@bongos/core 1.19.311 → 1.19.312

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.311",
-  "core_contract": "1.19.311",
-  "source_commit": "e1c43e441e7fc621f31480ab2306aa29cf6fabfa",
+  "core_version": "1.19.312",
+  "core_contract": "1.19.312",
+  "source_commit": "1115918f0f231eb592993c52535bccf7459ba201",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T20:49:01.750Z",
+  "built_at": "2026-08-23T20:51:36.647Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1766,
-  "tree_sha256": "52b0f6698975b1156c233e14471c23249226712403aaad8498402f78a7a3c5d4",
+  "tree_sha256": "8fa5a70e1592609c53386120743ab236e02cd64aaf8c3911891bd79d6a8da6ea",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3057,7 +3057,7 @@
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "6d85422869793382fc372a43b6a2b745bcb0e8a62c4fec06b780e812ae5066b9"
+      "sha256": "e48b8e01738969ca589496ee0bea94b5a31995e853a1347f63ca83895d4d28fd"
     },
     {
       "path": "modules/government/membership-predicate.js",
@@ -4582,12 +4582,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ac29f684d093a69db95b7e41ff40c70dccf70ea5a9bce2e78bf2a5b02ec302e7"
+      "sha256": "57b834edcb83e8b41bb7535bbacc1740537b0f3551726295884ea35615a88686"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "118f6dad272f412617ba4f4693317498f42580f7bb84cdca272705b3a696fe22"
+      "sha256": "7e8d9420573b8eabbe2ad7f96f0317d4b454fcf5788b68bfc6afdf6fb45b3cb4"
     },
     {
       "path": "public-docs/index.html",
@@ -6257,7 +6257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c936d7dda32ef492b30f7b1230157e27d088606066056188794b0fd1b42f34f7"
+      "sha256": "a35a7a2ca59f77d06b12aaaec28b4d82bbe5a4713289c072d4e9cc45d0d467e5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7387,7 +7387,7 @@
     {
       "path": "tests/government_rank_sync.mjs",
       "mode": "0000644",
-      "sha256": "83462482dff692a3587edecd0e57e0d7638fa08076329a7591c0cb2222d50e47"
+      "sha256": "8e430f7286ec798eceaba7db962bb3725c1de2e9cbaeee70739aae6287695d7e"
     },
     {
       "path": "tests/government_require_permission.mjs",

package/modules/government/db.js

@@ -94,9 +94,9 @@ async function syncRank(client, { builderId, rank } = {}) {
     return { target: null, added: [], removed: [] };
   }
   const q = client || pool;
-  const seededRoles = await getSeededRanks(q);
-  const currentRoles = await getRankAssignmentsForBuilder(q, builderId);
-  const plan = planRankSync({ rank, currentRoles, seededRoles });
+  const seededRanks = await getSeededRanks(q);
+  const currentRanks = await getRankAssignmentsForBuilder(q, builderId);
+  const plan = planRankSync({ rank, currentRanks, seededRanks });
 
   if (plan.remove.length > 0) {
     await q.query(

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.311",
+  "version": "1.19.312",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.311",
+      "version": "1.19.312",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.311",
+  "version": "1.19.312",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1049,8 +1049,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.309 with no explicit bump. run 32665109518. (task 1002620)
 //   1.19.311 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.310 with no explicit bump. run 32665535518. (task 1002620)
+//   1.19.312 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.311 with no explicit bump. run 32665664699. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.311'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.312'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_rank_sync.mjs

@@ -229,3 +229,93 @@ test('every governance migration keeps its objects namespaced and additive', ()
     assert.ok(m[1].startsWith('governance_'), `object ${m[1]} is not governance_-namespaced`);
   }
 });
+
+// ---------------------------------------------------------------------------
+// the writer, EXECUTED (task 1003213)
+// ---------------------------------------------------------------------------
+//
+// Everything above this line proves the DECISION (planRankSync, called directly
+// with the right argument names) and the SQL TEXT (regex over db.js source). That
+// pair has a hole exactly the width of the call site: nothing asserted that
+// db.syncRank passes planRankSync the parameters it actually destructures.
+//
+// It did not, for a week. The ADR 0174 governance→government rename landed the
+// call site as `planRankSync({ rank, currentRoles, seededRoles })` (14dcedd) and
+// then renamed the planner's parameters to `currentRanks`/`seededRanks` (f7cdcce).
+// The planner therefore read an EMPTY seed list, returned target:null / add:[],
+// and syncRank silently wrote NOTHING — no throw, so safeSyncRankRole logged
+// nothing either. Every builder whose first sign-in came after their instance's
+// run-once governance_002 backfill held ZERO permissions (getPermissionKeysForBuilder
+// resolves only through government_builder_ranks), including a freshly seated
+// Archon owner locked out of their own hall.
+//
+// So these RUN the writer against a recording client. A rename that desynchronises
+// the call site from the planner fails here, where source-text assertions cannot see it.
+
+const govDb = require(path.join(GOV, 'db.js'));
+
+// A stand-in for the caller's transaction client that records every statement and
+// answers the writer's two reads. Order matters: the assignments read also names
+// `government_ranks` (it joins it), so match the more specific table first.
+function recordingClient({ seeded = SEEDED, held = [] } = {}) {
+  const calls = [];
+  return {
+    calls,
+    find: (re) => calls.find((c) => re.test(c.sql)),
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (/INSERT INTO|DELETE FROM/.test(sql)) return { rows: [] };
+      if (/FROM government_builder_ranks br/.test(sql)) return { rows: held };
+      if (/FROM government_ranks/.test(sql)) return { rows: seeded };
+      return { rows: [] };
+    },
+  };
+}
+
+test('the writer EXECUTES its plan: a rank-less builder really gets the INSERT', async () => {
+  const c = recordingClient({ held: [] });
+  const res = await govDb.syncRank(c, { builderId: 42, rank: 'archon' });
+
+  // The verdict must survive the call site — target:null here is the regression.
+  assert.equal(res.target, 'archon',
+    'syncRank must pass planRankSync the parameter names it destructures (currentRanks/seededRanks)');
+  assert.deepEqual([...res.added], ['archon']);
+
+  const insert = c.find(/INSERT INTO government_builder_ranks/);
+  assert.ok(insert, 'the assignment INSERT must actually be issued, not merely present in the source');
+  assert.deepEqual(insert.params, [42, ['archon']],
+    'the INSERT must name the builder and the seeded rank the plan chose');
+});
+
+test('the writer EXECUTES its plan: a demotion really issues the DELETE', async () => {
+  // The trust-boundary half: a demoted Archon must lose `archon` on the next request.
+  const c = recordingClient({ held: [seededRank_('archon')] });
+  const res = await govDb.syncRank(c, { builderId: 7, rank: 'thetes' });
+
+  assert.equal(res.target, 'thetes');
+  assert.deepEqual([...res.removed], ['archon']);
+
+  const del = c.find(/DELETE FROM government_builder_ranks/);
+  assert.ok(del, 'the superseded assignment DELETE must actually be issued');
+  assert.deepEqual(del.params, [7, ['archon']]);
+});
+
+test('the writer EXECUTES its plan: an unchanged rank writes nothing (idempotence)', async () => {
+  const c = recordingClient({ held: [seededRank_('metic')] });
+  const res = await govDb.syncRank(c, { builderId: 9, rank: 'metic' });
+
+  assert.deepEqual([...res.added], []);
+  assert.deepEqual([...res.removed], []);
+  assert.ok(!c.find(/INSERT INTO|DELETE FROM/),
+    'a builder already holding the right rank must cost reads only — no write');
+});
+
+test('the writer EXECUTES its plan: a custom rank survives a rank change', async () => {
+  const c = recordingClient({ held: [seededRank_('archon'), customRank('release-manager')] });
+  const res = await govDb.syncRank(c, { builderId: 11, rank: 'metic' });
+
+  assert.deepEqual([...res.removed], ['archon'],
+    'only seeded ranks rotate — an Archon-assigned custom rank must never be revoked');
+  const del = c.find(/DELETE FROM government_builder_ranks/);
+  assert.deepEqual(del.params, [11, ['archon']]);
+});