+    // government.manage individually (defence in depth unchanged); the board +
+    // constitution reads carry their own atoms. The shell follows the widest
+    // legitimate audience — the audience changed when the page did.
     if (GOVERNMENT_PAGE_RE.test(norm)) {
-      return gdsAuth.requireGovernmentManagePage(req, res, next);
+      return gdsAuth.requireGovernmentPage(req, res, next);
     }
     if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);

package/src/module-api.js

@@ -889,8 +889,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.229 with no explicit bump. run 32131450528. (task 1002620)
 //   1.19.231 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.230 with no explicit bump. run 32133132988. (task 1002620)
+//   1.19.232 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.231 with no explicit bump. run 32133691409. (task 1002620)
+//   1.19.233 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.232 with no explicit bump. run 32160823445. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.231'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.233'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_amendment.mjs

@@ -0,0 +1,226 @@
+// tests/government_board_amendment.mjs — constitutional amendments as the
+// board's second subject (BV1.R14 of goal 1000069, ADR 0175 §7).
+//
+// DB-free (db monkeypatched; the apply runs against a REAL temp file so the
+// atomic-write path is exercised, not stubbed). The invariants:
+//
+//   1. A PROPOSAL IS VALIDATED STRICTLY, NEVER SANITIZED — a config file falls
+//      back field-by-field so a boot never breaks; a proposal that fell back
+//      would put text before the board its proposer never wrote. Every field
+//      required, every refusal named.
+//   2. THE MONARCHY ACT WORKS END TO END — the sole Archon proposes, votes on
+//      their OWN amendment (anti-self is a full_idea rule; §7 blesses this and
+//      forbids a bootstrap exception), first_ratifier closes it, and the
+//      instance pack now carries the new constitution.
+//   3. ANTI-SELF STILL BINDS FOR IDEAS — the carve-out is subject-typed, and
+//      the full_idea case is re-pinned right here beside it.
+//   4. A RETURNED AMENDMENT APPLIES NOTHING; a passed one books NO credit
+//      (the R12 contract's subject_type filter) and applies AFTER the close.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+
+const { validateProposedConstitution, proposeAmendment, castVote, maybeCloseAfterVote } = board;
+
+const CONSENT_90 = Object.freeze({
+  membership: 'rank:archon', pass_rule: 'consent', window_minutes: 90, close_early_on_full_turnout: true,
+});
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+// ── invariant 1: strict validation ──────────────────────────────────────────
+
+test('every field is required and every refusal is named — no silent correction', () => {
+  assert.equal(validateProposedConstitution(CONSENT_90).ok, true);
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, window_minutes: null }).ok, true, 'null clock is a legal explicit choice');
+
+  const cases = [
+    [null, 'proposal_not_an_object'],
+    ['consent', 'proposal_not_an_object'],
+    [{ ...CONSENT_90, extra: true }, 'unknown_field'],
+    [{ ...CONSENT_90, membership: 'everyone' }, 'bad_membership'],
+    [{ ...CONSENT_90, membership: undefined }, 'bad_membership'],
+    [{ ...CONSENT_90, pass_rule: 'majority' }, 'bad_pass_rule'],
+    [{ ...CONSENT_90, window_minutes: 0 }, 'bad_window_minutes'],
+    [{ ...CONSENT_90, window_minutes: 1.5 }, 'bad_window_minutes'],
+    [{ ...CONSENT_90, close_early_on_full_turnout: 'yes' }, 'bad_close_early'],
+  ];
+  for (const [raw, reason] of cases) {
+    const v = validateProposedConstitution(raw);
+    assert.equal(v.ok, false, `${JSON.stringify(raw)} must be refused`);
+    assert.equal(v.reason, reason);
+  }
+  // THE CONTRAST WITH THE SANITIZER, stated as an assertion: the sanitizer
+  // silently corrects a bad pass_rule; the proposal validator refuses it.
+  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'majority' }).pass_rule, 'first_ratifier');
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'majority' }).ok, false);
+});
+
+// ── propose: files the row and opens the window in the same breath ──────────
+
+test('a proposal files the amendment and opens its window under the constitution IN FORCE', async () => {
+  let opened = null;
+  await withDb({
+    createAmendment: async (args) => ({ id: '5', proposed: args.proposed, rationale_md: args.rationaleMd, proposed_by: args.proposedBy }),
+    openBoardItem: async (args) => { opened = args; return { id: '21', ...args }; },
+  }, async () => {
+    const out = await proposeAmendment({ proposal: CONSENT_90, rationaleMd: 'time to open up', proposedBy: '42' });
+    assert.equal(out.ok, true);
+    assert.equal(out.amendment.id, '5');
+  });
+  assert.equal(opened.subjectType, 'constitutional_amendment');
+  assert.equal(opened.subjectId, '5');
+  assert.equal(opened.openedBy, '42', 'an amendment HAS a human opener, unlike a grade-opened idea');
+  assert.equal(opened.constitution.pass_rule, 'first_ratifier',
+    'the window runs under the constitution IN FORCE (this checkout: monarchy), not the proposed one');
+});
+
+test('an invalid proposal files NOTHING — refused before any write', async () => {
+  await withDb({
+    createAmendment: async () => { throw new Error('must not be reached'); },
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'majority' }, proposedBy: '42' })).ok, false);
+    assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
+  });
+});
+
+// ── invariants 2+3: the monarchy act, and the subject-typed anti-self ────────
+
+const MONARCHY = Object.freeze({ membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true });
+const amendmentItem = (over = {}) => ({
+  id: '21', subject_type: 'constitutional_amendment', subject_id: '5',
+  opened_by: '42', closed_at: null, expired: false, constitution: MONARCHY, ...over,
+});
+
+test('the monarchy act end to end: the sole Archon ratifies their OWN amendment and the pack changes', async () => {
+  const tmp = path.join(os.tmpdir(), `gov-instance-${process.pid}-${Math.floor(performance.now() * 1000)}.json`);
+  // Redirect the instance-pack write to a temp file — board.js resolves
+  // applyBoardAmendment by property lookup at call time for exactly this.
+  const origApply = config.applyBoardAmendment;
+  config.applyBoardAmendment = (proposed) => origApply(proposed, { instancePath: tmp });
+  try {
+    const karma = [];
+    let votes = [];
+    let authorAsked = 0;
+    await withDb({
+      getBoardItemForVote: async () => amendmentItem(),
+      builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+      insertBoardVote: async (args) => { const v = { id: '1', voter_id: args.voterId, direction: args.direction }; votes.push(v); return v; },
+      insertVoteKarma: async () => {},
+      getVotesForItem: async () => votes,
+      getActiveBuildersWithRank: async () => [{ builder_id: '42', github_login: 'sole-archon', display_name: 'Sole Archon' }],
+      closeBoardItem: async ({ outcome, afterClose }) => {
+        const closed = { ...amendmentItem(), closed_at: 'T', outcome };
+        assert.equal(afterClose, null, 'an amendment books NO credit — the R12 contract filter');
+        return closed;
+      },
+      getAmendment: async (id) => { assert.equal(id, '5'); return { id: '5', proposed: CONSENT_90 }; },
+      insertAuthorRatifyKarma: async (args) => { karma.push(args); return true; },
+      // reached ONLY by the post-close ratify karma, never by the vote's
+      // anti-self (the carve-out) — the counter proves the order.
+      getBoardItemAuthor: async () => { authorAsked += 1; return '42'; },
+    }, async () => {
+      // The PROPOSER casts on their own amendment — legal (§7) — and it closes
+      // immediately under first_ratifier.
+      const cast = await castVote({ itemId: 21, voterId: '42', direction: 'yes' });
+      assert.equal(cast.ok, true, `the sole Archon's vote on their own amendment must land: ${JSON.stringify(cast)}`);
+      assert.equal(authorAsked, 0, 'anti-self was not even consulted for the amendment vote');
+      const closed = await maybeCloseAfterVote(21);
+      assert.equal(closed.closed, true);
+      assert.equal(closed.outcome, 'passed');
+      assert.ok(closed.applied_constitution, 'the amendment was applied on close');
+      assert.equal(closed.applied_constitution.pass_rule, 'consent', 'the project now runs consent');
+      assert.equal(closed.applied_constitution.window_minutes, 90);
+      assert.ok(authorAsked >= 1, 'the ratify karma DID resolve the author, after the close');
+    });
+    assert.equal(karma.length, 1, 'the proposer earned the ratification karma (+3, same act as an idea ratify)');
+    const onDisk = JSON.parse(fs.readFileSync(tmp, 'utf8'));
+    assert.equal(onDisk.board.pass_rule, 'consent', 'the TEMP instance pack carries the new constitution');
+  } finally {
+    config.applyBoardAmendment = origApply;
+    try { fs.unlinkSync(tmp); } catch (_) { /* not created */ }
+  }
+});
+
+test('anti-self STILL binds for a full_idea — the carve-out is subject-typed', async () => {
+  await withDb({
+    getBoardItemForVote: async () => amendmentItem({ subject_type: 'full_idea', subject_id: '7' }),
+    builderHoldsRankActive: async () => true,
+    getBoardItemAuthor: async () => '42',
+    insertBoardVote: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    assert.deepEqual(await castVote({ itemId: 21, voterId: '42', direction: 'yes' }),
+      { ok: false, reason: 'anti_self_vote' });
+  });
+});
+
+test('a RETURNED amendment applies nothing', async () => {
+  await withDb({
+    getVotesForItem: async () => [{ voter_id: '9', direction: 'no', reason_md: 'r', section_key: 'fit' }],
+    closeBoardItem: async ({ outcome, afterClose }) => {
+      assert.equal(afterClose, null, 'no credit hook for an amendment either way');
+      return { ...amendmentItem(), closed_at: 'T', outcome };
+    },
+    getAmendment: async () => { throw new Error('must not be reached — a return applies nothing'); },
+    getBoardItemAuthor: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    const out = await board.closeItem(amendmentItem());
+    assert.equal(out.outcome, 'returned');
+    assert.equal(out.applied_constitution, undefined);
+  });
+});
+
+// ── the apply itself, against a real file ─────────────────────────────────────
+
+test('applyBoardAmendment writes the instance pack atomically and preserves its other keys', () => {
+  const tmp = path.join(os.tmpdir(), `gov-apply-${process.pid}-${Math.floor(performance.now() * 1000)}.json`);
+  try {
+    fs.writeFileSync(tmp, JSON.stringify({ ranks: { metic: { label: 'Trusted' } } }, null, 2));
+    const applied = config.applyBoardAmendment(CONSENT_90, { instancePath: tmp });
+    assert.equal(applied.pass_rule, 'consent');
+    const onDisk = JSON.parse(fs.readFileSync(tmp, 'utf8'));
+    assert.equal(onDisk.ranks.metic.label, 'Trusted', 'the pack\'s OTHER keys survive the apply');
+    assert.deepEqual(onDisk.board, { ...CONSENT_90 });
+    // and the resolver now serves it — one resolution path, R05's precedence intact
+    const resolved = config.resolveGovernmentConfig({ neutral: {}, instance: onDisk, env: {} });
+    assert.equal(resolved.board.pass_rule, 'consent');
+    // a missing instance pack is created whole
+    fs.unlinkSync(tmp);
+    config.applyBoardAmendment(MONARCHY, { instancePath: tmp });
+    assert.equal(JSON.parse(fs.readFileSync(tmp, 'utf8')).board.pass_rule, 'first_ratifier');
+  } finally {
+    try { fs.unlinkSync(tmp); } catch (_) { /* gone */ }
+  }
+});
+
+test('the route pin names board.item.open, and the catalog predicted this exact route', () => {
+  const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  assert.equal(rrc.MODULE_EXPECTED_RANKS.government['POST /government/board/items'],
+    `${rrc.PERM_PIN_PREFIX}board.item.open`);
+  const catalog = fs.readFileSync(path.join(GOV, 'catalog.js'), 'utf8');
+  assert.ok(catalog.includes('in practice this guards an amendment'),
+    'the R04 catalog guards note called it: the only proposed subject is an amendment');
+});
+
+
+test('this checkout stays vanilla: no test may leave a real config/government.json behind', () => {
+  assert.equal(fs.existsSync(path.join(ROOT, 'config', 'government.json')), false,
+    'the instance pack is host-owned and ABSENT here — a test that writes it pollutes the vanilla-boot fixtures (government_config.mjs guards the same fact)');
+});

package/tests/government_board_view.mjs

@@ -0,0 +1,129 @@
+// tests/government_board_view.mjs — the Board Room view (BV1.R16 of goal
+// 1000069, ADR 0175 §9): open items with their clock, the open ballot, and the
+// closed history — assembled server-side, decided nowhere.
+//
+// DB-free (db monkeypatched, the sibling board tests' idiom). The invariants:
+//   1. THE VIEW DECIDES NOTHING — it projects rows; the payload carries each
+//      item's SNAPSHOT so the room describes the rule the item actually runs
+//      under, and remaining time is the database's number, passed through.
+//   2. SUBJECTS ARE ENRICHED, HONESTLY — an idea shows its title + author, an
+//      amendment its proposed block; a subject whose row is GONE projects
+//      subject:null rather than being dropped or invented.
+//   3. THE BALLOT IS OPEN — voter identity rides every vote row (§9), and an
+//      objection carries its reason + section for the room to show.
+//   4. THE READ IS GATED ON THE VOTE ATOM, NOT THE MANAGE ATOM — seeing the
+//      ballot is part of casting; the pin (and the generalized gate test in
+//      government_routes.mjs) hold the route to board.vote.cast.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+
+const { boardRoomView } = board;
+
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+test('the assembled view: enrichment, the open ballot, the snapshot, the database clock — all passthrough', async () => {
+  const view = await withDb({
+    listOpenBoardItems: async () => [
+      { id: 11n, subject_type: 'full_idea', subject_id: 7n, opened_by: null, opened_at: 'T1', closes_at: 'T2', remaining_seconds: 540, expired: false, closed_at: null, outcome: null, constitution: MONARCHY },
+      { id: 12n, subject_type: 'constitutional_amendment', subject_id: 5n, opened_by: 42n, opened_at: 'T1', closes_at: null, remaining_seconds: null, expired: false, closed_at: null, outcome: null, constitution: MONARCHY },
+    ],
+    listClosedBoardItems: async (limit) => { assert.equal(limit, 20); return [
+      { id: 9, subject_type: 'full_idea', subject_id: 6, opened_by: null, opened_at: 'T0', closes_at: null, closed_at: 'T3', outcome: 'returned', constitution: MONARCHY },
+    ]; },
+    getVotesForItems: async (ids) => {
+      assert.deepEqual(ids.map(String).sort(), ['11', '12', '9'].sort(), 'one ballot query for ALL items, open and closed');
+      return [
+        { item_id: 11n, voter_id: 42n, github_login: 'first-member', display_name: 'First Member', direction: 'yes', reason_md: null, section_key: null, cast_at: 'T2' },
+        { item_id: 9, voter_id: 43, github_login: 'second-member', display_name: null, direction: 'no', reason_md: 'fit is thin', section_key: 'fit', cast_at: 'T2' },
+      ];
+    },
+    getIdeaSubjects: async (ids) => {
+      assert.deepEqual(ids.map(String).sort(), ['6', '7']);
+      return [{ id: 7n, title: 'A big idea', captured_by: 9n }]; // idea 6 is GONE — deleted subject
+    },
+    getAmendmentSubjects: async (ids) => {
+      assert.deepEqual(ids.map(String), ['5']);
+      return [{ id: 5n, proposed: { pass_rule: 'consent' }, rationale_md: 'open up', proposed_by: 42n }];
+    },
+  }, () => boardRoomView());
+
+  assert.equal(view.open.length, 2);
+  assert.equal(view.closed.length, 1);
+
+  const idea = view.open[0];
+  assert.deepEqual(idea.subject, { title: 'A big idea', author_id: '9' }, 'an idea shows its title + author (R17 greys anti-self from this)');
+  assert.equal(idea.remaining_seconds, 540, 'the DATABASE clock, passed through — the client never does clock math');
+  assert.deepEqual(idea.constitution, MONARCHY, 'the SNAPSHOT rides along — the room describes the rule the item runs under');
+  assert.equal(idea.votes.length, 1);
+  assert.equal(idea.votes[0].github_login, 'first-member', 'the ballot is OPEN — identity on every vote row');
+
+  const amendment = view.open[1];
+  assert.deepEqual(amendment.subject, { proposed: { pass_rule: 'consent' }, rationale_md: 'open up', author_id: '42' });
+  assert.equal(amendment.remaining_seconds, null, 'no clock is null, not zero');
+
+  const gone = view.closed[0];
+  assert.equal(gone.subject, null, 'a deleted subject projects null — shown honestly, never dropped or invented');
+  assert.equal(gone.outcome, 'returned');
+  assert.equal(gone.votes[0].section_key, 'fit', 'the objection travels with the closed history');
+  // every id is a string — Postgres bigints and JS numbers must compare equal downstream
+  for (const item of [...view.open, ...view.closed]) {
+    assert.equal(typeof item.id, 'string');
+    assert.equal(typeof item.subject_id, 'string');
+    for (const v of item.votes) assert.equal(typeof v.voter_id, 'string');
+  }
+});
+
+test('an empty board is two empty lists — no error, no placeholder rows', async () => {
+  const view = await withDb({
+    listOpenBoardItems: async () => [],
+    listClosedBoardItems: async () => [],
+    getVotesForItems: async (ids) => { assert.deepEqual(ids, []); return []; },
+    getIdeaSubjects: async (ids) => { assert.deepEqual(ids, []); return []; },
+    getAmendmentSubjects: async (ids) => { assert.deepEqual(ids, []); return []; },
+  }, () => boardRoomView());
+  assert.deepEqual(view, { open: [], closed: [] });
+});
+
+test('the reads are indexed and clock math stays in SQL (source pins)', () => {
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const open = src.slice(src.indexOf('async function listOpenBoardItems'), src.indexOf('async function listClosedBoardItems'));
+  assert.match(open, /EXTRACT\(EPOCH FROM \(closes_at - now\(\)\)\)/, 'remaining time is the DATABASE clock');
+  assert.match(open, /GREATEST\(0,/, 'a just-expired item reads 0, never negative');
+  const closed = src.slice(src.indexOf('async function listClosedBoardItems'), src.indexOf('async function getVotesForItems'));
+  assert.match(closed, /ORDER BY closed_at DESC/, 'newest closes first');
+  const migration = fs.readFileSync(path.join(GOV, 'migrations', 'government_008_closed_items_index.sql'), 'utf8');
+  assert.ok(migration.includes('government_board_items_closed_by_time'), 'the closed-history read is indexed (the R13 grader lesson, applied up front)');
+});
+
+test('the room is gated on the vote atom, and the page shell widened WITH the tab seal (the R16 pair)', () => {
+  const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  assert.equal(rrc.MODULE_EXPECTED_RANKS.government['GET /government/board/items'],
+    `${rrc.PERM_PIN_PREFIX}board.vote.cast`, 'seeing the ballot is part of casting — never the manage atom');
+  // The page-gate widening and the client-side ranks seal land TOGETHER: the
+  // shell admitting metic+ without the admin tab sealing itself would render a
+  // broken tab; the seal without the widening would seal a page nobody new can
+  // reach. Both halves pinned here so neither can be reverted alone.
+  const serve = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8');
+  const idx = serve.indexOf('GOVERNMENT_PAGE_RE.test(norm)');
+  assert.ok(serve.slice(idx, idx + 200).includes('requireGovernmentPage'),
+    'the shell admits page.view.government (metic+), not the manage atom');
+  const client = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
+  assert.match(client, /sealRanksPanel/, 'the admin tab seals itself for non-archons');
+});

package/tests/government_seed.mjs

@@ -39,6 +39,8 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_003_board_tables.sql',               // ADR 0175 Board Room schema (task 1003016)
   'government_005_seeded_rank_descriptions.sql',   // ADR 0174 seeded-description text fix (task 1003083)
   'government_006_returned_items_index.sql',      // R13 returned-item lookup index (task 1003026)
+  'government_007_amendments.sql',                 // R14 amendment proposals table (task 1003027)
+  'government_008_closed_items_index.sql',         // R16 closed-history index (task 1003029)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.

package/tests/hall_page_gate_map.mjs

@@ -67,8 +67,12 @@ const ORACLE = {
   '/builders/people': 'requireProjectCuratePage',
   '/builders/scouting': 'requireProjectCuratePage',
 
-  // Archon.
-  '/builders/government': 'requireGovernmentManagePage',
+  // Metic+ since R16 (goal 1000069): the Government page is three rooms —
+  // Constitution · Board Room · Ranks & Permissions — and only the third is the
+  // archon admin surface, whose DATA routes all still gate on government.manage
+  // individually. The shell follows the widest legitimate audience; the board
+  // reads carry the vote atom, the manage tab seals itself for non-archons.
+  '/builders/government': 'requireGovernmentPage',
 
   // Deliberately UNGATED — the landing card, the rank ladder, the reward
   // schedule and a builder's public portfolio all render for a stranger.