@bongos/core 1.24.1 → 1.24.3

package/modules/government/asks.js

@@ -44,10 +44,12 @@ const MARKUP = /\*\*|`|^#|\[[^\]]*\]\(|https?:\/\/|<\/?[a-z]/im;
 // Control characters other than tab and line breaks (line breaks have their own rule).
 // eslint-disable-next-line no-control-regex
 const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+const access = require('./access');
 const BUILDINGS = Object.freeze(['charter', 'rules', 'disputes', 'people', 'planning', 'automation', 'review', 'release', 'treasury']);
 // The seats an ask can wait on (gov-living.js seatResolver's grammar). An
 // unseated building falls to the owner when it is routed (owner ruling).
-const SEAT = new RegExp(`^(owner|(lead|board):(${BUILDINGS.join('|')})|committee:(${BUILDINGS.join('|')})\\.[a-z][a-z0-9_]{0,31})$`);
+// `access:<key>` (task 1005000): whoever holds that outside access (access.js).
+const SEAT = new RegExp(`^(owner|(lead|board):(${BUILDINGS.join('|')})|committee:(${BUILDINGS.join('|')})\\.[a-z][a-z0-9_]{0,31}|${access.SEAT_PART})$`);
 // An answer's key: what a tap sends. Its act, optional: the matter's own act it
 // takes ('go ahead', 'record', 'force:tested_by_hand'); the deck maps it onto
 // the desk row's real route and refuses one the row does not offer.
@@ -150,7 +152,7 @@ function checkAsk(raw) {
   // ---- who it waits on: a seat the direction desk can route ----
   const seat = str(c.waits_on).trim();
   if (!seat) err('waits_on', 'missing', 'Say who this waits on.');
-  else if (!SEAT.test(seat)) err('waits_on', 'unknown_seat', `"${seat.slice(0, 40)}" is not a seat: say owner, lead:<building>, committee:<building>.<name> or board:<building>.`);
+  else if (!SEAT.test(seat)) err('waits_on', 'unknown_seat', `"${seat.slice(0, 40)}" is not a seat: say owner, lead:<building>, committee:<building>.<name>, board:<building> or access:<key>.`);
 
   // ---- what happens if nobody answers ----
   lineRule('if_nobody_answers', c.if_nobody_answers, 'Say what happens if nobody answers.');
@@ -206,6 +208,7 @@ const ASK_REQUIRED_MESSAGE = 'An AI session files a blocker with an ask: a quest
 function seatWords(seat) {
   const s = str(seat);
   if (s === 'owner') return 'the owner';
+  if (/^access:/.test(s)) return access.accessLabel(s.slice(7));
   const m = /^(lead|board|committee):([a-z]+)(?:\.([a-z0-9_]+))?$/.exec(s);
   if (!m) return s;
   const building = m[2].charAt(0).toUpperCase() + m[2].slice(1);

package/modules/government/db.js

@@ -888,6 +888,41 @@ async function listActiveArchons() {
   return rows;
 }
 
+// ACCESS HOLDERS (task 1005000, government_036): who holds each outside access.
+// Active builders only — someone who left the project is nobody to ask. A record
+// of who to ask, never authority: no gate reads these rows (access.js).
+async function listAccessHolders() {
+  const { rows } = await pool.query(
+    `SELECT h.access_key, h.builder_id, h.granted_at, b.github_login, b.display_name
+       FROM government_access_holders h
+       JOIN builders b ON b.id = h.builder_id
+      WHERE b.status = 'active' AND b.system_role IS NULL
+      ORDER BY h.access_key, h.granted_at, h.builder_id`,
+  );
+  return rows;
+}
+
+// Record that a builder holds an access. Idempotent: an existing row is kept as it
+// was (its original granted_at/by). → true when a row was added.
+async function grantAccess(accessKey, builderId, grantedBy) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO government_access_holders (access_key, builder_id, granted_by)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (access_key, builder_id) DO NOTHING`,
+    [accessKey, builderId, grantedBy],
+  );
+  return rowCount > 0;
+}
+
+// → true when a row was removed.
+async function revokeAccess(accessKey, builderId) {
+  const { rowCount } = await pool.query(
+    'DELETE FROM government_access_holders WHERE access_key = $1 AND builder_id = $2',
+    [accessKey, builderId],
+  );
+  return rowCount > 0;
+}
+
 // One builder of this project, or null: who a Lead appointment names. Only an
 // active person (no machine identity) can be appointed.
 async function getActiveBuilder(builderId) {
@@ -1306,6 +1341,9 @@ module.exports = {
   applyLaws,
   listLeads,
   listActiveArchons,
+  listAccessHolders,
+  grantAccess,
+  revokeAccess,
   getActiveBuilder,
   applyLeadAct,
   listBuildouts,

package/modules/government/docket.js

@@ -86,6 +86,7 @@ const governmentConfig = require('./config');
 const asksDb = require('./asks-db');
 const routing = require('./routing');
 const waiting = require('./waiting');
+const access = require('./access');
 const { ownerOf } = require('./leads');
 
 const log = api.logger('government');
@@ -840,8 +841,17 @@ async function docketFor(builder) {
 // nothing — the docket then says `routed: false` rather than guess whose it is.
 async function loadSeats(government) {
   try {
-    const [leads, archons] = await Promise.all([db.listLeads(), db.listActiveArchons()]);
-    return { leads, owner: ownerOf(archons), holders: (government && government.holders) || {} };
+    // task 1005000: who holds each outside access. Its own read fails OPEN to nobody
+    // recorded (every access seat then falls to the owner), so a missing table on an
+    // instance that has not migrated yet never stops the City routing. Started inside
+    // a .then so a db layer without the function (an older stub, the walk's store)
+    // fails open too rather than throwing before the catch is attached.
+    const accessRows = Promise.resolve().then(() => db.listAccessHolders()).catch((err) => {
+      log.warn({ err: err && err.message }, 'governor docket: access holders unreadable, access seats fall to the owner');
+      return [];
+    });
+    const [leads, archons, held] = await Promise.all([db.listLeads(), db.listActiveArchons(), accessRows]);
+    return { leads, owner: ownerOf(archons), holders: (government && government.holders) || {}, access: access.holdersByKey(held) };
   } catch (err) {
     log.warn({ err: err && err.message }, 'governor docket: seats unreadable, nothing routed');
     return null;

package/modules/government/migrations/government_036_access_holders.sql

@@ -0,0 +1,33 @@
+-- government_036_access_holders.sql — who holds the keys OUTSIDE Bongos, and an ask
+-- that waits on them (task 1005000, goal 1000111).
+--
+-- WHAT THIS ADDS
+--
+--   government_access_holders — one row per (outside access, builder): the GitHub
+--   repository's admin, the server, the domain's DNS, the hosting account, package
+--   publishing, payments. The vocabulary is modules/government/access.js `ACCESS`,
+--   held equal to the CHECK below by tests/access_holders.mjs. Written by the owner
+--   only (the routes gate government.manage); who granted it and when ride the row.
+--
+--   It is a RECORD OF WHO TO ASK, never an authority grant: no permission atom, rank
+--   check or gate reads this table, and it stores no credential — only who holds one.
+--
+--   government_asks.waits_on gains the seat `access:<key>`, so an ask can wait on
+--   whoever holds an outside access (routing.js; nobody recorded → the owner).
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS government_access_holders (
+  access_key  text        NOT NULL
+              CHECK (access_key IN ('github-admin', 'server-ssh', 'dns', 'hosting', 'npm-publish', 'payments')),
+  builder_id  bigint      NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  granted_by  bigint      REFERENCES builders(id) ON DELETE SET NULL,
+  granted_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (access_key, builder_id)
+);
+
+ALTER TABLE government_asks DROP CONSTRAINT IF EXISTS government_asks_waits_on_check;
+ALTER TABLE government_asks ADD CONSTRAINT government_asks_waits_on_check
+  CHECK (waits_on ~ '^(owner|(lead|board):(charter|rules|disputes|people|planning|automation|review|release|treasury)|committee:(charter|rules|disputes|people|planning|automation|review|release|treasury)\.[a-z][a-z0-9_]{0,31}|access:(github-admin|server-ssh|dns|hosting|npm-publish|payments))$');
+
+COMMIT;

package/modules/government/routes/government.js

@@ -34,6 +34,7 @@ const counts = require('../counts');
 const asks = require('../asks');
 const asksDb = require('../asks-db');
 const routing = require('../routing');
+const { accessHandlers } = require('../access-routes');
 const governmentConfig = require('../config');
 const membershipPredicate = require('../membership-predicate');
 const positions = require('../positions');
@@ -689,6 +690,14 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // ACCESS HOLDERS (task 1005000): who holds the keys outside Bongos, so an ask can wait
+  // on access:<key>. Read on the docket's atom; recorded by the owner. A record of who to
+  // ask, never authority (access.js). Bodies: access-routes.js.
+  const accessRoutes = accessHandlers({ db, log, parseId, validateOrRespond });
+  router.get('/government/access', api.requireBuilder, api.requirePermission('board.vote.cast'), accessRoutes.read);
+  router.post('/government/access/:accessKey/holders', api.requireBuilder, api.requirePermission('government.manage'), accessRoutes.grant);
+  router.delete('/government/access/:accessKey/holders/:builderId', api.requireBuilder, api.requirePermission('government.manage'), accessRoutes.revoke);
+
   // rank: perm board.vote.cast — the Board Room view: open items with their
   // clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). Gated on
   // the XENOS-floored vote atom, deliberately: seeing the ballot is part of

package/modules/government/routing.js

@@ -38,6 +38,7 @@
 // request, uncached (ADR 0016), and routes every matter with routeAll.
 
 const { answerFor } = require('./leads');
+const access = require('./access');
 const asks = require('./asks');
 
 const BUILDING_NAMES = Object.freeze({
@@ -59,6 +60,7 @@ function seatOf(matter) {
 function seatLabel(seat) {
   const s = String(seat || '');
   if (s === 'owner') return 'the owner';
+  if (/^access:/.test(s)) return access.accessLabel(s.slice(7));
   const m = /^(lead|board):([a-z]+)$/.exec(s);
   if (m) return `the ${BUILDING_NAMES[m[2]] || m[2]} ${m[1] === 'lead' ? 'Lead' : 'board'}`;
   return asks.seatWords(s);
@@ -87,7 +89,7 @@ function directoryOf(ctx) {
   for (const l of Array.isArray(c.leads) ? c.leads : Object.values(c.leads || {})) {
     if (l && !l.removed_at) put(l.builder_id, l.github_login, l.display_name);
   }
-  for (const list of Object.values(c.holders || {})) {
+  for (const list of [...Object.values(c.holders || {}), ...Object.values(c.access || {})]) {
     for (const p of Array.isArray(list) ? list : []) {
       if (p && typeof p === 'object') put(p.builder_id ?? p.id, p.github_login ?? p.login, p.display_name ?? p.name);
     }
@@ -103,7 +105,8 @@ function peopleOf(ids, dir) {
 //   seat         the seat that answers it, after any fall
 //   builder_ids  who sits there now ([] when nobody does)
 // ctx { leads: Lead rows in office, owner: leads ownerOf(archons) shape
-//       { builders: [{ id }] }, holders: { building: [people] | null } }
+//       { builders: [{ id }] }, holders: { building: [people] | null },
+//       access: { key: [holder rows] } (task 1005000) }
 function resolveSeat(asked, ctx) {
   const c = ctx || {};
   const owner = c.owner || { builders: [] };
@@ -120,6 +123,11 @@ function resolveSeat(asked, ctx) {
     const held = idsOf((c.holders || {})[m[1]]);
     return held.length ? seated(asked, held) : toOwner();
   }
+  // task 1005000: an outside access — its recorded holders; nobody recorded → the owner.
+  if ((m = /^access:([a-z-]+)$/.exec(String(asked || ''))) && access.isAccessKey(m[1])) {
+    const held = idsOf((c.access || {})[m[1]]);
+    return held.length ? seated(asked, held) : toOwner();
+  }
   if ((m = /^committee:([a-z]+)\.[a-z0-9_]+$/.exec(String(asked || '')))) {
     return { ...resolveSeat(`lead:${m[1]}`, c), asked };
   }
@@ -178,7 +186,7 @@ function passRefusal(matter, viewerId, toSeat, ctx, now = Date.now()) {
   if (!m.ask) return { code: 'no_ask', status: 409, message: 'This matter has no ask to pass on yet.' };
   if (m.source === 'board') return { code: 'vote_not_passable', status: 409, message: 'A vote is its voters\' to answer; it cannot be passed on.' };
   const to = String(toSeat || '').trim();
-  if (!asks.SEAT.test(to)) return { code: 'unknown_seat', status: 400, message: 'Name a seat: owner, lead:<building>, committee:<building>.<name> or board:<building>.' };
+  if (!asks.SEAT.test(to)) return { code: 'unknown_seat', status: 400, message: 'Name a seat: owner, lead:<building>, committee:<building>.<name>, board:<building> or access:<key>.' };
   const route = routeMatter(m, viewerId, ctx, now);
   if (!route.yours) return { code: 'not_yours', status: 403, message: 'Only whoever this waits on can pass it on.' };
   if (to === m.ask.waits_on || resolveSeat(to, ctx).seat === route.seat) return { code: 'same_seat', status: 409, message: 'It already waits on that seat.' };

package/modules/government/waiting.js

@@ -21,6 +21,7 @@
 // PURE: no db. docket.js reads the blockers, their asks and the seats, then calls this.
 
 const routing = require('./routing');
+const access = require('./access');
 
 // One blocker as a line under a person: what it is, where it lives, and the seat it
 // reaches that person through, in words ("as the owner", "as the Planning Lead").
@@ -36,6 +37,9 @@ function itemOf(m, r) {
     as: r.label,
     asked: r.asked,
     fell_to_owner: !!r.fell_to_owner,
+    // task 1005000: a blocker only an outside-access holder can clear reads as its own
+    // category ("needs repo-owner access"), not as one more of the owner's.
+    needs: /^access:/.test(String(r.asked || '')) ? access.needsWords(String(r.asked).slice(7)) : null,
     question: m.ask && m.ask.question ? String(m.ask.question) : null,
   };
 }

package/modules/hall-ui/public/blockers-by-person.js

@@ -26,6 +26,8 @@
 
   // "as the owner" · "as the Planning Lead" · "as the owner, since Planning has no Lead".
   function asWords(item) {
+    // task 1005000: only whoever holds an outside access can clear it — say so first.
+    if (item.needs) return item.fell_to_owner ? item.needs + ', and nobody is recorded holding it' : item.needs;
     var as = item.as || 'their seat';
     if (item.fell_to_owner && /^lead:([a-z]+)$/.test(String(item.asked || ''))) {
       var b = String(item.asked).slice(5);

package/modules/hall-ui/public/government-access.js

@@ -0,0 +1,108 @@
+// government-access.js — Outside access, on the Government page's Permissions tab
+// (task 1005000).
+//
+// WHY. Some blockers can only be cleared by whoever holds access OUTSIDE Bongos: the
+// GitHub repository's admin, the server, DNS, hosting, package publishing, payments.
+// The owner records who holds each here (GET/POST/DELETE /government/access), and an
+// ask can then wait on `access:<key>` — it reaches that person, and reads on the
+// Blockers page as "needs repo-owner access". An access nobody is recorded holding
+// falls to the owner, like every unheld seat.
+//
+// A RECORD OF WHO TO ASK, NEVER A PERMISSION: holding one here unlocks nothing in
+// Bongos, and no credential is stored — the page says so. The server gates the
+// writes on government.manage; the Permissions tab is already sealed for everyone
+// else (government.js sealRanksPanel), so this file draws no gate of its own.
+//
+// UMD so tests/access_holders.mjs can run `accessHtml` without a browser.
+(function (root, factory) {
+  var mod = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = mod;
+  else root.OTBGovAccess = mod;
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  // accessHtml(list, esc) → one row per access: its name, what it is, who holds it
+  // (each with a Remove control), or that it falls to the owner.
+  function accessHtml(list, esc) {
+    if (!Array.isArray(list) || !list.length) return '';
+    return '<ul class="ov-rows">' + list.map(function (a) {
+      var holders = Array.isArray(a.holders) ? a.holders : [];
+      var who = holders.length
+        ? holders.map(function (h) {
+          return '<span class="ov-fact">' + esc(h.name || h.login || ('builder ' + h.id))
+            + ' <button type="button" class="btn-ghost" data-act="revoke" data-key="' + esc(a.key) + '" data-id="' + esc(h.id) + '">Remove</button></span>';
+        }).join('')
+        : '<span class="ov-fact">Nobody recorded — it falls to the owner</span>';
+      return '<li class="ov-row"><div class="ov-row__main">'
+        + '<span class="ov-row__title">' + esc(a.title || a.name) + '</span>'
+        + '<span class="ov-row__sub">' + esc(a.what) + '</span>'
+        + '<div class="ov-row__facts">' + who + '<span class="ov-mono">' + esc(a.seat) + '</span></div>'
+        + '</div></li>';
+    }).join('') + '</ul>';
+  }
+
+  // The Record form's picker: the same display name the list shows.
+  function optionsHtml(list, esc) {
+    return (Array.isArray(list) ? list : []).map(function (a) { return '<option value="' + esc(a.key) + '">' + esc(a.title || a.name) + '</option>'; }).join('');
+  }
+
+  function mount() {
+    var doc = typeof document !== 'undefined' ? document : null;
+    var box = doc && doc.getElementById('gov-access');
+    var form = doc && doc.getElementById('gov-access-form');
+    var select = doc && doc.getElementById('gov-access-key');
+    var esc = window.OTB && window.OTB.escapeHtml;
+    if (!box || !form || !select || typeof esc !== 'function') return;
+    var toast = function (m) { if (window.OTB && window.OTB.toast) window.OTB.toast(m, { duration: 3200 }); };
+    var call = function (method, path, body) {
+      return fetch('/api/bongos' + path, {
+        method: method,
+        credentials: 'same-origin',
+        headers: body ? { 'Content-Type': 'application/json' } : {},
+        body: body ? JSON.stringify(body) : undefined,
+      }).then(function (r) {
+        return r.json().catch(function () { return {}; }).then(function (d) { return { ok: r.ok, status: r.status, data: d }; });
+      });
+    };
+    var said = function (r) { var e = r.data && r.data.error; return (e && e.message) || ('It did not save (' + r.status + ').'); };
+
+    function load() {
+      return call('GET', '/government/access').then(function (r) {
+        if (!r.ok || !r.data || !Array.isArray(r.data.access)) {
+          box.innerHTML = '<p class="ov-row__sub">Outside access could not be read just now.</p>';
+          return;
+        }
+        if (!select.options.length) {
+          select.innerHTML = optionsHtml(r.data.access, esc);
+        }
+        box.innerHTML = accessHtml(r.data.access, esc);
+      });
+    }
+
+    box.addEventListener('click', function (ev) {
+      var btn = ev.target.closest && ev.target.closest('[data-act=revoke]');
+      if (!btn) return;
+      btn.disabled = true;
+      call('DELETE', '/government/access/' + encodeURIComponent(btn.dataset.key) + '/holders/' + encodeURIComponent(btn.dataset.id))
+        .then(function (r) { if (!r.ok) { toast(said(r)); btn.disabled = false; return null; } return load(); });
+    });
+    form.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      var id = Number(doc.getElementById('gov-access-builder').value);
+      call('POST', '/government/access/' + encodeURIComponent(select.value) + '/holders', { builder_id: id })
+        .then(function (r) {
+          if (!r.ok) { toast(said(r)); return null; }
+          form.reset();
+          return load();
+        });
+    });
+    load();
+  }
+
+  if (typeof window !== 'undefined' && typeof document !== 'undefined') {
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', mount);
+    else mount();
+  }
+
+  return { accessHtml: accessHtml, optionsHtml: optionsHtml };
+}));

package/modules/hall-ui/public/government.html

@@ -116,6 +116,26 @@
               <div id="gov-assignments"><span class="kit-skel"></span></div>
             </section>
 
+            <!-- task 1005000: who holds the keys OUTSIDE Bongos (GitHub admin, server, DNS,
+                 hosting, publishing, payments), so an ask can wait on access:<key>.
+                 Drawn by government-access.js. -->
+            <section class="scroll" aria-labelledby="gov-access-h">
+              <h2 class="scroll__h" id="gov-access-h">Outside access</h2>
+              <p class="scroll__lede">Who holds the keys outside the project, so a blocker that needs one reaches them. This is a record of who to ask: it grants nothing here and stores no password or token.</p>
+              <form class="ov-form" id="gov-access-form" autocomplete="off">
+                <div class="ov-field ov-field--sm">
+                  <label class="ov-field__l" for="gov-access-builder">Builder id</label>
+                  <input id="gov-access-builder" type="number" min="1" placeholder="e.g. 95" required>
+                </div>
+                <div class="ov-field">
+                  <label class="ov-field__l" for="gov-access-key">Access</label>
+                  <select id="gov-access-key" required></select>
+                </div>
+                <button class="btn-accent" type="submit">Record</button>
+              </form>
+              <div id="gov-access"><span class="kit-skel"></span></div>
+            </section>
+
             <section class="scroll" aria-labelledby="gov-principals-h">
               <h2 class="scroll__h" id="gov-principals-h">Machine principals</h2>
               <p class="scroll__lede">Capabilities held by a machine identity, never by a person or a rank. Shown for completeness; nothing here can be granted.</p>
@@ -143,5 +163,6 @@
      BEFORE government.js, which destructures window.OTBBoardLib at IIFE entry. -->
 <script src="/builders/board-lib.js?v=2026-09-10-boardlib1"></script>
 <script src="/builders/government.js?v=2026-09-02-gov-rows"></script>
+<script src="/builders/government-access.js"></script>
 </body>
 </html>

package/modules/hall-ui/public/street-inside.js

@@ -471,7 +471,7 @@
     treasury: {
       holds: 'The budget, and who gets paid for what.', rule: 'majority', cap: 7,
       growth: 'Each new spending line takes a floor.', annex: 'room for an annex of spending lines',
-      floors: [['Builder rewards', 'paid for shipped work', { floor: 'treasury.rewards' }], ['AI grading', 'the reviewer that grades every ship', { floor: 'treasury.grading' }], ['Hosting', 'servers and storage', { floor: 'treasury.hosting', desk: 'treasury.backup' }], ['Reserve', 'what is left this month', { reading: 'money', desk: 'treasury.budgets' }], ['Spending matters', 'spending put to a vote', { source: 'treasury_spending' }]],
+      floors: [['Builder rewards', 'credits earned for shipped work', { floor: 'treasury.rewards' }], ['AI grading', 'the reviewer that grades every ship', { floor: 'treasury.grading' }], ['Hosting', 'servers and storage', { floor: 'treasury.hosting', desk: 'treasury.backup' }], ['Reserve', 'what is left this month', { reading: 'money', desk: 'treasury.budgets' }], ['Spending matters', 'spending put to a vote', { source: 'treasury_spending' }]],
     },
   });
   const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec'];

package/modules/hall-ui/records/blockers-people.md

@@ -22,3 +22,17 @@ show the seat alone — or, on /blockers, every blocker under "Requires project
   fixture, because `tests/hall_preview_governor_fixtures.mjs` re-derives every route and fails on a guess.
 
 Tests: `tests/blockers_people.mjs`.
+
+## Outside access (task 1005000)
+
+- **The Permissions tab gains *Outside access*** (`government-access.js`, `#gov-access`): the six keys
+  that live outside the project (repo owner, server access, domain settings, hosting account, package
+  publishing, payments), who is recorded holding each, a Remove control per holder, and a Record form.
+  An access nobody holds says "Nobody recorded — it falls to the owner". The tab is already sealed for
+  non-Archons; the server gates the writes on `government.manage`.
+- **The lede says it grants nothing and stores no password or token** — the record is who to ask.
+- **On the people view**, a blocker waiting on an access seat reads "needs repo-owner access" under its
+  holder (`asWords` reads the server's `needs`), and "…, and nobody is recorded holding it" when it fell
+  to the owner.
+
+Tests: `tests/access_holders.mjs`.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.1",
+  "version": "1.24.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.1",
+      "version": "1.24.3",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.1",
+  "version": "1.24.3",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10801,5 +10801,21 @@
       "id": "1004934",
       "text": "We decided that Market Watch will search the web each week on the project's own AI key and under the owner's monthly cap, at about $4 to $5 per weekly check of 40 competitors."
     }
+  ],
+  "1.24.2": [
+    {
+      "id": "1005000",
+      "text": "The project can now record who holds the keys that live outside it: the GitHub repository's admin, the server, the domain settings, the hosting account, package publishing and payments. The owner records them on the Government"
+    },
+    {
+      "id": "1004970",
+      "text": "The payments decision record now carries the owner's answers: credits can be tuned but not switched off, pay rules live on the settings page, and Verro is Verro Labs."
+    }
+  ],
+  "1.24.3": [
+    {
+      "id": "1005006",
+      "text": "The Treasury screen now counts builder rewards in credits instead of dollars, and no longer says one credit is a dollar."
+    }
   ]
 }

package/scripts/bongos/government-walk.js

@@ -388,6 +388,9 @@ function makeStore(catalog) {
       }
       return { enacted, repealed };
     },
+    // Who holds each outside access (task 1005000): the walk records none, so every
+    // access seat falls to the owner, as it does on a project that has recorded none.
+    async listAccessHolders() { return []; },
     // The owner seat: every active Archon, oldest id first.
     async listActiveArchons() {
       return [...s.builders.values()].filter((b) => isLive(b) && b.rank === 'archon')

package/src/bongos/route-rank-check.js

@@ -304,6 +304,10 @@ const GOVERNMENT_PINS = {
   // task 1004999: open blockers under the people they wait on, and the viewer's own.
   'GET /government/blockers/people': 'perm:board.vote.cast',
   'GET /government/blockers/for-me': 'perm:board.vote.cast',
+  // task 1005000: who holds the keys outside Bongos (read), recorded by the owner (write).
+  'GET /government/access': 'perm:board.vote.cast',
+  'POST /government/access/:accessKey/holders': 'perm:government.manage',
+  'DELETE /government/access/:accessKey/holders/:builderId': 'perm:government.manage',
   // task 1004529: who decides what — a change to the decision-rules table is an
   // amendment by another door (same atom as proposing one), and a building's
   // matter is put to its sitting by the same atom. Only a passed amendment

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.3'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');