@bongos/core 1.21.181 → 1.21.182

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.21.181",
-  "core_contract": "1.21.181",
-  "source_commit": "677ee2b818cf829dddd5434301b158be3408fbd5",
+  "core_version": "1.21.182",
+  "core_contract": "1.21.182",
+  "source_commit": "7c1587ddd1d73cdd824b50d8b2673acef202c345",
   "source_ref": "HEAD",
-  "built_at": "2026-10-26T01:16:25.738Z",
+  "built_at": "2026-10-26T02:28:14.376Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 616,
     "agent_docs_stubbed": 29,
-    "functional_verbatim": 3539,
+    "functional_verbatim": 3538,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4185,
-  "tree_sha256": "e69b48d53a056c99114f3c5904e69828363e91f5f0df70b7b599e61e8e299d1d",
+  "file_count": 4184,
+  "tree_sha256": "92cf3493310173b9b2f207960210b2cf928d4da8e73e1810f0338412329118fa",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "4e0a9cf41330f62ec1d2bacdc07a7071b4081517e60f6446fe66a33e44175ce9"
+      "sha256": "b0d4bd11b81295f36fec4c76d6b2f37f27834b31e101f6f753ef2e4f74f0a648"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2937,7 +2937,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4835f21d9d6cf7eaa82821e1bb5eb4c79493267300ef852ad1ca1c05b4a41e65"
+      "sha256": "e2197d9aa0029cc2fe02353ecac558c7a051df54999b694fefa41335a415cdb1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5379,11 +5379,6 @@
       "mode": "0000644",
       "sha256": "a07001ad8854abc7b997eb900fe435990f90392ac6808688496f022d81219cf8"
     },
-    {
-      "path": "modules/government/protected-surfaces.js",
-      "mode": "0000644",
-      "sha256": "527ae1c53369eb0c6878584d311afa08d9e5d6ea4c8f9ce60406e57dcdf692aa"
-    },
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
@@ -10827,12 +10822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4d3ecd3d1a0b7e6602da53e83e88c204ab82a45ca83ae3d24979746970f15ac9"
+      "sha256": "2bcd79989eda93d96e1e04728683589bd539bb6371f2c44229ad14eb2a6cc968"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2a01fd05d918fc38ad18d1cc6305681129b6115a4eab33f7d1fa4d34b8da2e44"
+      "sha256": "18e16f23126637566ce4f667c6dd6b5f81a6d43034f2beef8cad0b2184d9a885"
     },
     {
       "path": "public-docs/index.html",
@@ -10852,7 +10847,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "2a6e6fa89b09fd51aa8fae09c92eec30b6d0823dcdf3eaeda63826e7269a46ea"
+      "sha256": "ceca276036f7a58806471e1fa82c20b240be069a10eb6786b2c4d652cd5a5be8"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -14677,7 +14672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c48862d3a5d62afff6c50b8de356b68ec2ef4f22ced0c0caa36a99d5f135747a"
+      "sha256": "1a1c9489fe25fb1f38547caad2c8f56196c02183d75f94a223ca92ce44e8c3b4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16922,7 +16917,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "6c974754ccdf93e12d6a9154e15642dcd952733c836ae5016b94eddff80232af"
+      "sha256": "62343f456ba76291cfb1bebd13e6e8164b1734e79adf33ee71c1c3372522d9c7"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/file-map.md

@@ -124,7 +124,7 @@
 │   ├── pixel-art/               ← the opt-in pixel-art skills (task 1004470, default-OFF): otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture, otb-figma-sync under skills/<name>/SKILL.md — moved out of .claude/skills/, where they were orphans no manifest owned. Skill TEXT only: the pipeline, palette, rubric and the copyrighted reference maps stay in the instance's never-published art-pipeline (ADR 0098). module.json, CLAUDE.md, skills/.
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest (its otb-character-review skill is the pixel-art module's since task 1004470). CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
-│   ├── government/              ← CORE-DOMAIN module (ADR 0151 / BV1 goal 1000030, renamed governance→government by ADR 0174, default-on): Discord-style configurable ranks + permissions. The PERMISSION is the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; the module owns the code-defined permission catalog — each key flagged `system` (trust-boundary), `substrate` (enforced out of band) or operational (delegable) — plus the compatibility seed that reproduces the old rank thresholds exactly. ADR 0016 is preserved: authority is still resolved server-side, per request, uncached. The word `role` is deliberately absent — it is reserved for the crafts. CLAUDE.md, module.json, catalog.js, ranks.js, resolver.js, config.js, db.js, board.js + board-membership.js + membership-predicate.js, session-scopes.{js,json}, protected-surfaces.{js,json}, routes/ (government + rank-sync), pollers/ (board-expiry), migrations/.
+│   ├── government/              ← CORE-DOMAIN module (ADR 0151 / BV1 goal 1000030, renamed governance→government by ADR 0174, default-on): Discord-style configurable ranks + permissions. The PERMISSION is the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; the module owns the code-defined permission catalog — each key flagged `system` (trust-boundary), `substrate` (enforced out of band) or operational (delegable) — plus the compatibility seed that reproduces the old rank thresholds exactly. ADR 0016 is preserved: authority is still resolved server-side, per request, uncached. The word `role` is deliberately absent — it is reserved for the crafts. CLAUDE.md, module.json, catalog.js, ranks.js, resolver.js, config.js, db.js, board.js + board-membership.js + membership-predicate.js, session-scopes.{js,json}, protected-surfaces.json, routes/ (government + rank-sync), pollers/ (board-expiry), migrations/.
 │   ├── specialities/            ← CORE-DOMAIN module (task 1003855 / ADR 0296, default-on): role SUB-SPECIALITIES — a named bundle of knowledge, skills and an interaction contract sitting UNDER a craft. A craft says HOW you work (engineer/ideator/artist/ui); a speciality says WHAT you work on, and how a subject-matter expert wants to be engaged inside it. Deliberately thin over three surfaces that already exist — discipline-modes.json for craft→playbook, behavior_prefs.interaction for the per-session contract (a speciality contract rides the SAME GET /me → Conductor path rather than adding a second one), and the ADR 0083 manifest for declared skills; the only new machinery is the knowledge bundle. Training is two-fold: documents the builder supplied, plus learnings captured from sessions worked in the speciality (pointing at existing `learnings` rows, never a second corpus). Owned per-builder OR per-project, each carrying its owner's sharing decision (private/project/public) and a sellable flag that records INTENT only — ADR 0107 defers the marketplace, so there is nothing to list on. CLAUDE.md, module.json, specialities.js, db.js, routes/, migrations/.
 │   ├── agents/                  ← declarative agent registry (BV1 goal 1000038 Phase 1) — the one module that ships `default:false`, so shipped is not enabled and an instance opts in per ADR 0083. `.claude/agents/*.md` are reconciled at deploy into `agents_definitions` plus the per-fire `agents_runs` ledger; files-are-source (an instance-authored DB row is never clobbered), and `author_rank` is stamped from the author's LIVE DB rank because a committed file cannot grant authority (ADR 0016). Spawns consume the EXISTING read-only `grade` port, so v1 agents are observe-and-report only — no write principals — and every fire bills through the shared LLM cost cache. `spend.requiresPayer` (task 1003884): a fire spends real money for whoever called it, so the core REFUSES to enable the module on an instance whose join door is `open` with no payer configured — an account created seconds ago would otherwise spend the instance's money with nobody to bill. lib/spend-ceiling.js is the per-payer monthly ceiling, failing closed when it is exhausted OR unreadable; lib/fire-budget.js is the separate RATE ceiling. CLAUDE.md, module.json, spawn.js, lib/, routes/, pollers/ (event-router), migrations/.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -3199,5 +3199,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.179 with no explicit bump. run 40251859318. (task 1002620)
   1.21.181 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.180 with no explicit bump. run 40253320267. (task 1002620)
+  1.21.182 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.181 with no explicit bump. run 40259167777. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.181",
+  "version": "1.21.182",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.181",
+      "version": "1.21.182",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.181",
+  "version": "1.21.182",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10362,5 +10362,11 @@
       "id": "1004892",
       "text": "The repo health dashboard's dead-code number now counts the same way the CI check does, so it no longer jumps by about 1,800 false alarms from modules/."
     }
+  ],
+  "1.21.182": [
+    {
+      "id": "1004890",
+      "text": "Removed a leftover permission-list checker that nothing in the product used; the real protections and their tests are unchanged."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.181'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.182'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -26,9 +26,23 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GOV = path.join(ROOT, 'modules', 'government');
 
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
-const registry = require(path.join(GOV, 'protected-surfaces.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 
+// The registry exactly as the live kernel matcher loads it — the one loader the
+// enforcers (pre-push hook, grader pre-pass, main audit, goal-scope check) use.
+// Task 1004890 deleted modules/government/protected-surfaces.js, a wrapper over
+// this same matcher that nothing but this test ever required; FLOOR and
+// SYSTEM_PERMISSIONS are derived here the way it derived them.
+const registry = {
+  SURFACES: ppc.PROTECTED_SURFACES,
+  PROTECTED_GLOBS: ppc.PROTECTED_GLOBS,
+  FLOOR: catalog.RANK_ORDER[Math.min(...ppc.PROTECTED_SURFACES.map((s) => catalog.RANK_ORDER.indexOf(s.floor)))],
+  SYSTEM_PERMISSIONS: [...new Set(ppc.PROTECTED_SURFACES.map((s) => s.permission))].sort(),
+  surfaceFor: (file) => ppc.surfaceFor(file),
+  floorFor: (file) => ppc.floorFor(file),
+  isProtected: (file) => ppc.surfaceFor(file) !== null,
+};
+
 // The verbatim PROTECTED_GLOBS array as it stood immediately before R101.
 const EXPECTED_GLOBS_BEFORE_R101 = [
   'src/bongos/auth.js',
@@ -979,91 +993,6 @@ test('every entry maps to a permission the catalog defines as system:true', () =
   assert.deepEqual(registry.SYSTEM_PERMISSIONS, ['path.protected.modify']);
 });
 
-// Feed a BAD registry through the real loader in a cold subprocess and assert the
-// module refuses to load. The pattern is the sibling probe below ("a missing
-// registry fails CLOSED"): patch fs.readFileSync for the registry path only, then
-// require the module under test and let its load-time throw be the result.
-//
-// WHY A SUBPROCESS AND NOT AN IN-PROCESS ASSERTION (task 1003196, finding 9). The
-// version of this test before that task read the catalog and checked that a
-// grantable key exists and an unknown key returns null — both true regardless of
-// whether the guard exists. Demonstrated: deleting the whole validation loop from
-// modules/government/protected-surfaces.js left the entire suite green. The guard
-// is load-time, so only a fresh module load can exercise it, and the registry is
-// read from disk, so only a patched read can make it bad.
-//
-// This matters because the sibling test above ("every entry maps to a permission
-// the catalog defines as system:true") only checks the COMMITTED file. The
-// load-time throw is what protects an out-of-band registry write — the Government
-// tab editing an instance file at runtime — and nothing was watching it.
-function loadWithRegistry(registryJson) {
-  execFileSync(process.execPath, ['-e',
-    "const fs=require('node:fs');const real=fs.readFileSync;" +
-    'const fake=' + JSON.stringify(JSON.stringify(registryJson)) + ';' +
-    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? fake : real(p,...r));" +
-    "require('./modules/government/protected-surfaces.js');",
-  ], { cwd: ROOT, stdio: 'pipe' });
-}
-
-test('a surface mapped to a GRANTABLE permission fails loud at load', () => {
-  // A grantable (system:false) key is the dangerous case ADR 0151 §4 names: a
-  // custom rank could be handed the very power the substrate reserves.
-  const grantable = catalog.grantableKeys()[0];
-  assert.ok(grantable, 'the catalog must define at least one grantable key for this probe');
-  assert.equal(catalog.isSystem(grantable), false, 'fixture sanity: the probe key must be grantable');
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'metic',
-      permission: grantable,
-      surfaces: [{ glob: 'src/probe/grantable-surface.js' }],
-    }),
-    /which is not system:true/,
-    'a surface mapping to a grantable permission must refuse to load',
-  );
-});
-
-test('a surface mapped to an UNKNOWN permission fails loud at load', () => {
-  assert.equal(catalog.byKey('not.a.real.permission'), null, 'fixture sanity: the key must be unknown');
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'metic',
-      permission: 'not.a.real.permission',
-      surfaces: [{ glob: 'src/probe/unknown-surface.js' }],
-    }),
-    /which the permission catalog does not define/,
-    'a surface mapping to a permission the catalog never defines must refuse to load',
-  );
-});
-
-test('the probe itself is honest — a GOOD registry loads clean through the same path', () => {
-  // Without this, both assertions above would pass if the subprocess threw for an
-  // unrelated reason (a bad patch, a missing cwd, a syntax error in the -e script).
-  assert.doesNotThrow(() => loadWithRegistry({
-    floor: 'metic',
-    permission: registry.SYSTEM_PERMISSIONS[0],
-    surfaces: [{ glob: 'src/probe/good-surface.js' }],
-  }), 'a well-formed registry must still load — otherwise the probes above prove nothing');
-});
-
-test('an unknown FLOOR is refused before the catalog check ever sees it', () => {
-  // The validation loop's third branch (`!catalog.RANK_ORDER.includes(s.floor)`) is
-  // a DRIFT guard, not dead code, and this test records why it cannot be provoked
-  // through the registry: the kernel loader keeps its own local RANK_TIER map
-  // (permission-path-check.js) and rejects an unknown floor first. The government
-  // branch only becomes reachable if those two rank lists ever disagree — which is
-  // exactly the drift it exists to catch, and is not craftable from JSON alone.
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'emperor',
-      permission: registry.SYSTEM_PERMISSIONS[0],
-      surfaces: [{ glob: 'src/probe/bad-floor.js' }],
-    }),
-    /unknown floor/,
-  );
-  assert.deepEqual(catalog.RANK_ORDER, ['xenos', 'thetes', 'metic', 'archon'],
-    'if this list and the kernel RANK_TIER drift, the government floor branch wakes up');
-});
-
 // ---------- synchronous, no DB, no server ----------
 
 test('the registry loads synchronously from the repo with no DB and no server', () => {
@@ -1080,12 +1009,6 @@ test('the registry loads synchronously from the repo with no DB and no server',
 test('the registry data file carries no DB/network dependency', () => {
   const json = fs.readFileSync(path.join(GOV, 'protected-surfaces.json'), 'utf8');
   assert.doesNotThrow(() => JSON.parse(json), 'the canonical form must be plain parseable data');
-  const code = fs.readFileSync(path.join(GOV, 'protected-surfaces.js'), 'utf8')
-    .split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
-  for (const banned of ['./db', 'pool', 'fetch(', 'await ']) {
-    assert.ok(!code.includes(banned),
-      `protected-surfaces.js must not introduce "${banned}" — the substrate reads this with no DB and no server (ADR 0151 §4)`);
-  }
 });
 
 // ---------- policy owns / substrate enforces ----------
@@ -1095,10 +1018,6 @@ test('the kernel does not require the governance module (ADR 0083 one-way rule)'
   const requires = [...kernel.matchAll(/require\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1]);
   assert.deepEqual(requires.filter((r) => r.includes('modules/')), [],
     'core must never require a module — it reads the registry as data');
-  // …and the flow runs the legal way: governance reaches the matcher through the doorway.
-  const gov = fs.readFileSync(path.join(GOV, 'protected-surfaces.js'), 'utf8');
-  assert.ok(/require\(\s*['"]\.\.\/\.\.\/src\/module-api['"]\s*\)/.test(gov),
-    'governance must reach the kernel matcher through the published doorway');
 });
 
 test('the hardcoded protected list is gone from the kernel — one source, no drift', () => {

package/modules/government/protected-surfaces.js

@@ -1,88 +0,0 @@
-'use strict';
-
-// modules/government/protected-surfaces.js — the protected-surface registry's
-// GOVERNMENT-side API (ADR 0151 §4, BV1.R101).
-//
-// POLICY OWNS / SUBSTRATE ENFORCES — the whole point of this slice.
-//
-//   GOVERNMENT OWNS THE DATA. protected-surfaces.json (next to this file) says
-//   WHICH repo paths are protected, at WHAT rank floor, mapped to WHICH
-//   `system: true` catalog permission. That file is the source of truth; the
-//   Archon Government tab (R110/R111) edits it as policy. Before R101 the same
-//   information was a hardcoded PROTECTED_GLOBS constant inside the kernel.
-//
-//   THE OUT-OF-BAND SUBSTRATE STAYS THE ENFORCER. Nothing here enforces
-//   anything. The enforcers are the git pre-push hook, the grader pre-pass, the
-//   post-push main audit and the goal-scope check — they read
-//   the registry with no DB, no server and no HTTP, and they are what actually
-//   blocks a sub-floor change (ADR 0043). Re-mapping a floor here changes what
-//   the substrate protects; it can never make the request path the authority.
-//   Moving enforcement into the app is the regression R101 exists to prevent
-//   (ADR 0151 §"Alternatives considered").
-//
-//   NO DB DEPENDENCY. A DB-backed override is a government-tab concern layered
-//   on top and must never become a dependency of the hook — the hook runs on a
-//   laptop with no database and no network. This module is therefore
-//   synchronous, DB-free and requires nothing but the catalog and the doorway.
-//
-// DEPENDENCY DIRECTION (ADR 0083's one-way rule). Code flows exactly one way:
-// this module → src/module-api.js (the published doorway) → the kernel matcher
-// in src/bongos/permission-path-check.js. Core never requires this module. The
-// kernel loads the JSON data file directly (a static data read, the same way the
-// sibling trust primitive route-rank-check.js reads modules/*/routes/*.js off
-// disk to rank-gate them), and we read the parsed result back through the
-// doorway so there is exactly ONE loader and ONE matcher — no second list to
-// drift (the SEC #863 failure mode).
-
-const api = require('../../src/module-api');
-const catalog = require('./catalog');
-
-const ppc = api.permissionPathCheck;
-
-// The registry, as parsed by the single kernel loader.
-const SURFACES = ppc.PROTECTED_SURFACES;
-
-// ── invariants asserted at module load (fail loud on an authoring typo) ───────
-// The government module is where the registry meets the permission catalog, so
-// this is where "every protected surface maps to a real, non-grantable
-// permission" is checked. A surface mapping to an unknown key, or to a
-// `system: false` (grantable) key, would mean an Archon could hand a custom rank
-// the power the substrate is supposed to reserve — exactly the wall ADR 0151 §4
-// builds. Fail loud rather than silently protecting nothing.
-for (const s of SURFACES) {
-  const perm = catalog.byKey(s.permission);
-  if (!perm) {
-    throw new Error(`protected-surface registry: "${s.glob}" maps to "${s.permission}", which the permission catalog does not define`);
-  }
-  if (perm.system !== true) {
-    throw new Error(`protected-surface registry: "${s.glob}" maps to "${s.permission}", which is not system:true — a protected surface must map to a NON-GRANTABLE permission (ADR 0151 §4)`);
-  }
-  if (!catalog.RANK_ORDER.includes(s.floor)) {
-    throw new Error(`protected-surface registry: "${s.glob}" declares floor "${s.floor}", which is not a rank`);
-  }
-}
-
-// The lowest floor any surface declares — 'metic' today (ADR 0043's Metic floor,
-// now DERIVED from registry data rather than hardcoded).
-const FLOOR = catalog.RANK_ORDER[Math.min(...SURFACES.map((s) => catalog.RANK_ORDER.indexOf(s.floor)))];
-
-// The distinct system permissions the registry maps onto.
-const SYSTEM_PERMISSIONS = Object.freeze([...new Set(SURFACES.map((s) => s.permission))].sort());
-
-// Per-path lookups — the single matcher, reached through the doorway.
-const surfaceFor = (file) => ppc.surfaceFor(file);
-const floorFor = (file) => ppc.floorFor(file);
-const permissionFor = (file) => ppc.permissionFor(file);
-const isProtected = (file) => ppc.surfaceFor(file) !== null;
-
-module.exports = {
-  SURFACES,
-  PROTECTED_GLOBS: ppc.PROTECTED_GLOBS,
-  REGISTRY_PATH: ppc.REGISTRY_PATH,
-  FLOOR,
-  SYSTEM_PERMISSIONS,
-  surfaceFor,
-  floorFor,
-  permissionFor,
-  isProtected,
-};