@bongos/core 1.19.239 → 1.19.240

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.239",
-  "core_contract": "1.19.239",
-  "source_commit": "92f85bc3527c85038cc818e47b4d503a340c8abb",
+  "core_version": "1.19.240",
+  "core_contract": "1.19.240",
+  "source_commit": "fd0201e6b50f0e354cea9a97c215730c16357ee3",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T19:09:51.272Z",
+  "built_at": "2026-08-18T20:26:47.249Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 312,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1324,
+    "functional_verbatim": 1325,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1657,
-  "tree_sha256": "ba99d83f49d20d229d51e1ca9cbb5232f744888d91ab1dbf43d5c092eade4cf9",
+  "file_count": 1658,
+  "tree_sha256": "a6ef1676edb20a115c4942ab09c2689af96309917e65340533f47d7cd18c6e7c",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4342,12 +4342,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "16010eb616ec78eb915efe81ecf81ad7b20339180ec495e40eb50b71bbac8b93"
+      "sha256": "5016dfd9f9b3ee1b5141dc1d0a24a478637b449e39b8e82fa42dc8f5084356f5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8cf3937acd1926b71f0e9ee112fce2b1d23adfd5b58cb2a2e36926f90b2e714f"
+      "sha256": "9e996de99c2422683685f66dc08b2b8a8663d4e5da4e71f00059c332acfa9b37"
     },
     {
       "path": "public-docs/index.html",
@@ -5332,7 +5332,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "21bcaeaa9d8b2048b9c3f9ff9b251a9203a9259c991a536636c0ec3c8745bbd5"
+      "sha256": "192350d9d65934a1af724d0f285cc74a89a842e75d0fdec37037d34ded5db546"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5962,7 +5962,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3995623cfa7376dbf8cbcf14b238c1fa1c919ad9d8da5af781b0f78dcb0bb8cc"
+      "sha256": "4c133ea04355ccf4ac6b4f1530d612421ca5e5a99393a4ee102cee4949377611"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6967,7 +6967,12 @@
     {
       "path": "tests/government_live_proof.mjs",
       "mode": "0000644",
-      "sha256": "af6423ac87819ff344c8a7804c0eda903a3e8c7633d1e4182e7d4f446d30cec0"
+      "sha256": "6d829af6ef71bfa744a4ff457a4766b5cce021f317661579b06ecfc14298a523"
+    },
+    {
+      "path": "tests/government_live_proof_shape.mjs",
+      "mode": "0000644",
+      "sha256": "75160048aba7b8c2264478c29aa2fc19636c67f66cd63842a83851574b722469"
     },
     {
       "path": "tests/government_ownership_scope.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.239",
+  "version": "1.19.240",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.239",
+      "version": "1.19.240",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.239",
+  "version": "1.19.240",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -74,7 +74,13 @@ const INTEGRATION = new Set([
   // .github/workflows/consumer-layout-boot.yml, not this DB-free gate (task 2142).
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
-  'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
+  // RENAMED by ADR 0174 (goal 1000068) — these entries said governance_* until task
+  // 1003091. A curated set keyed by a stem that no longer exists silently stops
+  // covering its file: both of these dropped OUT of the integration set and INTO the
+  // DB-free lane, where they only "passed" because they self-skip. The pairing guard
+  // is in tests/government_live_proof_shape.mjs — every curated entry must name a
+  // real test file.
+  'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records', 'setup_smoke',
   'status-probe',

package/src/module-api.js

@@ -905,8 +905,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.237 with no explicit bump. run 32172843539. (task 1002620)
 //   1.19.239 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.238 with no explicit bump. run 32174983930. (task 1002620)
+//   1.19.240 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.239 with no explicit bump. run 32182178305. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.239'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.240'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_live_proof.mjs

@@ -13,6 +13,11 @@
 // resolver behind the real `governance` kernel port, no stubs, no monkeypatches.
 // The captured sandbox transcript lives in docs/governance/bongos-v1-c6-live-proof.md.
 //
+// REPAIRED 2026-08-18 (task 1003091): between ADR 0174's rename and that task this
+// file was SILENTLY DEAD — see the readiness guard below for what happened and why
+// the guard's shape, not just its table name, was the bug. tests/
+// government_live_proof_shape.mjs now pins both from the DB-free lane.
+//
 // Real-DB integration test (the needs_rebase.mjs class): SELF-SKIPS (exit 0)
 // when DATABASE_URL is unset/unreachable or the governance tables are missing,
 // and is listed in run-unit-tests.js's INTEGRATION set so the DB-free lane
@@ -38,18 +43,65 @@ if (!process.env.DATABASE_URL) {
 
 const { Pool } = require('pg');
 const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+// ── THE READINESS GUARD, AND WHY ITS SHAPE MATTERS (task 1003091) ────────────
+//
+// This guard used to be one `SELECT 1 FROM governance_roles LIMIT 1` inside a
+// catch-all that skipped on ANY error. When ADR 0174's rename landed
+// (government_001), that table became `government_ranks` — so on a HEALTHY,
+// fully migrated database the probe raised 42P01 (undefined_table), the catch
+// read it as "no migrated Postgres", and the proof exited 0 having asserted
+// NOTHING. It stayed that way silently, because a fail-OPEN guard cannot fail
+// and this file lives in run-unit-tests' INTEGRATION set, where nobody reads the
+// skip line.
+//
+// So the two cases are now separated, and only one of them is a skip:
+//   • the server is unreachable (no DATABASE_URL, refused, no such DB) → SKIP.
+//     That is the "this lane has no Postgres" case the skip exists for.
+//   • the server IS reachable but an expected table is MISSING → FAIL, naming
+//     the tables. A schema this file cannot recognise is exactly the condition
+//     it must shout about: either the proof is stale (as it was) or the database
+//     is not what it claims to be.
+const REQUIRED_TABLES = [
+  'builders', 'builder_sessions', 'idea_inbox',
+  'government_ranks', 'government_builder_ranks', 'government_rank_permissions',
+];
 try {
-  await pool.query('SELECT 1 FROM governance_roles LIMIT 1');
+  await pool.query('SELECT 1');
 } catch (e) {
-  console.log(`government_live_proof.mjs SKIPPED — no migrated Postgres (${e.code || e.message}).`);
+  console.log(`government_live_proof.mjs SKIPPED — Postgres unreachable (${e.code || e.message}).`);
   await pool.end().catch(() => {});
   process.exit(0);
 }
+{
+  const { rows } = await pool.query(
+    `SELECT table_name FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_name = ANY($1::text[])`,
+    [REQUIRED_TABLES],
+  );
+  const present = new Set(rows.map((r) => r.table_name));
+  const missing = REQUIRED_TABLES.filter((t) => !present.has(t));
+  if (missing.length === REQUIRED_TABLES.length) {
+    // Nothing at all: an empty database, not a stale proof. Still a legitimate
+    // skip — this is the "reachable server, no instance schema" case.
+    console.log('government_live_proof.mjs SKIPPED — reachable Postgres with no instance schema (run scripts/migrate.sh).');
+    await pool.end().catch(() => {});
+    process.exit(0);
+  }
+  if (missing.length) {
+    await pool.end().catch(() => {});
+    throw new Error(
+      `government_live_proof.mjs CANNOT RUN: this database is migrated but is missing ${missing.join(', ')}. `
+      + 'Either the schema was renamed under this proof (the task-1003091 failure — fix the names HERE, do not widen the guard) '
+      + 'or the target is not a Cloud Bongos instance database.'
+    );
+  }
+}
 
 // ── fixtures (high-ID range; cleaned before AND after so reruns are safe) ────
 const ARCHON = 90000701;
 const THETES = 90000702;
-const ROLE_KEY = 'glp-demo-triager';
+const RANK_KEY = 'glp-demo-triager';
 const OPERATIONAL_KEY = 'idea.triage';      // system:false, floor metic — above thetes
 const SYSTEM_KEY = 'deploy.push_main';      // system:true — substrate-enforced
 const tok = () => 'glp' + crypto.randomBytes(24).toString('hex');
@@ -59,8 +111,8 @@ const THETES_TOKEN = tok();
 const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
 
 async function cleanup() {
-  await q(`DELETE FROM governance_roles WHERE role_key=$1`, [ROLE_KEY]); // grants+assignments cascade
-  await q(`DELETE FROM governance_builder_roles WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
+  await q(`DELETE FROM government_ranks WHERE rank_key=$1`, [RANK_KEY]); // grants+assignments cascade
+  await q(`DELETE FROM government_builder_ranks WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
   await q(`DELETE FROM builder_sessions WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
   await q(`DELETE FROM idea_inbox WHERE captured_by IN ($1,$2)`, [ARCHON, THETES]);
   // The audit middleware records the demo's own writes; those rows FK the
@@ -80,7 +132,7 @@ async function seed() {
   // builder mirrors its effect here (one seeded rank-role each, fail-closed
   // otherwise — the archon would resolve ZERO permissions and deny itself).
   await q(
-    `INSERT INTO governance_builder_roles (builder_id, role_key)
+    `INSERT INTO government_builder_ranks (builder_id, rank_key)
      VALUES ($1,'archon'), ($2,'thetes')`,
     [ARCHON, THETES]
   );
@@ -143,35 +195,35 @@ try {
 
   // Act 2 — an Archon creates a custom role and grants the operational permission.
   r = await call(ARCHON_TOKEN, 'POST', '/government/ranks',
-    { role_key: ROLE_KEY, label: 'GLP demo triage role' });
-  ok(r.status === 201, 'the Archon creates a custom role (201)');
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
+    { rank_key: RANK_KEY, label: 'GLP demo triage rank' });
+  ok(r.status === 201, 'the Archon creates a custom rank (201)');
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/${OPERATIONAL_KEY}`);
   ok(r.status === 200 && r.body.ok === true,
-    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom role (200)`);
+    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom rank (200)`);
 
   // Act 3 — the locked wall: a system permission is refused through the same API.
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/${SYSTEM_KEY}`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/government.manage`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/government.manage`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     'the meta-escalation (government.manage) is refused the same way');
 
   // Act 4 — assign, then the same builder performs the action: no re-login, no
   // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
   r = await call(ARCHON_TOKEN, 'POST', '/government/assignments',
-    { builder_id: THETES, role_key: ROLE_KEY });
-  ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
+    { builder_id: THETES, rank_key: RANK_KEY });
+  ok(r.status === 201, 'the Archon assigns the custom rank to the thetes builder (201)');
   r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });
-  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom role works');
+  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom rank works');
 
   // Act 5 — the wall behind the wall: force the grant row no API path can create,
-  // so the role now "has" a system permission in the DB…
+  // so the rank now "has" a system permission in the DB…
   await q(
-    `INSERT INTO governance_role_permissions (role_key, permission_key) VALUES ($1,$2)`,
-    [ROLE_KEY, SYSTEM_KEY]
+    `INSERT INTO government_rank_permissions (rank_key, permission_key) VALUES ($1,$2)`,
+    [RANK_KEY, SYSTEM_KEY]
   );
-  console.log(`  (forced INTO the DB: grant ${ROLE_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
+  console.log(`  (forced INTO the DB: grant ${RANK_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
 
   // …the resolver reports it honestly (it is a defined catalog key; matrix V10
   // proves no route consumes it via requirePermission, so it admits nothing
@@ -193,7 +245,7 @@ try {
   ok(sub.hardFail === true && sub.findings.length === 2,
     'the substrate checker still BLOCKS the protected-path attempt (deploy/migration machinery), forced grant and all');
 
-  console.log(`\ngovernance_live_proof: ${pass} assertions passed`);
+  console.log(`\ngovernment_live_proof: ${pass} assertions passed`);
 } finally {
   await cleanup().catch((e) => console.error('cleanup failed', e.message));
   if (server) await new Promise((resolve) => server.close(resolve));

package/tests/government_live_proof_shape.mjs

@@ -0,0 +1,124 @@
+// tests/government_live_proof_shape.mjs — the DB-free guard on the C6 live proof
+// (task 1003091). ADR 0151's C6 proof (tests/government_live_proof.mjs) is a
+// REAL-DB integration test, so the DB-free lane never runs it — which is how it
+// came to be silently dead for days.
+//
+// WHAT HAPPENED: its readiness probe was `SELECT 1 FROM governance_roles LIMIT 1`
+// inside a catch-all that skipped on ANY error. ADR 0174's rename
+// (government_001) turned that table into `government_ranks`, so on a healthy,
+// fully migrated database the probe raised 42P01 and the catch reported "no
+// migrated Postgres". The proof exited 0 having asserted nothing, and no signal
+// anywhere said so — a fail-OPEN guard cannot fail.
+//
+// So this file pins the two properties that make that irrecoverable-by-silence
+// state impossible, from the lane that DOES run every PR:
+//   1. the proof names the CURRENT schema + routes, not the pre-rename ones;
+//   2. its guard SEPARATES "unreachable" (skip) from "reachable but missing an
+//      expected table" (throw) — and no OTHER integration test reintroduces the
+//      old shape by probing a specific table inside its skip guard.
+//
+// Run:  node --test tests/government_live_proof_shape.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PROOF_REL = 'tests/government_live_proof.mjs';
+const proof = fs.readFileSync(path.join(ROOT, PROOF_REL), 'utf8');
+
+// A line that CITES the incident has to be able to name the old spellings —
+// otherwise the file cannot explain its own history. Same principle as
+// fitness.js's VOCAB_HISTORICAL_REF.
+const CITATION = /task[- ]?1003091|used to be|pre-rename|ADR 0174/i;
+const PRE_RENAME = [
+  'governance_roles',
+  'governance_builder_roles',
+  'governance_role_permissions',
+  '/governance/roles',
+];
+
+test('the C6 proof names the CURRENT government schema and routes', () => {
+  const offenders = [];
+  proof.split('\n').forEach((line, i) => {
+    if (CITATION.test(line)) return;
+    for (const old of PRE_RENAME) {
+      if (line.includes(old)) offenders.push(`${PROOF_REL}:${i + 1}: ${old} → ${line.trim().slice(0, 80)}`);
+    }
+  });
+  assert.deepEqual(offenders, [],
+    'the proof still names pre-rename objects; ADR 0174 renamed them (government_001) and task 1003084 removed the /governance/* alias');
+  for (const t of ['government_ranks', 'government_builder_ranks', 'government_rank_permissions']) {
+    assert.ok(proof.includes(t), `the proof must exercise ${t}`);
+  }
+  assert.match(proof, /\/government\/ranks\/\$\{RANK_KEY\}\/permissions\//,
+    'the grant route is /government/ranks/:rankKey/permissions/:permissionKey');
+});
+
+test('the readiness guard skips on UNREACHABLE and THROWS on a migrated-but-missing schema', () => {
+  // Connectivity is probed with a table-free query: a `SELECT 1 FROM <table>`
+  // here is precisely the bug — it conflates "no database" with "schema I do not
+  // recognise", and the second one must never be silent.
+  const guard = proof.slice(proof.indexOf('const REQUIRED_TABLES'), proof.indexOf('// ── fixtures'));
+  assert.ok(guard.includes("pool.query('SELECT 1')"),
+    'connectivity must be probed WITHOUT naming a table');
+  assert.ok(!/pool\.query\('SELECT 1 FROM/.test(guard),
+    'no table-named readiness probe may return: that is the task-1003091 failure mode');
+  assert.match(guard, /information_schema\.tables/, 'the expected tables are checked explicitly');
+  assert.match(guard, /throw new Error\(/, 'a migrated database missing an expected table must THROW');
+  assert.match(guard, /CANNOT RUN/, 'and say so loudly enough to read in CI output');
+  // The skip branches stay, but only for the two honest cases.
+  const skips = guard.match(/SKIPPED/g) || [];
+  assert.equal(skips.length, 2,
+    'exactly two skip cases: unreachable server, and a reachable server with NO instance schema');
+});
+
+test('no other integration test probes a specific table inside its skip guard', () => {
+  // The sibling real-DB tests (needs_rebase, handle_machinery, …) already probe
+  // `SELECT 1`. This asserts the whole class, so the old shape cannot reappear
+  // in a NEW file and rot there unseen.
+  const offenders = [];
+  const SELF = path.basename(fileURLToPath(import.meta.url)); // the rule is not one of its own subjects
+  for (const name of fs.readdirSync(path.join(ROOT, 'tests')).filter((n) => n.endsWith('.mjs') && n !== SELF)) {
+    const src = fs.readFileSync(path.join(ROOT, 'tests', name), 'utf8');
+    if (!src.includes('SKIPPED')) continue;
+    src.split('\n').forEach((line, i) => {
+      if (CITATION.test(line)) return;
+      // A readiness probe is a LIVE query: `await pool.query('SELECT 1 FROM x')`.
+      // Assertions ABOUT sql strings (fakePool matchers, /SELECT 1 FROM …/ regexes)
+      // are not queries and are left alone.
+      if (/(await\s+)?pool\.query\(\s*['"`]SELECT 1 FROM /.test(line)) {
+        offenders.push(`tests/${name}:${i + 1}: ${line.trim().slice(0, 80)}`);
+      }
+    });
+  }
+  assert.deepEqual(offenders, [],
+    'a skip guard that probes a named table skips silently the day that table is renamed (task 1003091)');
+});
+
+test('every curated INTEGRATION / KNOWN_FAILING entry names a real test file', () => {
+  // The SAME rename miss, one layer out: run-unit-tests.js's curated sets are keyed
+  // by filename STEM, and the INTEGRATION set still said `governance_live_proof`
+  // after ADR 0174 renamed the file. A stem that matches nothing does not error —
+  // the entry just stops applying, so the file quietly moved into the DB-free lane
+  // (where it "passed" by self-skipping). Curated lists must point at real files.
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const setEntries = (name) => {
+    const start = runner.indexOf(`const ${name} = new Set([`);
+    assert.ok(start > -1, `${name} must exist in run-unit-tests.js`);
+    const block = runner.slice(start, runner.indexOf(']);', start));
+    return [...block.matchAll(/'([a-z0-9_.-]+)'/gi)].map((m) => m[1]).filter((k) => k !== name);
+  };
+  const stems = new Set(
+    fs.readdirSync(path.join(ROOT, 'tests')).filter((n) => n.endsWith('.mjs')).map((n) => n.replace(/\.mjs$/, ''))
+  );
+  const missing = [];
+  for (const setName of ['INTEGRATION', 'KNOWN_FAILING']) {
+    for (const stem of setEntries(setName)) {
+      if (!stems.has(stem)) missing.push(`${setName}: '${stem}' matches no tests/*.mjs`);
+    }
+  }
+  assert.deepEqual(missing, [],
+    'a curated entry whose file was renamed silently stops applying (task 1003091)');
+});