@bongos/core 1.24.1 → 1.24.2

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**3106 strings** across 3 surfaces · 2446 distinct pieces of copy · 3106 certain, 0 heuristic · 260 shown in more than one place.
+**3111 strings** across 3 surfaces · 2450 distinct pieces of copy · 3111 certain, 0 heuristic · 261 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 159 | 2008 |
+| `builders-hall` | `modules/hall-ui/public` | 160 | 2013 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 91 |
 | `landing` | `modules/public-landing/public` | 10 | 1007 |
 
@@ -76,9 +76,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `eff70e59d12e` | 4x | Task {…} | modules/hall-ui/public/task.js:491, modules/hall-ui/public/task.js:527, modules/hall-ui/public/task.js:1022 |
 | `72a29648399b` | 4x | Tweak a page | modules/hall-ui/public/tweak-editor.html:32, modules/hall-ui/public/tweak-editor.html:32, modules/hall-ui/public/tweak-editor.html:55 |
 | `ed394c66d49c` | 4x | What the choice changes | modules/public-landing/public/projects.html:1342, modules/public-landing/public/projects.html:1430, modules/public-landing/public/projects.html:1442 |
-| … | | _220 more in the JSON registry_ | |
+| … | | _221 more in the JSON registry_ | |
 
-## `builders-hall` — 2008 strings
+## `builders-hall` — 2013 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -251,6 +251,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `da910fee01d7` | certain | Browse goals → | `modules/hall-ui/public/goals.js:105` |
 | `25b4ab94728a` | certain | Build from your own machine — get a copy of the project, sign in once, then work in Claude. | `modules/hall-ui/public/hall-render.js:817` |
 | `08bfcc9198ba` | certain | Builder id | `modules/hall-ui/public/government.html:107` |
+| `08bfcc9198ba` | certain | Builder id | `modules/hall-ui/public/government.html:127` |
 | `fd1903586e8e` | certain | Builders hall · this session | `modules/hall-ui/public/craft-mode.js:670` |
 | `306bc316184d` | certain | Builders you may know | `modules/hall-ui/public/profile-connections.js:158` |
 | `60b248791dc3` | certain | Builders — {{worldName}} | `modules/hall-ui/public/roster.html:6` |
@@ -270,7 +271,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `181cfa50b127` | certain | By the numbers | `modules/hall-ui/public/profile.html:64` |
 | `a015a43bfc7f` | certain | CLI access | `modules/hall-ui/public/settings.html:141` |
 | `09e863eb90af` | certain | Can: {…} | `modules/hall-ui/public/government.js:911` |
-| `084eb64bce72` | certain | Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can | `modules/hall-ui/public/government.html:121` |
+| `084eb64bce72` | certain | Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can | `modules/hall-ui/public/government.html:141` |
 | `c31f00bce184` | certain | Card added. | `modules/hall-ui/public/settings-passkeys.js:92` |
 | `3cd965c9e3b1` | certain | Card name | `modules/hall-ui/public/settings.html:186` |
 | `6fad39976eaf` | certain | Card removed. | `modules/hall-ui/public/settings-passkeys.js:59` |
@@ -757,7 +758,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9da6a9b67eea` | certain | Look around first | `modules/hall-ui/public/welcome-boot.js:197` |
 | `4017ee030bc2` | certain | Lookback window | `modules/hall-ui/public/profile-charts.js:540` |
 | `73677b6839d7` | certain | Looks good | `modules/hall-ui/public/studio.js:196` |
-| `06b4ede3fb58` | certain | Machine principals | `modules/hall-ui/public/government.html:120` |
+| `06b4ede3fb58` | certain | Machine principals | `modules/hall-ui/public/government.html:140` |
 | `b8a2b32fdbb1` | certain | Main role | `modules/hall-ui/public/settings.html:125` |
 | `4088dac7b364` | certain | Make it a law | `modules/hall-ui/public/my-agents.js:418` |
 | `d535454fac6d` | certain | Make it again | `modules/hall-ui/public/ai-studio.js:416` |
@@ -874,6 +875,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1967d2176f2e` | certain | Nobody has an open ask right now. | `modules/hall-ui/public/collab.html:95` |
 | `c65c9f5c02e3` | certain | Nobody is waiting on you. Requests reach you by role — | `modules/hall-ui/public/collab.html:54` |
 | `d5cf262e671d` | certain | Nobody is writing this page. Take it, and every line here is yours to type over. | `modules/hall-ui/public/tweak-editor.js:323` |
+| `380b924cd4a0` | certain | Nobody recorded — it falls to the owner | `modules/hall-ui/public/government-access.js:35` |
 | `91c409a4aea5` | certain | Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit | `modules/hall-ui/public/watch.js:397` |
 | `4016b9cf8d57` | certain | None of your asks have been settled yet. | `modules/hall-ui/public/collab.html:145` |
 | `36c97d6094bf` | certain | None yet. Yours will be the first. | `modules/hall-ui/public/lightbulb.js:90` |
@@ -983,6 +985,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a2bd76ae030d` | certain | Opens this project's upgrade{…}: you see what would move, confirm it, and it installs, checks itself, and roll | `modules/hall-ui/public/settings-software-update.js:130` |
 | `569980a263ae` | certain | Optional. This is the ledger link — a copy change ships as a task like every other change. | `modules/hall-ui/public/copy-desk.html:130` |
 | `f2e9e8f21e8e` | certain | Or add someone without asking… | `modules/hall-ui/public/goals-render.js:1258` |
+| `8b1e7aae1e5f` | certain | Outside access | `modules/hall-ui/public/government.html:123` |
+| `20cf1adf4154` | certain | Outside access could not be read just now. | `modules/hall-ui/public/government-access.js:72` |
 | `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1287` |
 | `695ffff13730` | certain | Over time | `modules/hall-ui/public/profile.html:76` |
 | `5ded44da0cc5` | certain | Override requests | `modules/hall-ui/public/watch.html:137` |
@@ -1592,6 +1596,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f9ab9eb870a6` | certain | While you wait: install the Claude desktop app at | `modules/hall-ui/public/hall-render.js:471` |
 | `74d8c58ef235` | certain | Who builds on this project, ranked by work shipped. This project's own ledger — everyone who builds here is li | `modules/hall-ui/public/roster.html:28` |
 | `b79ea4077bc5` | certain | Who can use it | `modules/hall-ui/public/settings.html:306` |
+| `c6d830ca9e08` | certain | Who holds the keys outside the project, so a blocker that needs one reaches them. This is a record of who to a | `modules/hall-ui/public/government.html:124` |
 | `045c629729b7` | certain | Who’s on this goal, and what they’ve contributed to it. | `modules/hall-ui/public/goals.html:219` |
 | `5cc53380b1e8` | certain | Why (optional) | `modules/hall-ui/public/goals-render.js:1029` |
 | `62ab2e60f629` | certain | Why is this better? | `modules/hall-ui/public/copy-desk.html:164` |

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/bongos/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 3106,
-    "unique_ids": 2446,
-    "certain": 3106,
+    "strings": 3111,
+    "unique_ids": 2450,
+    "certain": 3111,
     "heuristic": 0,
-    "duplicate_ids": 260
+    "duplicate_ids": 261
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 159,
-      "strings": 2008
+      "files": 160,
+      "strings": 2013
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1258,6 +1258,16 @@
         "modules/hall-ui/public/goals.js:105"
       ]
     },
+    {
+      "id": "08bfcc9198ba",
+      "surface": "builders-hall",
+      "text": "Builder id",
+      "occurrences": 2,
+      "at": [
+        "modules/hall-ui/public/government.html:107",
+        "modules/hall-ui/public/government.html:127"
+      ]
+    },
     {
       "id": "60b248791dc3",
       "surface": "builders-hall",
@@ -4561,6 +4571,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "08bfcc9198ba",
+      "surface": "builders-hall",
+      "text": "Builder id",
+      "file": "modules/hall-ui/public/government.html",
+      "line": 127,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "fd1903586e8e",
       "surface": "builders-hall",
@@ -4737,7 +4756,7 @@
       "surface": "builders-hall",
       "text": "Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can be granted.",
       "file": "modules/hall-ui/public/government.html",
-      "line": 121,
+      "line": 141,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -9120,7 +9139,7 @@
       "surface": "builders-hall",
       "text": "Machine principals",
       "file": "modules/hall-ui/public/government.html",
-      "line": 120,
+      "line": 140,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -10168,6 +10187,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "380b924cd4a0",
+      "surface": "builders-hall",
+      "text": "Nobody recorded — it falls to the owner",
+      "file": "modules/hall-ui/public/government-access.js",
+      "line": 35,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "91c409a4aea5",
       "surface": "builders-hall",
@@ -11149,6 +11177,24 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8b1e7aae1e5f",
+      "surface": "builders-hall",
+      "text": "Outside access",
+      "file": "modules/hall-ui/public/government.html",
+      "line": 123,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
+    {
+      "id": "20cf1adf4154",
+      "surface": "builders-hall",
+      "text": "Outside access could not be read just now.",
+      "file": "modules/hall-ui/public/government-access.js",
+      "line": 72,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "d89d1923ecf9",
       "surface": "builders-hall",
@@ -16630,6 +16676,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "c6d830ca9e08",
+      "surface": "builders-hall",
+      "text": "Who holds the keys outside the project, so a blocker that needs one reaches them. This is a record of who to ask: it grants nothing here and stores no password or token.",
+      "file": "modules/hall-ui/public/government.html",
+      "line": 124,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "045c629729b7",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -3264,5 +3264,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         The lifecycle feed and claim gate apply it. Additive, so MINOR.
   1.24.1 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.0 with no explicit bump. run 40985289858. (task 1002620)
+  1.24.2 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.1 with no explicit bump. run 41000649913. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-inventory.json

@@ -611,7 +611,8 @@
         "modules/hall-ui/public/palette.js",
         "modules/hall-ui/public/hall-kit.js",
         "modules/hall-ui/public/board-lib.js",
-        "modules/hall-ui/public/government.js"
+        "modules/hall-ui/public/government.js",
+        "modules/hall-ui/public/government-access.js"
       ],
       "states_files": [
         "modules/hall-ui/public/government.states.json"

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/bongos/page-reader.js --stale",
   "how": ["Generated by node scripts/bongos/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":48,"lines":5447,"placed":1678,"shared":427,"unplaced":3342,"omitted_data":3705},
+  "counts": {"pages":48,"lines":5456,"placed":1683,"shared":427,"unplaced":3346,"omitted_data":3730},
   "pages": [
     {
       "id": "builders:ai-studio",
@@ -160,7 +160,7 @@
       "surface": "builders",
       "title": "Blockers",
       "states_read": ["default"],
-      "files_hash": "dd1eef188b4d3bf8",
+      "files_hash": "439934ddd9d1a4d2",
       "reading_hash": "c393e54845d545ee",
       "counts": {"lines":34,"placed":14,"shared":8,"unplaced":12},
       "omitted": {"data":49},
@@ -327,7 +327,7 @@
       "surface": "builders",
       "title": "Collab",
       "states_read": ["board","out"],
-      "files_hash": "75d4fa4c09ed937c",
+      "files_hash": "2e20ca6774af82fc",
       "reading_hash": "71803b40b959a9b9",
       "counts": {"lines":80,"placed":31,"shared":7,"unplaced":42},
       "omitted": {"data":21},
@@ -1456,10 +1456,10 @@
       "surface": "builders",
       "title": "Government",
       "states_read": ["constitution","out","permissions","board","constitution-tab"],
-      "files_hash": "a7bba5b1bc058a3c",
-      "reading_hash": "165c2459edf3678c",
-      "counts": {"lines":54,"placed":19,"shared":8,"unplaced":27},
-      "omitted": {"data":249},
+      "files_hash": "25c1dc0003420a7c",
+      "reading_hash": "18d8e460088c2550",
+      "counts": {"lines":63,"placed":24,"shared":8,"unplaced":31},
+      "omitted": {"data":274},
       "notes": ["permissions: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","board: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","constitution-tab: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood"],
       "lines": [
         {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":868,"string_id":"87cee78ca134"},
@@ -1503,19 +1503,28 @@
         {"key":"L0039","section":"Assignments","text":"{…} · via rank","placement":"unplaced","occurrences":2},
         {"key":"L0040","section":"Assignments","text":"rank","placement":"unplaced","occurrences":3},
         {"key":"L0041","section":"Assignments","text":"Remove","placement":"unplaced"},
-        {"key":"L0042","section":"Machine principals","text":"Machine principals","placement":"placed","file":"modules/hall-ui/public/government.html","line":120,"string_id":"06b4ede3fb58"},
-        {"key":"L0043","section":"Machine principals","text":"Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can be granted.","placement":"placed","file":"modules/hall-ui/public/government.html","line":121,"string_id":"084eb64bce72"},
-        {"key":"L0044","section":"Machine principals","text":"holds","placement":"unplaced","occurrences":2},
-        {"key":"L0045","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":516,"string_id":"1883ad7f07fc"},
-        {"key":"L0046","section":"Machine principals","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":670,"string_id":"fd1903586e8e"},
-        {"key":"L0047","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":671,"string_id":"60853319f290"},
-        {"key":"L0048","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":672,"string_id":"4f87d5b17b54"},
-        {"key":"L0049","section":"What are you doing now?","text":"Building","placement":"unplaced"},
-        {"key":"L0050","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
-        {"key":"L0051","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
-        {"key":"L0052","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
-        {"key":"L0053","section":"What are you doing now?","text":"Turn thoughts into ideas.","placement":"unplaced"},
-        {"key":"L0054","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":675,"string_id":"fa86bf403775"}
+        {"key":"L0042","section":"Outside access","text":"Outside access","placement":"placed","file":"modules/hall-ui/public/government.html","line":123,"string_id":"8b1e7aae1e5f"},
+        {"key":"L0043","section":"Outside access","text":"Who holds the keys outside the project, so a blocker that needs one reaches them. This is a record of who to ask: it grants nothing here and stores no password or token.","placement":"placed","file":"modules/hall-ui/public/government.html","line":124,"string_id":"c6d830ca9e08"},
+        {"key":"L0044","section":"Outside access","text":"Builder id","placement":"placed","file":"modules/hall-ui/public/government.html","line":107,"string_id":"08bfcc9198ba"},
+        {"key":"L0045","section":"Outside access","text":"e.g. 95","placement":"unplaced","attr":"placeholder"},
+        {"key":"L0046","section":"Outside access","text":"Access","placement":"unplaced"},
+        {"key":"L0047","section":"Outside access","text":"Record","placement":"unplaced"},
+        {"key":"L0048","section":"Outside access","text":"Remove","placement":"unplaced","occurrences":2},
+        {"key":"L0049","section":"Outside access","text":"Nobody recorded — it falls to the owner","placement":"placed","file":"modules/hall-ui/public/government-access.js","line":35,"string_id":"380b924cd4a0","occurrences":4},
+        {"key":"L0050","section":"Outside access","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232"},
+        {"key":"L0051","section":"Machine principals","text":"Machine principals","placement":"placed","file":"modules/hall-ui/public/government.html","line":140,"string_id":"06b4ede3fb58"},
+        {"key":"L0052","section":"Machine principals","text":"Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can be granted.","placement":"placed","file":"modules/hall-ui/public/government.html","line":141,"string_id":"084eb64bce72"},
+        {"key":"L0053","section":"Machine principals","text":"holds","placement":"unplaced","occurrences":2},
+        {"key":"L0054","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":516,"string_id":"1883ad7f07fc"},
+        {"key":"L0055","section":"Machine principals","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":670,"string_id":"fd1903586e8e"},
+        {"key":"L0056","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":671,"string_id":"60853319f290"},
+        {"key":"L0057","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":672,"string_id":"4f87d5b17b54"},
+        {"key":"L0058","section":"What are you doing now?","text":"Building","placement":"unplaced"},
+        {"key":"L0059","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
+        {"key":"L0060","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
+        {"key":"L0061","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
+        {"key":"L0062","section":"What are you doing now?","text":"Turn thoughts into ideas.","placement":"unplaced"},
+        {"key":"L0063","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":675,"string_id":"fa86bf403775"}
       ]
     },
     {

package/modules/government/access-routes.js

@@ -0,0 +1,70 @@
+'use strict';
+
+// modules/government/access-routes.js — the handlers behind the three ACCESS HOLDERS
+// routes (task 1005000). The routes themselves — path, permission gate and pin — are
+// declared in routes/government.js, where route-rank-check reads them; only the bodies
+// live here, so the router file stays under the size ratchet.
+//
+//   GET    /government/access                               (board.vote.cast) — read
+//   POST   /government/access/:accessKey/holders            (government.manage) — record
+//   DELETE /government/access/:accessKey/holders/:builderId (government.manage) — remove
+//
+// ⚠ A record of who to ask, never authority (access.js). Not act-alone routes: they
+// record a fact about the world outside the project; they decide nothing a sitting
+// votes on.
+
+const access = require('./access');
+
+// deps: { db, log, parseId, validateOrRespond } — the router's own, passed in so a
+// test that stubs the db by property reaches these handlers too.
+function accessHandlers({ db, log, parseId, validateOrRespond }) {
+  const keyOf = (req, res) => {
+    const key = String(req.params.accessKey || '');
+    if (access.isAccessKey(key)) return key;
+    res.fail('unknown_access', { status: 400, message: `Name one of: ${access.KEYS.join(', ')}.` });
+    return null;
+  };
+
+  async function read(req, res) {
+    try {
+      res.json({ access: access.accessView(await db.listAccessHolders()) });
+    } catch (err) {
+      log.error('[gds] GET /government/access', err);
+      res.fail('access_read_failed', { status: 500, message: 'internal error' });
+    }
+  }
+
+  async function grant(req, res) {
+    if (validateOrRespond(req, res, { builder_id: { required: true, type: 'integer', min: 1 } })) return;
+    const key = keyOf(req, res);
+    if (key === null) return;
+    const builderId = req.body.builder_id;
+    try {
+      const who = await db.getActiveBuilder(builderId);
+      if (!who) return res.fail('builder_not_found', { status: 404, message: 'No active builder with that id.' });
+      const added = await db.grantAccess(key, builderId, req.builder.id);
+      res.status(added ? 201 : 200).json({ ok: true, access_key: key, builder_id: String(builderId), added });
+    } catch (err) {
+      log.error('[gds] POST /government/access/:accessKey/holders', err);
+      res.fail('access_grant_failed', { status: 500, message: 'internal error' });
+    }
+  }
+
+  async function revoke(req, res) {
+    const key = keyOf(req, res);
+    if (key === null) return;
+    const builderId = parseId(req, res, { param: 'builderId', code: 'bad_builder_id', positiveInt: true });
+    if (builderId === null) return;
+    try {
+      const removed = await db.revokeAccess(key, builderId);
+      res.json({ ok: true, access_key: key, builder_id: String(builderId), removed });
+    } catch (err) {
+      log.error('[gds] DELETE /government/access/:accessKey/holders/:builderId', err);
+      res.fail('access_revoke_failed', { status: 500, message: 'internal error' });
+    }
+  }
+
+  return { read, grant, revoke };
+}
+
+module.exports = { accessHandlers };

package/modules/government/access.js

@@ -0,0 +1,88 @@
+'use strict';
+
+// modules/government/access.js — ACCESS HOLDERS: who holds the keys that live OUTSIDE
+// Bongos, so a blocker that needs one reaches the person who has it (task 1005000,
+// goal 1000111).
+//
+// WHY. Some blockers can only be cleared by whoever holds access no rank or Lead
+// models: the GitHub repository's admin (token scopes, branch protection, the App's
+// permissions), the server, the domain's DNS, the hosting account, package publishing,
+// payments. An Archon in Bongos may not hold the GitHub admin, and a Lead never does.
+// It lived only in prose (docs/credentials.md "account logins the owner holds") and in
+// blocker text — blocker 1000199, the publish token missing GitHub's `workflow` scope,
+// could only be filed to "the owner". The builder's words: repo owner is a category of
+// blockers that go beyond normality.
+//
+// WHAT IT IS. A fixed vocabulary of outside-access keys (ACCESS, extendable here and in
+// the migration's CHECK together), a record of which builders hold each
+// (government_access_holders, written by the owner only), and a seat, `access:<key>`,
+// that an ask can wait on. routing.js resolves that seat to the recorded holders, and
+// to the owner when nobody is recorded — the same fall every other seat takes.
+//
+// ⚠ A RECORD OF WHO TO ASK, NEVER AN AUTHORITY GRANT. Holding github-admin here unlocks
+// no Bongos route and no rank: this module is not read by requireRank, the permission
+// resolver, or any gate, and an access key is not a permission atom. No secret is
+// stored either — the row says WHO holds an access, never a credential or a token.
+//
+// PURE: no db.
+
+const ACCESS = Object.freeze([
+  // name: how the seat reads after "waits on the"; needs: what a blocker on it needs.
+  Object.freeze({ key: 'github-admin', name: 'repo owner', needs: 'repo-owner access', what: 'Admin on the GitHub repository: token scopes, branch protection, the GitHub App.' }),
+  Object.freeze({ key: 'server-ssh', name: 'server access', needs: 'server access', what: 'A login on the server the project runs on.' }),
+  Object.freeze({ key: 'dns', name: 'domain settings', needs: 'access to the domain settings', what: 'The DNS account for the project\'s domain.' }),
+  Object.freeze({ key: 'hosting', name: 'hosting account', needs: 'access to the hosting account', what: 'The account that pays for and runs the project\'s servers.' }),
+  Object.freeze({ key: 'npm-publish', name: 'package publishing', needs: 'package publishing rights', what: 'Publishing rights for the project\'s packages.' }),
+  Object.freeze({ key: 'payments', name: 'payments', needs: 'access to payments', what: 'The account money moves through.' }),
+]);
+const KEYS = Object.freeze(ACCESS.map((a) => a.key));
+const isAccessKey = (k) => KEYS.includes(String(k || ''));
+const byKey = (k) => ACCESS.find((a) => a.key === k) || null;
+
+// The seat grammar's access half, for asks.js SEAT and the migration's CHECK.
+const SEAT_PART = `access:(${KEYS.join('|')})`;
+
+// "the repo owner" — how the seat reads after "waits on".
+function accessLabel(key) {
+  const a = byKey(key);
+  return a ? `the ${a.name}` : 'the owner';
+}
+
+// "needs repo-owner access" — how a blocker on this seat reads under its holder.
+function needsWords(key) {
+  const a = byKey(key);
+  return a ? `needs ${a.needs}` : 'needs outside access';
+}
+
+// The holders read as the seat resolver wants them: { key: [{ builder_id, github_login, display_name }] }.
+function holdersByKey(rows) {
+  const out = {};
+  for (const k of KEYS) out[k] = [];
+  for (const r of rows || []) {
+    if (r && isAccessKey(r.access_key) && r.builder_id != null) out[r.access_key].push(r);
+  }
+  return out;
+}
+
+// The read GET /government/access answers: every access, its words, who holds it.
+function accessView(rows) {
+  const held = holdersByKey(rows);
+  return ACCESS.map((a) => ({
+    key: a.key,
+    name: a.name,
+    // the one display form, for the list and the picker alike
+    title: a.name.charAt(0).toUpperCase() + a.name.slice(1),
+    what: a.what,
+    seat: `access:${a.key}`,
+    holders: held[a.key].map((r) => ({
+      id: String(r.builder_id),
+      login: r.github_login || null,
+      name: r.display_name || r.github_login || null,
+      since: r.granted_at || null,
+    })),
+    // nobody recorded: the seat falls to the owner, as every unheld seat does
+    falls_to_owner: held[a.key].length === 0,
+  }));
+}
+
+module.exports = { ACCESS, KEYS, SEAT_PART, isAccessKey, accessLabel, needsWords, holdersByKey, accessView };

package/modules/government/asks.js

@@ -44,10 +44,12 @@ const MARKUP = /\*\*|`|^#|\[[^\]]*\]\(|https?:\/\/|<\/?[a-z]/im;
 // Control characters other than tab and line breaks (line breaks have their own rule).
 // eslint-disable-next-line no-control-regex
 const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+const access = require('./access');
 const BUILDINGS = Object.freeze(['charter', 'rules', 'disputes', 'people', 'planning', 'automation', 'review', 'release', 'treasury']);
 // The seats an ask can wait on (gov-living.js seatResolver's grammar). An
 // unseated building falls to the owner when it is routed (owner ruling).
-const SEAT = new RegExp(`^(owner|(lead|board):(${BUILDINGS.join('|')})|committee:(${BUILDINGS.join('|')})\\.[a-z][a-z0-9_]{0,31})$`);
+// `access:<key>` (task 1005000): whoever holds that outside access (access.js).
+const SEAT = new RegExp(`^(owner|(lead|board):(${BUILDINGS.join('|')})|committee:(${BUILDINGS.join('|')})\\.[a-z][a-z0-9_]{0,31}|${access.SEAT_PART})$`);
 // An answer's key: what a tap sends. Its act, optional: the matter's own act it
 // takes ('go ahead', 'record', 'force:tested_by_hand'); the deck maps it onto
 // the desk row's real route and refuses one the row does not offer.
@@ -150,7 +152,7 @@ function checkAsk(raw) {
   // ---- who it waits on: a seat the direction desk can route ----
   const seat = str(c.waits_on).trim();
   if (!seat) err('waits_on', 'missing', 'Say who this waits on.');
-  else if (!SEAT.test(seat)) err('waits_on', 'unknown_seat', `"${seat.slice(0, 40)}" is not a seat: say owner, lead:<building>, committee:<building>.<name> or board:<building>.`);
+  else if (!SEAT.test(seat)) err('waits_on', 'unknown_seat', `"${seat.slice(0, 40)}" is not a seat: say owner, lead:<building>, committee:<building>.<name>, board:<building> or access:<key>.`);
 
   // ---- what happens if nobody answers ----
   lineRule('if_nobody_answers', c.if_nobody_answers, 'Say what happens if nobody answers.');
@@ -206,6 +208,7 @@ const ASK_REQUIRED_MESSAGE = 'An AI session files a blocker with an ask: a quest
 function seatWords(seat) {
   const s = str(seat);
   if (s === 'owner') return 'the owner';
+  if (/^access:/.test(s)) return access.accessLabel(s.slice(7));
   const m = /^(lead|board|committee):([a-z]+)(?:\.([a-z0-9_]+))?$/.exec(s);
   if (!m) return s;
   const building = m[2].charAt(0).toUpperCase() + m[2].slice(1);

package/modules/government/db.js

@@ -888,6 +888,41 @@ async function listActiveArchons() {
   return rows;
 }
 
+// ACCESS HOLDERS (task 1005000, government_036): who holds each outside access.
+// Active builders only — someone who left the project is nobody to ask. A record
+// of who to ask, never authority: no gate reads these rows (access.js).
+async function listAccessHolders() {
+  const { rows } = await pool.query(
+    `SELECT h.access_key, h.builder_id, h.granted_at, b.github_login, b.display_name
+       FROM government_access_holders h
+       JOIN builders b ON b.id = h.builder_id
+      WHERE b.status = 'active' AND b.system_role IS NULL
+      ORDER BY h.access_key, h.granted_at, h.builder_id`,
+  );
+  return rows;
+}
+
+// Record that a builder holds an access. Idempotent: an existing row is kept as it
+// was (its original granted_at/by). → true when a row was added.
+async function grantAccess(accessKey, builderId, grantedBy) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO government_access_holders (access_key, builder_id, granted_by)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (access_key, builder_id) DO NOTHING`,
+    [accessKey, builderId, grantedBy],
+  );
+  return rowCount > 0;
+}
+
+// → true when a row was removed.
+async function revokeAccess(accessKey, builderId) {
+  const { rowCount } = await pool.query(
+    'DELETE FROM government_access_holders WHERE access_key = $1 AND builder_id = $2',
+    [accessKey, builderId],
+  );
+  return rowCount > 0;
+}
+
 // One builder of this project, or null: who a Lead appointment names. Only an
 // active person (no machine identity) can be appointed.
 async function getActiveBuilder(builderId) {
@@ -1306,6 +1341,9 @@ module.exports = {
   applyLaws,
   listLeads,
   listActiveArchons,
+  listAccessHolders,
+  grantAccess,
+  revokeAccess,
   getActiveBuilder,
   applyLeadAct,
   listBuildouts,

package/modules/government/docket.js

@@ -86,6 +86,7 @@ const governmentConfig = require('./config');
 const asksDb = require('./asks-db');
 const routing = require('./routing');
 const waiting = require('./waiting');
+const access = require('./access');
 const { ownerOf } = require('./leads');
 
 const log = api.logger('government');
@@ -840,8 +841,17 @@ async function docketFor(builder) {
 // nothing — the docket then says `routed: false` rather than guess whose it is.
 async function loadSeats(government) {
   try {
-    const [leads, archons] = await Promise.all([db.listLeads(), db.listActiveArchons()]);
-    return { leads, owner: ownerOf(archons), holders: (government && government.holders) || {} };
+    // task 1005000: who holds each outside access. Its own read fails OPEN to nobody
+    // recorded (every access seat then falls to the owner), so a missing table on an
+    // instance that has not migrated yet never stops the City routing. Started inside
+    // a .then so a db layer without the function (an older stub, the walk's store)
+    // fails open too rather than throwing before the catch is attached.
+    const accessRows = Promise.resolve().then(() => db.listAccessHolders()).catch((err) => {
+      log.warn({ err: err && err.message }, 'governor docket: access holders unreadable, access seats fall to the owner');
+      return [];
+    });
+    const [leads, archons, held] = await Promise.all([db.listLeads(), db.listActiveArchons(), accessRows]);
+    return { leads, owner: ownerOf(archons), holders: (government && government.holders) || {}, access: access.holdersByKey(held) };
   } catch (err) {
     log.warn({ err: err && err.message }, 'governor docket: seats unreadable, nothing routed');
     return null;

package/modules/government/migrations/government_036_access_holders.sql

@@ -0,0 +1,33 @@
+-- government_036_access_holders.sql — who holds the keys OUTSIDE Bongos, and an ask
+-- that waits on them (task 1005000, goal 1000111).
+--
+-- WHAT THIS ADDS
+--
+--   government_access_holders — one row per (outside access, builder): the GitHub
+--   repository's admin, the server, the domain's DNS, the hosting account, package
+--   publishing, payments. The vocabulary is modules/government/access.js `ACCESS`,
+--   held equal to the CHECK below by tests/access_holders.mjs. Written by the owner
+--   only (the routes gate government.manage); who granted it and when ride the row.
+--
+--   It is a RECORD OF WHO TO ASK, never an authority grant: no permission atom, rank
+--   check or gate reads this table, and it stores no credential — only who holds one.
+--
+--   government_asks.waits_on gains the seat `access:<key>`, so an ask can wait on
+--   whoever holds an outside access (routing.js; nobody recorded → the owner).
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS government_access_holders (
+  access_key  text        NOT NULL
+              CHECK (access_key IN ('github-admin', 'server-ssh', 'dns', 'hosting', 'npm-publish', 'payments')),
+  builder_id  bigint      NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  granted_by  bigint      REFERENCES builders(id) ON DELETE SET NULL,
+  granted_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (access_key, builder_id)
+);
+
+ALTER TABLE government_asks DROP CONSTRAINT IF EXISTS government_asks_waits_on_check;
+ALTER TABLE government_asks ADD CONSTRAINT government_asks_waits_on_check
+  CHECK (waits_on ~ '^(owner|(lead|board):(charter|rules|disputes|people|planning|automation|review|release|treasury)|committee:(charter|rules|disputes|people|planning|automation|review|release|treasury)\.[a-z][a-z0-9_]{0,31}|access:(github-admin|server-ssh|dns|hosting|npm-publish|payments))$');
+
+COMMIT;