@bongos/core 1.21.112 → 1.21.114

package/modules/government/law-board.js

@@ -0,0 +1,131 @@
+'use strict';
+
+// modules/government/law-board.js — the board's side of the project's LAWS
+// (task 1004706, goal 1000111). laws.js is the pure half (what a law is, strict
+// validation, the guard); this file is where the law book meets the board:
+// proposing a change as an amendment, writing a passed one inside its closing
+// transaction, and reading the book with who passed each law and when. Split out
+// of board.js the way decision-board.js is; board.js calls in here and never the
+// other way round (no require cycle).
+//
+// The window-open nudge (board.item.opened) is emitted by board.js's wrapper
+// around proposeLaws, beside every other open.
+
+const db = require('./db');
+const { loadGovernmentConfig } = require('./config');
+const laws = require('./laws');
+const charter = require('./charter');
+
+// ── proposing: an amendment of kind 'laws' ──────────────────────────────────
+//
+// Validated strictly, checked against the laws in force, filed as an amendment
+// of kind 'laws' and sat under the constitution IN FORCE — exactly like a
+// constitution amendment. Nothing here writes a law; only the sitting passing
+// does (applyPassedLaws). Returns { ok, amendment, item, proposal } or a named
+// refusal: validateLawsProposal's reasons | checkAgainstInForce's reasons
+// | 'missing_proposer'.
+async function proposeLaws({ enact, repeal, rationaleMd = null, proposedBy } = {}) {
+  const v = laws.validateLawsProposal({ ...(enact !== undefined ? { enact } : {}), ...(repeal !== undefined ? { repeal } : {}) });
+  if (!v.ok) return v;
+  if (proposedBy == null || proposedBy === '') return { ok: false, reason: 'missing_proposer' };
+  const inForce = await db.listLaws();
+  const c = laws.checkAgainstInForce(v.proposal, inForce);
+  if (!c.ok) return c;
+
+  const { board } = loadGovernmentConfig();
+  const amendment = await db.createAmendment({
+    proposed: { laws: v.proposal },
+    rationaleMd: rationaleMd || laws.proposalWords(v.proposal, inForce),
+    proposedBy,
+    kind: 'laws',
+  });
+  const item = await db.openBoardItem({
+    subjectType: 'constitutional_amendment',
+    subjectId: amendment.id,
+    openedBy: proposedBy,
+    constitution: board,
+    windowMinutes: board.window_minutes,
+  });
+  return { ok: true, amendment, item, proposal: v.proposal };
+}
+
+// ── the one write ───────────────────────────────────────────────────────────
+//
+// Runs INSIDE the transaction that closes the sitting (`client`); a throw rolls
+// the close back. Guarded here (laws.lawsWriteAllowed), in db.applyLaws's SQL,
+// and by government_027's trigger.
+async function applyPassedLaws(client, closedRow, amendment) {
+  if (!laws.lawsWriteAllowed(closedRow, amendment)) {
+    throw new Error(`[government] laws may only be written by a passed laws amendment (item ${closedRow && closedRow.id})`);
+  }
+  // Re-validated as a belt: the row was validated strictly at propose time and
+  // is immutable since, so a refusal here means the stored row was altered.
+  const v = laws.validateLawsProposal((amendment.proposed || {}).laws);
+  if (!v.ok) throw new Error(`[government] passed laws amendment ${amendment.id} no longer validates (${v.reason}) — NOT applied`);
+  const out = await db.applyLaws(client, {
+    itemId: closedRow.id,
+    enact: v.proposal.enact,
+    repeal: v.proposal.repeal,
+    proposedBy: amendment.proposed_by == null ? null : amendment.proposed_by,
+  });
+  return {
+    enacted: (out.enacted || []).map((r) => ({ id: String(r.id), text: r.text })),
+    repealed: (out.repealed || []).map((r) => String(r.id)),
+  };
+}
+
+// ── the law book ────────────────────────────────────────────────────────────
+//
+// Every law in force (or, with includeRepealed, every law ever passed), oldest
+// first, each saying WHO passed it and WHEN: the government it was decided under
+// (read as its form's name), who proposed it, who said yes, and the sitting.
+const person = (id, login, name) => (id == null ? null : { id: String(id), login: login || null, name: name || login || null });
+
+function projectLaw(row, yesByItem) {
+  const under = row.decided_under || null;
+  const form = under ? charter.readCharter(under) : null;
+  const itemId = String(row.passed_by_item_id);
+  return {
+    id: String(row.id),
+    text: row.text,
+    effect_on_ai: row.effect_on_ai || null,
+    locks: Array.isArray(row.locks) ? row.locks : [],
+    in_force: row.repealed_at == null,
+    passed_at: row.passed_at,
+    passed_by: {
+      item_id: itemId,
+      href: `/board-room?item=${encodeURIComponent(itemId)}`,
+      government: form ? form.name : null,
+      pass_rule: under && under.pass_rule ? under.pass_rule : null,
+      proposer: person(row.proposed_by, row.proposer_login, row.proposer_name),
+      yes: (yesByItem.get(itemId) || []).map((v) => person(v.voter_id, v.github_login, v.display_name)),
+    },
+    repealed_at: row.repealed_at || null,
+    repealed_by_item_id: row.repealed_by_item_id == null ? null : String(row.repealed_by_item_id),
+  };
+}
+
+async function lawsView({ includeRepealed = false } = {}) {
+  const rows = await db.listLaws({ includeRepealed });
+  const itemIds = [...new Set(rows.map((r) => String(r.passed_by_item_id)))];
+  const yes = itemIds.length ? await db.listYesVoters(itemIds) : [];
+  const yesByItem = new Map();
+  for (const v of yes) {
+    const k = String(v.item_id);
+    if (!yesByItem.has(k)) yesByItem.set(k, []);
+    yesByItem.get(k).push(v);
+  }
+  const book = rows.map((r) => projectLaw(r, yesByItem));
+  return {
+    laws: book,
+    in_force: book.filter((l) => l.in_force).length,
+    changed_by: 'a passed amendment only: POST /government/board/laws files one',
+    limits: { text_max: laws.LAW_TEXT_MAX, effect_max: laws.EFFECT_MAX, locks_max: laws.MAX_LOCKS },
+  };
+}
+
+module.exports = {
+  proposeLaws,
+  applyPassedLaws,
+  lawsView,
+};

package/modules/government/laws.js

@@ -0,0 +1,241 @@
+'use strict';
+
+// modules/government/laws.js — STANDING ORDERS: the project's laws for its AI
+// agents (task 1004706, goal 1000111 "government is how a project steers its AI").
+//
+// WHAT A LAW IS. A short, one-line rule every AI agent on the project obeys —
+// "Stuck? Note it, skip it, keep going", "Land only. Ask before going live",
+// "Ask like a human". It carries an optional line saying what it means for an
+// agent, and may LOCK personal settings it overrides (a lock names a setting and
+// either fixes its value or caps it with a max). Before this, rules like these
+// lived in one builder's private AI notes, so nobody else's agents ever saw them.
+//
+// CHANGED ONLY BY A PASSED AMENDMENT, like the constitution. There is no route
+// that writes a law. A change — enacting new laws, repealing laws in force, or
+// both at once — is filed as an amendment of kind 'laws' (law-board.js
+// proposeLaws), decided by the board IN FORCE like every other amendment, and
+// written INSIDE the transaction that closes that sitting as passed
+// (board.closeItem → law-board.applyPassedLaws → db.applyLaws). The database
+// refuses any other write (government_027's trigger), so a hand-written INSERT
+// or UPDATE is refused too, and a law is never deleted: a repeal is a passed
+// amendment, and the repealed row stays on the record.
+//
+// WHO PASSED IT, AND WHEN. Every law row names the board item that passed it,
+// its proposer and when it passed; the read joins that item's constitution (the
+// government it was decided under) and its yes votes. A repeal records the item
+// that repealed it, and when.
+//
+// READ INTO EVERY AI SESSION (task 1004707). forSession below turns the laws in
+// force into the one block every session reads: GET /me carries it, and the
+// Conductor hook relays it verbatim beside the builder's interaction profile.
+// The server writes the words; nothing a builder edits locally can change them.
+// A lock is ENFORCED on the builder's personal settings by builder-settings
+// (law-locks.js), on every read of the effective value and on every write. The
+// first laws themselves are the owner's to ratify (task 1004708).
+//
+// PURE: no db, no requires. law-board.js and the routes hand rows in.
+
+const LAW_TEXT_MIN = 3;
+const LAW_TEXT_MAX = 100;
+const EFFECT_MAX = 200;
+const MAX_LOCKS = 8;
+const MAX_ENACT = 10;
+const MAX_REPEAL = 20;
+const LOCK_VALUE_MAX = 64;
+// A personal setting's key, as the hall and the interaction profile spell them
+// (technical_level, wandering, model.main, on_stuck).
+const SETTING_KEY = /^[a-z][a-z0-9_]*(\.[a-zA-Z][a-zA-Z0-9_]*)?$/;
+const SETTING_KEY_MAX = 64;
+// One line: no line breaks or other control characters.
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u001f\u007f]/;
+
+function oneLine(raw, { min, max }) {
+  if (typeof raw !== 'string') return null;
+  if (CONTROL.test(raw)) return null;
+  const s = raw.trim().replace(/\s+/g, ' ');
+  if (s.length < min || s.length > max) return null;
+  return s;
+}
+
+// A lock: { setting, value } fixes the setting; { setting, max } caps it (a
+// number, or the highest option of an ordered list such as wandering's).
+function validateLock(raw, i) {
+  const at = `locks[${i}]`;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'bad_lock', field: at };
+  for (const k of Object.keys(raw)) {
+    if (k !== 'setting' && k !== 'value' && k !== 'max') return { ok: false, reason: 'unknown_field', field: `${at}.${k}` };
+  }
+  if (typeof raw.setting !== 'string' || raw.setting.length > SETTING_KEY_MAX || !SETTING_KEY.test(raw.setting)) {
+    return { ok: false, reason: 'bad_lock_setting', field: `${at}.setting` };
+  }
+  const hasValue = Object.prototype.hasOwnProperty.call(raw, 'value');
+  const hasMax = Object.prototype.hasOwnProperty.call(raw, 'max');
+  if (hasValue === hasMax) return { ok: false, reason: 'lock_needs_value_or_max', field: at, expected: 'exactly one of value, max' };
+  if (hasValue) {
+    const v = raw.value;
+    const okValue = typeof v === 'boolean'
+      || (typeof v === 'number' && Number.isFinite(v))
+      || (typeof v === 'string' && v.length >= 1 && v.length <= LOCK_VALUE_MAX && !CONTROL.test(v));
+    if (!okValue) return { ok: false, reason: 'bad_lock_value', field: `${at}.value` };
+    return { ok: true, lock: { setting: raw.setting, value: v } };
+  }
+  const m = raw.max;
+  const okMax = (typeof m === 'number' && Number.isFinite(m))
+    || (typeof m === 'string' && m.length >= 1 && m.length <= LOCK_VALUE_MAX && !CONTROL.test(m));
+  if (!okMax) return { ok: false, reason: 'bad_lock_max', field: `${at}.max` };
+  return { ok: true, lock: { setting: raw.setting, max: m } };
+}
+
+function validateLaw(raw, i) {
+  const at = `enact[${i}]`;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'bad_law', field: at };
+  for (const k of Object.keys(raw)) {
+    if (k !== 'text' && k !== 'effect_on_ai' && k !== 'locks') return { ok: false, reason: 'unknown_field', field: `${at}.${k}` };
+  }
+  const text = oneLine(raw.text, { min: LAW_TEXT_MIN, max: LAW_TEXT_MAX });
+  if (!text) return { ok: false, reason: 'bad_text', field: `${at}.text`, expected: `one line of ${LAW_TEXT_MIN}-${LAW_TEXT_MAX} characters` };
+  let effect = null;
+  if (raw.effect_on_ai != null) {
+    effect = oneLine(raw.effect_on_ai, { min: 1, max: EFFECT_MAX });
+    if (!effect) return { ok: false, reason: 'bad_effect', field: `${at}.effect_on_ai`, expected: `one line of at most ${EFFECT_MAX} characters` };
+  }
+  const locksIn = raw.locks == null ? [] : raw.locks;
+  if (!Array.isArray(locksIn) || locksIn.length > MAX_LOCKS) return { ok: false, reason: 'bad_locks', field: `${at}.locks`, expected: `a list of at most ${MAX_LOCKS}` };
+  const locks = [];
+  const seen = new Set();
+  for (let j = 0; j < locksIn.length; j++) {
+    const v = validateLock(locksIn[j], j);
+    if (!v.ok) return { ...v, field: `${at}.${v.field}` };
+    if (seen.has(v.lock.setting)) return { ok: false, reason: 'setting_locked_twice', field: `${at}.locks[${j}].setting`, setting: v.lock.setting };
+    seen.add(v.lock.setting);
+    locks.push(v.lock);
+  }
+  return { ok: true, law: { text, effect_on_ai: effect, locks } };
+}
+
+const sameText = (a, b) => String(a).trim().toLowerCase() === String(b).trim().toLowerCase();
+
+// A proposal, validated STRICTLY — every field named, nothing corrected beyond
+// trimming whitespace (the board must not ratify words the proposer never wrote).
+//   { enact?: [{ text, effect_on_ai?, locks? }], repeal?: [law id] }
+// Returns { ok: true, proposal: { enact, repeal } } or { ok: false, reason, field?, expected? }.
+function validateLawsProposal(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'bad_proposal', expected: '{ enact?: [law], repeal?: [law id] }' };
+  for (const k of Object.keys(raw)) {
+    if (k !== 'enact' && k !== 'repeal') return { ok: false, reason: 'unknown_field', field: k };
+  }
+  const enactIn = raw.enact == null ? [] : raw.enact;
+  const repealIn = raw.repeal == null ? [] : raw.repeal;
+  if (!Array.isArray(enactIn) || enactIn.length > MAX_ENACT) return { ok: false, reason: 'bad_enact', field: 'enact', expected: `a list of at most ${MAX_ENACT} laws` };
+  if (!Array.isArray(repealIn) || repealIn.length > MAX_REPEAL) return { ok: false, reason: 'bad_repeal', field: 'repeal', expected: `a list of at most ${MAX_REPEAL} law ids` };
+  if (!enactIn.length && !repealIn.length) return { ok: false, reason: 'nothing_to_change', expected: 'at least one law to enact or repeal' };
+  const enact = [];
+  for (let i = 0; i < enactIn.length; i++) {
+    const v = validateLaw(enactIn[i], i);
+    if (!v.ok) return v;
+    if (enact.some((l) => sameText(l.text, v.law.text))) return { ok: false, reason: 'duplicate_law', field: `enact[${i}].text` };
+    enact.push(v.law);
+  }
+  const repeal = [];
+  for (let i = 0; i < repealIn.length; i++) {
+    const r = repealIn[i];
+    const n = typeof r === 'string' && /^\d+$/.test(r) ? Number(r) : r;
+    if (typeof n !== 'number' || !Number.isSafeInteger(n) || n <= 0) return { ok: false, reason: 'bad_law_id', field: `repeal[${i}]` };
+    if (repeal.includes(String(n))) return { ok: false, reason: 'duplicate_law_id', field: `repeal[${i}]` };
+    repeal.push(String(n));
+  }
+  return { ok: true, proposal: { enact, repeal } };
+}
+
+// Against the laws in force: a repeal must name a law in force, an enacted law
+// must not already be in force (unless the same proposal repeals it), and no
+// setting may be locked by two laws at once. `inForce` rows: { id, text, locks }.
+// Returns { ok: true } or a named refusal.
+function checkAgainstInForce(proposal, inForce) {
+  const rows = Array.isArray(inForce) ? inForce : [];
+  const byId = new Map(rows.map((l) => [String(l.id), l]));
+  for (const id of proposal.repeal) {
+    if (!byId.has(id)) return { ok: false, reason: 'not_in_force', law_id: id };
+  }
+  const staying = rows.filter((l) => !proposal.repeal.includes(String(l.id)));
+  for (let i = 0; i < proposal.enact.length; i++) {
+    const law = proposal.enact[i];
+    const twin = staying.find((l) => sameText(l.text, law.text));
+    if (twin) return { ok: false, reason: 'already_in_force', field: `enact[${i}].text`, law_id: String(twin.id) };
+    for (const lock of law.locks) {
+      const holder = staying.find((l) => (Array.isArray(l.locks) ? l.locks : []).some((x) => x && x.setting === lock.setting))
+        || proposal.enact.slice(0, i).find((l) => l.locks.some((x) => x.setting === lock.setting));
+      if (holder) return { ok: false, reason: 'setting_already_locked', field: `enact[${i}].locks`, setting: lock.setting, ...(holder.id != null ? { law_id: String(holder.id) } : {}) };
+    }
+  }
+  return { ok: true };
+}
+
+// The record's own words for a proposal ("Law: Ask like a human. Repeal: ...").
+function proposalWords(proposal, inForce) {
+  const byId = new Map((Array.isArray(inForce) ? inForce : []).map((l) => [String(l.id), l]));
+  const parts = [];
+  proposal.enact.forEach((l) => parts.push(`Law: ${l.text}`));
+  proposal.repeal.forEach((id) => parts.push(`Repeal: ${byId.has(id) ? byId.get(id).text : `law ${id}`}`));
+  return parts.join('. ').replace(/([.!?])\.(\s|$)/g, '$1$2').replace(/([^.!?])$/, '$1.');
+}
+
+// THE GUARD. A law may be written only when the row that just closed is a
+// PASSED constitutional amendment whose amendment is of kind 'laws' and is the
+// item's own subject. db.applyLaws carries the same condition in its SQL, and
+// government_027's trigger refuses every other write — three layers.
+function lawsWriteAllowed(closedRow, amendment) {
+  return !!closedRow && !!amendment
+    && closedRow.subject_type === 'constitutional_amendment'
+    && closedRow.outcome === 'passed'
+    && amendment.kind === 'laws'
+    && String(amendment.id) === String(closedRow.subject_id);
+}
+
+// ── the session read (task 1004707) ─────────────────────────────────────────
+//
+// What every AI session on the project reads: the laws in force, oldest first,
+// numbered, each with what it means for an agent and the settings it locks.
+// `rows`: db.listLaws() rows (in force only). Returns
+//   { laws: [{ id, no, text, effect_on_ai, locks }], contract, inject }
+// `contract` is the block the Conductor relays verbatim; '' (and inject:false)
+// when no law is in force, so a project with no laws spends no context. The
+// text is one line per law by construction (government_027's CHECKs), so a law
+// can never smuggle a second instruction onto a line of its own.
+const lockWords = (lock) => (Object.prototype.hasOwnProperty.call(lock, 'value')
+  ? `${lock.setting} is fixed at ${lock.value}`
+  : `${lock.setting} is at most ${lock.max}`);
+
+function forSession(rows) {
+  const list = (Array.isArray(rows) ? rows : [])
+    .filter((r) => r && r.id != null && r.repealed_at == null && typeof r.text === 'string');
+  const book = list.map((r, i) => ({
+    id: String(r.id),
+    no: i + 1,
+    text: r.text,
+    effect_on_ai: r.effect_on_ai || null,
+    locks: (Array.isArray(r.locks) ? r.locks : []).filter((l) => l && typeof l.setting === 'string'),
+  }));
+  if (!book.length) return { laws: [], contract: '', inject: false };
+  const lines = book.map((l) => {
+    let line = `${l.no}. ${l.text}`;
+    if (l.effect_on_ai) line += ` — ${l.effect_on_ai}`;
+    if (l.locks.length) line += ` (locks: ${l.locks.map(lockWords).join('; ')})`;
+    return line;
+  });
+  const contract = 'Project laws — passed by a vote of this project\'s government. Every AI agent on the project obeys them, and they come before this builder\'s own settings and preferences. A setting a law locks is enforced by the server; do not work around it:\n'
+    + lines.join('\n');
+  return { laws: book, contract, inject: true };
+}
+
+module.exports = {
+  forSession,
+  LAW_TEXT_MAX,
+  EFFECT_MAX,
+  MAX_LOCKS,
+  validateLawsProposal,
+  checkAgainstInForce,
+  proposalWords,
+  lawsWriteAllowed,
+};

package/modules/government/leads.js

@@ -0,0 +1,170 @@
+'use strict';
+
+// modules/government/leads.js — THE LEAD OF EACH BUILDING: who leads it, held as a
+// position the government appoints and removes by vote (task 1004709, goal
+// 1000111; ADR 0374). decision-board.js is the board side (opening the People
+// matter, carrying out a passed one), board.js serves the read (GET
+// /government/leads), and government_029 is the table and its guard.
+//
+// WHAT A LEAD IS. One builder in office at one of the nine buildings, carrying a
+// short charter: one line saying what they answer for. A building has at most
+// one Lead. A Lead is appointed and removed ONLY by a passed People matter — the
+// actions appoint_lead { building, builder_id, charter } and remove_lead
+// { building } (decision-board.js MATTER_ACTIONS) — and the table's trigger
+// refuses every other write.
+//
+// WHO ANSWERS FOR A BUILDING. Its Lead; an UNSEATED building falls to the owner
+// (owner ruling, 2026-10-09). The project has no owner field, so the owner seat
+// is held by the founder's rank: every active Archon, the founding one (the
+// lowest id, the Archon the project was bootstrapped with) first — never one
+// Archon picked by a guess. answerFor() is that rule, written
+// once, for the read here and for routing every ask to a seat (routing.js, task
+// 1004705).
+//
+// WHAT IT DOES NOT DECIDE. Holding the Lead's office confers no authority of its
+// own. Whether a building's holder may build it out without a vote comes from
+// the FORM OF GOVERNMENT and the building's own decision rule (build-rights.js,
+// task 1004710), never from the Lead or their charter; the read below carries
+// that answer per building as `build_rights`. Positions on /me are task 1004713.
+// What each building has grown under its holder rides the same read as
+// `structure` (buildouts.js, task 1004711).
+//
+// PURE: no db, no requires beyond the buildings' vocabulary, the build rule and
+// the build-outs' shape.
+
+const { AREAS, AREA_KEYS } = require('./decision-rules');
+const { buildRightsFor } = require('./build-rights');
+const { structureOf } = require('./buildouts');
+
+const CHARTER_MIN = 3;
+const CHARTER_MAX = 140;
+
+// The charter a Lead is appointed with when the matter names none: one line per
+// building, saying what its Lead answers for.
+const DEFAULT_CHARTERS = Object.freeze({
+  charter: 'The constitution: how the project is governed and how that changes.',
+  rules: 'The project settings and the standing rules of work.',
+  disputes: 'Security reports and the disputes over them.',
+  people: 'Who joins, and the ranks they hold.',
+  planning: 'Goals, priorities and the order of work.',
+  automation: 'Unattended building: when it runs and on what.',
+  review: 'Who checks finished work, and how.',
+  release: 'Releases and the path to going live.',
+  treasury: 'Spending limits and what the project pays for.',
+});
+
+const isBuilding = (b) => typeof b === 'string' && AREA_KEYS.includes(b);
+
+// A charter line, normalised, or null when it breaks the rule (3-140 characters,
+// one line). An absent charter takes the building's default.
+function charterLine(raw, building) {
+  if (raw == null || raw === '') return DEFAULT_CHARTERS[building] || null;
+  if (typeof raw !== 'string' || /[\r\n]/.test(raw)) return null;
+  const s = raw.trim();
+  return s.length >= CHARTER_MIN && s.length <= CHARTER_MAX ? s : null;
+}
+
+// The two People matter actions that seat and unseat a Lead.
+const LEAD_ACTS = Object.freeze(['appoint_lead', 'remove_lead']);
+const isLeadAct = (type) => LEAD_ACTS.includes(type);
+
+// The owner seat: every active Archon, the founding one (lowest id) first; nobody
+// when the project has no active Archon.
+function ownerOf(archons) {
+  const list = (archons || [])
+    .filter((b) => b && b.id != null)
+    .slice()
+    .sort((a, b) => Number(a.id) - Number(b.id))
+    .map((b) => ({ id: String(b.id), login: b.github_login || null, name: b.display_name || b.github_login || null }));
+  return { seat: 'owner', rank: 'archon', builders: list };
+}
+
+// Who answers for a building: its Lead in office, or the owner when unseated.
+// `leadsInOffice` is a map building → lead ({ builder_id, ... }) or an array of rows.
+function answerFor(building, leadsInOffice, owner) {
+  if (!isBuilding(building)) return null;
+  const rows = Array.isArray(leadsInOffice) ? leadsInOffice : Object.values(leadsInOffice || {});
+  const lead = rows.find((l) => l && l.building === building && !l.removed_at) || null;
+  if (lead) return { seat: `lead:${building}`, builder_ids: [String(lead.builder_id)], fell_to_owner: false };
+  const ids = ((owner && owner.builders) || []).map((b) => String(b.id));
+  return { seat: 'owner', builder_ids: ids, fell_to_owner: true };
+}
+
+// One Lead row as the read shows it.
+function projectLead(r) {
+  return {
+    id: String(r.id),
+    building: r.building,
+    builder: { id: String(r.builder_id), login: r.github_login || null, name: r.display_name || r.github_login || null },
+    charter: r.charter,
+    since: r.appointed_at || null,
+    appointed_by: { item_id: String(r.appointed_by_item_id), href: `/board-room?item=${r.appointed_by_item_id}` },
+    ...(r.removed_at ? { removed_at: r.removed_at, removed_by: { item_id: String(r.removed_by_item_id), href: `/board-room?item=${r.removed_by_item_id}` } } : {}),
+  };
+}
+
+// Who may build a building out without a vote, from the context the server
+// resolved (decision-board.leadsView): the board block in force, each building's
+// resolved decision row, who sits on the board, who sits on each building's own
+// sitting, and the goals hook. null when no context was read.
+function rightsOf(building, answers, rights) {
+  if (!rights) return null;
+  const ids = ((answers && answers.builder_ids) || []).map(String);
+  const seatedIn = (list) => Array.isArray(list) && list.some((id) => ids.includes(String(id)));
+  const decision = (rights.decisions || []).find((d) => d && d.area === building) || null;
+  return buildRightsFor({
+    building,
+    board: rights.board,
+    decision,
+    holder: {
+      seat: answers ? answers.seat : null,
+      on_board: seatedIn(rights.boardMemberIds),
+      in_sitting: seatedIn((rights.sittingMemberIds || {})[building]),
+    },
+    goals: rights.goals || [],
+  });
+}
+
+// GET /government/leads: the nine buildings in street order, each with its Lead
+// in office (or null), who answers for it, and what its holder may build without
+// a vote (`build_rights`; null when the server could not read what it needs).
+// `structure` ({ rows, pending, now }: the build-outs on the record and the
+// open build_out sittings) gives each building what it has grown and what waits
+// on a vote; without it each building's `structure` is null.
+function leadsView(rows, archons, { includePast = false, rights = null, structure = null } = {}) {
+  const owner = ownerOf(archons);
+  const inOffice = (rows || []).filter((r) => r && !r.removed_at);
+  const buildings = AREAS.map((a) => {
+    const row = inOffice.find((r) => r.building === a.key) || null;
+    const answers = answerFor(a.key, inOffice, owner);
+    return {
+      building: a.key,
+      name: a.name,
+      lead: row ? projectLead(row) : null,
+      answers,
+      build_rights: rightsOf(a.key, answers, rights),
+      structure: structure ? structureOf(a.key, structure.rows, structure.pending, structure.now) : null,
+    };
+  });
+  return {
+    buildings,
+    owner,
+    seated: buildings.filter((b) => b.lead).length,
+    build_rights_from: 'the form of government and each building\'s own decision rule (goals may grant or limit it later), never a Lead\'s charter',
+    ...(includePast ? { past: (rows || []).filter((r) => r && r.removed_at).map(projectLead) } : {}),
+    changed_by: 'a passed People matter only: POST /government/board/matters with area people and an appoint_lead or remove_lead action',
+    grown_through: 'the building\'s holder: POST /government/buildouts builds at once where build_rights allows it, and otherwise files a build_out matter for a vote',
+    limits: { charter_min: CHARTER_MIN, charter_max: CHARTER_MAX },
+  };
+}
+
+module.exports = {
+  CHARTER_MAX,
+  DEFAULT_CHARTERS,
+  LEAD_ACTS,
+  isLeadAct,
+  charterLine,
+  answerFor,
+  ownerOf,
+  leadsView,
+};