@bongos/core 1.21.8 → 1.21.10

package/modules/government/decision-rules.js

@@ -0,0 +1,312 @@
+'use strict';
+
+// modules/government/decision-rules.js — WHO DECIDES WHAT: the per-project table
+// that says, for each building of the government, who decides its matters and by
+// which rule (task 1004529, goal 1000125 the Governor City). Decision of record:
+// docs/adr/0363-who-decides-what-is-a-table-changed-only-by-amendment.md.
+//
+// WHY. Before this, every building's matters were decided one way: whoever held
+// that building's fixed permission acted alone (the rank gate), and only the
+// charter had a board. The reference design (docs/design/mocks/governor-city/
+// Governments.dc.html, "Four governments") shows one project decided four ways —
+// one founder, a council, everyone votes, a board of trustees — and a project
+// that starts as one and amends itself into another. That needs the answer to
+// "who decides, and how" to be DATA a project can change, not code.
+//
+// THE THREE THINGS A ROW CAN SAY (the table is government_023):
+//   decided_by 'gate'      — AS TODAY. Whoever holds the building's fixed
+//                            permission acts alone, through its own page. No
+//                            rule of its own (the effective rule is `decide`).
+//                            Every building except the charter starts here.
+//   decided_by 'board'     — the CHARTER only: the constitution's own board,
+//                            under its own pass rule. The charter is changed by
+//                            amending the board block, never through this table.
+//   decided_by 'nobody'    — VACANT (rule 'vacant'): no one holds this building
+//                            yet. Its matters wait; none can be put to a sitting.
+//   decided_by <predicate> — a SITTING: matters here are put to the members the
+//                            predicate seats (the board's own grammar, rank:<key>,
+//                            rank:<key>+, rank:a,b — membership-predicate.js) and
+//                            decided by the row's rule.
+//
+// CHANGED ONLY BY A PASSED AMENDMENT. There is no settings route that writes the
+// table. A change is filed as an amendment of kind 'decision_rules'
+// (board.proposeDecisionRules), decided by the board in force like every other
+// amendment, and written INSIDE the transaction that closes the sitting as
+// passed (board.closeItem). The database refuses any other write (government_023's
+// trigger), so a hand-edited row is refused too.
+//
+// PURE: no db, no requires beyond the grammar and the catalog. The board and the
+// docket read the table through db.js and hand the rows here.
+
+const { parseMembershipPredicate, describeMembership } = require('./membership-predicate');
+const { RANK_ORDER } = require('./catalog');
+
+// The nine buildings, in street order (held equal to docket-vocab BUILDINGS by
+// test). `gate` is the fixed permission that decides the building's matters
+// today — the atom its own pages require, named so a reader can see what a
+// sitting replaces. `acts` lists the direct acts in THIS module that already
+// defer to the row (task 1004529 wired People's rank assignments); every other
+// building's own pages keep their gate until their owning module adopts
+// `mayActAlone` (the ADR's follow-up list).
+const AREAS = Object.freeze([
+  Object.freeze({ key: 'charter', name: 'Charter', gate: null,
+    today: 'the board, under the constitution in force', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'rules', name: 'Rules', gate: 'project.settings.manage',
+    today: 'whoever may change the project settings', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'disputes', name: 'Disputes', gate: 'security.report.adjudicate',
+    today: 'whoever may judge reports', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'people', name: 'People', gate: 'government.manage',
+    today: 'whoever may manage ranks',
+    acts: Object.freeze(['POST /government/assignments', 'DELETE /government/assignments/:builderId/:rankKey']) }),
+  Object.freeze({ key: 'planning', name: 'Planning', gate: 'goal.create',
+    today: 'whoever may create goals', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'automation', name: 'Automation', gate: 'autonomy.fence.manage',
+    today: 'whoever may switch unattended building on and off', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'review', name: 'Review', gate: 'criterion.satisfy',
+    today: 'whoever may mark work as meeting its checks', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'release', name: 'Release', gate: 'core.pin.move',
+    today: 'whoever may put a release live', acts: Object.freeze([]) }),
+  Object.freeze({ key: 'treasury', name: 'Treasury', gate: 'builder.budget.set',
+    today: 'whoever may set spending limits', acts: Object.freeze([]) }),
+]);
+const AREA_KEYS = Object.freeze(AREAS.map((a) => a.key));
+const areaByKey = (key) => AREAS.find((a) => a.key === key) || null;
+
+// The seven ways a building can decide (the design's decision glyphs, plus
+// vacant from the "Four governments" board). `sitting` rules put a matter to the
+// members a predicate seats; `decide` and `first` also let a seated member act
+// alone; `vacant` decides nothing.
+const DECISION_RULES = Object.freeze([
+  Object.freeze({ key: 'decide', words: 'decides alone', passRule: 'first_ratifier', actsAlone: true }),
+  Object.freeze({ key: 'first', words: 'first yes wins', passRule: 'first_ratifier', actsAlone: true }),
+  Object.freeze({ key: 'consent', words: 'passes unless someone objects', passRule: 'consent', actsAlone: false }),
+  Object.freeze({ key: 'majority', words: 'majority vote', passRule: 'majority', actsAlone: false }),
+  Object.freeze({ key: 'unanimous', words: 'everyone agrees', passRule: 'unanimous', actsAlone: false }),
+  Object.freeze({ key: 'signoff', words: 'signed off by someone who did not build it', passRule: 'first_ratifier', actsAlone: false }),
+  Object.freeze({ key: 'vacant', words: 'no one holds this yet', passRule: null, actsAlone: false }),
+]);
+const DECISION_RULE_KEYS = Object.freeze(DECISION_RULES.map((r) => r.key));
+const SITTING_RULE_KEYS = Object.freeze(DECISION_RULE_KEYS.filter((k) => k !== 'vacant'));
+const ruleByKey = (key) => DECISION_RULES.find((r) => r.key === key) || null;
+
+// The board's pass rules in the table's words (the charter row's effective rule).
+const PASS_RULE_TO_DECISION_RULE = Object.freeze({
+  first_ratifier: 'first', consent: 'consent', majority: 'majority', unanimous: 'unanimous',
+});
+
+// The board subject a building's matters sit as. The charter has none of its
+// own: its matters are constitutional amendments.
+const MATTER_SUBJECT_TYPES = Object.freeze(Object.fromEntries(
+  AREAS.filter((a) => a.key !== 'charter').map((a) => [a.key, `${a.key}_matter`]),
+));
+const areaForSubjectType = (subjectType) => {
+  const hit = Object.entries(MATTER_SUBJECT_TYPES).find(([, t]) => t === subjectType);
+  return hit ? hit[0] : null;
+};
+const isMatterSubject = (subjectType) => areaForSubjectType(subjectType) !== null;
+
+const WHO_MAX = 120;
+const DECIDED_BY_MAX = 200;
+
+// The as-today row for a building — what government_023 seeds, and what a
+// building reads as when its row is missing or unreadable as stored.
+function defaultRow(area) {
+  return Object.freeze({
+    area, decided_by: area === 'charter' ? 'board' : 'gate', rule: null, who: null, set_by_item_id: null,
+  });
+}
+
+// ── strict validation of a proposed change ──────────────────────────────────
+//
+// Like a constitution proposal (board.validateProposedConstitution), a proposal
+// is VALIDATED, never sanitized: the board must not ratify a row its proposer
+// did not write. A proposal lists the buildings it changes; each listed row is
+// replaced whole. Returns { ok, rules } in street order, or a named refusal.
+const PROPOSAL_FIELDS = Object.freeze(['area', 'decided_by', 'rule', 'who']);
+const PREDICATE_EXPECTED = "'gate' (as today), 'nobody' (vacant), or rank:<key> / rank:<key>+ / a comma list such as rank:council,archon";
+
+function validateDecisionRulesProposal(raw) {
+  if (!Array.isArray(raw) || raw.length === 0) return { ok: false, reason: 'proposal_not_a_list', expected: 'a non-empty list of { area, decided_by, rule, who }' };
+  if (raw.length > AREAS.length) return { ok: false, reason: 'too_many_rows' };
+  const seen = new Set();
+  const out = [];
+  for (const row of raw) {
+    if (!row || typeof row !== 'object' || Array.isArray(row)) return { ok: false, reason: 'row_not_an_object' };
+    for (const k of Object.keys(row)) {
+      if (!PROPOSAL_FIELDS.includes(k)) return { ok: false, reason: 'unknown_field', field: k };
+    }
+    const area = row.area;
+    if (!AREA_KEYS.includes(area)) return { ok: false, reason: 'unknown_area', expected: AREA_KEYS };
+    if (seen.has(area)) return { ok: false, reason: 'duplicate_area', area };
+    seen.add(area);
+    if (area === 'charter') {
+      return {
+        ok: false, reason: 'charter_is_the_board', area,
+        expected: 'the charter is decided by the constitution\'s own board — change its members or rule with a constitution amendment (POST /government/board/items or /government/board/charter)',
+      };
+    }
+    const decidedBy = row.decided_by;
+    if (typeof decidedBy !== 'string' || decidedBy.length === 0 || decidedBy.length > DECIDED_BY_MAX) {
+      return { ok: false, reason: 'bad_decided_by', area, expected: PREDICATE_EXPECTED };
+    }
+    const rule = row.rule === undefined ? null : row.rule;
+    if (decidedBy === 'gate') {
+      if (rule !== null) return { ok: false, reason: 'gate_takes_no_rule', area, expected: 'leave rule out: as today, whoever holds the building\'s permission decides alone' };
+    } else if (decidedBy === 'nobody') {
+      if (rule !== 'vacant') return { ok: false, reason: 'nobody_is_vacant', area, expected: "rule 'vacant'" };
+    } else if (decidedBy === 'board') {
+      return { ok: false, reason: 'only_the_charter_is_the_board', area };
+    } else {
+      if (!parseMembershipPredicate(decidedBy)) return { ok: false, reason: 'bad_decided_by', area, expected: PREDICATE_EXPECTED };
+      if (!SITTING_RULE_KEYS.includes(rule)) return { ok: false, reason: 'bad_rule', area, expected: SITTING_RULE_KEYS };
+    }
+    let who = row.who === undefined ? null : row.who;
+    if (who !== null) {
+      if (typeof who !== 'string' || who.trim().length === 0 || who.length > WHO_MAX) {
+        return { ok: false, reason: 'bad_who', area, expected: `null, or the seat in words (1..${WHO_MAX} characters)` };
+      }
+      who = who.trim();
+    }
+    out.push(Object.freeze({ area, decided_by: decidedBy, rule, who }));
+  }
+  out.sort((a, b) => AREA_KEYS.indexOf(a.area) - AREA_KEYS.indexOf(b.area));
+  return { ok: true, rules: Object.freeze(out) };
+}
+
+// The CUSTOM rank keys a proposal names (a standard rank always exists), so the
+// caller can refuse a council that is not a rank yet — it would seat nobody.
+function customRankKeysIn(rules) {
+  const keys = new Set();
+  for (const r of rules || []) {
+    const parsed = parseMembershipPredicate(r.decided_by);
+    if (!parsed) continue;
+    for (const k of parsed.rankKeys) if (!RANK_ORDER.includes(k)) keys.add(k);
+  }
+  return [...keys];
+}
+
+// Would applying these rows change anything? A proposal that changes nothing is
+// refused before it costs a sitting.
+function changesAnything(rules, liveRows) {
+  const live = new Map((liveRows || []).map((r) => [r.area, r]));
+  return (rules || []).some((r) => {
+    const cur = live.get(r.area) || defaultRow(r.area);
+    return cur.decided_by !== r.decided_by || (cur.rule || null) !== (r.rule || null) || (cur.who || null) !== (r.who || null);
+  });
+}
+
+// ── reading a row ───────────────────────────────────────────────────────────
+
+// A stored row as the public, resolved shape: effective rule, the seat in words,
+// whether matters here go to a sitting, whether a seated member may act alone.
+// `board` is the live constitution block (the charter's row reads its rule).
+// A row that is malformed as stored reads as the as-today default — the same
+// fail-closed direction as the constitution's sanitizer: never wider than today.
+function resolveRow(stored, { board = {} } = {}) {
+  const area = stored && AREA_KEYS.includes(stored.area) ? stored.area : null;
+  if (!area) return null;
+  const def = areaByKey(area);
+  let row = stored;
+  const shapeOk = (area === 'charter' && row.decided_by === 'board' && row.rule == null)
+    || (area !== 'charter' && row.decided_by === 'gate' && row.rule == null)
+    || (area !== 'charter' && row.decided_by === 'nobody' && row.rule === 'vacant')
+    || (area !== 'charter' && parseMembershipPredicate(row.decided_by) && SITTING_RULE_KEYS.includes(row.rule));
+  if (!shapeOk) row = defaultRow(area);
+
+  const asToday = row.decided_by === 'gate' || row.decided_by === 'board';
+  let rule;
+  let who;
+  if (row.decided_by === 'board') {
+    rule = PASS_RULE_TO_DECISION_RULE[board.pass_rule] || null;
+    const members = describeMembership(board.membership);
+    who = row.who || (members ? `the board (${members})` : 'the board');
+  } else if (row.decided_by === 'gate') {
+    rule = 'decide';
+    who = row.who || def.today;
+  } else if (row.decided_by === 'nobody') {
+    rule = 'vacant';
+    who = row.who || 'no one yet';
+  } else {
+    rule = row.rule;
+    who = row.who || describeMembership(row.decided_by);
+  }
+  const r = ruleByKey(rule);
+  return Object.freeze({
+    area,
+    name: def.name,
+    decided_by: row.decided_by,
+    rule,
+    rule_words: r ? r.words : null,
+    who,
+    as_today: asToday,
+    // Matters here are put to a sitting of the seated members (never for the
+    // charter — its matters are amendments, sat under the board in force).
+    sitting: area !== 'charter' && !asToday && row.decided_by !== 'nobody',
+    gate: def.gate,
+    today: def.today,
+    acts: def.acts,
+    set_by_item_id: row.set_by_item_id == null ? null : String(row.set_by_item_id),
+    updated_at: row.updated_at || null,
+  });
+}
+
+// Every building, in street order, from whatever rows were read (a missing row
+// reads as its default).
+function resolveAll(rows, { board = {} } = {}) {
+  const byArea = new Map((rows || []).map((r) => [r.area, r]));
+  return Object.freeze(AREAS.map((a) => resolveRow(byArea.get(a.key) || defaultRow(a.key), { board })));
+}
+
+// The constitution a matter's sitting is snapshotted under. Built from the row
+// (who and how) and the live board (early close). A clock is set only under a
+// rule whose expiry means RETURN — under first_ratifier or consent a deadline
+// would pass a matter nobody read (ADR 0191 §4), so those sit with no clock.
+function sittingConstitution(resolved, { board = {}, clockSafe = (passRule) => passRule === 'majority' || passRule === 'unanimous' } = {}) {
+  const r = ruleByKey(resolved && resolved.rule);
+  if (!resolved || !resolved.sitting || !r || !r.passRule) return null;
+  const window = clockSafe(r.passRule) && Number.isInteger(board.window_minutes) ? board.window_minutes : null;
+  return Object.freeze({
+    membership: resolved.decided_by,
+    pass_rule: r.passRule,
+    window_minutes: window,
+    close_early_on_full_turnout: board.close_early_on_full_turnout !== false,
+    // The table's own words ride the snapshot, so the docket and the board read
+    // the rule the matter was decided under, and `signoff` holds the proposer
+    // to the author rule.
+    rule: resolved.rule,
+    area: resolved.area,
+  });
+}
+
+// May this builder act ALONE at this building right now? `seated` is whether
+// the row's predicate seats them (resolved by the caller, server-side,
+// uncached). As today → yes (the route's own permission gate still applies).
+// decide / first → only a seated member. Any other rule, or vacant → nobody:
+// the matter goes to a sitting.
+function mayActAlone(resolved, { seated = false } = {}) {
+  if (!resolved) return false;
+  if (resolved.as_today) return true;
+  const r = ruleByKey(resolved.rule);
+  return !!(r && r.actsAlone && resolved.sitting && seated);
+}
+
+module.exports = {
+  AREAS,
+  AREA_KEYS,
+  areaByKey,
+  DECISION_RULES,
+  DECISION_RULE_KEYS,
+  SITTING_RULE_KEYS,
+  PASS_RULE_TO_DECISION_RULE,
+  MATTER_SUBJECT_TYPES,
+  areaForSubjectType,
+  isMatterSubject,
+  defaultRow,
+  validateDecisionRulesProposal,
+  customRankKeysIn,
+  changesAnything,
+  resolveRow,
+  resolveAll,
+  sittingConstitution,
+  mayActAlone,
+};

package/modules/government/docket.js

@@ -40,6 +40,15 @@
 // rows — the screen can say a building has matters you cannot see without
 // leaking them.
 //
+// WHO DECIDES, FROM THE TABLE (task 1004529). Every building carries
+// `decision` — who decides it and by which rule — read from the project's
+// decision-rules table (decision-rules.js), so the street and the building
+// interiors state the project's own government rather than a fixed one. A
+// sitting at a building (one of the board's matter subjects) carries the rule it
+// was opened under, which is the table's row at that moment, snapshotted on the
+// item. A contributed matter keeps the rule its own route decides it by: that
+// route's gate is what decides it until its module defers to the row.
+//
 // NOTHING IS INVENTED. A source the design names that has no data yet (grade
 // appeals, votes on new standing rules, the treasury's spending matters) is
 // reported `coming`; a source whose module is off is `off`; a read that throws or
@@ -51,6 +60,7 @@ const board = require('./board');
 const db = require('./db');
 const { resolveBoardMembers } = require('./board-membership');
 const resolver = require('./resolver');
+const decisionRules = require('./decision-rules');
 
 const log = api.logger('government');
 
@@ -214,13 +224,17 @@ function boardMatter(item, { viewerId, members }) {
   else if (voted || memberIds.has(viewer) || authorId === viewer) state = 'moving';
   else state = 'settled';
 
-  const building = item.subject_type === 'full_idea' ? 'planning' : 'charter';
-  const title = item.subject_type === 'constitutional_amendment'
+  const matterArea = decisionRules.areaForSubjectType(item.subject_type);
+  const building = matterArea || (item.subject_type === 'full_idea' ? 'planning' : 'charter');
+  const title = matterArea
+    ? ((item.subject && item.subject.title) || `A matter at ${building}`)
+    : item.subject_type === 'constitutional_amendment'
     ? (item.subject && item.subject.rationale_md ? firstLine(item.subject.rationale_md) : 'A change to the charter')
     : item.subject_type === 'genesis_stage'
       ? `Close the founding stage: ${(item.subject && item.subject.label) || item.subject_id}`
       : ((item.subject && item.subject.title) || `Full idea ${item.subject_id}`);
-  const where = item.subject_type === 'constitutional_amendment' ? 'charter · amendment'
+  const where = matterArea ? `${building} · matter`
+    : item.subject_type === 'constitutional_amendment' ? 'charter · amendment'
     : item.subject_type === 'genesis_stage' ? 'charter · founding'
       : 'planning · idea to ratify';
   const forN = votes.filter((v) => v.direction === 'yes').length;
@@ -233,10 +247,15 @@ function boardMatter(item, { viewerId, members }) {
   return {
     id: item.id,
     building,
-    rule: vocab.PASS_RULE_TO_RULE[constitution.pass_rule] || null,
+    // A building's sitting carries the table's own rule on its snapshot (so a
+    // sign-off reads as sign-off, a one-person decision as decide); every other
+    // sitting reads the board's pass rule.
+    rule: (vocab.RULE_KEYS.includes(constitution.rule) ? constitution.rule : null)
+      || vocab.PASS_RULE_TO_RULE[constitution.pass_rule] || null,
     state,
     title,
-    short: item.subject_type === 'constitutional_amendment' ? 'amendment'
+    short: matterArea ? 'matter'
+      : item.subject_type === 'constitutional_amendment' ? 'amendment'
       : item.subject_type === 'genesis_stage' ? 'founding stage' : 'idea to ratify',
     where,
     opened_at: item.opened_at,
@@ -340,7 +359,10 @@ function registeredContributions() {
 // Build the docket for one viewer. `permissions` is the viewer's resolved set;
 // `contributions` defaults to what is registered on the seam (a test passes its
 // own). Never throws for a source: each is isolated and timed.
-async function buildDocket({ viewer, permissions, contributions = registeredContributions(), now = Date.now(), timeoutMs = SOURCE_TIMEOUT_MS } = {}) {
+// `decisions` is the resolved decision-rules table (board.decisionRulesView), or
+// null when it could not be read — each building's `decision` is then null
+// rather than a guess.
+async function buildDocket({ viewer, permissions, contributions = registeredContributions(), now = Date.now(), timeoutMs = SOURCE_TIMEOUT_MS, decisions = null } = {}) {
   const held = new Set(permissions || []);
   const ctx = Object.freeze({
     builderId: String(viewer.id),
@@ -416,9 +438,17 @@ async function buildDocket({ viewer, permissions, contributions = registeredCont
   }));
 
   const counts = countStates(matters);
+  const decisionBy = new Map((Array.isArray(decisions) ? decisions : []).filter(Boolean).map((d) => [d.area, d]));
   const buildings = vocab.BUILDINGS.map((b) => {
     const here = matters.filter((m) => m.building === b.key);
-    return { key: b.key, name: b.name, group: b.group, counts: countStates(here), matter_ids: here.map((m) => m.id) };
+    const d = decisionBy.get(b.key) || null;
+    return {
+      key: b.key, name: b.name, group: b.group, counts: countStates(here), matter_ids: here.map((m) => m.id),
+      decision: d ? {
+        who: d.who, rule: d.rule, rule_words: d.rule_words, decided_by: d.decided_by,
+        as_today: d.as_today, sitting: d.sitting, set_by_item_id: d.set_by_item_id,
+      } : null,
+    };
   });
   return {
     viewer: { id: ctx.builderId },
@@ -429,7 +459,11 @@ async function buildDocket({ viewer, permissions, contributions = registeredCont
     buildings,
     sources: sourceStatus,
     readings,
-    vocabulary: { buildings: vocab.BUILDINGS, rules: vocab.RULES, states: vocab.STATES },
+    vocabulary: {
+      buildings: vocab.BUILDINGS, rules: vocab.RULES, states: vocab.STATES,
+      // The table's rule set — the matter glyphs plus vacant (no one holds it).
+      decision_rules: decisionRules.DECISION_RULES.map((r) => ({ key: r.key, words: r.words })),
+    },
   };
 }
 
@@ -437,7 +471,13 @@ async function buildDocket({ viewer, permissions, contributions = registeredCont
 // uncached — ADR 0016), then build.
 async function docketFor(builder) {
   const permissions = await resolver.resolveBuilderPermissions(builder.id);
-  return buildDocket({ viewer: builder, permissions });
+  // The table is read per request, uncached (ADR 0016). A failed read leaves
+  // every building's decision null; it never fails the city.
+  const decisions = await board.decisionRulesView().catch((err) => {
+    log.warn({ err: err && err.message }, 'governor docket: decision rules unreadable');
+    return null;
+  });
+  return buildDocket({ viewer: builder, permissions, decisions });
 }
 
 module.exports = {

package/modules/government/migrations/government_023_decision_rules.sql

@@ -0,0 +1,190 @@
+-- government_023_decision_rules.sql — who decides what, per building, changed
+-- only by a passed amendment (task 1004529, goal 1000125 the Governor City).
+-- Decision of record: docs/adr/0363-who-decides-what-is-a-table-changed-only-by-amendment.md
+--
+-- WHAT THIS ADDS
+--
+--   1. government_decision_rules — ONE ROW PER BUILDING of the project's
+--      government (charter, rules, disputes, people, planning, automation,
+--      review, release, treasury). Each row says WHO decides matters at that
+--      building and BY WHICH RULE (decide alone, first yes, consent, majority,
+--      unanimous, sign-off, or vacant — nobody holds it yet). An instance is one
+--      project, so the area is the whole key.
+--
+--   2. The nine DEFAULT rows, each meaning "exactly as today": `decided_by =
+--      'gate'` (whoever holds the building's fixed permission acts alone, through
+--      its own page) and, for the charter, `decided_by = 'board'` (the
+--      constitution's own board, under its own pass rule). A default row carries
+--      no rule of its own (rule IS NULL). Seeding them changes NO permission for
+--      any existing project.
+--
+--   3. A GUARD TRIGGER: after the seed, a row may only be changed by a passed
+--      decision-rules amendment. Every insert or update must name the board item
+--      that carried it (`set_by_item_id`), and that item must be a CLOSED, PASSED
+--      constitutional amendment whose amendment row is of kind 'decision_rules'.
+--      There is no settings route that writes this table, and the trigger makes
+--      that structural — a hand-written UPDATE is refused too. Deleting a row is
+--      refused outright. The one exception is re-seeding a MISSING area with its
+--      as-today default, so a re-run of this file stays safe.
+--
+--   4. government_amendments.kind — 'constitution' (every existing row, and the
+--      board block amendments filed today) or 'decision_rules' (a change to rows
+--      of the table above). One amendments table, one subject type, one pass
+--      path: a rules amendment is decided by the board in force exactly like any
+--      other amendment.
+--
+--   5. government_matters + eight new board subjects. Today the board votes on
+--      three things (a Full Idea, a constitutional amendment, a genesis stage).
+--      This adds one subject per building other than the charter — rules_matter,
+--      disputes_matter, people_matter, planning_matter, automation_matter,
+--      review_matter, release_matter, treasury_matter — eleven in all. A matter
+--      is put to a sitting ONLY when its building's row names a sitting (an
+--      amendment moved it off the fixed gate); under the default rows none can
+--      be opened, so nothing about today's behaviour changes.
+--
+-- Additive and idempotent: new tables, a new column with a default every
+-- existing row satisfies, CHECKs that only WIDEN (dropped and re-added under
+-- the same name, the government_020 pattern), and CREATE OR REPLACE for the
+-- trigger function and trigger (Postgres 14+; production runs 16).
+
+BEGIN;
+
+-- ---------------------------------------------------------------------------
+-- 4. amendments gain a kind (first: the guard below reads it).
+-- ---------------------------------------------------------------------------
+ALTER TABLE government_amendments
+  ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'constitution';
+
+ALTER TABLE government_amendments
+  DROP CONSTRAINT IF EXISTS government_amendments_kind_check;
+
+ALTER TABLE government_amendments
+  ADD CONSTRAINT government_amendments_kind_check
+  CHECK (kind IN ('constitution', 'decision_rules'));
+
+-- ---------------------------------------------------------------------------
+-- 1. the table
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS government_decision_rules (
+  area            text        PRIMARY KEY
+                  CHECK (area IN ('charter', 'rules', 'disputes', 'people', 'planning',
+                                  'automation', 'review', 'release', 'treasury')),
+  -- 'gate'   — as today: whoever holds the building's fixed permission acts alone
+  -- 'board'  — the constitution's own board (the charter's only value)
+  -- 'nobody' — vacant: no one holds this building yet
+  -- otherwise a board membership predicate (rank:<key>, rank:<key>+, rank:a,b),
+  -- resolved per request and uncached like every other franchise read (ADR 0016).
+  decided_by      text        NOT NULL CHECK (char_length(decided_by) BETWEEN 1 AND 200),
+  rule            text        CHECK (rule IN ('decide', 'first', 'consent', 'majority',
+                                              'unanimous', 'signoff', 'vacant')),
+  -- The design's words for the seat ("Mira under $50, the council above").
+  -- Display only; it never decides anything.
+  who             text        CHECK (who IS NULL OR char_length(who) BETWEEN 1 AND 120),
+  -- The passed amendment's board item that set this row. NULL only on a default.
+  set_by_item_id  bigint      REFERENCES government_board_items(id) ON DELETE RESTRICT,
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+
+  -- A default row carries no rule; every other row carries exactly one.
+  CONSTRAINT government_decision_rules_rule_shape CHECK (
+    (decided_by IN ('gate', 'board') AND rule IS NULL)
+    OR (decided_by = 'nobody' AND rule = 'vacant')
+    OR (decided_by NOT IN ('gate', 'board', 'nobody') AND rule IS NOT NULL AND rule <> 'vacant')
+  ),
+  -- The charter is the board, always: its own rule is changed by amending the
+  -- constitution's board block, never through this table. And only the charter
+  -- may be 'board'.
+  CONSTRAINT government_decision_rules_charter_is_the_board CHECK (
+    (area = 'charter') = (decided_by = 'board')
+  )
+);
+
+-- ---------------------------------------------------------------------------
+-- 2. the defaults — exactly today's behaviour. Inserted BEFORE the guard
+--    exists; on a re-run only a missing area is inserted (and the guard admits
+--    exactly that shape).
+-- ---------------------------------------------------------------------------
+INSERT INTO government_decision_rules (area, decided_by, rule)
+SELECT v.area, v.decided_by, NULL
+  FROM (VALUES
+    ('charter',    'board'),
+    ('rules',      'gate'),
+    ('disputes',   'gate'),
+    ('people',     'gate'),
+    ('planning',   'gate'),
+    ('automation', 'gate'),
+    ('review',     'gate'),
+    ('release',    'gate'),
+    ('treasury',   'gate')
+  ) AS v(area, decided_by)
+ WHERE NOT EXISTS (SELECT 1 FROM government_decision_rules r WHERE r.area = v.area);
+
+-- ---------------------------------------------------------------------------
+-- 3. the guard: changed only by a passed decision-rules amendment.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION government_decision_rules_guard() RETURNS trigger
+LANGUAGE plpgsql AS $guard$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'government_decision_rules: a building cannot be removed from the government'
+      USING ERRCODE = 'check_violation';
+  END IF;
+
+  -- Re-seeding a missing area with its as-today default (a re-run of the
+  -- migration). Only on INSERT: an UPDATE back to the default is a change like
+  -- any other and needs its amendment.
+  IF TG_OP = 'INSERT' AND NEW.set_by_item_id IS NULL
+     AND NEW.decided_by IN ('gate', 'board') AND NEW.rule IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.set_by_item_id IS NULL OR NOT EXISTS (
+       SELECT 1
+         FROM government_board_items i
+         JOIN government_amendments a ON a.id = i.subject_id
+        WHERE i.id = NEW.set_by_item_id
+          AND i.subject_type = 'constitutional_amendment'
+          AND i.outcome = 'passed'
+          AND a.kind = 'decision_rules'
+     ) THEN
+    RAISE EXCEPTION 'government_decision_rules changes only through a passed decision-rules amendment (board item %)', NEW.set_by_item_id
+      USING ERRCODE = 'check_violation';
+  END IF;
+
+  NEW.updated_at := now();
+  RETURN NEW;
+END
+$guard$;
+
+CREATE OR REPLACE TRIGGER government_decision_rules_amendment_only
+  BEFORE INSERT OR UPDATE OR DELETE ON government_decision_rules
+  FOR EACH ROW EXECUTE FUNCTION government_decision_rules_guard();
+
+-- ---------------------------------------------------------------------------
+-- 5. matters, and the eight new subjects
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS government_matters (
+  id           bigserial   PRIMARY KEY,
+  area         text        NOT NULL
+               CHECK (area IN ('rules', 'disputes', 'people', 'planning',
+                               'automation', 'review', 'release', 'treasury')),
+  title        text        NOT NULL CHECK (char_length(btrim(title)) BETWEEN 1 AND 200),
+  detail_md    text        CHECK (detail_md IS NULL OR char_length(detail_md) <= 5000),
+  -- What the building does by itself when the sitting passes, where it can
+  -- (today: People giving or taking a custom rank). NULL = a recorded decision.
+  action       jsonb,
+  proposed_by  bigint      REFERENCES builders(id) ON DELETE SET NULL,
+  created_at   timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE government_board_items
+  DROP CONSTRAINT IF EXISTS government_board_items_subject_type_check;
+
+ALTER TABLE government_board_items
+  ADD CONSTRAINT government_board_items_subject_type_check
+  CHECK (subject_type IN (
+    'full_idea', 'constitutional_amendment', 'genesis_stage',
+    'rules_matter', 'disputes_matter', 'people_matter', 'planning_matter',
+    'automation_matter', 'review_matter', 'release_matter', 'treasury_matter'
+  ));
+
+COMMIT;