@bongos/core 1.21.81 → 1.21.82

package/modules/government/db.js

@@ -207,6 +207,50 @@ async function resetRankGrants({ rankKey, permissionKeys }) {
   return permissionKeys.length;
 }
 
+// Delete a CUSTOM rank (task 1004481) — or refuse, naming who still holds it.
+// The rank row is locked FOR UPDATE before the holders are read: an assignment's
+// foreign-key check takes a KEY SHARE lock on that same row, so a concurrent
+// assign either finishes first (and is seen here as a holder) or waits until the
+// rank is gone (and then fails its FK). Grants go with the rank by CASCADE.
+// A seeded rank never matches (`is_system = false`), whatever the caller sent.
+// Returns { deleted: true } | { deleted: false, reason: 'not_found' | 'held', holders }.
+async function deleteCustomRank(rankKey) {
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows: locked } = await client.query(
+      `SELECT rank_key FROM government_ranks
+        WHERE rank_key = $1 AND is_system = false
+          FOR UPDATE`,
+      [rankKey],
+    );
+    if (locked.length === 0) {
+      await client.query('ROLLBACK');
+      return { deleted: false, reason: 'not_found', holders: [] };
+    }
+    const { rows: holders } = await client.query(
+      `SELECT br.builder_id, b.github_login, b.display_name
+         FROM government_builder_ranks br
+         JOIN builders b ON b.id = br.builder_id
+        WHERE br.rank_key = $1
+        ORDER BY br.builder_id`,
+      [rankKey],
+    );
+    if (holders.length > 0) {
+      await client.query('ROLLBACK');
+      return { deleted: false, reason: 'held', holders };
+    }
+    await client.query(`DELETE FROM government_ranks WHERE rank_key = $1 AND is_system = false`, [rankKey]);
+    await client.query('COMMIT');
+    return { deleted: true, holders: [] };
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
 async function listAssignments() {
   const { rows } = await pool.query(
     `SELECT br.builder_id, b.github_login, b.display_name, b.rank,
@@ -885,6 +929,7 @@ module.exports = {
   grantRankPermission,
   revokeRankPermission,
   resetRankGrants,
+  deleteCustomRank,
   listAssignments,
   assignRank,
   unassignRank,

package/modules/government/routes/government.js

@@ -28,6 +28,8 @@ const board = require('../board');
 const boardWithdraw = require('../board-withdraw');
 const recommendations = require('../recommendations');
 const docket = require('../docket');
+const governmentConfig = require('../config');
+const membershipPredicate = require('../membership-predicate');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('government');
 
@@ -476,6 +478,75 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm government.manage — delete a CUSTOM rank (task 1004481). Ranks
+  // added from a recommended set used to be permanent; the owner hesitated to
+  // try one for exactly that reason. Three refusals, each naming what to do:
+  //   - a seeded rank, never (`seeded_rank_immutable`) — the ladder is the system;
+  //   - a rank someone still holds (`rank_still_held`, with the holders) — owner
+  //     decision 2026-10-08: no auto-unassign, so nobody loses a rank as a side
+  //     effect of a cleanup;
+  //   - a rank the constitution or the who-decides table seats
+  //     (`rank_in_use_by_government`) — deleting it would leave that seat empty,
+  //     and only an amendment may change who decides.
+  router.delete('/government/ranks/:rankKey', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
+    const rankKey = rankKeyParam(req, res);
+    if (rankKey === null) return;
+    try {
+      const rank = await db.getRankByKey(rankKey);
+      if (!rank) return res.fail('rank_not_found', 404, { rank_key: rankKey });
+      if (rank.is_system) {
+        return res.fail('seeded_rank_immutable', 403, { rank_key: rankKey, reason: 'a ladder rank is part of the system and can never be deleted' });
+      }
+      const seatedIn = await seatsNamingRank(rankKey);
+      if (seatedIn.length > 0) {
+        return res.fail('rank_in_use_by_government', 409, {
+          rank_key: rankKey, seated_in: seatedIn,
+          reason: 'this rank decides something; propose an amendment that seats someone else first',
+        });
+      }
+      const out = await db.deleteCustomRank(rankKey);
+      if (out.reason === 'not_found') return res.fail('rank_not_found', 404, { rank_key: rankKey });
+      if (out.reason === 'held') {
+        return res.fail('rank_still_held', 409, {
+          rank_key: rankKey,
+          holders: out.holders.map((h) => ({ builder_id: h.builder_id, github_login: h.github_login, display_name: h.display_name })),
+          reason: 'remove this rank from everyone who holds it, then delete it',
+        });
+      }
+      res.json({ ok: true, rank_key: rankKey, deleted: true });
+    } catch (err) {
+      log.error('[gds] DELETE /government/ranks/:rankKey', err);
+      res.fail('delete_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // Where the live government seats a rank by name: the constitution's board
+  // membership and every who-decides row that names a sitting.
+  //
+  // loadGovernmentConfig() reads two small files synchronously, which config.js
+  // says belongs at boot. This route is the documented exception, as board.js's
+  // window-opening is: an Archon deleting a rank is rare and never a hot path, and
+  // the answer must be the constitution IN FORCE NOW (an amendment applied a moment
+  // ago rewrites the file), which a boot-time copy would not be.
+  //
+  // FAIL-CLOSED on an unparseable predicate: it seats nobody today, but if it
+  // spells this rank's key it is refused, so a typo someone later fixes cannot
+  // point at a rank that was deleted in the meantime.
+  async function seatsNamingRank(rankKey) {
+    const names = (predicate) => {
+      const parsed = membershipPredicate.parseMembershipPredicate(predicate);
+      if (parsed) return parsed.rankKeys.includes(rankKey);
+      return typeof predicate === 'string' && predicate.includes(rankKey);
+    };
+    const out = [];
+    const { board: live } = governmentConfig.loadGovernmentConfig();
+    if (live && names(live.membership)) out.push('the board');
+    for (const row of await db.listDecisionRules()) {
+      if (names(row.decided_by)) out.push(`who decides at ${row.area}`);
+    }
+    return out;
+  }
+
   // rank: perm government.manage — assign a CUSTOM rank to a builder.
   // assigned_by is ALWAYS the session builder, never input (the audit trail's
   // "who did this" must be the authenticated actor).

package/modules/hall-ui/public/government.js

@@ -268,6 +268,15 @@
       btn.addEventListener('click', () => resetRank(rank, btn));
       resetBox.appendChild(btn);
     }
+    // A custom rank can be deleted (task 1004481); the ladder never.
+    if (rank && !rank.is_system) {
+      const btn = document.createElement('button');
+      btn.type = 'button';
+      btn.className = 'btn-ghost';
+      btn.textContent = 'Delete rank';
+      btn.addEventListener('click', () => deleteRank(rank, btn));
+      resetBox.appendChild(btn);
+    }
 
     grid.innerHTML = '';
     // Principals are rendered in their own section further down the page; a machine
@@ -303,6 +312,35 @@
     }
   }
 
+  // Delete a custom rank. The server refuses while anyone holds it and names
+  // them, so the toast can say exactly whose rank to remove first.
+  async function deleteRank(rank, btn) {
+    const label = rank.label || rank.rank_key;
+    if (!window.confirm(`Delete the ${label} rank?\n\nIts permissions go with it. This cannot be undone, though you can create a rank with the same name again.`)) return;
+    btn.disabled = true;
+    const res = await api.request('DELETE', `${API}/government/ranks/${encodeURIComponent(rank.rank_key)}`);
+    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+    if (res.ok) {
+      toast(`${label} deleted.`);
+      await reloadRanks();
+      return;
+    }
+    btn.disabled = false;
+    toast(deleteRefusal((res.data || {}).error || {}, label));
+  }
+  function deleteRefusal(err, label) {
+    const d = err.details || {};
+    if (err.code === 'rank_still_held' && Array.isArray(d.holders) && d.holders.length) {
+      const names = d.holders.map((h) => h.display_name || h.github_login || `builder ${h.builder_id}`);
+      const shown = names.length > 3 ? `${names.slice(0, 3).join(', ')} and ${names.length - 3} more` : names.join(', ');
+      return `${label} is still held by ${shown}. Remove it from them below, then delete it.`;
+    }
+    if (err.code === 'rank_in_use_by_government' && Array.isArray(d.seated_in) && d.seated_in.length) {
+      return `${label} still decides something (${d.seated_in.join(', ')}). Propose an amendment that seats someone else first.`;
+    }
+    return `Could not delete: ${friendlyError(err.code) || err.message || 'the server refused'}`;
+  }
+
   async function toggleGrant(rank, permissionKey, grant, btn) {
     btn.disabled = true;
     try {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.81",
+  "version": "1.21.82",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.81",
+      "version": "1.21.82",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.81",
+  "version": "1.21.82",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9312,5 +9312,11 @@
       "id": "1004442",
       "text": "When the board turns someone's idea into a goal, every task later finished under that goal now pays the idea's author, as promised. Before this, only work promoted straight from the idea paid them, so a goal full of finished w"
     }
+  ],
+  "1.21.82": [
+    {
+      "id": "1004481",
+      "text": "Custom ranks can now be deleted from the Government page, so trying a recommended rank set is no longer a permanent choice. A rank someone still holds can't be deleted, and the page says who holds it. The four built-in ranks c"
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -261,6 +261,7 @@ const GOVERNMENT_PINS = {
   'PUT /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
   'DELETE /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
   'POST /government/ranks/:rankKey/reset': 'perm:government.manage',
+  'DELETE /government/ranks/:rankKey': 'perm:government.manage',
   'POST /government/rank-sets/apply': 'perm:government.manage',
   'POST /government/assignments': 'perm:government.manage',
   'DELETE /government/assignments/:builderId/:rankKey': 'perm:government.manage',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.81'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.82'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_routes.mjs

@@ -35,6 +35,7 @@ const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
+const governmentConfig = require(path.join(ROOT, 'modules', 'government', 'config.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 const express = require('express');
@@ -58,6 +59,7 @@ test('the routes file declares the full R110 surface', () => {
     'PUT /government/ranks/:rankKey/permissions/:permissionKey',
     'DELETE /government/ranks/:rankKey/permissions/:permissionKey',
     'POST /government/ranks/:rankKey/reset',
+    'DELETE /government/ranks/:rankKey',
     'POST /government/assignments',
     'DELETE /government/assignments/:builderId/:rankKey',
     'POST /government/rank-sets/apply',
@@ -125,6 +127,7 @@ test('checkRouteRanks passes over the real tree (no governance findings)', () =>
 
 // The db stub: every function the routes call, recording args. Reset per test.
 const calls = [];
+let deleteAnswer = { deleted: true, holders: [] };
 const stub = {
   listRanksWithGrants: async () => [{ rank_key: 'metic', label: 'Metic', description: null, is_system: true, seeded_rank: 'metic', created_by: null, created_at: 't', permissions: ['task.create'] }],
   listAssignments: async () => [{ builder_id: 7, github_login: 'x', display_name: 'X', rank: 'metic', rank_key: 'metic', role_label: 'Metic', is_system: true, seeded_rank: 'metic', assigned_by: null, assigned_at: 't' }],
@@ -141,6 +144,8 @@ const stub = {
   grantRankPermission: async () => true,
   revokeRankPermission: async () => true,
   resetRankGrants: async ({ permissionKeys }) => permissionKeys.length,
+  // task 1004481: `deleteAnswer` scripts what the locked delete found.
+  deleteCustomRank: async () => deleteAnswer,
   assignRank: async () => true,
   unassignRank: async () => true,
   // task 1004529: who decides at People. [] = the as-today default row.
@@ -412,6 +417,73 @@ test('POST reset: refused on a custom role (no catalog default to return to)', a
   assert.equal(calls.filter(([k]) => k === 'resetRankGrants').length, 0);
 });
 
+// --- delete a custom rank (task 1004481) --------------------------------------
+
+test('DELETE a rank: a custom rank nobody holds is deleted', async () => {
+  deleteAnswer = { deleted: true, holders: [] };
+  const r = await call('DELETE', '/government/ranks/triage-helper');
+  assert.equal(r.status, 200);
+  assert.equal(r.json.deleted, true);
+  const c = calls.find(([k]) => k === 'deleteCustomRank');
+  assert.equal(c[1], 'triage-helper');
+});
+
+test('DELETE a rank: refused while held, and the refusal names who holds it', async () => {
+  deleteAnswer = { deleted: false, reason: 'held', holders: [{ builder_id: 9, github_login: 'ana', display_name: 'Ana', extra: 'x' }] };
+  const r = await call('DELETE', '/government/ranks/triage-helper');
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'rank_still_held');
+  assert.deepEqual(r.json.error.details.holders, [{ builder_id: 9, github_login: 'ana', display_name: 'Ana' }], 'names them, and only those fields');
+  assert.equal(calls.filter(([k]) => k === 'unassignRank').length, 0, 'never unassigns on the way');
+  deleteAnswer = { deleted: true, holders: [] };
+});
+
+test('DELETE a rank: every seeded rank is refused before the db is asked', async () => {
+  for (const k of catalog.RANK_ORDER) {
+    const r = await call('DELETE', `/government/ranks/${k}`);
+    assert.equal(r.status, 403, k);
+    assert.equal(r.json.error.code, 'seeded_rank_immutable');
+    assert.equal(calls.filter(([n]) => n === 'deleteCustomRank').length, 0);
+  }
+});
+
+test('DELETE a rank: a missing rank 404s, from the read or from the locked delete', async () => {
+  assert.equal((await call('DELETE', '/government/ranks/missing')).status, 404);
+  deleteAnswer = { deleted: false, reason: 'not_found', holders: [] };
+  assert.equal((await call('DELETE', '/government/ranks/triage-helper')).status, 404);
+  deleteAnswer = { deleted: true, holders: [] };
+});
+
+test('DELETE a rank: refused while the board or a who-decides row seats it', async () => {
+  const realLoad = governmentConfig.loadGovernmentConfig;
+  try {
+    governmentConfig.loadGovernmentConfig = () => ({ board: { membership: 'rank:archon,triage-helper' } });
+    let r = await call('DELETE', '/government/ranks/triage-helper');
+    assert.equal(r.status, 409);
+    assert.equal(r.json.error.code, 'rank_in_use_by_government');
+    assert.deepEqual(r.json.error.details.seated_in, ['the board']);
+    assert.equal(calls.filter(([k]) => k === 'deleteCustomRank').length, 0);
+
+    governmentConfig.loadGovernmentConfig = () => ({ board: { membership: 'rank:archon' } });
+    stub.listDecisionRules = async () => [{ area: 'people', decided_by: 'rank:triage-helper' }, { area: 'treasury', decided_by: 'gate' }];
+    r = await call('DELETE', '/government/ranks/triage-helper');
+    assert.equal(r.status, 409);
+    assert.deepEqual(r.json.error.details.seated_in, ['who decides at people']);
+    r = await call('DELETE', '/government/ranks/other-rank');
+    assert.equal(r.status, 200, 'a rank nothing seats is still deletable');
+
+    // fail-closed: an unparseable predicate that spells the key still refuses
+    stub.listDecisionRules = async () => [];
+    governmentConfig.loadGovernmentConfig = () => ({ board: { membership: 'rank:triage-helper+' } });
+    r = await call('DELETE', '/government/ranks/triage-helper');
+    assert.equal(r.status, 409, 'rank:<custom>+ is unparseable, and still names the rank');
+    assert.deepEqual(r.json.error.details.seated_in, ['the board']);
+  } finally {
+    governmentConfig.loadGovernmentConfig = realLoad;
+    stub.listDecisionRules = async () => [];
+  }
+});
+
 // --- assignments -------------------------------------------------------------
 
 test('POST /government/assignments assigns a custom role, assigned_by = the session builder', async () => {