@bongos/core 1.21.175 → 1.21.177

package/tests/government_board_view.mjs

@@ -133,3 +133,42 @@ test('the room is gated on the vote atom, and the page shell widened WITH the ta
   const client = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
   assert.match(client, /sealRanksPanel/, 'the admin tab seals itself for non-archons');
 });
+
+// task 1004825: the room shows a ballot only to a viewer the vote route would
+// accept, so each open item says whether THIS viewer may cast on it — board
+// membership under the item's OWN snapshot, and a clock that has not run out.
+test('viewer_may_vote mirrors castVote: membership under the snapshot, not expired, per viewer', async () => {
+  const META = { membership: 'rank:metic', pass_rule: 'consent', window_minutes: 60, close_early_on_full_turnout: false };
+  const asked = [];
+  const row = (id, constitution, expired = false) => ({ id, subject_type: 'constitutional_amendment', subject_id: 5, opened_by: 1, opened_at: 'T', closes_at: null, remaining_seconds: null, expired, closed_at: null, outcome: null, constitution });
+  const view = await withDb({
+    listOpenBoardItems: async () => [row(1, MONARCHY), row(2, META), row(3, MONARCHY), row(4, META, true)],
+    listClosedBoardItems: async () => [],
+    getVotesForItems: async () => [],
+    getIdeaSubjects: async () => [],
+    getAmendmentSubjects: async () => [],
+    builderHoldsRankActive: async (id, keys) => { asked.push(keys.join(',')); return id === '7' && keys.includes('archon'); },
+  }, () => boardRoomView({ viewerId: '7' }));
+  assert.deepEqual(view.open.map((i) => i.viewer_may_vote), [true, false, true, false],
+    'an archon sits on the monarchy sittings, not the metic one; an expired sitting takes no vote');
+  assert.deepEqual(asked.sort(), ['archon', 'metic'], 'one membership read per distinct predicate, none for an expired item');
+
+  const anon = await withDb({
+    listOpenBoardItems: async () => [row(1, MONARCHY)], listClosedBoardItems: async () => [],
+    getVotesForItems: async () => [], getIdeaSubjects: async () => [], getAmendmentSubjects: async () => [],
+    builderHoldsRankActive: async () => { throw new Error('no viewer, no read'); },
+  }, () => boardRoomView());
+  assert.equal(anon.open[0].viewer_may_vote, false, 'no viewer → no ballot');
+
+  const broken = await withDb({
+    listOpenBoardItems: async () => [row(1, MONARCHY)], listClosedBoardItems: async () => [],
+    getVotesForItems: async () => [], getIdeaSubjects: async () => [], getAmendmentSubjects: async () => [],
+    builderHoldsRankActive: async () => { throw new Error('db down'); },
+  }, () => boardRoomView({ viewerId: '7' }));
+  assert.equal(broken.open[0].viewer_may_vote, false, 'a failed membership read hides the ballot, never shows it');
+});
+
+test('the route passes the signed-in viewer to the view', () => {
+  const src = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
+  assert.match(src, /boardRoomView\(\{ closedLimit: 20, viewerId: String\(req\.builder\.id\) \}\)/);
+});

package/tests/government_board_vote_ui.mjs

@@ -87,7 +87,7 @@ test('the author of a full_idea gets a REAL ballot plus the limit in words (task
   assert.match(form, /earns no karma/, 'and that a self-cast is unpaid');
   // The single most important structural assertion: there is exactly ONE return
   // of the ballot, so no branch can silently withhold it from the author again.
-  assert.equal((form.match(/data-vote="yes"/g) || []).length, 1,
+  assert.equal((form.match(/'data-vote': 'yes'/g) || []).length, 1,
     'one ballot, reachable by author and peer alike');
   assert.ok(!/return `<p class="gov-grid-note">This is your idea/.test(form),
     'the old form-suppressing early return is gone, not merely bypassed');
@@ -107,3 +107,41 @@ test('every refusal castVote can return has friendly copy', () => {
     assert.ok(copyBlock.includes(`${r}:`), `ERROR_COPY must explain '${r}'`);
   }
 });
+
+// task 1004825: the ballot is the shared ask card, and it shows ONLY when the
+// server says this viewer may cast here (viewer_may_vote). Runs the real
+// itemCard + voteFormHtml + the real OTBAsk builder over a stubbed rest.
+test('the ballot is an ask card, shown only to a viewer the vote route would accept', () => {
+  const OTBAsk = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'hall-ask.js'));
+  const slice = (a, b) => CLIENT.slice(CLIENT.indexOf(a), CLIENT.indexOf(b));
+  const src = slice('  const SECTION_LABELS_BY_TEMPLATE', '  // ---- the sitting\'s rules')
+    + slice('  function voteFormHtml', '  async function castVoteFromRoom')
+    + slice('  function itemCard', '  async function loadBoard');
+  const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const itemCard = new Function('window', 'escapeHtml', 'pill', 'clockLine', 'subjectLine', 'emptyStateHtml', 'decidedByHtml', 'ballotHtml', 'recommendationHtml',
+    `${src}\nreturn itemCard;`)({ OTBAsk }, esc, (t, s) => s, () => 'no clock', (i) => i.subject.title, (s) => s, () => '', () => '', () => '');
+  const item = (over) => ({ id: '41', subject_type: 'full_idea', subject_id: '7', subject: { title: 'An idea', author_id: '9', template_key: 'base-v2', field_values: {} },
+    closes_at: null, remaining_seconds: null, expired: false, closed_at: null, outcome: null, constitution: {}, votes: [], ...over });
+
+  const member = itemCard(item({ viewer_may_vote: true }), '3');
+  assert.match(member, /class="hask"/, 'the vote is the shared ask card');
+  assert.match(member, /Pass this idea\?/, 'asked as a question');
+  assert.match(member, /data-vote="yes"/, 'yes casts through the same handler');
+  assert.match(member, /data-vote-open/, 'Object opens the reason form');
+  assert.match(member, /class="gov-vote__no" hidden/, 'which starts closed');
+  assert.match(member, /data-vote="no"/, 'and carries the objection cast');
+
+  for (const flag of [false, undefined, null]) {
+    const out = itemCard(item({ viewer_may_vote: flag }), '3');
+    assert.ok(!/data-vote|class="hask"/.test(out), `no ballot when viewer_may_vote is ${flag}`);
+  }
+  const cast = itemCard(item({ viewer_may_vote: true, votes: [{ voter_id: '3', direction: 'yes' }] }), '3');
+  assert.ok(!/data-vote/.test(cast) && /You voted yes\./.test(cast), 'a cast voter sees what they cast, not a second ballot');
+});
+
+test('the page loads the ask card builder before its own script', () => {
+  const html = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.html'), 'utf8');
+  const ask = html.indexOf('/builders/hall-ask.js');
+  assert.ok(ask > 0 && ask < html.indexOf('/builders/board-room.js'));
+  assert.ok(html.includes('/builders/hall-ask.css'));
+});

package/tests/government_config.mjs

@@ -156,7 +156,7 @@ test('the resolved config is frozen — a caller cannot mutate it into a grant',
 test('the neutral starter carries no host-specific identity (a vanilla instance boots from it alone)', () => {
   // Reuses fitness.js's own definition of "host identity" so this cannot drift from
   // the CI gate (which does not scan .json itself — IDENTITY_SCAN_EXTS is js/html/css).
-  const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+  const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
   assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
   // And it carries only templates — never a live per-builder assignment. The key list
@@ -191,7 +191,7 @@ test('loadGovernmentConfig reads the real neutral starter and tolerates a missin
 });
 
 test('the neutral starter publishes with the core (a packaged vanilla instance needs it)', () => {
-  const { isPublishable } = require(path.join(ROOT, 'scripts', 'gds', 'publish-manifest.js'));
+  const { isPublishable } = require(path.join(ROOT, 'scripts', 'bongos', 'publish-manifest.js'));
   assert.equal(isPublishable('config/government.neutral.json'), true);
   assert.equal(isPublishable('config/government.json'), false, "a host's filled-in pack is instance content");
 });

package/tests/government_live_proof_shape.mjs

@@ -103,7 +103,7 @@ test('every curated INTEGRATION / KNOWN_FAILING entry names a real test file', (
   // after ADR 0174 renamed the file. A stem that matches nothing does not error —
   // the entry just stops applying, so the file quietly moved into the DB-free lane
   // (where it "passed" by self-skipping). Curated lists must point at real files.
-  const runner = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'run-unit-tests.js'), 'utf8');
   const setEntries = (name) => {
     const start = runner.indexOf(`const ${name} = new Set([`);
     assert.ok(start > -1, `${name} must exist in run-unit-tests.js`);

package/tests/government_protected_surfaces.mjs

@@ -47,20 +47,21 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
   'modules/grading/grader.js',
   'modules/grading/grader-workers/',
   'modules/grading/grader-rubric.json',
-  'scripts/gds/ship.js',
-  'scripts/gds/confirm.js',
-  'scripts/gds/merge-mode.js',
-  'scripts/gds/ci-grade.js',
-  'scripts/gds/grade-smoke.js',
-  'scripts/gds/conductor-dispatch.js',
-  'scripts/gds/main-audit.js',
-  'scripts/gds/push-main.js',
-  'scripts/gds/run-unit-tests.js',
-  'scripts/gds/gate-review.js',
-  'scripts/gds/setup.js',
-  'scripts/gds/install-git-hooks.js',
-  'scripts/gds/hooks/',
-  'scripts/gds/cli-lib.js',
+  'scripts/bongos/ship.js',
+  'scripts/bongos/confirm.js',
+  'scripts/bongos/merge-mode.js',
+  'scripts/bongos/ci-grade.js',
+  'scripts/bongos/grade-smoke.js',
+  'scripts/bongos/conductor-dispatch.js',
+  'scripts/bongos/main-audit.js',
+  'scripts/bongos/push-main.js',
+  'scripts/bongos/run-unit-tests.js',
+  'scripts/bongos/gate-review.js',
+  'scripts/bongos/setup.js',
+  'scripts/bongos/install-git-hooks.js',
+  'scripts/bongos/hooks/',
+  'scripts/gds/', // task 1004848: the @bongos-forwarder files still run on boxes
+  'scripts/bongos/cli-lib.js',
   'scripts/migrate.sh',
   'scripts/deploy/',
   'modules/lifecycle/merge-lock.js',
@@ -131,53 +132,53 @@ const ADDED_SINCE_R101 = [
   // closure.js names eight, so the audit's prose was already stale against shipped code.
   // The drift tripwire below is what keeps this list honest from here.
   {
-    after: 'scripts/gds/cli-lib.js',
-    glob: 'scripts/gds/git-merge-regen.js',
+    after: 'scripts/bongos/cli-lib.js',
+    glob: 'scripts/bongos/git-merge-regen.js',
     why: 'the otb-regen MERGE DRIVER. Registered as a relative command with cwd at the '
        + 'clone root, so git merge runs the BRANCH copy with the live server environment '
        + 'BEFORE any post-merge step — the earliest execution vector, and the one the '
        + "audit's \"after the merge\" framing missed.",
   },
   {
-    after: 'scripts/gds/git-merge-regen.js',
-    glob: 'scripts/gds/gen-repo-map.js',
+    after: 'scripts/bongos/git-merge-regen.js',
+    glob: 'scripts/bongos/gen-repo-map.js',
     why: 'a post-merge generator the resolver runs as execFile(node, [<clone>/...]) — the '
        + "branch's own copy, inheriting DATABASE_URL and BUILDER_SECRET_KEY.",
   },
   {
-    after: 'scripts/gds/gen-repo-map.js',
-    glob: 'scripts/gds/gen-file-map.js',
+    after: 'scripts/bongos/gen-repo-map.js',
+    glob: 'scripts/bongos/gen-file-map.js',
     why: 'a post-merge generator the resolver executes out of the clone, on the same path '
        + 'as gen-repo-map.js.',
   },
   {
-    after: 'scripts/gds/gen-file-map.js',
-    glob: 'scripts/gds/gen-session-index.js',
+    after: 'scripts/bongos/gen-file-map.js',
+    glob: 'scripts/bongos/gen-session-index.js',
     why: 'a post-merge generator the resolver executes out of the clone, on the same path '
        + 'as gen-repo-map.js.',
   },
   {
-    after: 'scripts/gds/gen-session-index.js',
-    glob: 'scripts/gds/copy-inventory.js',
+    after: 'scripts/bongos/gen-session-index.js',
+    glob: 'scripts/bongos/copy-inventory.js',
     why: 'a post-merge generator the resolver executes out of the clone. NOT one of the '
        + "audit's \"gen-* trio\" — it is the first of the four roots that prose omitted, "
        + 'which is why this registry is pinned to the closure rather than to the audit.',
   },
   {
-    after: 'scripts/gds/copy-inventory.js',
-    glob: 'scripts/gds/gen-api-docs.js',
+    after: 'scripts/bongos/copy-inventory.js',
+    glob: 'scripts/bongos/gen-api-docs.js',
     why: 'a post-merge generator the resolver executes out of the clone, and the widest '
        + 'one: it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers, '
-       + 'which is why a restore scoped to scripts/gds/ was never sufficient.',
+       + 'which is why a restore scoped to scripts/bongos/ was never sufficient.',
   },
   {
-    after: 'scripts/gds/gen-api-docs.js',
-    glob: 'scripts/gds/gen-api-client.js',
+    after: 'scripts/bongos/gen-api-docs.js',
+    glob: 'scripts/bongos/gen-api-client.js',
     why: 'a post-merge generator the resolver executes out of the clone, inheriting the '
        + 'live server environment like its siblings.',
   },
   {
-    after: 'scripts/gds/gen-api-client.js',
+    after: 'scripts/bongos/gen-api-client.js',
     glob: '.gitattributes',
     why: 'never require()d, so it is not code — but it NAMES which paths git hands the '
        + 'otb-regen driver, so editing it changes how much of the tree that driver '
@@ -192,22 +193,22 @@ const ADDED_SINCE_R101 = [
   // cf-tunnel.js — were deleted with it in task 1003893, entries and all.)
   {
     after: 'modules/dev-box/box-credential.js',
-    glob: 'scripts/gds/provision-config.js',
+    glob: 'scripts/bongos/provision-config.js',
     why: 'reads process.env.DO_API_TOKEN. The DigitalOcean credential for instance '
        + 'provisioning, previously unprotected at any rank while the files deciding WHO '
        + 'may provision were protected at Metic.',
   },
   {
-    after: 'scripts/gds/provision-config.js',
-    glob: 'scripts/gds/provision-net.js',
+    after: 'scripts/bongos/provision-config.js',
+    glob: 'scripts/bongos/provision-net.js',
     why: 'reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task '
-       + 'placed this code in scripts/gds/provision.js, which by the time of the claim '
+       + 'placed this code in scripts/bongos/provision.js, which by the time of the claim '
        + 'read no credential at all — registering the file the prose named would have '
        + 'recorded the gap as closed while closing nothing.',
   },
   {
-    after: 'scripts/gds/provision-net.js',
-    glob: 'scripts/gds/do-api.js',
+    after: 'scripts/bongos/provision-net.js',
+    glob: 'scripts/bongos/do-api.js',
     why: 'the DigitalOcean API client the token is handed TO. It reads no process.env '
        + 'value — the token arrives as a parameter and the constructor throws when a live '
        + 'call has none — so the tripwire below does not demand it and its absence from '
@@ -264,7 +265,7 @@ const ADDED_SINCE_R101 = [
     'grader-prompt', 'grader-score', 'grader-subagent'],
     'the grader.js carve: the deterministic permission-path pre-pass and the server-side '
     + 'score guards a model cannot talk past.'),
-  ...carve('scripts/gds/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
+  ...carve('scripts/bongos/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
     'ship-finish', 'ship-flow', 'ship-git', 'ship-grade-steps', 'ship-grade', 'ship-honesty',
     'ship-io', 'ship-land', 'ship-memory-sync', 'ship-merge-gate', 'ship-merge', 'ship-mode-ask',
     'ship-preflight-steps', 'ship-regen', 'ship-resume', 'ship-session-upload', 'ship-state',
@@ -298,8 +299,8 @@ const ADDED_SINCE_R101 = [
   // task 1004631: a ship.js sibling added after the carve — registered so the carve
   // tripwire below stays green and the file sits at ship.js's floor.
   {
-    after: 'scripts/gds/ship-merge.js',
-    glob: 'scripts/gds/ship-mode-manual.js',
+    after: 'scripts/bongos/ship-merge.js',
+    glob: 'scripts/bongos/ship-mode-manual.js',
     why: 'split out of the protected ship.js: the ship-mode step every ship runs '
        + 'before it lands, so an edit here could change how work reaches main.',
   },
@@ -492,9 +493,9 @@ test('no protected glob uses a wildcard — the goal scope wall could not read i
 });
 
 test('stemSiblings finds a split-out file and nothing that merely resembles one', () => {
-  const tree = ['scripts/gds/ship.js', 'scripts/gds/ship-land.js', 'scripts/gds/shipper.js',
-    'scripts/gds/ship_x.js', 'scripts/gds/sub/ship-x.js', 'scripts/gds/ship-notes.md', 'src/ship-y.js'];
-  assert.deepEqual(stemSiblings('scripts/gds/ship.js', tree), ['scripts/gds/ship-land.js']);
+  const tree = ['scripts/bongos/ship.js', 'scripts/bongos/ship-land.js', 'scripts/bongos/shipper.js',
+    'scripts/bongos/ship_x.js', 'scripts/bongos/sub/ship-x.js', 'scripts/bongos/ship-notes.md', 'src/ship-y.js'];
+  assert.deepEqual(stemSiblings('scripts/bongos/ship.js', tree), ['scripts/bongos/ship-land.js']);
 });
 
 test('every file split out of a protected file is itself protected (1004024 carve tripwire)', () => {
@@ -526,7 +527,7 @@ test('every file split out of a protected file is itself protected (1004024 carv
 // that HOLDS the DigitalOcean / Cloudflare credentials those decisions spend.
 //
 // WHY THIS IS COMPUTED AND NOT LISTED. The task offered two options, both resting on a
-// named file: "scripts/gds/provision.js is the sole holder of the DO and CF tokens". By
+// named file: "scripts/bongos/provision.js is the sole holder of the DO and CF tokens". By
 // the time it was claimed that sentence was false in both halves — provision.js reads
 // NEITHER token (the code moved), and the readers are spread across five files. Taking the
 // prose at its word would have registered a file holding no credential and recorded the
@@ -659,7 +660,7 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
 // ---------- the hard-floor subset: gate-review's second list may narrow, never diverge ----------
 //
 // task 1002875, from idea 1000620 (raised as a major by the BV1.R101 ship grader).
-// scripts/gds/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
+// scripts/bongos/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
 // escalate-to-owner set — and the comment above it declares the array to be "A subset of
 // PROTECTED_GLOBS". That was a checkable invariant stated in prose and enforced by nothing.
 //
@@ -676,7 +677,7 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
 // computes or filters the list cannot leave the visible source saying one thing while the
 // gate enforces another.
 function hardFloorGlobsFromSource() {
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
   const block = src.match(/const HARD_FLOOR_GLOBS = \[([\s\S]*?)\n\];/);
   assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in gate-review.js — '
     + 'if it was renamed or restructured, this test must be taught the new shape rather '
@@ -691,7 +692,7 @@ test('every hard-floor glob is a protected surface (1002875 subset tripwire)', (
     + 'and the array has held about two dozen since it was written. A parse that returns '
     + 'few or none passes the subset check vacuously.');
 
-  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
   assert.deepEqual(fromSource, gr.HARD_FLOOR_GLOBS,
     'the HARD_FLOOR_GLOBS literal in gate-review.js no longer matches the array the module '
     + 'exports and compiles into its matcher. The source and the enforced list must be the '
@@ -700,7 +701,7 @@ test('every hard-floor glob is a protected surface (1002875 subset tripwire)', (
   const registry = new Set(ppc.PROTECTED_GLOBS);
   for (const glob of gr.HARD_FLOOR_GLOBS) {
     assert.ok(registry.has(glob),
-      `'${glob}' is a HARD FLOOR surface in scripts/gds/gate-review.js — CI escalates any `
+      `'${glob}' is a HARD FLOOR surface in scripts/bongos/gate-review.js — CI escalates any `
       + 'edit to it to the owner regardless of rank — but it is not in '
       + 'modules/government/protected-surfaces.json, so no rank floor covers it at all. '
       + 'The hard floor is declared to be a SUBSET of the protected set: it may be '
@@ -721,7 +722,7 @@ test('registering the credential readers widened no module wall', () => {
   const protectedNow = map.protectedModules();
   assert.ok(!protectedNow.includes('provisioning'),
     'the provisioning module derived protected:true — a credential-reader entry reached '
-    + 'modules/provisioning/ or scripts/gds/provision.js, which walls goals 1000032, '
+    + 'modules/provisioning/ or scripts/bongos/provision.js, which walls goals 1000032, '
     + '1000046 and 1000059 behind an Archon join. Keep the entries file-level.');
   // Since task 1003892 the readers are owned by their own control-plane scope, which
   // is protected BY them — that is where the wall belongs, not on provisioning.
@@ -877,7 +878,7 @@ test('registering the switchboard widened no module wall', () => {
   //
   // `agents` is the module to watch, and the ONLY one this test can honestly cite.
   // `autonomy` — which owns .claude/scheduled-tasks/, the routine bodies — was ALREADY
-  // protected before this entry, through scripts/gds/conductor-dispatch.js in group
+  // protected before this entry, through scripts/bongos/conductor-dispatch.js in group
   // 'pipeline' (verified glob by glob: none of its other five globs is protected). So its
   // flag is not evidence either way here, and asserting it unprotected would have been a
   // test that fails for a reason unrelated to what it claims to check.
@@ -914,7 +915,7 @@ test('registering the switchboard widened no module wall', () => {
     '.claude/agents/ became protected — task 1002492 considered and rejected that, and '
     + 'task 1004006 walled the module SOURCE without reopening it. An agent definition '
     + 'is scoped by validate.js, not by a rank floor on the file.');
-  assert.ok(ppc.surfaceFor('scripts/gds/conductor-dispatch.js'),
+  assert.ok(ppc.surfaceFor('scripts/bongos/conductor-dispatch.js'),
     'the autonomy module was protected through conductor-dispatch.js before this entry. '
     + 'If that glob is gone, re-derive which modules this registry walls before trusting '
     + 'the assertion above.');
@@ -941,7 +942,7 @@ test('a floor raise flows through to the enforcers, not just the registry', () =
   // checkPermissionPaths, the authoritative post-push audit through its per-hit
   // comparison (task 1003191 — it used to test the global minimum and silently
   // downgraded every raise).
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'main-audit.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'main-audit.js'), 'utf8');
   assert.ok(!/\bppc\.isBelowFloor\s*\(/.test(src),
     'main-audit.js must not decide floors with isBelowFloor — that tests the registry '
     + 'GLOBAL MINIMUM, so a governance floor raise is silently downgraded in the one '
@@ -1290,7 +1291,7 @@ test('compileGlobMatcher folds BOTH sides', () => {
 });
 
 test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
-  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
   const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
   assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
   assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');
@@ -1306,7 +1307,7 @@ test('no consumer compiles a PROTECTED glob list byte-exact', () => {
   // legitimately need it: folding publish-manifest's PUBLISH_ALLOWLIST would widen
   // what reaches the public OSS mirror, i.e. publish MORE. So the ban is narrow —
   // pairing a PROTECTED list with the raw compiler in one file.
-  const dir = path.join(ROOT, 'scripts', 'gds');
+  const dir = path.join(ROOT, 'scripts', 'bongos');
   const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js'));
   assert.ok(files.length > 20, `only ${files.length} scripts scanned — the sweep is not reading the CLI directory`);
   const offenders = [];

package/tests/government_require_permission.mjs

@@ -27,7 +27,7 @@ const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 // The same stripper the category guard scans with, rather than a second copy: both
 // checks are answering "which text here is executable", and two answers in one tree
 // is how one of them quietly stops agreeing with the other (task 1003832).
-const { stripComments } = require(path.join(ROOT, 'scripts', 'gds', 'category-advisory-guard.js'));
+const { stripComments } = require(path.join(ROOT, 'scripts', 'bongos', 'category-advisory-guard.js'));
 
 // Minimal res double capturing status + body, with res.fail() installed exactly
 // as the router installs it (mirrors tests/rank_gate.mjs).
@@ -416,6 +416,14 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     // construction: blocker 1000126 carries the audience question to the owner,
     // and spike 1002786 R3 mints the atom that removes this entry.
     'platform-identity/routes/scouting.js',
+    // Still requireRank after BV1.R105 — and at the BOTTOM of the ladder, which is the
+    // point. `POST /raise/edit` (task 1004847) is open to any active builder by the
+    // owner's decision of 2026-10-25, so its gate is requireRank(EDIT_MIN_RANK='xenos'):
+    // "signed in, active, and on the ladder". No permission atom means that — every
+    // atom names a specific authority, and borrowing one would make this page's edit
+    // door move whenever an unrelated grant does. If the owner later narrows who may
+    // edit, that is the moment to mint an atom and remove this entry (task 1004852).
+    'raise/routes/raise.js',
   ].sort();
 
   const modulesDir = path.join(ROOT, 'modules');

package/tests/government_vanilla_boot.mjs

@@ -41,7 +41,7 @@ const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { loadGovernmentConfig, resolveGovernmentConfig, NEUTRAL_PATH, INSTANCE_PATH } = require(path.join(GOV, 'config.js'));
 const { effectivePermissions, resolveBuilderPermissions } = require(path.join(GOV, 'resolver.js'));
-const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+const fitness = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
 
 // Every precedence test injects exactly the env it asserts on — an ambient

package/tests/government_vocabulary.mjs

@@ -2,7 +2,7 @@
 // (goal 1000068 R07, task 1003008).
 //
 // The rule under test says: "role" means a CRAFT — Artist, Ideator, or Builder —
-// and never a rank. `scripts/gds/fitness.js` checkVocabularyWall enforces it on
+// and never a rank. `scripts/bongos/fitness.js` checkVocabularyWall enforces it on
 // the government surface, in the CI `unit` check.
 //
 // WHY THIS FILE EXISTS AT ALL. A naming rule is the easiest kind of check to
@@ -18,7 +18,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+const fitness = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
 
 // ---------- the wall holds on the real tree ----------
 

package/tests/government_walk.mjs

@@ -1,7 +1,7 @@
 // tests/government_walk.mjs — the government walk stays true (task 1004658, goal
 // 1000111, criterion gov-proven-and-kept-proven).
 //
-// scripts/gds/government-walk.js walks a throwaway project's whole government —
+// scripts/bongos/government-walk.js walks a throwaway project's whole government —
 // genesis, every form, every building's act-alone gate, every matter action — and
 // writes the pass/fail table to docs/governance/government-walk.md. This runs the
 // walk again in its own process (it points the instance root at a temp folder and
@@ -25,7 +25,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'government-walk.js');
+const SCRIPT = path.join(ROOT, 'scripts', 'bongos', 'government-walk.js');
 const walk = require(SCRIPT);
 const dr = require(path.join(ROOT, 'modules', 'government', 'decision-rules.js'));
 const decisionBoard = require(path.join(ROOT, 'modules', 'government', 'decision-board.js'));

package/tests/grade_body_limit.mjs

@@ -18,6 +18,7 @@
 
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -74,7 +75,7 @@ test('a realistic mass-change body fits the new limit', () => {
   // The shape that broke it: one path per changed file, plus the panel's findings. 1,141
   // paths measured ~38 KB of JSON on their own — comfortably over 64 KB once the grade
   // output is added, and comfortably under 1 MB.
-  const files = Array.from({ length: 1200 }, (_, i) => `scripts/gds/some-fairly-long-script-name-${i}.js`);
+  const files = Array.from({ length: 1200 }, (_, i) => `scripts/bongos/some-fairly-long-script-name-${i}.js`);
   const body = JSON.stringify({
     committed_files: files,
     subagent_output: { functional_fidelity: 9, code_quality: 9, notes: 'x'.repeat(20_000) },
@@ -109,7 +110,7 @@ test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', ()
   // diff. shouldReuseGrade compares that hash to the stored grade's, so two different large
   // diffs on one task collided and a stale PASS could be reused on changed code, skipping
   // the panel entirely.
-  const src = read('scripts/gds/ship-grade.js');
+  const src = read('scripts/bongos/ship-grade.js');
 
   const fn = src.slice(src.indexOf('function computeRawDiffHash'), src.indexOf('function shouldReuseGrade'));
   assert.ok(fn.length > 0, 'computeRawDiffHash is gone');
@@ -128,7 +129,7 @@ test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', ()
 test('both diff captures use one shared size, not two drifting numbers', () => {
   // The two call sites are the same decision; a second literal is how one gets fixed and
   // the other does not — which is exactly what happened here.
-  const src = read('scripts/gds/ship-grade.js');
+  const src = read('scripts/bongos/ship-grade.js');
   assert.match(src, /const DIFF_CAPTURE_MAX_BYTES = /, 'the capture size must be named once');
   const uses = (src.match(/maxBuffer: DIFF_CAPTURE_MAX_BYTES/g) || []).length;
   assert.equal(uses, 2, `both diff captures must share the constant, saw ${uses}`);
@@ -144,7 +145,8 @@ test('the grade endpoint keeps its full generated description', () => {
   //
   // Pinned on LENGTH rather than exact prose so ordinary edits to the comment do not red
   // this, while the collapse (which is an order-of-magnitude drop) still does.
-  const spec = JSON.parse(read('docs/api/openapi.json'));
+  // The spec is gitignored (task 1004866): build it from the routes.
+  const spec = createRequire(import.meta.url)('../scripts/bongos/gen-api-docs.js').build().spec;
   const desc = spec.paths['/tasks/{id}/grade']?.post?.description || '';
   assert.ok(desc.length > 400,
     `the grade endpoint's generated description collapsed to ${desc.length} chars — `

package/tests/grade_correlation_audit.mjs

@@ -19,7 +19,7 @@ import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const A = require('../scripts/gds/grade-correlation-audit.js');
+const A = require('../scripts/bongos/grade-correlation-audit.js');
 const ROOT = fileURLToPath(new URL('..', import.meta.url));
 
 const close = (a, b, eps = 1e-9) => assert.ok(Math.abs(a - b) < eps, `${a} != ${b}`);
@@ -147,10 +147,10 @@ test('the CLI reports a saved dataset — refusals by name, and --json — with
   const file = path.join(dir, 'dataset.json');
   fs.writeFileSync(file, JSON.stringify({ grades: [row(1), row(2, { quality: 'fail' })], overrides: [] }));
   try {
-    const text = execFileSync(process.execPath, ['scripts/gds/grade-correlation-audit.js', '--file', file], { cwd: ROOT, encoding: 'utf8' });
+    const text = execFileSync(process.execPath, ['scripts/bongos/grade-correlation-audit.js', '--file', file], { cwd: ROOT, encoding: 'utf8' });
     assert.match(text, /2 recorded panel round\(s\) over 2 task\(s\), minimum n = 30/);
     assert.match(text, /narc × quality\s+REFUSED — n=2 is below the minimum of 30/);
-    const json = JSON.parse(execFileSync(process.execPath, ['scripts/gds/grade-correlation-audit.js', '--file', file, '--json'], { cwd: ROOT, encoding: 'utf8' }));
+    const json = JSON.parse(execFileSync(process.execPath, ['scripts/bongos/grade-correlation-audit.js', '--file', file, '--json'], { cwd: ROOT, encoding: 'utf8' }));
     assert.equal(json.panels, 2);
     assert.equal(json.pairwise.length, 6);
   } finally {

package/tests/grade_diff_hash.mjs

@@ -16,7 +16,7 @@ import { createRequire } from 'node:module';
 import { makeSqlAwareClient } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { diffHash, shouldReuseGrade, reconstructPanelIssues } = require('../scripts/gds/ship.js');
+const { diffHash, shouldReuseGrade, reconstructPanelIssues } = require('../scripts/bongos/ship.js');
 const db = require('../modules/lifecycle/db.js');
 // applyGrade resolves the 'reward' kernel port; register it so calls in the
 // passed=true path don't blow up on null (mirrors grade_attribution.mjs).

package/tests/grade_engine_replay.mjs

@@ -2,7 +2,7 @@
 // (task 1002839, ADR 0089 §1).
 //
 // The corpus (tests/fixtures/grade-replay/recorded-panel-grades.json) is real:
-// production grade rows pulled by `scripts/gds/grade-replay.js --live
+// production grade rows pulled by `scripts/bongos/grade-replay.js --live
 // --write-fixture`, one per panel shape, with review prose hashed. Each row
 // carries the judges' persisted verdicts and the decision the server stored.
 // Replaying the verdicts through the grade engine's aggregate + gate stages must
@@ -21,7 +21,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const grader = require('../modules/grading/grader.js');
-const replay = require('../scripts/gds/grade-replay.js');
+const replay = require('../scripts/bongos/grade-replay.js');
 const { grades: corpus } = require('./fixtures/grade-replay/recorded-panel-grades.json');
 
 const clone = (v) => JSON.parse(JSON.stringify(v));

package/tests/grade_server_authoritative.mjs

@@ -6,7 +6,7 @@
 // THE FINDING: validateAndScore only shape-validates the submitted numbers —
 // `passed` is computed from the CLIENT's values. The real adversarial panel + the
 // deterministic route-rank / permission-path pre-passes run CLIENT-SIDE in
-// scripts/gds/ship.js; the server never re-runs them. So a builder could POST
+// scripts/bongos/ship.js; the server never re-runs them. So a builder could POST
 // {functional_fidelity:10, code_quality:10, confidence:1, issues:[]} to self-pass,
 // and forged signals.diff_stats / committed_files could mint the net-negative
 // "Subtractor" bonus + shipper badges (SR-18).

package/tests/grade_unavailable_display.mjs

@@ -12,7 +12,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const ship = require('../scripts/gds/ship.js');
+const ship = require('../scripts/bongos/ship.js');
 const grader = require('../modules/grading/grader.js');
 const { formatGradeOutcome } = ship;