@bongos/core 1.24.1 → 1.24.2

package/modules/government/routes/government.js

@@ -34,6 +34,7 @@ const counts = require('../counts');
 const asks = require('../asks');
 const asksDb = require('../asks-db');
 const routing = require('../routing');
+const { accessHandlers } = require('../access-routes');
 const governmentConfig = require('../config');
 const membershipPredicate = require('../membership-predicate');
 const positions = require('../positions');
@@ -689,6 +690,14 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // ACCESS HOLDERS (task 1005000): who holds the keys outside Bongos, so an ask can wait
+  // on access:<key>. Read on the docket's atom; recorded by the owner. A record of who to
+  // ask, never authority (access.js). Bodies: access-routes.js.
+  const accessRoutes = accessHandlers({ db, log, parseId, validateOrRespond });
+  router.get('/government/access', api.requireBuilder, api.requirePermission('board.vote.cast'), accessRoutes.read);
+  router.post('/government/access/:accessKey/holders', api.requireBuilder, api.requirePermission('government.manage'), accessRoutes.grant);
+  router.delete('/government/access/:accessKey/holders/:builderId', api.requireBuilder, api.requirePermission('government.manage'), accessRoutes.revoke);
+
   // rank: perm board.vote.cast — the Board Room view: open items with their
   // clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). Gated on
   // the XENOS-floored vote atom, deliberately: seeing the ballot is part of

package/modules/government/routing.js

@@ -38,6 +38,7 @@
 // request, uncached (ADR 0016), and routes every matter with routeAll.
 
 const { answerFor } = require('./leads');
+const access = require('./access');
 const asks = require('./asks');
 
 const BUILDING_NAMES = Object.freeze({
@@ -59,6 +60,7 @@ function seatOf(matter) {
 function seatLabel(seat) {
   const s = String(seat || '');
   if (s === 'owner') return 'the owner';
+  if (/^access:/.test(s)) return access.accessLabel(s.slice(7));
   const m = /^(lead|board):([a-z]+)$/.exec(s);
   if (m) return `the ${BUILDING_NAMES[m[2]] || m[2]} ${m[1] === 'lead' ? 'Lead' : 'board'}`;
   return asks.seatWords(s);
@@ -87,7 +89,7 @@ function directoryOf(ctx) {
   for (const l of Array.isArray(c.leads) ? c.leads : Object.values(c.leads || {})) {
     if (l && !l.removed_at) put(l.builder_id, l.github_login, l.display_name);
   }
-  for (const list of Object.values(c.holders || {})) {
+  for (const list of [...Object.values(c.holders || {}), ...Object.values(c.access || {})]) {
     for (const p of Array.isArray(list) ? list : []) {
       if (p && typeof p === 'object') put(p.builder_id ?? p.id, p.github_login ?? p.login, p.display_name ?? p.name);
     }
@@ -103,7 +105,8 @@ function peopleOf(ids, dir) {
 //   seat         the seat that answers it, after any fall
 //   builder_ids  who sits there now ([] when nobody does)
 // ctx { leads: Lead rows in office, owner: leads ownerOf(archons) shape
-//       { builders: [{ id }] }, holders: { building: [people] | null } }
+//       { builders: [{ id }] }, holders: { building: [people] | null },
+//       access: { key: [holder rows] } (task 1005000) }
 function resolveSeat(asked, ctx) {
   const c = ctx || {};
   const owner = c.owner || { builders: [] };
@@ -120,6 +123,11 @@ function resolveSeat(asked, ctx) {
     const held = idsOf((c.holders || {})[m[1]]);
     return held.length ? seated(asked, held) : toOwner();
   }
+  // task 1005000: an outside access — its recorded holders; nobody recorded → the owner.
+  if ((m = /^access:([a-z-]+)$/.exec(String(asked || ''))) && access.isAccessKey(m[1])) {
+    const held = idsOf((c.access || {})[m[1]]);
+    return held.length ? seated(asked, held) : toOwner();
+  }
   if ((m = /^committee:([a-z]+)\.[a-z0-9_]+$/.exec(String(asked || '')))) {
     return { ...resolveSeat(`lead:${m[1]}`, c), asked };
   }
@@ -178,7 +186,7 @@ function passRefusal(matter, viewerId, toSeat, ctx, now = Date.now()) {
   if (!m.ask) return { code: 'no_ask', status: 409, message: 'This matter has no ask to pass on yet.' };
   if (m.source === 'board') return { code: 'vote_not_passable', status: 409, message: 'A vote is its voters\' to answer; it cannot be passed on.' };
   const to = String(toSeat || '').trim();
-  if (!asks.SEAT.test(to)) return { code: 'unknown_seat', status: 400, message: 'Name a seat: owner, lead:<building>, committee:<building>.<name> or board:<building>.' };
+  if (!asks.SEAT.test(to)) return { code: 'unknown_seat', status: 400, message: 'Name a seat: owner, lead:<building>, committee:<building>.<name>, board:<building> or access:<key>.' };
   const route = routeMatter(m, viewerId, ctx, now);
   if (!route.yours) return { code: 'not_yours', status: 403, message: 'Only whoever this waits on can pass it on.' };
   if (to === m.ask.waits_on || resolveSeat(to, ctx).seat === route.seat) return { code: 'same_seat', status: 409, message: 'It already waits on that seat.' };

package/modules/government/waiting.js

@@ -21,6 +21,7 @@
 // PURE: no db. docket.js reads the blockers, their asks and the seats, then calls this.
 
 const routing = require('./routing');
+const access = require('./access');
 
 // One blocker as a line under a person: what it is, where it lives, and the seat it
 // reaches that person through, in words ("as the owner", "as the Planning Lead").
@@ -36,6 +37,9 @@ function itemOf(m, r) {
     as: r.label,
     asked: r.asked,
     fell_to_owner: !!r.fell_to_owner,
+    // task 1005000: a blocker only an outside-access holder can clear reads as its own
+    // category ("needs repo-owner access"), not as one more of the owner's.
+    needs: /^access:/.test(String(r.asked || '')) ? access.needsWords(String(r.asked).slice(7)) : null,
     question: m.ask && m.ask.question ? String(m.ask.question) : null,
   };
 }

package/modules/hall-ui/public/blockers-by-person.js

@@ -26,6 +26,8 @@
 
   // "as the owner" · "as the Planning Lead" · "as the owner, since Planning has no Lead".
   function asWords(item) {
+    // task 1005000: only whoever holds an outside access can clear it — say so first.
+    if (item.needs) return item.fell_to_owner ? item.needs + ', and nobody is recorded holding it' : item.needs;
     var as = item.as || 'their seat';
     if (item.fell_to_owner && /^lead:([a-z]+)$/.test(String(item.asked || ''))) {
       var b = String(item.asked).slice(5);

package/modules/hall-ui/public/government-access.js

@@ -0,0 +1,108 @@
+// government-access.js — Outside access, on the Government page's Permissions tab
+// (task 1005000).
+//
+// WHY. Some blockers can only be cleared by whoever holds access OUTSIDE Bongos: the
+// GitHub repository's admin, the server, DNS, hosting, package publishing, payments.
+// The owner records who holds each here (GET/POST/DELETE /government/access), and an
+// ask can then wait on `access:<key>` — it reaches that person, and reads on the
+// Blockers page as "needs repo-owner access". An access nobody is recorded holding
+// falls to the owner, like every unheld seat.
+//
+// A RECORD OF WHO TO ASK, NEVER A PERMISSION: holding one here unlocks nothing in
+// Bongos, and no credential is stored — the page says so. The server gates the
+// writes on government.manage; the Permissions tab is already sealed for everyone
+// else (government.js sealRanksPanel), so this file draws no gate of its own.
+//
+// UMD so tests/access_holders.mjs can run `accessHtml` without a browser.
+(function (root, factory) {
+  var mod = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = mod;
+  else root.OTBGovAccess = mod;
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  // accessHtml(list, esc) → one row per access: its name, what it is, who holds it
+  // (each with a Remove control), or that it falls to the owner.
+  function accessHtml(list, esc) {
+    if (!Array.isArray(list) || !list.length) return '';
+    return '<ul class="ov-rows">' + list.map(function (a) {
+      var holders = Array.isArray(a.holders) ? a.holders : [];
+      var who = holders.length
+        ? holders.map(function (h) {
+          return '<span class="ov-fact">' + esc(h.name || h.login || ('builder ' + h.id))
+            + ' <button type="button" class="btn-ghost" data-act="revoke" data-key="' + esc(a.key) + '" data-id="' + esc(h.id) + '">Remove</button></span>';
+        }).join('')
+        : '<span class="ov-fact">Nobody recorded — it falls to the owner</span>';
+      return '<li class="ov-row"><div class="ov-row__main">'
+        + '<span class="ov-row__title">' + esc(a.title || a.name) + '</span>'
+        + '<span class="ov-row__sub">' + esc(a.what) + '</span>'
+        + '<div class="ov-row__facts">' + who + '<span class="ov-mono">' + esc(a.seat) + '</span></div>'
+        + '</div></li>';
+    }).join('') + '</ul>';
+  }
+
+  // The Record form's picker: the same display name the list shows.
+  function optionsHtml(list, esc) {
+    return (Array.isArray(list) ? list : []).map(function (a) { return '<option value="' + esc(a.key) + '">' + esc(a.title || a.name) + '</option>'; }).join('');
+  }
+
+  function mount() {
+    var doc = typeof document !== 'undefined' ? document : null;
+    var box = doc && doc.getElementById('gov-access');
+    var form = doc && doc.getElementById('gov-access-form');
+    var select = doc && doc.getElementById('gov-access-key');
+    var esc = window.OTB && window.OTB.escapeHtml;
+    if (!box || !form || !select || typeof esc !== 'function') return;
+    var toast = function (m) { if (window.OTB && window.OTB.toast) window.OTB.toast(m, { duration: 3200 }); };
+    var call = function (method, path, body) {
+      return fetch('/api/bongos' + path, {
+        method: method,
+        credentials: 'same-origin',
+        headers: body ? { 'Content-Type': 'application/json' } : {},
+        body: body ? JSON.stringify(body) : undefined,
+      }).then(function (r) {
+        return r.json().catch(function () { return {}; }).then(function (d) { return { ok: r.ok, status: r.status, data: d }; });
+      });
+    };
+    var said = function (r) { var e = r.data && r.data.error; return (e && e.message) || ('It did not save (' + r.status + ').'); };
+
+    function load() {
+      return call('GET', '/government/access').then(function (r) {
+        if (!r.ok || !r.data || !Array.isArray(r.data.access)) {
+          box.innerHTML = '<p class="ov-row__sub">Outside access could not be read just now.</p>';
+          return;
+        }
+        if (!select.options.length) {
+          select.innerHTML = optionsHtml(r.data.access, esc);
+        }
+        box.innerHTML = accessHtml(r.data.access, esc);
+      });
+    }
+
+    box.addEventListener('click', function (ev) {
+      var btn = ev.target.closest && ev.target.closest('[data-act=revoke]');
+      if (!btn) return;
+      btn.disabled = true;
+      call('DELETE', '/government/access/' + encodeURIComponent(btn.dataset.key) + '/holders/' + encodeURIComponent(btn.dataset.id))
+        .then(function (r) { if (!r.ok) { toast(said(r)); btn.disabled = false; return null; } return load(); });
+    });
+    form.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      var id = Number(doc.getElementById('gov-access-builder').value);
+      call('POST', '/government/access/' + encodeURIComponent(select.value) + '/holders', { builder_id: id })
+        .then(function (r) {
+          if (!r.ok) { toast(said(r)); return null; }
+          form.reset();
+          return load();
+        });
+    });
+    load();
+  }
+
+  if (typeof window !== 'undefined' && typeof document !== 'undefined') {
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', mount);
+    else mount();
+  }
+
+  return { accessHtml: accessHtml, optionsHtml: optionsHtml };
+}));

package/modules/hall-ui/public/government.html

@@ -116,6 +116,26 @@
               <div id="gov-assignments"><span class="kit-skel"></span></div>
             </section>
 
+            <!-- task 1005000: who holds the keys OUTSIDE Bongos (GitHub admin, server, DNS,
+                 hosting, publishing, payments), so an ask can wait on access:<key>.
+                 Drawn by government-access.js. -->
+            <section class="scroll" aria-labelledby="gov-access-h">
+              <h2 class="scroll__h" id="gov-access-h">Outside access</h2>
+              <p class="scroll__lede">Who holds the keys outside the project, so a blocker that needs one reaches them. This is a record of who to ask: it grants nothing here and stores no password or token.</p>
+              <form class="ov-form" id="gov-access-form" autocomplete="off">
+                <div class="ov-field ov-field--sm">
+                  <label class="ov-field__l" for="gov-access-builder">Builder id</label>
+                  <input id="gov-access-builder" type="number" min="1" placeholder="e.g. 95" required>
+                </div>
+                <div class="ov-field">
+                  <label class="ov-field__l" for="gov-access-key">Access</label>
+                  <select id="gov-access-key" required></select>
+                </div>
+                <button class="btn-accent" type="submit">Record</button>
+              </form>
+              <div id="gov-access"><span class="kit-skel"></span></div>
+            </section>
+
             <section class="scroll" aria-labelledby="gov-principals-h">
               <h2 class="scroll__h" id="gov-principals-h">Machine principals</h2>
               <p class="scroll__lede">Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can be granted.</p>
@@ -143,5 +163,6 @@
      BEFORE government.js, which destructures window.OTBBoardLib at IIFE entry. -->
 <script src="/builders/board-lib.js?v=2026-09-10-boardlib1"></script>
 <script src="/builders/government.js?v=2026-09-02-gov-rows"></script>
+<script src="/builders/government-access.js"></script>
 </body>
 </html>

package/modules/hall-ui/records/blockers-people.md

@@ -22,3 +22,17 @@ show the seat alone — or, on /blockers, every blocker under "Requires project
   fixture, because `tests/hall_preview_governor_fixtures.mjs` re-derives every route and fails on a guess.
 
 Tests: `tests/blockers_people.mjs`.
+
+## Outside access (task 1005000)
+
+- **The Permissions tab gains *Outside access*** (`government-access.js`, `#gov-access`): the six keys
+  that live outside the project (repo owner, server access, domain settings, hosting account, package
+  publishing, payments), who is recorded holding each, a Remove control per holder, and a Record form.
+  An access nobody holds says "Nobody recorded — it falls to the owner". The tab is already sealed for
+  non-Archons; the server gates the writes on `government.manage`.
+- **The lede says it grants nothing and stores no password or token** — the record is who to ask.
+- **On the people view**, a blocker waiting on an access seat reads "needs repo-owner access" under its
+  holder (`asWords` reads the server's `needs`), and "…, and nobody is recorded holding it" when it fell
+  to the owner.
+
+Tests: `tests/access_holders.mjs`.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.1",
+  "version": "1.24.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.1",
+      "version": "1.24.2",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.1",
+  "version": "1.24.2",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10801,5 +10801,15 @@
       "id": "1004934",
       "text": "We decided that Market Watch will search the web each week on the project's own AI key and under the owner's monthly cap, at about $4 to $5 per weekly check of 40 competitors."
     }
+  ],
+  "1.24.2": [
+    {
+      "id": "1005000",
+      "text": "The project can now record who holds the keys that live outside it: the GitHub repository's admin, the server, the domain settings, the hosting account, package publishing and payments. The owner records them on the Government"
+    },
+    {
+      "id": "1004970",
+      "text": "The payments decision record now carries the owner's answers: credits can be tuned but not switched off, pay rules live on the settings page, and Verro is Verro Labs."
+    }
   ]
 }

package/scripts/bongos/government-walk.js

@@ -388,6 +388,9 @@ function makeStore(catalog) {
       }
       return { enacted, repealed };
     },
+    // Who holds each outside access (task 1005000): the walk records none, so every
+    // access seat falls to the owner, as it does on a project that has recorded none.
+    async listAccessHolders() { return []; },
     // The owner seat: every active Archon, oldest id first.
     async listActiveArchons() {
       return [...s.builders.values()].filter((b) => isLive(b) && b.rank === 'archon')

package/src/bongos/route-rank-check.js

@@ -304,6 +304,10 @@ const GOVERNMENT_PINS = {
   // task 1004999: open blockers under the people they wait on, and the viewer's own.
   'GET /government/blockers/people': 'perm:board.vote.cast',
   'GET /government/blockers/for-me': 'perm:board.vote.cast',
+  // task 1005000: who holds the keys outside Bongos (read), recorded by the owner (write).
+  'GET /government/access': 'perm:board.vote.cast',
+  'POST /government/access/:accessKey/holders': 'perm:government.manage',
+  'DELETE /government/access/:accessKey/holders/:builderId': 'perm:government.manage',
   // task 1004529: who decides what — a change to the decision-rules table is an
   // amendment by another door (same atom as proposing one), and a building's
   // matter is put to its sitting by the same atom. Only a passed amendment

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.2'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/access_holders.mjs

@@ -0,0 +1,214 @@
+// tests/access_holders.mjs — who holds the keys OUTSIDE Bongos, and blockers that need
+// them (task 1005000, goal 1000111).
+//
+// WHAT IT GUARDS (the task's done-when, one by one):
+//   1. Only the owner can record a holder: the writes refuse anyone without
+//      government.manage; the read is the docket's atom.
+//   2. An ask on access:<key> resolves to exactly the recorded holders, and to the
+//      owner when none is recorded.
+//   3. Such a blocker shows under its holder as "needs repo-owner access".
+//   4. No secret is stored: the table has no column a credential could live in.
+//   And the trap: it is a record of who to ask, never authority — no gate, rank check
+//   or permission atom reads it.
+//
+// Also: the vocabulary, the ask grammar (asks.SEAT) and both migration CHECKs agree.
+// DB-free: the government db is stubbed by property. Run:  node --test tests/access_holders.mjs
+
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gov = (f) => path.join(ROOT, 'modules', 'government', f);
+const access = require(gov('access.js'));
+const asks = require(gov('asks.js'));
+const routing = require(gov('routing.js'));
+const waiting = require(gov('waiting.js'));
+const leads = require(gov('leads.js'));
+const people = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'blockers-by-person.js'));
+const page = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government-access.js'));
+const SQL = fs.readFileSync(gov('migrations/government_036_access_holders.sql'), 'utf8');
+
+const owner = leads.ownerOf([{ id: 1, github_login: 'lars', display_name: 'Lars' }]);
+const KIM = { access_key: 'github-admin', builder_id: 5, github_login: 'kim', display_name: 'Kim', granted_at: '2026-10-29T00:00:00Z' };
+const blocker = (id, waitsOn) => ({ id: `blockers:${id}`, source: 'blockers', building: 'planning', state: 'needs', title: `Blocker ${id}`, opened_at: '2026-10-29T00:00:00Z', ref: { type: 'blocker', id: String(id) }, ask: { question: 'Allow it?', waits_on: waitsOn, if_nobody_answers: 'It stays stuck.' } });
+
+test('one vocabulary: access.js, the holders CHECK and the asks CHECK name the same keys', () => {
+  const holders = /access_key IN \(([^)]+)\)/.exec(SQL)[1].match(/'([^']+)'/g).map((s) => s.slice(1, -1));
+  assert.deepEqual(holders, access.KEYS);
+  const seat = new RegExp(/CHECK \(waits_on ~ '([^']+)'\)/.exec(SQL)[1]);
+  for (const s of ['owner', 'lead:planning', 'board:charter', 'committee:review.testers', ...access.KEYS.map((k) => `access:${k}`)]) {
+    assert.equal(seat.test(s), true, `${s}: the table takes it`);
+    assert.equal(asks.SEAT.test(s), true, `${s}: the module takes it`);
+  }
+  for (const s of ['access:nope', 'access:', 'access:github-admin.x', 'lead:nowhere']) {
+    assert.equal(seat.test(s), false, `${s}: the table refuses it`);
+    assert.equal(asks.SEAT.test(s), false, `${s}: the module refuses it`);
+  }
+});
+
+test('an ask can wait on an outside access, and reads as its holder', () => {
+  const ok = asks.checkAsk({
+    question: 'Allow the publish token to change CI workflow files?',
+    options: [{ key: 'yes', label: 'Add the scope', result: 'It lands on the next ship.' }, { key: 'no', label: 'Leave it', result: 'It stays stuck.' }],
+    recommend: { key: 'yes', why: 'One setting fixes it.' },
+    waits_on: 'access:github-admin',
+    if_nobody_answers: 'It stays stuck.',
+  });
+  assert.equal(ok.ok, true, JSON.stringify(ok.errors || []));
+  assert.equal(asks.seatWords('access:github-admin'), 'the repo owner');
+  assert.equal(asks.checkAsk({ ...ok.ask, waits_on: 'access:nope' }).ok, false);
+});
+
+test('access:<key> resolves to exactly the recorded holders, and to the owner when none is', () => {
+  const seats = { leads: [], owner, holders: {}, access: access.holdersByKey([KIM]) };
+  const held = routing.resolveSeat('access:github-admin', seats);
+  assert.deepEqual([held.seat, held.label, held.builder_ids, held.fell_to_owner], ['access:github-admin', 'the repo owner', ['5'], false]);
+  const unheld = routing.resolveSeat('access:dns', seats);
+  assert.deepEqual([unheld.seat, unheld.builder_ids, unheld.fell_to_owner], ['owner', ['1'], true]);
+  const route = routing.routeMatter(blocker(1, 'access:github-admin'), '5', seats, Date.now());
+  assert.deepEqual([route.yours, route.people], [true, [{ id: '5', login: 'kim', name: 'Kim' }]]);
+  assert.equal(routing.routeMatter(blocker(1, 'access:github-admin'), '1', seats, Date.now()).yours, false, 'not the owner\'s while a holder is recorded');
+  // no access read at all (an instance that has not migrated): every access seat falls to the owner
+  assert.deepEqual(routing.resolveSeat('access:github-admin', { leads: [], owner, holders: {} }).builder_ids, ['1']);
+});
+
+test('a blocker on an access seat shows under its holder as "needs repo-owner access"', () => {
+  const g = waiting.groupByPerson([blocker(7, 'access:github-admin'), blocker(8, 'access:payments')], { leads: [], owner, holders: {}, access: access.holdersByKey([KIM]) });
+  const kim = g.people.find((p) => p.person.name === 'Kim');
+  assert.deepEqual(kim.items.map((i) => [i.id, i.needs]), [['7', 'needs repo-owner access']]);
+  const lars = g.people.find((p) => p.person.name === 'Lars');
+  assert.deepEqual(lars.items.map((i) => [i.id, i.needs, i.fell_to_owner]), [['8', 'needs access to payments', true]]);
+  const esc = (s) => String(s);
+  const html = people.peopleHtml({ available: true, ...g }, { esc, fmtDate: (d) => d.slice(0, 10) });
+  assert.match(html, /needs repo-owner access · filed/);
+  assert.match(html, /needs access to payments, and nobody is recorded holding it/);
+  assert.equal(people.asWords({ as: 'the owner', asked: 'owner' }), 'as the owner', 'an ordinary seat reads as before');
+});
+
+test('no secret is stored, and nothing that gates reads it', () => {
+  const cols = /CREATE TABLE IF NOT EXISTS government_access_holders \(([\s\S]*?)\n\);/.exec(SQL)[1]
+    .split('\n').map((l) => /^\s+([a-z_]+)\s/.exec(l)).filter(Boolean).map((m) => m[1]).filter((c) => c !== 'PRIMARY');
+  assert.deepEqual(cols, ['access_key', 'builder_id', 'granted_by', 'granted_at']);
+  for (const f of ['src/bongos/auth.js', 'modules/government/resolver.js', 'modules/government/catalog.js', 'src/bongos/act-alone.js']) {
+    const src = fs.readFileSync(path.join(ROOT, f), 'utf8');
+    assert.doesNotMatch(src, /access_holders|listAccessHolders|require\(['"][./]*access['"]\)/, `${f} never reads access holders`);
+  }
+  const catalog = require(gov('catalog.js'));
+  const keys = catalog.PERMISSIONS.map((p) => p.key || p);
+  assert.ok(keys.length > 50, 'the real catalog, not an empty list');
+  for (const k of access.KEYS) assert.ok(!keys.some((p) => String(p).includes(k)), `${k} is not a permission atom`);
+});
+
+test('the access view: each access, what it is, its holders, or that it falls to the owner', () => {
+  const v = access.accessView([KIM, { ...KIM, access_key: 'not-a-key' }]);
+  assert.deepEqual(v.map((a) => a.key), access.KEYS);
+  const gh = v.find((a) => a.key === 'github-admin');
+  assert.deepEqual([gh.seat, gh.holders.map((h) => h.name), gh.falls_to_owner], ['access:github-admin', ['Kim'], false]);
+  assert.equal(v.find((a) => a.key === 'dns').falls_to_owner, true);
+  const html = page.accessHtml(v, (s) => String(s).replace(/</g, '&lt;'));
+  assert.match(html, /Repo owner/);
+  assert.match(html, /data-act="revoke" data-key="github-admin" data-id="5"/);
+  assert.match(html, /Nobody recorded — it falls to the owner/);
+  // the picker and the list say the same name, capitalised the same way
+  const opts = page.optionsHtml(v, (s) => String(s));
+  for (const a of v) {
+    assert.match(opts, new RegExp('<option value="' + a.key + '">' + a.title + '</option>'));
+    assert.ok(html.includes('>' + a.title + '<'), a.key + ': the list shows the same name');
+    assert.match(a.title, /^[A-Z]/);
+  }
+});
+
+test('every access reads as plain words when a blocker needs it — no "access access"', () => {
+  for (const k of access.KEYS) {
+    const w = access.needsWords(k);
+    assert.match(w, /^needs [a-z]/, k);
+    assert.doesNotMatch(w, /access access|-access access/, k + ': ' + w);
+  }
+  assert.equal(access.needsWords('github-admin'), 'needs repo-owner access');
+});
+
+test('the City keeps routing when the access read fails or is missing: every access seat falls to the owner', async () => {
+  const docket = require(gov('docket.js'));
+  const db = require(gov('db.js'));
+  const real = { leads: db.listLeads, archons: db.listActiveArchons, access: db.listAccessHolders };
+  db.listLeads = async () => [];
+  db.listActiveArchons = async () => [{ id: 1, github_login: 'lars', display_name: 'Lars' }];
+  try {
+    db.listAccessHolders = async () => { throw new Error('relation government_access_holders does not exist'); };
+    const failed = await docket.loadSeats({ holders: {} });
+    assert.ok(failed, 'seats still read');
+    assert.deepEqual(routing.resolveSeat('access:github-admin', failed).builder_ids, ['1'], 'falls to the owner');
+    assert.deepEqual(failed.access['github-admin'], []);
+    db.listAccessHolders = undefined;
+    const missing = await docket.loadSeats({ holders: {} });
+    assert.ok(missing, 'a db layer without the read still routes');
+    assert.deepEqual(routing.resolveSeat('access:dns', missing).builder_ids, ['1']);
+    db.listAccessHolders = async () => [KIM];
+    assert.deepEqual(routing.resolveSeat('access:github-admin', await docket.loadSeats({ holders: {} })).builder_ids, ['5']);
+  } finally {
+    db.listLeads = real.leads; db.listActiveArchons = real.archons; db.listAccessHolders = real.access;
+  }
+});
+
+// --- the routes, through the real router and the real permission gate ---------------
+
+const express = require('express');
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const govDb = require(gov('db.js'));
+
+const rows = [];
+const REAL = { list: govDb.listAccessHolders, grant: govDb.grantAccess, revoke: govDb.revokeAccess, who: govDb.getActiveBuilder };
+govDb.listAccessHolders = async () => rows.slice();
+govDb.grantAccess = async (k, id, by) => { if (rows.some((r) => r.access_key === k && r.builder_id === id)) return false; rows.push({ access_key: k, builder_id: id, granted_by: by, github_login: 'kim', display_name: 'Kim' }); return true; };
+govDb.revokeAccess = async (k, id) => { const i = rows.findIndex((r) => r.access_key === k && r.builder_id === id); if (i < 0) return false; rows.splice(i, 1); return true; };
+govDb.getActiveBuilder = async (id) => (id === 5 ? { id: 5, github_login: 'kim', display_name: 'Kim' } : null);
+const realRequireBuilder = api.requireBuilder;
+api.requireBuilder = (req, res, next) => { req.builder = { id: 1, rank: 'archon' }; next(); };
+function grant(keys) { seams._reset(); seams.registerProvider('government', { resolveBuilderPermissions: async () => keys }); }
+grant(['government.manage', 'board.vote.cast']);
+const buildRouter = require(gov('routes/government.js'));
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => {
+  server.close();
+  api.requireBuilder = realRequireBuilder;
+  govDb.listAccessHolders = REAL.list; govDb.grantAccess = REAL.grant; govDb.revokeAccess = REAL.revoke; govDb.getActiveBuilder = REAL.who;
+  seams._reset();
+});
+const call = async (method, p, body) => {
+  const res = await fetch(BASE + p, { method, headers: body ? { 'content-type': 'application/json' } : {}, body: body ? JSON.stringify(body) : undefined });
+  return { status: res.status, json: await res.json().catch(() => null) };
+};
+
+test('only the owner records a holder; everyone who can open the City can read who holds what', async () => {
+  grant(['board.vote.cast']);
+  assert.equal((await call('POST', '/government/access/github-admin/holders', { builder_id: 5 })).status, 403, 'a voter cannot record');
+  assert.equal((await call('DELETE', '/government/access/github-admin/holders/5')).status, 403, 'nor remove');
+  assert.equal((await call('GET', '/government/access')).status, 200, 'but can read');
+  grant(['government.manage', 'board.vote.cast']);
+  const added = await call('POST', '/government/access/github-admin/holders', { builder_id: 5 });
+  assert.deepEqual([added.status, added.json.added], [201, true]);
+  assert.equal(rows[0].granted_by, 1, 'who recorded it rides the row');
+  assert.deepEqual([(await call('POST', '/government/access/github-admin/holders', { builder_id: 5 })).status], [200], 'idempotent');
+  const read = await call('GET', '/government/access');
+  assert.deepEqual(read.json.access.find((a) => a.key === 'github-admin').holders.map((h) => h.id), ['5']);
+  assert.equal((await call('POST', '/government/access/nope/holders', { builder_id: 5 })).status, 400, 'an unknown access');
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 99 })).status, 404, 'an unknown builder');
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 'x' })).status, 400);
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 5, token: 'ghp_x' })).status, 400, 'strict: an unknown field (a token, say) is refused, never stored');
+  const removed = await call('DELETE', '/government/access/github-admin/holders/5');
+  assert.deepEqual([removed.status, removed.json.removed, rows.length], [200, true, 0]);
+});

package/tests/government_board_membership.mjs

@@ -256,7 +256,10 @@ test('the membership queries exclude machines and the deactivated — structural
   const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
   const start = src.indexOf('getActiveBuildersWithRank');
   assert.ok(start > -1);
-  const block = src.slice(start);
+  // bounded to the two membership reads: a later query filtering status for its own
+  // reasons (task 1005000's access holders) is not one of them
+  const end = src.indexOf('\nasync function ', src.indexOf('async function builderHoldsRankActive') + 1);
+  const block = src.slice(start, end > start ? end : undefined);
   assert.equal((block.match(/b\.status = 'active'/g) || []).length, 2, 'both reads filter status');
   assert.equal((block.match(/b\.system_role IS NULL/g) || []).length, 2, 'both reads exclude principals');
 });

package/tests/government_routes.mjs

@@ -104,7 +104,7 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
   // task 1004712: the treasury is read, and its pots and borrows decided, where the room is (the holder and the seat are the walls).
   // task 1004715: the strictness presets are read where the law book is.
   // task 1004716: the counts are read where the docket they count is.
-  const boardFamily = (key) => key.includes('/board/') || key.includes('/government/asks') || key.endsWith('/government/constitution') || key.endsWith('/government/docket') || key.includes('/government/blockers/') || key.endsWith('/government/counts') || key.endsWith('/government/laws') || key.endsWith('/government/leads') || key.endsWith('/government/buildouts') || key.includes('/government/treasury') || key.endsWith('/government/presets');
+  const boardFamily = (key) => key.includes('/board/') || key.includes('/government/asks') || key.endsWith('/government/constitution') || key.endsWith('/government/docket') || key.includes('/government/blockers/') || key.endsWith('/government/access') || key.endsWith('/government/counts') || key.endsWith('/government/laws') || key.endsWith('/government/leads') || key.endsWith('/government/buildouts') || key.includes('/government/treasury') || key.endsWith('/government/presets');
   for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }

package/tests/government_seed.mjs

@@ -52,6 +52,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_030_buildouts.sql',                  // a Lead's build-outs, on the record at once or by a passed vote (task 1004711)
   'government_031_treasury.sql',                   // the treasury: a pot per goal and the loans a dry pot asks the reserve for (task 1004712)
   'government_032_ask_flags.sql',                  // the reword list: matters a reader flagged as unclear (owner 2026-10-23)
+  'government_036_access_holders.sql',             // who holds the keys outside Bongos + the access:<key> ask seat (task 1005000)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.