@bongos/core 1.19.239 → 1.19.241

package/modules/platform-identity/routes/sso.js

@@ -358,8 +358,18 @@ module.exports = function ssoRoutes() {
   // that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by
   // client_id + client_secret (same constant-time check as /sso/token). Upserts the
   // account (so a CLI-only builder still appears in My Projects) + the membership
-  // with a COARSE role. The client_id is taken from the AUTHENTICATED client — the
-  // caller cannot report membership for a project it doesn't hold the secret for.
+  // with a COARSE membership_kind. The client_id is taken from the AUTHENTICATED
+  // client — the caller cannot report membership for a project it doesn't hold the
+  // secret for.
+  //
+  // THE FIELD IS `membership_kind`; `role` IS ACCEPTED FOR THE WINDOW (task 1003090,
+  // ADR 0177 §"the fifth use"). ADR 0174 reserves `role` for the three crafts, and
+  // the old value 'builder' was a craft name meaning "non-owner member" — so both
+  // the field and that value are renamed. Unlike the goal-membership rename, this is
+  // a CROSS-VERSION wire contract: the callers are other instances on their own
+  // upgrade schedule, so an un-upgraded instance still sends `role: 'builder'` and
+  // the hub must keep understanding it. `membership_kind` WINS when both arrive
+  // (a sender in the window sends both deliberately).
   //
   // rank: public — authenticated by client_id + client_secret, not a builder rank.
   router.post('/sso/membership/check-in', async (req, res) => {
@@ -370,9 +380,14 @@ module.exports = function ssoRoutes() {
       github_login: { required: true, type: 'string', maxLength: 200 },
       display_name: { type: 'string', maxLength: 400 },
       avatar_url: { type: 'string', maxLength: 2048 },
+      membership_kind: { type: 'string', maxLength: 16 },
+      // LEGACY, accepted for the cross-version window (task 1003090).
       role: { type: 'string', maxLength: 16 },
     })) return;
-    const { client_id, client_secret, github_id, github_login, display_name, avatar_url, role } = req.body || {};
+    const { client_id, client_secret, github_id, github_login, display_name, avatar_url, membership_kind, role } = req.body || {};
+    const membershipKind = membership_kind
+      || (role ? pi.membershipKindFromLegacy(role) : null)
+      || 'member';
     try {
       const client = await pi.getClient(client_id, { pool });
       if (!client || client.status !== 'active' || !pi.clientSecretValid(client, client_secret)) {
@@ -381,7 +396,7 @@ module.exports = function ssoRoutes() {
       // Upsert the account first so a CLI-only builder is known to the hub, then the
       // membership — keyed to the AUTHENTICATED client_id, never a caller-named one.
       await pi.upsertAccount({ githubId: github_id, githubLogin: github_login, displayName: display_name, avatarUrl: avatar_url }, { pool });
-      await pi.upsertMembership({ clientId: client_id, githubId: github_id, role: role || 'builder' }, { pool });
+      await pi.upsertMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
       res.json({ ok: true });
     } catch (err) {
       console.error('[platform-identity] /sso/membership/check-in', err);
@@ -424,7 +439,7 @@ module.exports = function ssoRoutes() {
         return res.fail('invalid_github_id', 400);
       }
       const membership = await pi.getMembership(b.client_id, b.github_id, { pool });
-      if (!membership || membership.role === 'pending') {
+      if (!membership || membership.membership_kind === 'pending') {
         return res.fail('membership_required', 409);
       }
       await pi.upsertActivity({

package/modules/platform-identity/tests/platform-identity.mjs

@@ -262,9 +262,9 @@ await ta('registerClient auto-catalogues the project (2nd query) when an origin
 
 console.log('\nproject memberships (§3 check-in directory):');
 
-await ta('upsertMembership upserts on (client_id, github_id) with a coarse role', async () => {
-  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', role: 'owner' }] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, role: 'owner' }, { pool });
+await ta('upsertMembership upserts on (client_id, github_id) with a coarse membership_kind', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'owner' }] }]);
+  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'owner' }, { pool });
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_project_memberships/);
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
@@ -272,10 +272,23 @@ await ta('upsertMembership upserts on (client_id, github_id) with a coarse role'
   assert.deepEqual(c.params, ['c1', 42, 'owner']);
 });
 
-await ta('upsertMembership clamps an unknown role to builder (never trusts a caller role blindly)', async () => {
+await ta('upsertMembership clamps an unknown kind to member (never trusts a caller blindly)', async () => {
   const pool = mockPool([{ rows: [{}] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, role: 'archon' }, { pool });
-  assert.equal(pool.calls[0].params[2], 'builder', 'a non-coarse role is clamped to builder');
+  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'archon' }, { pool });
+  assert.equal(pool.calls[0].params[2], 'member', 'a non-coarse membership_kind is clamped to member');
+});
+
+await ta('the legacy wire vocabulary maps both ways (the cross-version window, task 1003090)', async () => {
+  // Other instances upgrade on their own schedule, so 'builder' keeps arriving on
+  // the wire for a while; 'member' is what the hub stores. Nothing else changes.
+  assert.equal(P.membershipKindFromLegacy('builder'), 'member');
+  assert.equal(P.legacyRoleFromKind('member'), 'builder');
+  for (const same of ['owner', 'visitor', 'pending']) {
+    assert.equal(P.membershipKindFromLegacy(same), same);
+    assert.equal(P.legacyRoleFromKind(same), same);
+  }
+  assert.deepEqual(P.MEMBERSHIP_KINDS, ['owner', 'member', 'visitor', 'pending'],
+    'the craft name is gone from the coarse vocabulary');
 });
 
 await ta('removeMembership deletes the (client_id, github_id) row (self-service leave)', async () => {
@@ -287,20 +300,20 @@ await ta('removeMembership deletes the (client_id, github_id) row (self-service
 });
 
 await ta('listMembershipsForAccount joins projects + excludes pending', async () => {
-  const pool = mockPool([{ rows: [{ client_id: 'c1', role: 'builder', project_name: 'Proj' }] }]);
+  const pool = mockPool([{ rows: [{ client_id: 'c1', membership_kind: 'member', project_name: 'Proj' }] }]);
   const out = await P.listMembershipsForAccount(42, { pool });
   assert.equal(out.length, 1);
   const c = pool.calls[0];
   assert.match(c.text, /FROM platform_identity_project_memberships m/);
   assert.match(c.text, /LEFT JOIN platform_identity_sso_clients c/);
-  assert.match(c.text, /role <> 'pending'/);
+  assert.match(c.text, /membership_kind <> 'pending'/);
   assert.deepEqual(c.params, [42]);
 });
 
 console.log('\ninvitations (§5 — pre-seed pending membership):');
 
 await ta('inviteToProject pre-seeds a pending row, never clobbering an existing member', async () => {
-  const pool = mockPool([{ rows: [{ id: '1', role: 'pending' }] }]);
+  const pool = mockPool([{ rows: [{ id: '1', membership_kind: 'pending' }] }]);
   const out = await P.inviteToProject({ clientId: 'c1', githubId: 42 }, { pool });
   assert.equal(out.invited, true);
   const c = pool.calls[0];
@@ -320,15 +333,15 @@ await ta('resolveInvite accept flips ONLY a pending row to builder', async () =>
   const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: true }, { pool });
   assert.deepEqual(out, { resolved: true, accepted: true });
   const c = pool.calls[0];
-  assert.match(c.text, /UPDATE platform_identity_project_memberships SET role = 'builder'/);
-  assert.match(c.text, /AND role = 'pending'/, 'only touches pending — never a real member');
+  assert.match(c.text, /UPDATE platform_identity_project_memberships SET membership_kind = 'member'/);
+  assert.match(c.text, /AND membership_kind = 'pending'/, 'only touches pending — never a real member');
 });
 
 await ta('resolveInvite decline deletes ONLY a pending row', async () => {
   const pool = mockPool([{ rowCount: 1 }]);
   const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: false }, { pool });
   assert.deepEqual(out, { resolved: true, accepted: false });
-  assert.match(pool.calls[0].text, /DELETE FROM platform_identity_project_memberships[\s\S]*AND role = 'pending'/);
+  assert.match(pool.calls[0].text, /DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/);
 });
 
 await ta('getAccountByLogin resolves case-insensitively, newest first', async () => {
@@ -376,7 +389,7 @@ await ta('upsertActivity keeps a legitimate core rank key', async () => {
 });
 
 await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
-  const row = { id: '9', client_id: 'c1', github_id: '42', role: 'builder' };
+  const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.getMembership('c1', 42, { pool });
   assert.deepEqual(out, row);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.239",
+  "version": "1.19.241",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.239",
+      "version": "1.19.241",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.239",
+  "version": "1.19.241",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1741,7 +1741,7 @@ function vocabFilesToScan() {
   return out;
 }
 
-// ── Check 19b — the FOURTH "role": a goal membership is not a craft either ──
+// ── Check 19b — the FOURTH and FIFTH "role": a membership is not a craft either ─
 //
 // task 1003013 / ADR 0177. ADR 0174 reserved `role` for the three crafts and R07
 // (checkVocabularyWall above) enforces it on the GOVERNMENT surface — deliberately
@@ -1751,10 +1751,16 @@ function vocabFilesToScan() {
 // exactly why it survived the rename: the rule was silent on it, as designed.
 //
 // So this is a SECOND narrow wall rather than a widened first one — same reason the
-// first was scoped: the honest unit is a SURFACE, not the repo. The surface here is
-// the goal-membership one: the routes and pure gate that decide it, the hall page
-// that renders it, and (line-scoped) the membership SQL in the module's db.js. The
-// noun on it is `membership_kind`.
+// first was scoped: the honest unit is a SURFACE, not the repo. Two surfaces carry
+// a membership, and both now say `membership_kind`:
+//   • GOAL membership (`goal_members`, task 1003013) — the routes and pure gate that
+//     decide it, the hall page that renders it, and (line-scoped) the membership SQL
+//     in modules/lifecycle/db.js;
+//   • PROJECT membership on the hub (`platform_identity_project_memberships`, task
+//     1003090) — whose old VALUE 'builder' was itself a craft name. Its check-in
+//     route keeps reading a legacy `role` field for the cross-version federation
+//     window (other instances upgrade on their own schedule), so the lines that
+//     handle that legacy field cite the task and are exempt like any other citation.
 //
 // Naming the rule stays legal — a line that cites ADR 0174 / ADR 0177 / task
 // 1003013 is meta-commentary about the ban, the same principle as
@@ -1767,14 +1773,23 @@ const GOAL_VOCAB_SURFACE = [
   'modules/hall-ui/public/goals-page.js',
   'modules/hall-ui/public/goals.html',
   'modules/hall-ui/public/goals.css',
+  // The FIFTH use (task 1003090): the hub's coarse project membership.
+  'modules/platform-identity/platform-identity.js',
+  'modules/platform-identity/routes/my-projects.js',
+  'modules/hall-ui/public/my-projects.js',
 ];
 // modules/lifecycle/db.js is 5k+ lines and legitimately says "role" about ranks
 // (the rank-sync port, builders.system_role). Scanning it whole would need an
 // allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
 // the only thing that can regress here — a membership query reaching for the old
 // column — with no false positives to excuse.
-const GOAL_VOCAB_LINE_SCOPED = [{ file: 'modules/lifecycle/db.js', mustMention: /goal_members/ }];
-const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013/;
+const GOAL_VOCAB_LINE_SCOPED = [
+  { file: 'modules/lifecycle/db.js', mustMention: /goal_members/ },
+  // sso.js is the federation surface: only the lines that name the membership table
+  // or its upsert are in scope, so the file's other server-to-server prose stays out.
+  { file: 'modules/platform-identity/routes/sso.js', mustMention: /project_memberships|upsertMembership/ },
+];
+const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013|task 1003090/;
 
 function checkGoalMembershipVocabulary() {
   const violations = [];
@@ -1789,19 +1804,19 @@ function checkGoalMembershipVocabulary() {
       const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
       if (!/\brole/i.test(scanLine)) return;
       if (GOAL_VOCAB_CITATION.test(scanLine)) return;
-      violations.push(`${rel}:${i + 1}: "role" — a goal membership is 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
+      violations.push(`${rel}:${i + 1}: "role" — a membership is a 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
     });
   };
   for (const rel of GOAL_VOCAB_SURFACE) scanFile(rel);
   for (const { file, mustMention } of GOAL_VOCAB_LINE_SCOPED) scanFile(file, mustMention);
   return {
-    name: 'a goal membership is a "membership_kind", never a role (ADR 0177)',
+    name: 'a membership is a "membership_kind", never a role (ADR 0177)',
     ok: violations.length === 0,
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} goal-membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole + `
-        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming goal_members); no allowlist — `
+    note: `${scanned} membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole — goal + project membership — plus `
+        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming the membership tables); no allowlist — `
         + 'a line that CITES the rule is the only exemption.',
   };
 }

package/scripts/gds/run-unit-tests.js

@@ -74,7 +74,13 @@ const INTEGRATION = new Set([
   // .github/workflows/consumer-layout-boot.yml, not this DB-free gate (task 2142).
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
-  'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
+  // RENAMED by ADR 0174 (goal 1000068) — these entries said governance_* until task
+  // 1003091. A curated set keyed by a stem that no longer exists silently stops
+  // covering its file: both of these dropped OUT of the integration set and INTO the
+  // DB-free lane, where they only "passed" because they self-skip. The pairing guard
+  // is in tests/government_live_proof_shape.mjs — every curated entry must name a
+  // real test file.
+  'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records', 'setup_smoke',
   'status-probe',

package/src/bongos/auth.js

@@ -173,15 +173,27 @@ function idpConfigured() {
 }
 
 // The COARSE membership role to report to the hub (ADR 0141 §3) — owner if this
-// builder is the instance's configured firstAdmin, else builder. NEVER a rank.
-function membershipRole({ githubLogin } = {}) {
+// builder is the instance's configured firstAdmin, else a plain member. NEVER a rank.
+//
+// 'member', not 'builder' (task 1003090, ADR 0177 §"the fifth use"): ADR 0174 reserves
+// `role` — and the craft name 'Builder' — for Artist / Ideator / Builder, so the coarse
+// project membership says what it means. The legacy spelling still goes on the wire for
+// the cross-version window; see reportMembershipCheckIn.
+function membershipKind({ githubLogin } = {}) {
   const fa = firstAdminLogin();
   if (fa && String(githubLogin || '').toLowerCase() === fa.toLowerCase()) return 'owner';
-  return 'builder';
+  return 'member';
 }
 
 // Best-effort server-to-server membership check-in to the hub (ADR 0141 §3): "this
-// github_id builds on project <client_id>, coarse role <role>". Runs on every
+// github_id builds on project <client_id>, coarse membership <membership_kind>".
+//
+// BOTH SPELLINGS GO ON THE WIRE FOR THE WINDOW (task 1003090). The receiver is the
+// HUB, a different instance on its own upgrade schedule: send only the new field and
+// an un-upgraded hub silently defaults every membership to non-owner (it would drop
+// the owner flag); send only the legacy field and an upgraded hub keeps translating
+// forever. Sending both is what makes the two ends independent — the removal task
+// drops `role` once the hub is past the window. Runs on every
 // FEDERATED sign-in (the only sign-ins a federated instance has) so a CLI-only
 // project still appears in the builder's My Projects with no hub browser session.
 // Fire-and-forget + fully swallowed: a hub outage must NEVER fail a sign-in (mirrors
@@ -189,6 +201,7 @@ function membershipRole({ githubLogin } = {}) {
 async function reportMembershipCheckIn({ githubId, githubLogin, displayName, avatarUrl }) {
   const idp = loadIdpConfig();
   if (!idp) return;
+  const kind = membershipKind({ githubLogin });
   try {
     await fetch(`${idp.origin}/api/gds/sso/membership/check-in`, {
       method: 'POST',
@@ -200,7 +213,9 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
         github_login: githubLogin,
         display_name: displayName ?? null,
         avatar_url: avatarUrl ?? null,
-        role: membershipRole({ githubLogin }),
+        membership_kind: kind,
+        // LEGACY (cross-version window): 'member' → 'builder' for an un-upgraded hub.
+        role: kind === 'member' ? 'builder' : kind,
       }),
     });
   } catch (err) {
@@ -1816,7 +1831,7 @@ module.exports = {
   verifyHubLogoutToken,
   logoutTokenJtiSeenAndRecord,
   completeDeviceExchange,
-  membershipRole,
+  membershipKind,
   extractTokens,
   resolveSession,
   allowBoxScope,

package/src/module-api.js

@@ -905,8 +905,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.237 with no explicit bump. run 32172843539. (task 1002620)
 //   1.19.239 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.238 with no explicit bump. run 32174983930. (task 1002620)
+//   1.19.240 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.239 with no explicit bump. run 32182178305. (task 1002620)
+//   1.19.241 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.240 with no explicit bump. run 32184475745. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.239'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.241'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_live_proof.mjs

@@ -13,6 +13,11 @@
 // resolver behind the real `governance` kernel port, no stubs, no monkeypatches.
 // The captured sandbox transcript lives in docs/governance/bongos-v1-c6-live-proof.md.
 //
+// REPAIRED 2026-08-18 (task 1003091): between ADR 0174's rename and that task this
+// file was SILENTLY DEAD — see the readiness guard below for what happened and why
+// the guard's shape, not just its table name, was the bug. tests/
+// government_live_proof_shape.mjs now pins both from the DB-free lane.
+//
 // Real-DB integration test (the needs_rebase.mjs class): SELF-SKIPS (exit 0)
 // when DATABASE_URL is unset/unreachable or the governance tables are missing,
 // and is listed in run-unit-tests.js's INTEGRATION set so the DB-free lane
@@ -38,18 +43,65 @@ if (!process.env.DATABASE_URL) {
 
 const { Pool } = require('pg');
 const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+// ── THE READINESS GUARD, AND WHY ITS SHAPE MATTERS (task 1003091) ────────────
+//
+// This guard used to be one `SELECT 1 FROM governance_roles LIMIT 1` inside a
+// catch-all that skipped on ANY error. When ADR 0174's rename landed
+// (government_001), that table became `government_ranks` — so on a HEALTHY,
+// fully migrated database the probe raised 42P01 (undefined_table), the catch
+// read it as "no migrated Postgres", and the proof exited 0 having asserted
+// NOTHING. It stayed that way silently, because a fail-OPEN guard cannot fail
+// and this file lives in run-unit-tests' INTEGRATION set, where nobody reads the
+// skip line.
+//
+// So the two cases are now separated, and only one of them is a skip:
+//   • the server is unreachable (no DATABASE_URL, refused, no such DB) → SKIP.
+//     That is the "this lane has no Postgres" case the skip exists for.
+//   • the server IS reachable but an expected table is MISSING → FAIL, naming
+//     the tables. A schema this file cannot recognise is exactly the condition
+//     it must shout about: either the proof is stale (as it was) or the database
+//     is not what it claims to be.
+const REQUIRED_TABLES = [
+  'builders', 'builder_sessions', 'idea_inbox',
+  'government_ranks', 'government_builder_ranks', 'government_rank_permissions',
+];
 try {
-  await pool.query('SELECT 1 FROM governance_roles LIMIT 1');
+  await pool.query('SELECT 1');
 } catch (e) {
-  console.log(`government_live_proof.mjs SKIPPED — no migrated Postgres (${e.code || e.message}).`);
+  console.log(`government_live_proof.mjs SKIPPED — Postgres unreachable (${e.code || e.message}).`);
   await pool.end().catch(() => {});
   process.exit(0);
 }
+{
+  const { rows } = await pool.query(
+    `SELECT table_name FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_name = ANY($1::text[])`,
+    [REQUIRED_TABLES],
+  );
+  const present = new Set(rows.map((r) => r.table_name));
+  const missing = REQUIRED_TABLES.filter((t) => !present.has(t));
+  if (missing.length === REQUIRED_TABLES.length) {
+    // Nothing at all: an empty database, not a stale proof. Still a legitimate
+    // skip — this is the "reachable server, no instance schema" case.
+    console.log('government_live_proof.mjs SKIPPED — reachable Postgres with no instance schema (run scripts/migrate.sh).');
+    await pool.end().catch(() => {});
+    process.exit(0);
+  }
+  if (missing.length) {
+    await pool.end().catch(() => {});
+    throw new Error(
+      `government_live_proof.mjs CANNOT RUN: this database is migrated but is missing ${missing.join(', ')}. `
+      + 'Either the schema was renamed under this proof (the task-1003091 failure — fix the names HERE, do not widen the guard) '
+      + 'or the target is not a Cloud Bongos instance database.'
+    );
+  }
+}
 
 // ── fixtures (high-ID range; cleaned before AND after so reruns are safe) ────
 const ARCHON = 90000701;
 const THETES = 90000702;
-const ROLE_KEY = 'glp-demo-triager';
+const RANK_KEY = 'glp-demo-triager';
 const OPERATIONAL_KEY = 'idea.triage';      // system:false, floor metic — above thetes
 const SYSTEM_KEY = 'deploy.push_main';      // system:true — substrate-enforced
 const tok = () => 'glp' + crypto.randomBytes(24).toString('hex');
@@ -59,8 +111,8 @@ const THETES_TOKEN = tok();
 const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
 
 async function cleanup() {
-  await q(`DELETE FROM governance_roles WHERE role_key=$1`, [ROLE_KEY]); // grants+assignments cascade
-  await q(`DELETE FROM governance_builder_roles WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
+  await q(`DELETE FROM government_ranks WHERE rank_key=$1`, [RANK_KEY]); // grants+assignments cascade
+  await q(`DELETE FROM government_builder_ranks WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
   await q(`DELETE FROM builder_sessions WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
   await q(`DELETE FROM idea_inbox WHERE captured_by IN ($1,$2)`, [ARCHON, THETES]);
   // The audit middleware records the demo's own writes; those rows FK the
@@ -80,7 +132,7 @@ async function seed() {
   // builder mirrors its effect here (one seeded rank-role each, fail-closed
   // otherwise — the archon would resolve ZERO permissions and deny itself).
   await q(
-    `INSERT INTO governance_builder_roles (builder_id, role_key)
+    `INSERT INTO government_builder_ranks (builder_id, rank_key)
      VALUES ($1,'archon'), ($2,'thetes')`,
     [ARCHON, THETES]
   );
@@ -143,35 +195,35 @@ try {
 
   // Act 2 — an Archon creates a custom role and grants the operational permission.
   r = await call(ARCHON_TOKEN, 'POST', '/government/ranks',
-    { role_key: ROLE_KEY, label: 'GLP demo triage role' });
-  ok(r.status === 201, 'the Archon creates a custom role (201)');
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
+    { rank_key: RANK_KEY, label: 'GLP demo triage rank' });
+  ok(r.status === 201, 'the Archon creates a custom rank (201)');
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/${OPERATIONAL_KEY}`);
   ok(r.status === 200 && r.body.ok === true,
-    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom role (200)`);
+    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom rank (200)`);
 
   // Act 3 — the locked wall: a system permission is refused through the same API.
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/${SYSTEM_KEY}`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
-  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/government.manage`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/government/ranks/${RANK_KEY}/permissions/government.manage`);
   ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
     'the meta-escalation (government.manage) is refused the same way');
 
   // Act 4 — assign, then the same builder performs the action: no re-login, no
   // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
   r = await call(ARCHON_TOKEN, 'POST', '/government/assignments',
-    { builder_id: THETES, role_key: ROLE_KEY });
-  ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
+    { builder_id: THETES, rank_key: RANK_KEY });
+  ok(r.status === 201, 'the Archon assigns the custom rank to the thetes builder (201)');
   r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });
-  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom role works');
+  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom rank works');
 
   // Act 5 — the wall behind the wall: force the grant row no API path can create,
-  // so the role now "has" a system permission in the DB…
+  // so the rank now "has" a system permission in the DB…
   await q(
-    `INSERT INTO governance_role_permissions (role_key, permission_key) VALUES ($1,$2)`,
-    [ROLE_KEY, SYSTEM_KEY]
+    `INSERT INTO government_rank_permissions (rank_key, permission_key) VALUES ($1,$2)`,
+    [RANK_KEY, SYSTEM_KEY]
   );
-  console.log(`  (forced INTO the DB: grant ${ROLE_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
+  console.log(`  (forced INTO the DB: grant ${RANK_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
 
   // …the resolver reports it honestly (it is a defined catalog key; matrix V10
   // proves no route consumes it via requirePermission, so it admits nothing
@@ -193,7 +245,7 @@ try {
   ok(sub.hardFail === true && sub.findings.length === 2,
     'the substrate checker still BLOCKS the protected-path attempt (deploy/migration machinery), forced grant and all');
 
-  console.log(`\ngovernance_live_proof: ${pass} assertions passed`);
+  console.log(`\ngovernment_live_proof: ${pass} assertions passed`);
 } finally {
   await cleanup().catch((e) => console.error('cleanup failed', e.message));
   if (server) await new Promise((resolve) => server.close(resolve));

package/tests/government_live_proof_shape.mjs

@@ -0,0 +1,124 @@
+// tests/government_live_proof_shape.mjs — the DB-free guard on the C6 live proof
+// (task 1003091). ADR 0151's C6 proof (tests/government_live_proof.mjs) is a
+// REAL-DB integration test, so the DB-free lane never runs it — which is how it
+// came to be silently dead for days.
+//
+// WHAT HAPPENED: its readiness probe was `SELECT 1 FROM governance_roles LIMIT 1`
+// inside a catch-all that skipped on ANY error. ADR 0174's rename
+// (government_001) turned that table into `government_ranks`, so on a healthy,
+// fully migrated database the probe raised 42P01 and the catch reported "no
+// migrated Postgres". The proof exited 0 having asserted nothing, and no signal
+// anywhere said so — a fail-OPEN guard cannot fail.
+//
+// So this file pins the two properties that make that irrecoverable-by-silence
+// state impossible, from the lane that DOES run every PR:
+//   1. the proof names the CURRENT schema + routes, not the pre-rename ones;
+//   2. its guard SEPARATES "unreachable" (skip) from "reachable but missing an
+//      expected table" (throw) — and no OTHER integration test reintroduces the
+//      old shape by probing a specific table inside its skip guard.
+//
+// Run:  node --test tests/government_live_proof_shape.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PROOF_REL = 'tests/government_live_proof.mjs';
+const proof = fs.readFileSync(path.join(ROOT, PROOF_REL), 'utf8');
+
+// A line that CITES the incident has to be able to name the old spellings —
+// otherwise the file cannot explain its own history. Same principle as
+// fitness.js's VOCAB_HISTORICAL_REF.
+const CITATION = /task[- ]?1003091|used to be|pre-rename|ADR 0174/i;
+const PRE_RENAME = [
+  'governance_roles',
+  'governance_builder_roles',
+  'governance_role_permissions',
+  '/governance/roles',
+];
+
+test('the C6 proof names the CURRENT government schema and routes', () => {
+  const offenders = [];
+  proof.split('\n').forEach((line, i) => {
+    if (CITATION.test(line)) return;
+    for (const old of PRE_RENAME) {
+      if (line.includes(old)) offenders.push(`${PROOF_REL}:${i + 1}: ${old} → ${line.trim().slice(0, 80)}`);
+    }
+  });
+  assert.deepEqual(offenders, [],
+    'the proof still names pre-rename objects; ADR 0174 renamed them (government_001) and task 1003084 removed the /governance/* alias');
+  for (const t of ['government_ranks', 'government_builder_ranks', 'government_rank_permissions']) {
+    assert.ok(proof.includes(t), `the proof must exercise ${t}`);
+  }
+  assert.match(proof, /\/government\/ranks\/\$\{RANK_KEY\}\/permissions\//,
+    'the grant route is /government/ranks/:rankKey/permissions/:permissionKey');
+});
+
+test('the readiness guard skips on UNREACHABLE and THROWS on a migrated-but-missing schema', () => {
+  // Connectivity is probed with a table-free query: a `SELECT 1 FROM <table>`
+  // here is precisely the bug — it conflates "no database" with "schema I do not
+  // recognise", and the second one must never be silent.
+  const guard = proof.slice(proof.indexOf('const REQUIRED_TABLES'), proof.indexOf('// ── fixtures'));
+  assert.ok(guard.includes("pool.query('SELECT 1')"),
+    'connectivity must be probed WITHOUT naming a table');
+  assert.ok(!/pool\.query\('SELECT 1 FROM/.test(guard),
+    'no table-named readiness probe may return: that is the task-1003091 failure mode');
+  assert.match(guard, /information_schema\.tables/, 'the expected tables are checked explicitly');
+  assert.match(guard, /throw new Error\(/, 'a migrated database missing an expected table must THROW');
+  assert.match(guard, /CANNOT RUN/, 'and say so loudly enough to read in CI output');
+  // The skip branches stay, but only for the two honest cases.
+  const skips = guard.match(/SKIPPED/g) || [];
+  assert.equal(skips.length, 2,
+    'exactly two skip cases: unreachable server, and a reachable server with NO instance schema');
+});
+
+test('no other integration test probes a specific table inside its skip guard', () => {
+  // The sibling real-DB tests (needs_rebase, handle_machinery, …) already probe
+  // `SELECT 1`. This asserts the whole class, so the old shape cannot reappear
+  // in a NEW file and rot there unseen.
+  const offenders = [];
+  const SELF = path.basename(fileURLToPath(import.meta.url)); // the rule is not one of its own subjects
+  for (const name of fs.readdirSync(path.join(ROOT, 'tests')).filter((n) => n.endsWith('.mjs') && n !== SELF)) {
+    const src = fs.readFileSync(path.join(ROOT, 'tests', name), 'utf8');
+    if (!src.includes('SKIPPED')) continue;
+    src.split('\n').forEach((line, i) => {
+      if (CITATION.test(line)) return;
+      // A readiness probe is a LIVE query: `await pool.query('SELECT 1 FROM x')`.
+      // Assertions ABOUT sql strings (fakePool matchers, /SELECT 1 FROM …/ regexes)
+      // are not queries and are left alone.
+      if (/(await\s+)?pool\.query\(\s*['"`]SELECT 1 FROM /.test(line)) {
+        offenders.push(`tests/${name}:${i + 1}: ${line.trim().slice(0, 80)}`);
+      }
+    });
+  }
+  assert.deepEqual(offenders, [],
+    'a skip guard that probes a named table skips silently the day that table is renamed (task 1003091)');
+});
+
+test('every curated INTEGRATION / KNOWN_FAILING entry names a real test file', () => {
+  // The SAME rename miss, one layer out: run-unit-tests.js's curated sets are keyed
+  // by filename STEM, and the INTEGRATION set still said `governance_live_proof`
+  // after ADR 0174 renamed the file. A stem that matches nothing does not error —
+  // the entry just stops applying, so the file quietly moved into the DB-free lane
+  // (where it "passed" by self-skipping). Curated lists must point at real files.
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const setEntries = (name) => {
+    const start = runner.indexOf(`const ${name} = new Set([`);
+    assert.ok(start > -1, `${name} must exist in run-unit-tests.js`);
+    const block = runner.slice(start, runner.indexOf(']);', start));
+    return [...block.matchAll(/'([a-z0-9_.-]+)'/gi)].map((m) => m[1]).filter((k) => k !== name);
+  };
+  const stems = new Set(
+    fs.readdirSync(path.join(ROOT, 'tests')).filter((n) => n.endsWith('.mjs')).map((n) => n.replace(/\.mjs$/, ''))
+  );
+  const missing = [];
+  for (const setName of ['INTEGRATION', 'KNOWN_FAILING']) {
+    for (const stem of setEntries(setName)) {
+      if (!stems.has(stem)) missing.push(`${setName}: '${stem}' matches no tests/*.mjs`);
+    }
+  }
+  assert.deepEqual(missing, [],
+    'a curated entry whose file was renamed silently stops applying (task 1003091)');
+});