@bongos/core 1.19.631 → 1.19.633

package/docs/module-api-changelog.md

@@ -1711,5 +1711,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.629 with no explicit bump. run 34415169250. (task 1002620)
   1.19.631 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.630 with no explicit bump. run 34415537907. (task 1002620)
+  1.19.632 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.631 with no explicit bump. run 34417373737. (task 1002620)
+  1.19.633 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.632 with no explicit bump. run 34417769106. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/hall-render.js

@@ -211,6 +211,11 @@
       // not a local: renderNav takes (builder, onboarding) and is called from
       // five sites, so there is no `me` in scope here.
       social: (ctx.lastMeState && ctx.lastMeState.social) || null,
+      // task 1003744: the resolved permission map, for the `perm:` nav gates. Read
+      // off ctx.lastMeState for the same reason `social` is, and passed here for
+      // the same reason: without it the index — the hall's busiest page — is the
+      // one page a permission-gated nav item would never appear on.
+      permissions: (ctx.lastMeState && ctx.lastMeState.permissions) || null,
       builder,
     });
 

package/modules/hall-ui/public/shell.js

@@ -120,6 +120,14 @@
   //   `government` MODULE key, and the two are unrelated (ADR 0174).
   //               Mirrors the server's `page.view.government` floor, which that ADR
   //               lowered archon→metic. Cosmetic only — requireGovernmentPage is the wall.
+  //   perm:<atom> — the viewer HOLDS that permission, per the resolved map `/me`
+  //               returns in `permissions` (task 1003744). The one gate key that is
+  //               not a rank: an item whose page is gated on an ATOM declares the
+  //               SAME atom here instead of borrowing the nearest rank floor, so the
+  //               two cannot drift. The atom must be listed in NAV_PERMISSION_ATOMS
+  //               (src/bongos/routes/me.js) or `/me` never resolves it and the item
+  //               stays hidden — deliberately, since an unresolvable gate is a gate
+  //               that cannot be vouched for.
   // `view` marks an index view (hash-routed); `module` gates on window.__MODULES__.
   // task 2175: grouped by AUDIENCE of the data, so the sidebar reads in coherent
   // runs instead of one long list — the project (unlabeled), You, Community,
@@ -140,6 +148,27 @@
       // active-nav detection (#nav-work), the 'work' gate case, and the server
       // page-gate all keep working — only the visible label and order change.
       { id: 'work', label: 'Tasks', icon: 'work', href: '/work', gate: 'signed' },
+      // task 1003744 (goal 1000111): the Board Room lives HERE, in the project's
+      // own group, and gates on the atom its page gates on.
+      //
+      // WHY IT LEFT GOVERNMENT. ADR 0266 carved the room out of /government, so
+      // the item first landed in the Government group and read that group's metic
+      // floor — the closest rank the shell could then express. Its real wall is
+      // `board.vote.cast` (auth.js requireBoardVotePage), which floors at XENOS on
+      // purpose so that WIDENING the board works (modules/government/board.js). The
+      // moment an instance seats a sub-Metic member — the config change ADR 0175 §6
+      // exists to make — that member could reach the room by URL and by the
+      // board_votes need's deep link, with no sidebar entry.
+      //
+      // Fixing the gate alone would have put a wider item under a metic group head,
+      // so a newcomer board member would see a group labelled "Government" holding
+      // one link — more authority than they hold. The owner's call (2026-09-09) was
+      // to move it instead: a sitting is work the project does, beside Goals and
+      // Tasks, not a monitoring surface. The Government group's audience and floor
+      // are unchanged.
+      //
+      // Cosmetic only, as every gate here is — the page gate is the wall (ADR 0016).
+      { id: 'board-room', label: 'Board Room', icon: 'admin', href: '/board-room', gate: 'perm:board.vote.cast' },
       // task 1003113 (R02 of goal 1000074): the artist's queue over the words the
       // product shows people. gate 'signed' and NOT a craft gate — filing a flag
       // is open to every role on purpose (the engineer who wrote the toast and
@@ -246,22 +275,11 @@
     // Archon-only, so a group header reading "Archon" over items a Metic can open
     // would misdescribe the ladder to the builders most likely to be learning it.
     { group: 'Government', gate: 'government', items: [
-      // FIRST in the group because it is the one page here you ACT on — the
-      // Community group's ordering rule, applied (a sitting waits on a decision;
-      // the rest of this group is monitoring). Carved out of the /government tab
-      // strip by ADR 0266, which is also why it needs its own item at all: while
-      // it was a tab, the group's only door to it was labelled "Permissions".
-      //
-      // THE GATE HERE IS COSMETIC AND DELIBERATELY CONSERVATIVE. The page's real
-      // wall is `board.vote.cast` (auth.js requireBoardVotePage), which floors at
-      // xenos so a widened board can reach the room. This nav gate cannot say
-      // that: gateAllows() speaks rank, not permission. It is set to the group's
-      // floor because today's constitution seats `rank:archon`, so no sub-Metic
-      // member exists to hide the link from. An instance that widens membership
-      // below Metic gets a room it can reach by URL and by the board_votes need's
-      // deep link, but no sidebar entry — teaching the shell a permission-aware
-      // gate is filed rather than guessed at here.
-      { id: 'board-room', label: 'Board Room', icon: 'admin', href: '/board-room', gate: 'government' },
+      // The Board Room was FIRST here from the ADR 0266 carve until task 1003744
+      // moved it into the project group — its wall is an ATOM (`board.vote.cast`,
+      // xenos floor) rather than this group's rank, and a group whose audience is
+      // Metic+ oversight could not honestly hold it. Everything below IS a rank
+      // surface, so this group's gate and audience are unchanged.
       { id: 'watch', label: 'Watch', icon: 'admin', href: '/watch', gate: 'government' },
       { id: 'harbor', label: 'Harbor', icon: 'admin', href: '/harbor', gate: 'government', module: 'dev-box' },
       { id: 'gate', label: 'Gate', icon: 'admin', href: '/gate', gate: 'government' },
@@ -536,11 +554,25 @@
 
   // ---------- gated visibility ----------
 
-  var access = { authed: null, rank: null, graduated: false, showWork: false };
+  // `permissions` is the resolved map `/me` returns (task 1003744) — { '<atom>':
+  // boolean } over the atoms a nav item may gate on — or null when the server could
+  // not establish authority. null is NOT "holds nothing that matters": it is
+  // unreadable, and unreadable hides the link, the same call gateAllows()'s
+  // `default: false` and the social mode's OFF-is-the-fallback rule make.
+  var access = { authed: null, rank: null, graduated: false, showWork: false, permissions: null };
 
   function gateAllows(gate) {
     var authed = access.authed === true;
     var member = authed && access.rank !== 'xenos';
+    // task 1003744: the one gate key that is not a rank. `perm:<atom>` asks whether
+    // the viewer HOLDS that permission, reading the answer the SERVER resolved —
+    // never re-derived here from rank or anything else, the social-mode precedent:
+    // a page that decided for itself could disagree with the rest of the hall.
+    if (gate && gate.indexOf('perm:') === 0) {
+      var perms = access.permissions;
+      if (!authed || !perms) return false;
+      return perms[gate.slice(5)] === true;
+    }
     switch (gate) {
       case 'always': return true;
       case 'signed': return authed;
@@ -604,6 +636,13 @@
       if ('rank' in state) access.rank = state.rank ? String(state.rank).toLowerCase() : null;
       if ('graduated' in state) access.graduated = !!state.graduated;
       if ('showWork' in state) access.showWork = !!state.showWork;
+      // task 1003744: stored as given — an object or null. Not normalized into `{}`,
+      // because "the server said you hold none of them" and "the server could not
+      // say" are different facts and only the first is a real answer; both hide the
+      // link today, but a surface that later wants to SAY which one it is can.
+      if ('permissions' in state) {
+        access.permissions = (state.permissions && typeof state.permissions === 'object') ? state.permissions : null;
+      }
       if ('social' in state) applySocial(state.social);
       if (state.builder) { renderUser(state.builder); applyCraftEmphasis(state.builder); }
     }
@@ -821,6 +860,8 @@
         // task 1003178 (C08): the mode rides the identity every page already
         // fetches, so no surface needs a route or a second call to know.
         social: me.social || null,
+        // task 1003744: the resolved permission map, for the `perm:` nav gates.
+        permissions: me.permissions || null,
         builder: me.builder,
       });
     }).catch(function () { /* cosmetic only */ });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.631",
+  "version": "1.19.633",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.631",
+      "version": "1.19.633",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.631",
+  "version": "1.19.633",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -339,6 +339,53 @@ const MODULE_GLOBS = {
     'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
     'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
   ],
+  // --- the METHODOLOGY surfaces: the instruction core an agent session actually
+  //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
+  //     slash-command skills, and the two scripts/gds files that compose a session's
+  //     opening context (start.js and the discipline→mode table it routes on).
+  //     Added by task 1002989 (goal 1000095, working area 6) as PREP for the
+  //     kernel↔pack split (task 1002990): that work rewrites CLAUDE.md, authors the
+  //     Engineer/Artist/Ideator packs, and deletes .claude/skills/{dev,ideate,paint}/
+  //     — paths NO key resolved, so the goal could not wall its own work (the
+  //     1002690 / 1002736 / 1003124 precedent: a missing key is an empty wall, and
+  //     goal-scope-check then denies every member-authored task).
+  //     `protected` DERIVES true — the root CLAUDE.md, docs/canonical-permissions.md
+  //     and the two trust ADRs sit in the ADR 0043 protected-surfaces registry — so a
+  //     goal scoped here is Archon-only (BV1.R57). Correct: this is the text that
+  //     frames every agent session.
+  //     BOUNDARIES.
+  //     • 'docs/' is deliberately the WHOLE subtree. The ADRs, recipes, session logs,
+  //       audits and design notes are one library; splitting it per module would rot
+  //       on the next doc, and the glob format has no wildcards to carve with. The
+  //       exact docs/ paths other keys enumerate (kernel's module-api-changelog,
+  //       copy-desk's two copy artifacts, ui-design's two loop recipes) stay listed
+  //       there for task affinity — overlap is legal (touchesOverlap is prefix-aware
+  //       both directions) and it keeps those walls standing on their own.
+  //       KNOWN CONSEQUENCE: docs/ was previously owned by nobody, which the ship-time
+  //       module-drift advisory (scripts/gds/ship-flow.js, BV1.R53) read as
+  //       "cross-cutting, allowed". A module_key-labelled task that also writes a
+  //       session log / ADR / regenerated doc now trips that WARNING (advisory only —
+  //       it refuses solely under --enforce-module). Filed as an idea to teach the
+  //       drift check about cross-cutting keys rather than shrink this glob.
+  //     • '.claude/skills/' is the whole dir, on the precedent the map already sets
+  //       for autonomy ('.claude/scheduled-tasks/') and agents ('.claude/agents/'):
+  //       a definition surface travels with the system that composes it. The
+  //       devsecops note — skills stay with whichever module ships the skill — still
+  //       holds for a module that enumerates its own (ui-design lists three); this
+  //       key is the floor under the ~50 that no module claims.
+  //     • '.claude/rules/' is pre-carved territory for task 1003687 (move the
+  //       CLAUDE.md content charter to a paths-scoped rule file) — the carve precedes
+  //       the feature, ADR 0086 §4, on the devsecops '.npmrc' precedent.
+  //     NOT here: scripts/gds/fitness.js. Task 1002989's brief named it as uncovered,
+  //     but that brief predates task 1003124, which gave devsecops the fitness/entropy
+  //     tooling. One owner per enforcement tool — the CLAUDE.md budget check is
+  //     enforcement, not methodology prose. ---
+  methodology: [
+    'CLAUDE.md',
+    'docs/',
+    '.claude/skills/', '.claude/rules/',
+    'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+  ],
 };
 
 // A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one

package/src/bongos/routes/me.js

@@ -40,6 +40,7 @@ const { branding } = require('../../branding'); // task 2011: instance model-all
 // direct require of a module file.
 const { pool } = require('../pool');
 const seams = require('../../module-seams');
+const log = require('../logger').logger.child({ src: 'me' });
 // The lifecycle (tasks · claims · ship) carved to modules/lifecycle/ (BV1.R86 /
 // ADR 0093 §3): the per-builder claims/estimation/grade reads resolve the
 // `lifecycle` kernel PORT (lc()); the grade-TREND read (builderRollingAvgGrade)
@@ -99,6 +100,50 @@ const artSharedKeyConfigured = () =>
 const discordIsLinked = (builderId) =>
   seams.resolveOptional('discord.isLinked', async () => false)(builderId);
 
+// NAV_PERMISSION_ATOMS — the permission keys a hall NAV ITEM is allowed to gate
+// on, and the only ones `/me` resolves (task 1003744).
+//
+// WHY A LIST AND NOT THE WHOLE SET. The shell's gateAllows() speaks RANK, so a
+// nav item fronting a page gated on an ATOM had to borrow the nearest rank floor
+// and hope the two agreed. The Board Room is where they stopped agreeing: its
+// page asks `board.vote.cast`, which floors at XENOS on purpose so that widening
+// the board works (modules/government/board.js), while its nav entry read the
+// Government group's metic floor. This key lets an item declare the SAME atom its
+// page is gated on, so the two cannot drift.
+//
+// It stays an ALLOWLIST rather than the builder's full resolved set because the
+// full set is the shape of the instance's governance, and a cosmetic sidebar has
+// no business shipping that to every page load. Adding an atom here is the
+// deliberate act that lets a nav item gate on it.
+//
+// COSMETIC ONLY (ADR 0016). This decides who is OFFERED a link. The page gate
+// (auth.js PAGE_GATES) and each data route's requirePermission are the wall, and
+// they run regardless of what this says.
+const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast']);
+
+// navPermissionsFor(builderId) → { '<atom>': boolean } over NAV_PERMISSION_ATOMS,
+// or null when authority could not be established (government off, port missing,
+// resolver threw). NULL IS NOT "holds nothing" — the shell treats a missing or
+// unreadable map as nothing-visible, matching gateAllows()'s `default: false` and
+// the social mode's OFF-is-the-fallback rule, so an outage hides a link rather
+// than offering one it cannot vouch for.
+async function navPermissionsFor(builderId) {
+  try {
+    const government = seams.resolveOptional('government');
+    if (!government || typeof government.resolveBuilderPermissions !== 'function') return null;
+    const held = new Set((await government.resolveBuilderPermissions(builderId)) || []);
+    const out = {};
+    for (const atom of NAV_PERMISSION_ATOMS) out[atom] = held.has(atom);
+    return out;
+  } catch (err) {
+    // Message only — a resolver error can carry query text or row data. Through
+    // the structured logger rather than console.*, which is ratcheted in server
+    // paths (scripts/gds/fitness-ratchets.js).
+    log.error({ err: err && err.message }, 'GET /me nav permissions');
+    return null;
+  }
+}
+
 module.exports = function buildMeRouter() {
   const router = express.Router();
 
@@ -134,6 +179,7 @@ module.exports = function buildMeRouter() {
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, boxConnected, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
       taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
+      navPermissions,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -256,6 +302,10 @@ module.exports = function buildMeRouter() {
           return await lifecycle.openMingleIntroductionsFor(req.builder.id);
         } catch (_) { return 0; }
       })(),
+      // task 1003744: the resolved answer for each atom a nav item may gate on.
+      // Same fan-out slot as the reads above, but it fails CLOSED rather than
+      // open — null hides the link. See navPermissionsFor.
+      navPermissionsFor(req.builder.id),
     ]);
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
@@ -321,6 +371,12 @@ module.exports = function buildMeRouter() {
       // when lifecycle is disabled or the read failed, and the shell treats null
       // as OFF — a mode that cannot be read is not on.
       social: socialMode,
+      // task 1003744: { '<atom>': boolean } for each permission key a hall nav
+      // item may gate on (NAV_PERMISSION_ATOMS above), so an item can declare the
+      // SAME atom its page is gated on instead of borrowing the nearest rank
+      // floor. null when authority could not be established, which the shell
+      // reads as nothing-visible. Cosmetic only — ADR 0016, the server enforces.
+      permissions: navPermissions,
       unlocked,
       locked_with_progress: lockedWithProgress,
       streak: {

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.631'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.633'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -55,6 +55,32 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     replace(target) { replaced.push(String(target)); },
   };
 
+  // The gated nodes applyAccess() settles, parsed back out of the sidebar markup
+  // on demand and MEMOISED by key, so a test can call applyAccess and then read
+  // what each nav item's `hidden` became. Lazy because the markup does not exist
+  // until renderSidebar() runs, and memoised because applyAccess runs repeatedly
+  // (once at boot with null, then per /me) and must settle the same objects.
+  // Without this the stub returned [] and no gate was ever exercised — which is
+  // how the sidebar's whole gating layer went untested (task 1003744).
+  const gatedEls = new Map();
+  const attr = (tag, name) => (tag.match(new RegExp('\\b' + name + '="([^"]*)"')) || [])[1];
+  function gatedNodes() {
+    const html = els.has('app-sidebar') ? String(els.get('app-sidebar').innerHTML) : '';
+    const out = [];
+    for (const tag of html.split('<')) {
+      const gate = attr(tag, 'data-gate');
+      if (gate === undefined) continue;
+      const key = attr(tag, 'id') || ('head:' + attr(tag, 'data-group'));
+      if (!gatedEls.has(key)) gatedEls.set(key, { key, dataset: {}, hidden: true });
+      const el = gatedEls.get(key);
+      el.dataset.gate = gate;
+      const mod = attr(tag, 'data-module');
+      if (mod) el.dataset.module = mod;
+      out.push(el);
+    }
+    return out;
+  }
+
   const documentObj = {
     body: { dataset: { page } },
     documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
@@ -62,7 +88,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
       if (!els.has(id)) els.set(id, makeEl());
       return els.get(id);
     },
-    querySelectorAll() { return []; },
+    querySelectorAll(sel) { return sel === '#app-sidebar [data-gate]' ? gatedNodes() : []; },
     createElement() { return makeEl(); },
     addEventListener() {},
     dispatchEvent() {},
@@ -97,6 +123,13 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     viewHidden: (v) => documentObj.getElementById('view-' + v).hidden,
     shell: windowObj.OTBShell,
     replaced,
+    // navHidden('board-room') → is that item hidden right now? Read AFTER an
+    // applyAccess call; before one, everything is hidden (the boot default).
+    navHidden: (id) => {
+      const el = gatedEls.get('nav-' + id);
+      assert.ok(el, `nav item ${id} rendered`);
+      return el.hidden;
+    },
   };
 }
 
@@ -119,9 +152,32 @@ function parseNav(html) {
 
 // Permissiveness ladder, widest first. A group head gated MORE widely than every
 // one of its items renders a label over nothing.
-const GATE_WIDTH = { always: 0, signed: 1, work: 1, member: 2, archon: 3 };
+//
+// 'government' was MISSING here until task 1003744, which made every comparison
+// against it `undefined < n` — false — so the Government group passed this check
+// vacuously rather than by being right. It sits between member and archon (ADR
+// 0157: metic-or-archon).
+//
+// A `perm:<atom>` gate (task 1003744) is NOT on the rank ladder at all, and the
+// client genuinely cannot place it: the atom's floor lives in the government
+// catalog, server-side, and the whole reason the key exists is that an atom may
+// float BELOW the rank its neighbours read. So it scores 0 — as wide as 'always',
+// the only assumption that cannot understate its reach.
+const GATE_WIDTH = { always: 0, signed: 1, work: 1, member: 2, government: 3, archon: 4 };
+const widthOf = (gate) => (String(gate).startsWith('perm:') ? 0 : GATE_WIDTH[gate]);
 const headOutOfRange = (g) =>
-  g.headGate != null && GATE_WIDTH[g.headGate] < Math.min(...g.items.map((i) => GATE_WIDTH[i.gate]));
+  g.headGate != null && widthOf(g.headGate) < Math.min(...g.items.map((i) => widthOf(i.gate)));
+
+// THE OTHER DIRECTION, and the one that had no check (task 1003744). The rule
+// above catches a head gated wider than every item — a label over nothing. Its
+// mirror is an item gated WIDER than its own head: the head hides, the item does
+// not, and the viewer gets an orphan link under no label. That is exactly what
+// gating the Board Room honestly while leaving it in the Government group would
+// have produced, and it is the shape the owner declined (2026-09-09) by moving
+// the item into the unlabeled project group instead. Without this check nothing
+// stops it being moved back.
+const itemsWiderThanHead = (g) =>
+  (g.headGate == null ? [] : g.items.filter((i) => widthOf(i.gate) < widthOf(g.headGate)).map((i) => i.id));
 
 // A nav href must land: an index view hash, an external apex link, or a real
 // page file in the hall surface.
@@ -154,7 +210,15 @@ test('sidebar groups read by audience, in order', () => {
   // room and the flag table) sit side by side, both with the project's own work
   // rather than in Docs (reference) or You (a person). Pinning the order keeps a
   // new tab in the hall's most valuable nav real estate a reviewed decision.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'ideas', 'copy-desk', 'studio'],
+  // task 1003744 (goal 1000111): 'board-room' joins the same group, after Tasks.
+  // It was in Government from the ADR 0266 carve, reading that group's metic floor
+  // because the shell could not express its real wall — the `board.vote.cast` ATOM,
+  // which floors at XENOS so a widened board can reach the room. Gating it honestly
+  // would have put a wider item under a narrower group head, so the OWNER'S CALL
+  // (2026-09-09) was to move it: a sitting is work the project does, beside Goals
+  // and Tasks, not one of Government's monitoring surfaces. The item is invisible
+  // to anyone without the atom, so most builders never see it here.
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'board-room', 'ideas', 'copy-desk', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.
@@ -177,11 +241,10 @@ test('sidebar groups read by audience, in order', () => {
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
   // 'project-settings' joins the Government group at the metic floor (task 1003280,
   // goal 1000072) — it sits before 'government', which is the one archon-only item.
-  // 'board-room' leads the group since ADR 0266: it is the one page here you ACT
-  // on (a sitting waits on a decision; the rest is monitoring), the same ordering
-  // rule the Community group's first item follows. Before that carve it had no
-  // item at all — it was a tab behind the one labelled "Permissions".
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['board-room', 'watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
+  // 'board-room' LED this group from the ADR 0266 carve until task 1003744 moved
+  // it to the project group — see the note on nav[0]. What is left is rank surface
+  // throughout, which is what lets the group keep its metic head honestly.
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {
@@ -242,11 +305,97 @@ test('no group head is gated wider than its own items', () => {
   assert.deepEqual(bad, [], 'a head gated wider than every item would render a label over nothing');
 });
 
+// ── a nav item can gate on a PERMISSION, not just a rank (task 1003744) ─────
+
+// The Board Room's page asks `board.vote.cast`, which floors at XENOS on purpose
+// so that widening the board works. Its nav item read the Government group's
+// metic floor, because gateAllows() spoke rank and nothing else — so a sub-Metic
+// board member could reach the room by URL and by the board_votes deep link with
+// no sidebar entry. These four tests are the DONE-WHEN.
+//
+// They drive the REAL applyAccess through the boot stub rather than restating
+// gateAllows here, because what a builder sees is the settled `hidden`, and the
+// rule under test is precisely that the client does not re-derive the answer.
+
+test('THE DONE-WHEN: a xenos holding board.vote.cast is offered the Board Room', () => {
+  const b = boot();
+  b.shell.applyAccess({ authed: true, rank: 'xenos', permissions: { 'board.vote.cast': true } });
+  assert.equal(b.navHidden('board-room'), false, 'the atom is what opens the link, not the rank');
+  // The rank floor genuinely still binds everywhere else — this widened one item,
+  // not the sidebar. Watch is the neighbour it used to share a gate with.
+  assert.equal(b.navHidden('watch'), true, 'a xenos is still offered no Government page');
+});
+
+test('a builder WITHOUT the atom is not offered the Board Room, at any rank', () => {
+  const xenos = boot();
+  xenos.shell.applyAccess({ authed: true, rank: 'xenos', permissions: { 'board.vote.cast': false } });
+  assert.equal(xenos.navHidden('board-room'), true, 'holding nothing hides it');
+
+  // An ARCHON without the atom is the case the old rank gate got wrong in the
+  // other direction: it showed the link to every Metic+, atom or not.
+  const archon = boot();
+  archon.shell.applyAccess({ authed: true, rank: 'archon', permissions: { 'board.vote.cast': false } });
+  assert.equal(archon.navHidden('board-room'), true, 'rank does not substitute for the permission');
+  assert.equal(archon.navHidden('watch'), false, 'sanity: the archon does see the rank-gated pages');
+});
+
+test('an unreadable permission map hides the link — absent is not visible', () => {
+  // /me returns `permissions: null` when authority could not be established
+  // (government off, port missing, resolver threw). That is not "holds nothing",
+  // it is "cannot say", and it must hide — gateAllows()'s `default: false` and
+  // the social mode's OFF-is-the-fallback rule, applied.
+  for (const permissions of [null, undefined, 'yes', 0]) {
+    const b = boot();
+    b.shell.applyAccess({ authed: true, rank: 'archon', permissions });
+    assert.equal(b.navHidden('board-room'), true, `permissions=${JSON.stringify(permissions)} hides the link`);
+  }
+  // Signed OUT with a map somehow in hand is the same answer.
+  const out = boot();
+  out.shell.applyAccess({ authed: false, permissions: { 'board.vote.cast': true } });
+  assert.equal(out.navHidden('board-room'), true, 'a permission never implies a session');
+});
+
+test('the Board Room item declares the SAME atom its page is gated on', () => {
+  // The drift this task exists to close: the nav gate and the page gate must name
+  // one key. auth.js is the wall; the nav merely quotes it.
+  const item = parseNav(boot().sidebarHtml).flatMap((g) => g.items).find((i) => i.id === 'board-room');
+  assert.equal(item.gate, 'perm:board.vote.cast');
+  const authSrc = fs.readFileSync(path.join(ROOT, 'src/bongos/auth.js'), 'utf8');
+  assert.match(authSrc, /requireBoardVotePage: Object\.freeze\(\{ permission: 'board\.vote\.cast'/,
+    'the page gate still asks the atom the nav item quotes');
+  // And the server must actually RESOLVE it, or the item can never be shown.
+  const meSrc = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/me.js'), 'utf8');
+  assert.match(meSrc, /NAV_PERMISSION_ATOMS = Object\.freeze\(\[[^\]]*'board\.vote\.cast'/,
+    '/me resolves the atom the nav item gates on');
+});
+
 test('group-gate check actually CATCHES a head gated wider than its items', () => {
   assert.equal(headOutOfRange({ label: 'X', headGate: 'signed', items: [{ gate: 'member' }] }), true,
     'signed head over a member-only item is the bug');
   assert.equal(headOutOfRange({ label: 'X', headGate: 'member', items: [{ gate: 'member' }] }), false);
   assert.equal(headOutOfRange({ label: 'X', headGate: 'archon', items: [{ gate: 'archon' }] }), false);
+  // task 1003744: 'government' is on the ladder now — before it was undefined and
+  // every comparison against it was silently false, so the group passed vacuously.
+  assert.equal(headOutOfRange({ label: 'X', headGate: 'government', items: [{ gate: 'archon' }] }), true,
+    'a metic-visible head over archon-only items renders a label over nothing');
+  assert.equal(headOutOfRange({ label: 'X', headGate: 'government', items: [{ gate: 'government' }] }), false);
+});
+
+test('no nav item is more permissive than its own group head', () => {
+  const bad = parseNav(boot().sidebarHtml).flatMap(itemsWiderThanHead);
+  assert.deepEqual(bad, [], 'an item wider than its head renders as an orphan link under no label');
+});
+
+test('the orphan-link check CATCHES the arrangement the owner declined', () => {
+  // Board Room gated on its real atom, left inside the Government group: the
+  // xenos board member sees the link and not the "Government" label above it.
+  assert.deepEqual(
+    itemsWiderThanHead({ headGate: 'government', items: [{ id: 'board-room', gate: 'perm:board.vote.cast' }, { id: 'watch', gate: 'government' }] }),
+    ['board-room']);
+  // The same item in the unlabeled project group (no head) is fine — that is
+  // where it lives.
+  assert.deepEqual(itemsWiderThanHead({ headGate: null, items: [{ id: 'board-room', gate: 'perm:board.vote.cast' }] }), []);
+  assert.deepEqual(itemsWiderThanHead({ headGate: 'signed', items: [{ id: 'people', gate: 'government' }] }), []);
 });
 
 test('#leaderboard REDIRECTS to /roster from the index, and only from the index', () => {

package/tests/module-scope-map.mjs

@@ -206,3 +206,48 @@ test('devsecops joined the roster (task 1003124) — the enforcement territory g
   assert.equal(covers('.claude/skills/builder-ship/SKILL.md'), false, 'skills stay with the module that ships them');
   assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle, not devsecops');
 });
+
+test('methodology joined the roster (task 1002989) — the instruction surfaces working area 6 walls', () => {
+  // Before this, the root CLAUDE.md, docs/, .claude/skills/ and the two session-
+  // composing scripts were covered by NO key, so goal 1000095 could not wall the
+  // kernel↔pack split (task 1002990) — the work that rewrites CLAUDE.md, authors the
+  // Engineer/Artist/Ideator packs, and deletes the three discipline skills.
+  assert.ok(scope.isModuleKey('methodology'), 'roster missing module "methodology"');
+  const globs = scope.globsForModules(['methodology']);
+  assert.ok(globs.includes('CLAUDE.md'), 'methodology owns the always-loaded instruction root');
+  assert.ok(globs.includes('docs/'), 'methodology owns the docs library');
+  assert.ok(globs.includes('.claude/skills/'), 'the slash-command skills are the methodology definition surface');
+  assert.ok(globs.includes('scripts/gds/start.js'), 'the session-opening composer travels with the domain');
+  // Derived, not hand-set: CLAUDE.md, docs/canonical-permissions.md and the two trust
+  // ADRs sit in the ADR 0043 protected-surfaces registry, so this key MUST derive
+  // protected — creating or widening a goal into it is Archon-only (BV1.R57).
+  assert.equal(scope.isProtectedModule('methodology'), true, 'methodology must derive protected (CLAUDE.md is a protected surface)');
+  assert.equal(
+    scope.scopeForModule('methodology').protected,
+    scope.isProtected(globs),
+    'protected must be the faithful derivation, never a literal',
+  );
+  // Asserted through the REAL consumer (directional containment), not re-implemented.
+  const covers = (touch) => gsc.scopeSubset(['methodology'], [touch]).ok;
+  for (const touch of [
+    'CLAUDE.md',                              // the kernel half of the split (1002990)
+    '.claude/skills/dev/SKILL.md',            // one of the three discipline skills it deletes
+    '.claude/skills/ideate/SKILL.md',
+    '.claude/skills/paint/SKILL.md',
+    '.claude/rules/content-charter.md',       // pre-carved for task 1003687
+    'docs/adr/0264-the-ten-working-areas.md', // the ADR library
+    'docs/handoff-template.md',
+    'scripts/gds/start.js',                   // composes a session's opening context
+    'scripts/gds/discipline-modes.json',      // the discipline→mode table it routes on
+  ]) {
+    assert.equal(covers(touch), true, `wall does not cover ${touch}`);
+  }
+  // …and still BOUNDS: the trust kernel, the sibling .claude definition dirs, and the
+  // enforcement tooling devsecops owns all stay outside this wall.
+  assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
+  assert.equal(covers('.claude/settings.json'), false, 'the agent settings belong to devsecops');
+  assert.equal(covers('.claude/scheduled-tasks/bfg/SKILL.md'), false, 'scheduled-tasks belongs to autonomy, not methodology');
+  assert.equal(covers('.claude/agents/reviewer.md'), false, 'agent definitions belong to agents, not methodology');
+  assert.equal(covers('scripts/gds/fitness.js'), false, 'the fitness tool stayed with devsecops (task 1003124)');
+  assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle');
+});