@bongos/core 1.21.180 → 1.21.182

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.21.180",
-  "core_contract": "1.21.180",
-  "source_commit": "36dc85d6b63259779e000aebdf3dc1e0138792b0",
+  "core_version": "1.21.182",
+  "core_contract": "1.21.182",
+  "source_commit": "7c1587ddd1d73cdd824b50d8b2673acef202c345",
   "source_ref": "HEAD",
-  "built_at": "2026-10-26T00:58:50.603Z",
+  "built_at": "2026-10-26T02:28:14.376Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 616,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4184,
-  "tree_sha256": "fbe7e2684882ff2e854978d9a494f9058adeb5f62571e3e020009f9074f48249",
+  "tree_sha256": "92cf3493310173b9b2f207960210b2cf928d4da8e73e1810f0338412329118fa",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "4e0a9cf41330f62ec1d2bacdc07a7071b4081517e60f6446fe66a33e44175ce9"
+      "sha256": "b0d4bd11b81295f36fec4c76d6b2f37f27834b31e101f6f753ef2e4f74f0a648"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2937,7 +2937,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "82235d195b8ec1dae8f427ce3b500af7abcb84d3c265702ef66589f86abccc64"
+      "sha256": "e2197d9aa0029cc2fe02353ecac558c7a051df54999b694fefa41335a415cdb1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5379,11 +5379,6 @@
       "mode": "0000644",
       "sha256": "a07001ad8854abc7b997eb900fe435990f90392ac6808688496f022d81219cf8"
     },
-    {
-      "path": "modules/government/protected-surfaces.js",
-      "mode": "0000644",
-      "sha256": "527ae1c53369eb0c6878584d311afa08d9e5d6ea4c8f9ce60406e57dcdf692aa"
-    },
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
@@ -10827,12 +10822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ee9b6a44618660fc762c163d437234d8113af7f3d58e135a833ba5b1bc24fc2b"
+      "sha256": "2bcd79989eda93d96e1e04728683589bd539bb6371f2c44229ad14eb2a6cc968"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d1b93e086b2f09ccba18efa17327c3ca20cec70c4b1e6f305ded43643fce1f26"
+      "sha256": "18e16f23126637566ce4f667c6dd6b5f81a6d43034f2beef8cad0b2184d9a885"
     },
     {
       "path": "public-docs/index.html",
@@ -10852,7 +10847,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "6863c7358f68a6456d7be9d06d184442c3f3af03e8a27dab308913962649b751"
+      "sha256": "ceca276036f7a58806471e1fa82c20b240be069a10eb6786b2c4d652cd5a5be8"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12052,7 +12047,7 @@
     {
       "path": "scripts/bongos/repo-metrics.js",
       "mode": "0000644",
-      "sha256": "c1ee7d69e2ef949ecec2ff7f602c9876a835fb9853585e21aea4c2d215c9aa1f"
+      "sha256": "15dee800bf6fc5aca8a9d332854825b1d0081f2269ccdf69c2b5d3e1010009cb"
     },
     {
       "path": "scripts/bongos/retired-core-skills.json",
@@ -14677,7 +14672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "391a575b2a36039085561dfa8e1b76080d46a678f59dcde76ebb6e1c6a829945"
+      "sha256": "1a1c9489fe25fb1f38547caad2c8f56196c02183d75f94a223ca92ce44e8c3b4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16922,7 +16917,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "6c974754ccdf93e12d6a9154e15642dcd952733c836ae5016b94eddff80232af"
+      "sha256": "62343f456ba76291cfb1bebd13e6e8164b1734e79adf33ee71c1c3372522d9c7"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -19604,6 +19599,11 @@
       "mode": "0000644",
       "sha256": "5c964c162b87f2e73f6dc3343b1c4be886b7d3e0d29c01d51280dc790fc218e7"
     },
+    {
+      "path": "tests/repo_metrics_dead_exports.mjs",
+      "mode": "0000644",
+      "sha256": "f98a3d9635557d050f428c5ad3258ff1ef7652bf0f4fba87830cc09481b76e9b"
+    },
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",

package/docs/file-map.md

@@ -124,7 +124,7 @@
 │   ├── pixel-art/               ← the opt-in pixel-art skills (task 1004470, default-OFF): otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture, otb-figma-sync under skills/<name>/SKILL.md — moved out of .claude/skills/, where they were orphans no manifest owned. Skill TEXT only: the pipeline, palette, rubric and the copyrighted reference maps stay in the instance's never-published art-pipeline (ADR 0098). module.json, CLAUDE.md, skills/.
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest (its otb-character-review skill is the pixel-art module's since task 1004470). CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
-│   ├── government/              ← CORE-DOMAIN module (ADR 0151 / BV1 goal 1000030, renamed governance→government by ADR 0174, default-on): Discord-style configurable ranks + permissions. The PERMISSION is the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; the module owns the code-defined permission catalog — each key flagged `system` (trust-boundary), `substrate` (enforced out of band) or operational (delegable) — plus the compatibility seed that reproduces the old rank thresholds exactly. ADR 0016 is preserved: authority is still resolved server-side, per request, uncached. The word `role` is deliberately absent — it is reserved for the crafts. CLAUDE.md, module.json, catalog.js, ranks.js, resolver.js, config.js, db.js, board.js + board-membership.js + membership-predicate.js, session-scopes.{js,json}, protected-surfaces.{js,json}, routes/ (government + rank-sync), pollers/ (board-expiry), migrations/.
+│   ├── government/              ← CORE-DOMAIN module (ADR 0151 / BV1 goal 1000030, renamed governance→government by ADR 0174, default-on): Discord-style configurable ranks + permissions. The PERMISSION is the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; the module owns the code-defined permission catalog — each key flagged `system` (trust-boundary), `substrate` (enforced out of band) or operational (delegable) — plus the compatibility seed that reproduces the old rank thresholds exactly. ADR 0016 is preserved: authority is still resolved server-side, per request, uncached. The word `role` is deliberately absent — it is reserved for the crafts. CLAUDE.md, module.json, catalog.js, ranks.js, resolver.js, config.js, db.js, board.js + board-membership.js + membership-predicate.js, session-scopes.{js,json}, protected-surfaces.json, routes/ (government + rank-sync), pollers/ (board-expiry), migrations/.
 │   ├── specialities/            ← CORE-DOMAIN module (task 1003855 / ADR 0296, default-on): role SUB-SPECIALITIES — a named bundle of knowledge, skills and an interaction contract sitting UNDER a craft. A craft says HOW you work (engineer/ideator/artist/ui); a speciality says WHAT you work on, and how a subject-matter expert wants to be engaged inside it. Deliberately thin over three surfaces that already exist — discipline-modes.json for craft→playbook, behavior_prefs.interaction for the per-session contract (a speciality contract rides the SAME GET /me → Conductor path rather than adding a second one), and the ADR 0083 manifest for declared skills; the only new machinery is the knowledge bundle. Training is two-fold: documents the builder supplied, plus learnings captured from sessions worked in the speciality (pointing at existing `learnings` rows, never a second corpus). Owned per-builder OR per-project, each carrying its owner's sharing decision (private/project/public) and a sellable flag that records INTENT only — ADR 0107 defers the marketplace, so there is nothing to list on. CLAUDE.md, module.json, specialities.js, db.js, routes/, migrations/.
 │   ├── agents/                  ← declarative agent registry (BV1 goal 1000038 Phase 1) — the one module that ships `default:false`, so shipped is not enabled and an instance opts in per ADR 0083. `.claude/agents/*.md` are reconciled at deploy into `agents_definitions` plus the per-fire `agents_runs` ledger; files-are-source (an instance-authored DB row is never clobbered), and `author_rank` is stamped from the author's LIVE DB rank because a committed file cannot grant authority (ADR 0016). Spawns consume the EXISTING read-only `grade` port, so v1 agents are observe-and-report only — no write principals — and every fire bills through the shared LLM cost cache. `spend.requiresPayer` (task 1003884): a fire spends real money for whoever called it, so the core REFUSES to enable the module on an instance whose join door is `open` with no payer configured — an account created seconds ago would otherwise spend the instance's money with nobody to bill. lib/spend-ceiling.js is the per-payer monthly ceiling, failing closed when it is exhausted OR unreadable; lib/fire-budget.js is the separate RATE ceiling. CLAUDE.md, module.json, spawn.js, lib/, routes/, pollers/ (event-router), migrations/.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -3197,5 +3197,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.178 with no explicit bump. run 40250732318. (task 1002620)
   1.21.180 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.179 with no explicit bump. run 40251859318. (task 1002620)
+  1.21.181 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.180 with no explicit bump. run 40253320267. (task 1002620)
+  1.21.182 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.181 with no explicit bump. run 40259167777. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.180",
+  "version": "1.21.182",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.180",
+      "version": "1.21.182",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.180",
+  "version": "1.21.182",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10356,5 +10356,17 @@
       "id": "1004875",
       "text": "The unused-code check now covers modules/, the largest part of the codebase, and fails the build when someone adds a dead file or an unused export there. Five dead exports were removed along the way."
     }
+  ],
+  "1.21.181": [
+    {
+      "id": "1004892",
+      "text": "The repo health dashboard's dead-code number now counts the same way the CI check does, so it no longer jumps by about 1,800 false alarms from modules/."
+    }
+  ],
+  "1.21.182": [
+    {
+      "id": "1004890",
+      "text": "Removed a leftover permission-list checker that nothing in the product used; the real protections and their tests are unchanged."
+    }
   ]
 }

package/scripts/bongos/repo-metrics.js

@@ -37,6 +37,7 @@ const { execSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 const { hasFlag } = require('./cli-lib');
+const { countKnipFindings } = require('./fitness-ratchets');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 const TOP_N_LARGEST = 15;
@@ -151,36 +152,44 @@ function scanDeadCode() {
     return { dead_exports: null, dead_files: null, knip_status: 'unparseable' };
   }
 
-  // knip v6 JSON shape: { issues: [{ file, files (bool: whole file unused),
-  // exports:[...], types:[...], ... }] }. A top-level `files` array exists in
-  // some reporter modes; handle both. dead_exports sums unused exports+types
-  // across issues; dead_files counts issues whose whole file is unused.
-  let deadFiles = null;
+  const scored = scoreKnipReport(report);
+  if (!scored) return { dead_exports: null, dead_files: null, knip_status: 'unexpected_shape' };
+  return { ...scored, knip_status: 'ok' };
+}
+
+// knip JSON -> { dead_exports, dead_files }, or null on a shape we cannot read.
+//
+// dead_exports goes through the CI ratchet's own scorer, countKnipFindings, fed only
+// the exports/types findings (task 1004892). Counting knip's raw list instead put
+// ~1,800 exports under modules/ on the dashboard that ARE used: knip does not credit
+// a CommonJS namespace use (`lib.x`), and modules/ is written that way. The scorer's
+// name filter drops those, so this number and the ratchet's agree. `opts` passes
+// through to the scorer (a test injects `wordIndex`).
+//
+// COST: the scorer builds its word index once per call (codeWordIndex walks the
+// repo's .js/.mjs/.cjs/.html/.sh text) — measured ~2.3 s on this repo, beside a knip
+// run that already takes far longer. It is deliberately NOT fed from
+// gatherFileSizes()'s reads: that list is git-tracked .js/.mjs only, while the
+// ratchet's index also reads .cjs/.html/.sh and skips docs/ — a different file set
+// gives a different count, and matching CI's number is the whole point.
+function scoreKnipReport(report, opts = {}) {
+  if (!report || typeof report !== 'object') return null;
+  const hasIssues = Array.isArray(report.issues);
+  if (!hasIssues && !Array.isArray(report.files)) return null;
   let deadExports = null;
-  try {
-    if (Array.isArray(report.issues)) {
-      deadExports = report.issues.reduce((acc, issue) => {
-        const ex = Array.isArray(issue.exports) ? issue.exports.length : 0;
-        const ty = Array.isArray(issue.types) ? issue.types.length : 0;
-        return acc + ex + ty;
-      }, 0);
-      deadFiles = report.issues.reduce(
-        // knip 6 gives an ARRAY here ([{ name }]), not a bool (task 1004875).
-        (acc, issue) => acc + (issue.files === true || (Array.isArray(issue.files) && issue.files.length) ? 1 : 0),
-        0
-      );
-    }
-    // Some reporter modes additionally surface a flat unused-file list.
-    if (Array.isArray(report.files)) {
-      deadFiles = (deadFiles ?? 0) + report.files.length;
-    }
-    if (deadExports == null && deadFiles == null) {
-      return { dead_exports: null, dead_files: null, knip_status: 'unexpected_shape' };
-    }
-  } catch (_) {
-    return { dead_exports: null, dead_files: null, knip_status: 'unexpected_shape' };
+  let deadFiles = null;
+  if (hasIssues) {
+    const exportsOnly = report.issues.map((issue) => ({ file: issue.file, exports: issue.exports, types: issue.types }));
+    deadExports = countKnipFindings({ issues: exportsOnly }, opts);
+    deadFiles = report.issues.reduce(
+      // knip 6 gives an ARRAY here ([{ name }]), not a bool (task 1004875).
+      (acc, issue) => acc + (issue.files === true || (Array.isArray(issue.files) && issue.files.length) ? 1 : 0),
+      0
+    );
   }
-  return { dead_exports: deadExports, dead_files: deadFiles, knip_status: 'ok' };
+  // Some reporter modes additionally surface a flat unused-file list.
+  if (Array.isArray(report.files)) deadFiles = (deadFiles ?? 0) + report.files.length;
+  return { dead_exports: deadExports, dead_files: deadFiles };
 }
 
 // ---------- branch hygiene ----------
@@ -287,7 +296,7 @@ async function upsertSnapshot(pool, snap) {
 
 // ---------- main ----------
 
-(async () => {
+async function main() {
   const args = process.argv.slice(2);
   const asJson = hasFlag('--json', args);
   const noWrite = hasFlag('--no-write', args);
@@ -360,7 +369,15 @@ async function upsertSnapshot(pool, snap) {
   }
 
   process.exit(0);
-})().catch((err) => {
-  console.error('fatal:', err);
-  process.exit(1);
-});
+}
+
+module.exports = { scoreKnipReport };
+
+// CLI only when run directly, so a test can require this file without it
+// scanning the repo or writing to the DB (task 1004892).
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('fatal:', err);
+    process.exit(1);
+  });
+}

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.180'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.182'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -26,9 +26,23 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GOV = path.join(ROOT, 'modules', 'government');
 
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
-const registry = require(path.join(GOV, 'protected-surfaces.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 
+// The registry exactly as the live kernel matcher loads it — the one loader the
+// enforcers (pre-push hook, grader pre-pass, main audit, goal-scope check) use.
+// Task 1004890 deleted modules/government/protected-surfaces.js, a wrapper over
+// this same matcher that nothing but this test ever required; FLOOR and
+// SYSTEM_PERMISSIONS are derived here the way it derived them.
+const registry = {
+  SURFACES: ppc.PROTECTED_SURFACES,
+  PROTECTED_GLOBS: ppc.PROTECTED_GLOBS,
+  FLOOR: catalog.RANK_ORDER[Math.min(...ppc.PROTECTED_SURFACES.map((s) => catalog.RANK_ORDER.indexOf(s.floor)))],
+  SYSTEM_PERMISSIONS: [...new Set(ppc.PROTECTED_SURFACES.map((s) => s.permission))].sort(),
+  surfaceFor: (file) => ppc.surfaceFor(file),
+  floorFor: (file) => ppc.floorFor(file),
+  isProtected: (file) => ppc.surfaceFor(file) !== null,
+};
+
 // The verbatim PROTECTED_GLOBS array as it stood immediately before R101.
 const EXPECTED_GLOBS_BEFORE_R101 = [
   'src/bongos/auth.js',
@@ -979,91 +993,6 @@ test('every entry maps to a permission the catalog defines as system:true', () =
   assert.deepEqual(registry.SYSTEM_PERMISSIONS, ['path.protected.modify']);
 });
 
-// Feed a BAD registry through the real loader in a cold subprocess and assert the
-// module refuses to load. The pattern is the sibling probe below ("a missing
-// registry fails CLOSED"): patch fs.readFileSync for the registry path only, then
-// require the module under test and let its load-time throw be the result.
-//
-// WHY A SUBPROCESS AND NOT AN IN-PROCESS ASSERTION (task 1003196, finding 9). The
-// version of this test before that task read the catalog and checked that a
-// grantable key exists and an unknown key returns null — both true regardless of
-// whether the guard exists. Demonstrated: deleting the whole validation loop from
-// modules/government/protected-surfaces.js left the entire suite green. The guard
-// is load-time, so only a fresh module load can exercise it, and the registry is
-// read from disk, so only a patched read can make it bad.
-//
-// This matters because the sibling test above ("every entry maps to a permission
-// the catalog defines as system:true") only checks the COMMITTED file. The
-// load-time throw is what protects an out-of-band registry write — the Government
-// tab editing an instance file at runtime — and nothing was watching it.
-function loadWithRegistry(registryJson) {
-  execFileSync(process.execPath, ['-e',
-    "const fs=require('node:fs');const real=fs.readFileSync;" +
-    'const fake=' + JSON.stringify(JSON.stringify(registryJson)) + ';' +
-    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? fake : real(p,...r));" +
-    "require('./modules/government/protected-surfaces.js');",
-  ], { cwd: ROOT, stdio: 'pipe' });
-}
-
-test('a surface mapped to a GRANTABLE permission fails loud at load', () => {
-  // A grantable (system:false) key is the dangerous case ADR 0151 §4 names: a
-  // custom rank could be handed the very power the substrate reserves.
-  const grantable = catalog.grantableKeys()[0];
-  assert.ok(grantable, 'the catalog must define at least one grantable key for this probe');
-  assert.equal(catalog.isSystem(grantable), false, 'fixture sanity: the probe key must be grantable');
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'metic',
-      permission: grantable,
-      surfaces: [{ glob: 'src/probe/grantable-surface.js' }],
-    }),
-    /which is not system:true/,
-    'a surface mapping to a grantable permission must refuse to load',
-  );
-});
-
-test('a surface mapped to an UNKNOWN permission fails loud at load', () => {
-  assert.equal(catalog.byKey('not.a.real.permission'), null, 'fixture sanity: the key must be unknown');
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'metic',
-      permission: 'not.a.real.permission',
-      surfaces: [{ glob: 'src/probe/unknown-surface.js' }],
-    }),
-    /which the permission catalog does not define/,
-    'a surface mapping to a permission the catalog never defines must refuse to load',
-  );
-});
-
-test('the probe itself is honest — a GOOD registry loads clean through the same path', () => {
-  // Without this, both assertions above would pass if the subprocess threw for an
-  // unrelated reason (a bad patch, a missing cwd, a syntax error in the -e script).
-  assert.doesNotThrow(() => loadWithRegistry({
-    floor: 'metic',
-    permission: registry.SYSTEM_PERMISSIONS[0],
-    surfaces: [{ glob: 'src/probe/good-surface.js' }],
-  }), 'a well-formed registry must still load — otherwise the probes above prove nothing');
-});
-
-test('an unknown FLOOR is refused before the catalog check ever sees it', () => {
-  // The validation loop's third branch (`!catalog.RANK_ORDER.includes(s.floor)`) is
-  // a DRIFT guard, not dead code, and this test records why it cannot be provoked
-  // through the registry: the kernel loader keeps its own local RANK_TIER map
-  // (permission-path-check.js) and rejects an unknown floor first. The government
-  // branch only becomes reachable if those two rank lists ever disagree — which is
-  // exactly the drift it exists to catch, and is not craftable from JSON alone.
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'emperor',
-      permission: registry.SYSTEM_PERMISSIONS[0],
-      surfaces: [{ glob: 'src/probe/bad-floor.js' }],
-    }),
-    /unknown floor/,
-  );
-  assert.deepEqual(catalog.RANK_ORDER, ['xenos', 'thetes', 'metic', 'archon'],
-    'if this list and the kernel RANK_TIER drift, the government floor branch wakes up');
-});
-
 // ---------- synchronous, no DB, no server ----------
 
 test('the registry loads synchronously from the repo with no DB and no server', () => {
@@ -1080,12 +1009,6 @@ test('the registry loads synchronously from the repo with no DB and no server',
 test('the registry data file carries no DB/network dependency', () => {
   const json = fs.readFileSync(path.join(GOV, 'protected-surfaces.json'), 'utf8');
   assert.doesNotThrow(() => JSON.parse(json), 'the canonical form must be plain parseable data');
-  const code = fs.readFileSync(path.join(GOV, 'protected-surfaces.js'), 'utf8')
-    .split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
-  for (const banned of ['./db', 'pool', 'fetch(', 'await ']) {
-    assert.ok(!code.includes(banned),
-      `protected-surfaces.js must not introduce "${banned}" — the substrate reads this with no DB and no server (ADR 0151 §4)`);
-  }
 });
 
 // ---------- policy owns / substrate enforces ----------
@@ -1095,10 +1018,6 @@ test('the kernel does not require the governance module (ADR 0083 one-way rule)'
   const requires = [...kernel.matchAll(/require\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1]);
   assert.deepEqual(requires.filter((r) => r.includes('modules/')), [],
     'core must never require a module — it reads the registry as data');
-  // …and the flow runs the legal way: governance reaches the matcher through the doorway.
-  const gov = fs.readFileSync(path.join(GOV, 'protected-surfaces.js'), 'utf8');
-  assert.ok(/require\(\s*['"]\.\.\/\.\.\/src\/module-api['"]\s*\)/.test(gov),
-    'governance must reach the kernel matcher through the published doorway');
 });
 
 test('the hardcoded protected list is gone from the kernel — one source, no drift', () => {

package/tests/repo_metrics_dead_exports.mjs

@@ -0,0 +1,57 @@
+// tests/repo_metrics_dead_exports.mjs — repo-metrics scores dead exports the way the
+// CI knip ratchet does (task 1004892).
+//
+// Once knip scanned modules/ (task 1004875), repo-metrics' raw export count jumped by
+// ~1,800: knip does not credit a CommonJS namespace use (`lib.x`), and modules/ is
+// written that way. The ratchet's scorer (countKnipFindings) filters those by name;
+// repo-metrics must use the same scorer, so the dashboard number matches CI's.
+// Hermetic: synthetic knip JSON and an injected word index, no knip run.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rm = require(path.join(ROOT, 'scripts/bongos/repo-metrics.js'));
+const fr = require(path.join(ROOT, 'scripts/bongos/fitness-ratchets.js'));
+
+const issue = (file, extra) => ({ file, files: [], exports: [], types: [], dependencies: [], unlisted: [], ...extra });
+
+test('a modules/ export used through a namespace elsewhere is not a dead export', () => {
+  const wordIndex = new Map([
+    ['usedViaNamespace', true], // spelled in 2+ files
+    ['onlyHere', 'modules/x/lib.js'], // spelled only in its own file
+  ]);
+  const report = {
+    issues: [
+      issue('modules/x/lib.js', {
+        exports: [{ name: 'usedViaNamespace' }, { name: 'onlyHere' }],
+        types: [{ name: 'neverSpelled' }],
+      }),
+      issue('src/y.js', { exports: [{ name: 'usedViaNamespace' }] }), // outside modules/: knip's verdict stands
+    ],
+  };
+  const scored = rm.scoreKnipReport(report, { wordIndex });
+  assert.equal(scored.dead_exports, 3); // onlyHere + neverSpelled + the src/ one
+  // ...and that is exactly the ratchet scorer's count for the same export/type findings.
+  assert.equal(scored.dead_exports, fr.countKnipFindings(report, { wordIndex }));
+});
+
+test('non-export findings (deps, unlisted) do not leak into dead_exports; dead files still count', () => {
+  const report = {
+    issues: [
+      issue('src/a.js', { files: [{ name: 'src/a.js' }], dependencies: [{ name: 'left-pad' }], exports: [{ name: 'x' }] }),
+      issue('src/b.js', { unlisted: [{ name: 'chalk' }] }),
+    ],
+  };
+  const scored = rm.scoreKnipReport(report, { wordIndex: new Map() });
+  assert.equal(scored.dead_exports, 1);
+  assert.equal(scored.dead_files, 1);
+});
+
+test('a report with no issues list is an unexpected shape (null), not zero', () => {
+  assert.equal(rm.scoreKnipReport({}, { wordIndex: new Map() }), null);
+  assert.equal(rm.scoreKnipReport(null, { wordIndex: new Map() }), null);
+});

package/modules/government/protected-surfaces.js

@@ -1,88 +0,0 @@
-'use strict';
-
-// modules/government/protected-surfaces.js — the protected-surface registry's
-// GOVERNMENT-side API (ADR 0151 §4, BV1.R101).
-//
-// POLICY OWNS / SUBSTRATE ENFORCES — the whole point of this slice.
-//
-//   GOVERNMENT OWNS THE DATA. protected-surfaces.json (next to this file) says
-//   WHICH repo paths are protected, at WHAT rank floor, mapped to WHICH
-//   `system: true` catalog permission. That file is the source of truth; the
-//   Archon Government tab (R110/R111) edits it as policy. Before R101 the same
-//   information was a hardcoded PROTECTED_GLOBS constant inside the kernel.
-//
-//   THE OUT-OF-BAND SUBSTRATE STAYS THE ENFORCER. Nothing here enforces
-//   anything. The enforcers are the git pre-push hook, the grader pre-pass, the
-//   post-push main audit and the goal-scope check — they read
-//   the registry with no DB, no server and no HTTP, and they are what actually
-//   blocks a sub-floor change (ADR 0043). Re-mapping a floor here changes what
-//   the substrate protects; it can never make the request path the authority.
-//   Moving enforcement into the app is the regression R101 exists to prevent
-//   (ADR 0151 §"Alternatives considered").
-//
-//   NO DB DEPENDENCY. A DB-backed override is a government-tab concern layered
-//   on top and must never become a dependency of the hook — the hook runs on a
-//   laptop with no database and no network. This module is therefore
-//   synchronous, DB-free and requires nothing but the catalog and the doorway.
-//
-// DEPENDENCY DIRECTION (ADR 0083's one-way rule). Code flows exactly one way:
-// this module → src/module-api.js (the published doorway) → the kernel matcher
-// in src/bongos/permission-path-check.js. Core never requires this module. The
-// kernel loads the JSON data file directly (a static data read, the same way the
-// sibling trust primitive route-rank-check.js reads modules/*/routes/*.js off
-// disk to rank-gate them), and we read the parsed result back through the
-// doorway so there is exactly ONE loader and ONE matcher — no second list to
-// drift (the SEC #863 failure mode).
-
-const api = require('../../src/module-api');
-const catalog = require('./catalog');
-
-const ppc = api.permissionPathCheck;
-
-// The registry, as parsed by the single kernel loader.
-const SURFACES = ppc.PROTECTED_SURFACES;
-
-// ── invariants asserted at module load (fail loud on an authoring typo) ───────
-// The government module is where the registry meets the permission catalog, so
-// this is where "every protected surface maps to a real, non-grantable
-// permission" is checked. A surface mapping to an unknown key, or to a
-// `system: false` (grantable) key, would mean an Archon could hand a custom rank
-// the power the substrate is supposed to reserve — exactly the wall ADR 0151 §4
-// builds. Fail loud rather than silently protecting nothing.
-for (const s of SURFACES) {
-  const perm = catalog.byKey(s.permission);
-  if (!perm) {
-    throw new Error(`protected-surface registry: "${s.glob}" maps to "${s.permission}", which the permission catalog does not define`);
-  }
-  if (perm.system !== true) {
-    throw new Error(`protected-surface registry: "${s.glob}" maps to "${s.permission}", which is not system:true — a protected surface must map to a NON-GRANTABLE permission (ADR 0151 §4)`);
-  }
-  if (!catalog.RANK_ORDER.includes(s.floor)) {
-    throw new Error(`protected-surface registry: "${s.glob}" declares floor "${s.floor}", which is not a rank`);
-  }
-}
-
-// The lowest floor any surface declares — 'metic' today (ADR 0043's Metic floor,
-// now DERIVED from registry data rather than hardcoded).
-const FLOOR = catalog.RANK_ORDER[Math.min(...SURFACES.map((s) => catalog.RANK_ORDER.indexOf(s.floor)))];
-
-// The distinct system permissions the registry maps onto.
-const SYSTEM_PERMISSIONS = Object.freeze([...new Set(SURFACES.map((s) => s.permission))].sort());
-
-// Per-path lookups — the single matcher, reached through the doorway.
-const surfaceFor = (file) => ppc.surfaceFor(file);
-const floorFor = (file) => ppc.floorFor(file);
-const permissionFor = (file) => ppc.permissionFor(file);
-const isProtected = (file) => ppc.surfaceFor(file) !== null;
-
-module.exports = {
-  SURFACES,
-  PROTECTED_GLOBS: ppc.PROTECTED_GLOBS,
-  REGISTRY_PATH: ppc.REGISTRY_PATH,
-  FLOOR,
-  SYSTEM_PERMISSIONS,
-  surfaceFor,
-  floorFor,
-  permissionFor,
-  isProtected,
-};