@bongos/core 1.25.20 → 1.25.21

package/scripts/bongos/provision-render-promote.js

@@ -0,0 +1,93 @@
+'use strict';
+// provision-render-promote.js — a person promotes what ran on the sandbox to the live app:
+// the runner half of the `render-promote` intent (task 1005290; ADR 0406 §2, ADR 0327).
+//
+// WHY. Once a project has a sandbox, finished work lands on the sandbox only (it follows
+// `main`), and the live Render service no longer deploys on every merge. The live app
+// moves only here, when a person pressed promote and lent their Render key for that one
+// action. That is the project law "Land only. Ask before going live" made physical: no
+// ship, in Auto or Manual mode, reaches this file; only an owner's press does.
+//
+// WHAT IT DOES, in order, and why the order matters:
+//   1. checks the chosen change RAN on the sandbox (it is one of the sandbox's own deploys
+//      that went live there), and that the live app still runs what the owner was shown;
+//   2. RECORDS the promotion (provisioning_promotions) — before anything is sent, so
+//      nothing reaches the live app through Bongos without a row saying who and what;
+//   3. switches the live service to manual deploys (idempotent), so the next merge cannot
+//      reach it by itself;
+//   4. asks Render to deploy exactly that commit to the live service.
+//
+// Like the standup leg: the key is decrypted here, used for this run, and cleared in a
+// `finally`; every failure is terminal (the owner presses again with the key); every call
+// goes through scripts/bongos/render-api.js, which pins the workspace.
+
+const COMMIT_RE = /^[0-9a-f]{7,40}$/;
+// Only a deploy that served on the sandbox can be promoted: one still building, or one
+// whose build failed, never ran there for anyone to look at.
+const SERVED = ['live', 'deactivated'];
+
+const commitOf = (d) => (d && d.commit && d.commit.id) || null;
+
+async function promoteInstance(inst, deps, intent) {
+  const { db, log } = deps;
+  const render = require('./provision-render-common.js');
+  const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
+  const host = inst.app_host || {};
+  const ask = host.promote || {};
+  let promotionId = null;
+  try {
+    if (!intent || !intent.borrowed_key_enc) return await refuse('no Render key came with the promotion — press promote again');
+    const age = Date.now() - new Date(intent.created_at || 0).getTime();
+    if (!(age < render.KEY_TTL_MS)) return await refuse('the Render key waited too long to be used and was cleared — press promote again');
+    if (host.platform !== 'render' || !host.serviceId || !host.ownerId) return await refuse('this project has no app on Render to promote to');
+    const sb = host.sandbox || {};
+    if (!sb.serviceId) return await refuse('this project has no sandbox to promote from');
+    if (!COMMIT_RE.test(String(ask.commitId || ''))) return await refuse('no change was chosen to promote');
+
+    const api = render.renderApiFor(deps, secretBox.decrypt(intent.borrowed_key_enc), host.ownerId);
+    const owners = await api.listOwners();
+    if (!owners.some((o) => o.id === host.ownerId)) return await refuse(`this Render key cannot reach workspace ${host.ownerId}`);
+
+    // 1. it ran on the sandbox, and live is what the owner was shown
+    const sandboxDeploys = await api.listDeploys(sb.serviceId, { limit: 50 });
+    const ran = sandboxDeploys.find((d) => commitOf(d) === ask.commitId && SERVED.includes(d.status));
+    if (!ran) return await refuse('that change has not run on the sandbox, so it cannot be promoted');
+    const liveDeploys = await api.listDeploys(host.serviceId, { limit: 10 });
+    const liveCommit = commitOf(liveDeploys.find((d) => d.status === 'live'));
+    if ((ask.expectLiveCommit || null) !== liveCommit) return await refuse('what your live app runs changed since you looked, so nothing was done — look again and promote');
+    if (liveCommit === ask.commitId) return await refuse('that change is already on your live app');
+
+    // 2. the record comes first
+    const message = String((ran.commit && ran.commit.message) || '').split('\n')[0].slice(0, 300);
+    const { rows } = await db.query(
+      `INSERT INTO provisioning_promotions (instance_id, commit_id, commit_message, from_commit_id, sandbox_deploy_id, requested_by, state)
+       VALUES ($1, $2, $3, $4, $5, $6, 'started') RETURNING id`,
+      [inst.id, ask.commitId, message, liveCommit, ran.id || null, ask.requestedBy == null ? null : String(ask.requestedBy)]);
+    promotionId = rows && rows[0] ? rows[0].id : null;
+
+    // 3. live stops following main, so only promotions move it
+    await api.setAutoDeploy(host.serviceId, false);
+    // 4. exactly that commit
+    const dep = await api.triggerDeploy(host.serviceId, { commitId: ask.commitId });
+    const deployId = (dep && dep.id) || null;
+    await db.query(`UPDATE provisioning_promotions SET state = 'sent', render_deploy_id = $2, updated_at = now() WHERE id = $1`, [promotionId, deployId]);
+    await render.recordAppHost(db, inst.id, { liveAutoDeploy: 'off', promote: { ...ask, state: 'sent', error: null, renderDeployId: deployId } });
+    log(`  [render] ${inst.slug}: promoted ${ask.commitId.slice(0, 7)} from the sandbox to the live app (deploy ${deployId || 'started'})`);
+    return { ok: true };
+  } catch (e) {
+    return await refuse(render.plainReason(e).replace(/^Render would not set up the app/, 'Render would not promote it'));
+  } finally {
+    if (intent && intent.id != null) await render.clearBorrowedKey(db, intent.id);
+  }
+
+  async function refuse(error) {
+    if (promotionId != null) {
+      await db.query(`UPDATE provisioning_promotions SET state = 'failed', error = $2, updated_at = now() WHERE id = $1`, [promotionId, error]).catch(() => {});
+    }
+    await render.recordAppHost(db, inst.id, { promote: { ...ask, state: 'failed', error } }).catch(() => {});
+    log(`  ✖ [render] ${inst.slug} promote: ${error}`);
+    return { ok: false, terminal: true, error };
+  }
+}
+
+module.exports = { promoteInstance, COMMIT_RE };

package/scripts/bongos/provision-render-sandbox.js

@@ -20,14 +20,15 @@
 //   3. SERVICE — a free web service named `<slug>-sandbox`, auto-deploying from `main`,
 //      with BONGOS_SANDBOX=1. Found by name first, so a re-run never makes a second one.
 //
-// The live service is not touched here: switching it to manual deploys belongs with the
-// promote button that replaces them (task 1005290).
+// Once the sandbox stands, the LIVE service is switched to manual deploys, so only a
+// person's promotion moves it (task 1005290; scripts/bongos/provision-render-promote.js).
 //
 // TEARDOWN removes the sandbox service and the sandbox database only — never the live app
 // or its data (ADR 0406 §7). It needs the owner's key; without one the sandbox is
 // forgotten and the owner is told exactly what to delete.
 
 const payload = require('./render-payload.js');
+const { recordAppHost } = require('./provision-render-common.js');
 const { parseTargetRef } = require('./provision-repo-auth.js');
 
 async function recordSandbox(db, instId, patch) {
@@ -120,6 +121,17 @@ async function standupSandbox(api, inst, host, deps) {
     }
     const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
     await recordSandbox(db, inst.id, { state: 'deploying', serviceId: svc.id, serviceUrl: url, error: null });
+    // From here on finished work reaches the sandbox only: the live service stops deploying
+    // on every merge, and moves when a person promotes (task 1005290, ADR 0406 §2). Only once
+    // the sandbox exists, so live is never left with nowhere for work to land. A failure is
+    // said on the row and the sandbox stands; the next promotion switches it again.
+    try {
+      await api.setAutoDeploy(host.serviceId, false);
+      await recordAppHost(db, inst.id, { liveAutoDeploy: 'off' }); // the one app_host writer
+      log('  [render] the live app now moves only when a person promotes');
+    } catch (e) {
+      log(`  (the live app still deploys every merge: ${e && e.message})`);
+    }
     return { ok: true };
   } catch (e) {
     const error = `The sandbox could not be set up: ${String((e && e.message) || e).split('\n')[0].slice(0, 240)}`;

package/scripts/bongos/provision-render.js

@@ -31,32 +31,12 @@
 // Every Render call goes through scripts/bongos/render-api.js, which pins the workspace and
 // asserts it on every response, and which cannot delete.
 
-const { RenderApi } = require('./render-api.js');
 const payload = require('./render-payload.js');
 const { parseTargetRef } = require('./provision-repo-auth.js');
 const sandbox = require('./provision-render-sandbox.js');
-
-// A key waiting longer than this was lent for a run that never came. It is refused and
-// cleared rather than spent late.
-const KEY_TTL_MS = 30 * 60 * 1000;
-
-function renderApiFor(deps, token, ownerId) {
-  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
-  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
-}
-
-// Merge `patch` into the row's app_host. The runner is the only writer while an intent
-// runs, and the web tier only writes it when enqueuing, which the open-intent index
-// serialises — so a merge needs no read-modify-write.
-async function recordAppHost(db, instId, patch) {
-  await db.query(
-    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
-    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
-}
-
-async function clearBorrowedKey(db, intentId) {
-  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
-}
+// The pieces every Render leg shares live in their own file, so the sandbox and promote
+// legs can use them without a require cycle back into this one (task 1005290).
+const { KEY_TTL_MS, renderApiFor, recordAppHost, clearBorrowedKey, plainReason } = require('./provision-render-common.js');
 
 // Whether a Render service's repository is this project's. Render reports it as a URL;
 // compared as owner/name, case-insensitively, the way GitHub resolves them.
@@ -118,18 +98,6 @@ async function greenfield(api, inst, host, deps) {
   return { ok: true };
 }
 
-// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
-// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
-// so an answer from Render is re-said as a sentence with Render's own reason kept whole
-// (task 1004464). Anything else is already the leg's own words.
-function plainReason(e) {
-  const msg = e && e.message ? e.message : String(e);
-  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
-  if (said) return `Render would not set up the app: ${said}`;
-  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
-  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
-}
-
 async function renderStandupInstance(inst, deps, intent) {
   const { db, log } = deps;
   const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
@@ -233,4 +201,4 @@ async function forgetRenderApp(inst, deps) {
   if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
 }
 
-module.exports = { renderStandupInstance, afterProvision, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };
+module.exports = { renderStandupInstance, afterProvision, forgetRenderApp, clearBorrowedKey, recordAppHost, renderApiFor, plainReason, KEY_TTL_MS };

package/scripts/bongos/provision.js

@@ -1255,6 +1255,7 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
       else if (intent.action === 'core-upgrade-preflight') result = await preflightCoreUpgrade(inst, deps, intent); // changes nothing; caches what the move WOULD say (task 1004121)
       else if (intent.action === 'repo-private' || intent.action === 'render-standup') result = intent.action === 'repo-private' ? await require('./provision-repo-private.js').repoPrivateInstance(inst, deps) : await require('./provision-render.js').renderStandupInstance(inst, deps, intent); // wire the deploy key, THEN flip (task 1004193) · spend the borrowed Render key once (task 1004183); required here — this file is at the size ratchet
+      else if (intent.action === 'render-promote') result = await require('./provision-render-promote.js').promoteInstance(inst, deps, intent); // a person's promotion of a sandbox change to the live app (task 1005290, ADR 0406)
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
         // WAIT OR RETIRE (task 1004447, intent-retry.js): a transient failure waits ~15m/1h/6h; a

package/scripts/bongos/render-api.js

@@ -163,9 +163,24 @@ class RenderApi extends JsonHttpApi {
     return super._req('DELETE', path, null);
   }
 
-  async triggerDeploy(serviceId) {
+  // Start a deploy. With `commitId` Render builds THAT commit rather than the branch's
+  // newest — how a promotion moves the live app to exactly what ran on the sandbox (ADR
+  // 0406 §2, task 1005290). The answer carries no owner, so the service is read first.
+  async triggerDeploy(serviceId, { commitId } = {}) {
     await this.getService(serviceId);
-    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/deploys`, {}, { dryRunResult: { id: null } });
+    const body = commitId ? { commitId } : {};
+    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/deploys`, body, { dryRunResult: { id: null } });
+  }
+
+  // Whether the service deploys on every push to its branch. The live app is switched to
+  // `no` once its project has a sandbox, so only a person's promotion moves it (ADR 0406
+  // §2, task 1005290). A write to the owner's service, through the guard, nothing else.
+  async setAutoDeploy(serviceId, on) {
+    await this.getService(serviceId);
+    const json = await this._req('PATCH', `/services/${encodeURIComponent(serviceId)}`, { autoDeploy: on ? 'yes' : 'no' }, {
+      dryRunResult: { id: serviceId, ownerId: this.ownerId, autoDeploy: on ? 'yes' : 'no' },
+    });
+    return this.assertOwned(json && json.service ? json.service : json, `service ${serviceId}`);
   }
 
   // A service's deploys, newest first, as the bare deploy objects (Render wraps each in

package/scripts/gds/government-walk-sole.js

@@ -0,0 +1,6 @@
+// scripts/gds/government-walk-sole.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/government-walk-sole.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'government-walk-sole.js');

package/scripts/gds/provision-render-common.js

@@ -0,0 +1,6 @@
+// scripts/gds/provision-render-common.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-render-common.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'provision-render-common.js');

package/scripts/gds/provision-render-promote.js

@@ -0,0 +1,6 @@
+// scripts/gds/provision-render-promote.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-render-promote.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'provision-render-promote.js');

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.20'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.21'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/fleet_cost_view.mjs

@@ -135,6 +135,8 @@ const provisioning = require(path.join(ROOT, 'modules', 'provisioning', 'provisi
 const api = require(path.join(ROOT, 'src', 'module-api.js'));
 let detailRow = null;
 provisioning.getInstanceById = async () => detailRow;
+// The gate also admits an owner-made grant (task 1004161, ADR 0407); nobody in this file holds one.
+require(path.join(ROOT, 'modules', 'provisioning', 'grants.js')).liveGrant = async () => null;
 provisioning.getOpenIntent = async () => null;
 provisioning.getLatestOAuthManifestForInstance = async () => null;
 require(path.join(ROOT, 'modules', 'provisioning', 'catalog-bridge.js')).healInstanceCatalog = async () => {};

package/tests/genesis_government.mjs

@@ -131,7 +131,11 @@ test('picking Monarchy files nothing: it is already the government in force', as
   const seen = await underMonarchy(async () => {
     const { out } = await decide({ government: 'monarchy' });
     assert.equal(out.ok, true);
-    assert.deepEqual(out.charter, { state: 'in_force', form: 'monarchy' });
+    assert.equal(out.charter.state, 'in_force');
+    assert.equal(out.charter.form, 'monarchy');
+    // task 1005130: said plainly, and counted as done — never a silent no-op
+    assert.equal(out.charter.complete, true);
+    assert.match(out.charter.message, /already a Monarchy \/ BDFL\. Nothing to change/);
   });
   assert.equal(seen.filed, null);
 });

package/tests/genesis_home.mjs

@@ -573,6 +573,23 @@ test('a demo\'s genesis card: no decide form, the settled plan in one line, each
   assert.doesNotMatch(host.innerHTML, /data-genesis-plan/, 'a demo never shows the decide form');
 });
 
+test('the plan picker says what is in force, marks it, and says what each form asks day to day (task 1005130)', async () => {
+  const charter = require('../modules/government/charter.js');
+  const reco = require('../modules/government/recommendations.js');
+  const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+  const genesis = gh.shapeGenesis({ mode: { stage: 'decide', stage_number: 0, stage_count: 5, day: 1 }, plan: null });
+  // One stub answers every read: the genesis read and the constitution read.
+  const { host } = bootCard({ founding: true, data: {
+    genesis, viewer_id: '1', headcount: 1, charter: charter.charterView(MONARCHY), recommended: reco.recommendedCharter(1),
+  } });
+  for (let i = 0; i < 6; i++) await new Promise((r) => setImmediate(r));
+  assert.match(host.innerHTML, /This project runs as Monarchy \/ BDFL now\. Every project opens as one/, 'what is in force is said first');
+  assert.match(host.innerHTML, /Monarchy \/ BDFL · in force now · recommended/, 'the form in force is marked');
+  assert.match(host.innerHTML, /You decide\. Each decision takes one yes from you\./, 'monarchy says one yes is still needed');
+  assert.match(host.innerHTML, /Every builder on the project decides\./, 'every form says who decides');
+  assert.equal((host.innerHTML.match(/in force now/g) || []).length, 1, 'only the form in force is marked');
+});
+
 test('the card lists every stage vote waiting on the viewer, and votes yes on all in order (task 1005199)', async () => {
   const me = [{ builder_id: '1', display_name: 'Founder' }];
   const genesis = gh.shapeGenesis({

package/tests/government_charter_advice.mjs

@@ -148,3 +148,52 @@ test('the port entry reads the head count and the law book', async () => {
   assert.equal(expected.headcount, 2, 'the founder\'s expected number wins over the live count');
   assert.equal(expected.charter.key, 'monarchy');
 });
+
+// ── task 1005130: every project is already a monarchy, and is told so ────────
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+const config = require(path.join(ROOT, 'modules', 'government', 'config.js'));
+
+test('the default constitution reads as Monarchy, and the stage says so on arrival', () => {
+  const live = config.loadGovernmentConfig().board;
+  const v = charter.charterView(live);
+  assert.equal(v.in_force.form, 'monarchy', 'every project boots as a monarchy');
+  assert.match(v.in_force.line, /runs as Monarchy \/ BDFL now\. Every project opens as one/);
+  assert.match(v.in_force.line, /You decide\. Each decision takes one yes from you\./);
+  assert.deepEqual(v.forms.filter((f) => f.current).map((f) => f.key), ['monarchy'], 'exactly the form in force is marked');
+});
+
+test('every form says who decides and what closing takes, derived from its own settings', () => {
+  const v = charter.charterView(MONARCHY);
+  for (const f of v.forms.filter((x) => x.available)) {
+    const d = charter.dutyOf(f.franchise, f.pass_rule);
+    assert.equal(f.who_decides, d.who_decides, f.key);
+    assert.equal(f.to_close, d.to_close, f.key);
+    assert.ok(f.who_decides && f.to_close, `${f.key} says both`);
+  }
+  assert.equal(charter.dutyOf('founder', 'first_ratifier').to_close, 'Each decision takes one yes from you.');
+  assert.match(charter.dutyOf('everyone', 'majority').to_close, /more than half/);
+  assert.notEqual(charter.dutyOf('trusted', 'consent').to_close, charter.dutyOf('trusted', 'majority').to_close,
+    'the sentence follows the pass rule, so a tuned rule is described as it runs');
+});
+
+test('choosing what is in force changes nothing and is done; choosing another says what happens next', () => {
+  const same = charter.choiceOutcome(MONARCHY, 'monarchy');
+  assert.equal(same.changes, false);
+  assert.equal(same.complete, true);
+  assert.match(same.line, /already a Monarchy \/ BDFL\. Nothing to change/);
+  const other = charter.choiceOutcome(MONARCHY, 'direct-democracy');
+  assert.equal(other.changes, true);
+  assert.match(other.line, /filed as a change to the rules and decided under the government in force \(Monarchy \/ BDFL\)\. Under it, your own one yes applies it\./);
+  const underCircle = charter.choiceOutcome({ ...MONARCHY, membership: 'rank:xenos+', pass_rule: 'consent' }, 'monarchy');
+  assert.match(underCircle.line, /passes unless one of them objects/, 'under another government the rule in force is named');
+});
+
+test('the charter stage advice carries what is in force and what choosing the recommendation does', () => {
+  const a = advice.buildAdvice({ answers: {}, headcount: 1, board: MONARCHY });
+  assert.equal(a.in_force.form, 'monarchy');
+  assert.equal(a.charter.key, 'monarchy');
+  assert.equal(a.charter.on_choose.changes, false, 'a solo founder is told the recommendation is what they already have');
+  const b = advice.buildAdvice({ answers: { final_say: 'everyone' }, headcount: 1, board: MONARCHY });
+  assert.equal(b.charter.on_choose.changes, true);
+  assert.ok(b.forms.find((f) => f.key === 'monarchy').current);
+});

package/tests/government_charter_forms.mjs

@@ -254,8 +254,12 @@ test('a charter that changes nothing files nothing, and a council must be a rank
     getRankByKey: async (key) => (key === 'trustees' ? { rank_key: 'trustees' } : null),
     builderHoldsRankActive: async () => true,
   }, async () => {
-    assert.equal((await board.proposeCharter({ form: 'monarchy', proposedBy: '42' })).reason, 'no_change',
-      'a sitting on the constitution already in force would decide nothing');
+    const same = await board.proposeCharter({ form: 'monarchy', proposedBy: '42' });
+    assert.equal(same.reason, 'no_change', 'a sitting on the constitution already in force would decide nothing');
+    // task 1005130: the refusal says what is true in words and counts the choice done
+    assert.equal(same.in_force, 'Monarchy / BDFL');
+    assert.equal(same.complete, true);
+    assert.match(same.message, /You are already a Monarchy \/ BDFL\. Nothing to change/);
     assert.equal((await board.proposeCharter({ form: 'foundation', councilRank: 'ghosts', proposedBy: '42' })).reason, 'unknown_council_rank');
     assert.equal((await board.proposeCharter({ form: 'direct-democracy', proposedBy: null })).reason, 'missing_proposer');
   });
@@ -272,7 +276,14 @@ test('the constitution view carries the charter: forms, variables, and what the
   });
   const routes = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
   assert.match(routes, /router\.post\('\/government\/board\/charter', api\.requireBuilder, api\.requirePermission\('board\.item\.open'\)/);
-  assert.match(routes, /proposeCharter: board\.proposeCharter/);
+  // The port's charter filing IS board.proposeCharter, followed by the board-of-one
+  // confirm (task 1005130) — called, not read: a refusal from board comes back as is.
+  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
+  const real = board.proposeCharter;
+  board.proposeCharter = async (a) => ({ ok: false, reason: 'from_board', seen: a.form });
+  try {
+    assert.deepEqual(await governmentPort.proposeCharter({ form: 'monarchy', proposedBy: '42' }), { ok: false, reason: 'from_board', seen: 'monarchy' });
+  } finally { board.proposeCharter = real; }
   const pins = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'), 'utf8');
   assert.match(pins, /'POST \/government\/board\/charter': 'perm:board\.item\.open'/);
 });

package/tests/government_seed.mjs

@@ -55,6 +55,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_036_access_holders.sql',             // who holds the keys outside Bongos + the access:<key> ask seat (task 1005000)
   'government_037_constitution.sql',               // the constitution in force as a durable row (task 1005140)
   'government_038_vote_cast_via.sql',               // HOW a vote was cast: a ballot, or a stage-close confirm (task 1005121)
+  'government_039_vote_cast_via_filed.sql',         // a board of one's confirm given by filing (task 1005130)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.

package/tests/government_sole_member.mjs

@@ -0,0 +1,153 @@
+// tests/government_sole_member.mjs — a board of ONE decides by filing (task 1005130,
+// part C; the ruling task 1005121 shipped for closing a genesis stage, applied
+// wherever it holds).
+//
+// The rule held here, for a charter change, a laws change and a decision-rules change:
+//   • the sole member of a first_ratifier board files → their yes is cast in the same
+//     call, recorded as THEIR vote (attributed, cast_via 'filed'), and the sitting
+//     closes through the ordinary close path;
+//   • a second member on the board, a consent or majority rule, or a caller who is not
+//     the sole member → the filing comes back exactly as it was, and nothing is cast;
+//   • the yes goes through the real castVote — its membership re-check, and a
+//     'filed' cast is refused on anything but an amendment, or as a 'no';
+//   • a filing the filer was refused comes back untouched, and a failing confirm
+//     leaves the sitting open rather than failing the filing.
+// The real routes (permission gate first, a non-member's filing left open, a lower
+// rank refused before anything is filed) are walked end to end in
+// scripts/bongos/government-walk.js (rows G3, G5, B*, L2–L4, L11–L15).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const db = require(path.join(GOV, 'db.js'));
+const board = require(path.join(GOV, 'board.js'));
+const sole = require(path.join(GOV, 'sole-member.js'));
+
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+const FILERS = ['proposeCharter', 'proposeLaws', 'proposeDecisionRules'];
+
+// A world: who holds which rank, the one open item a filing opened, and every vote
+// written. db is stubbed underneath the REAL castVote; the filers and the close are
+// stubbed on board (looked up at call time), so this exercises the decision alone.
+async function world({ members = ['42'], constitution = MONARCHY, subjectType = 'constitutional_amendment', filedOk = true } = {}, fn) {
+  const votes = [];
+  const closes = [];
+  const item = { id: 7, subject_type: subjectType, constitution, closed_at: null, expired: false };
+  const stubs = {
+    getActiveBuildersWithRank: async () => members.map((id) => ({ builder_id: id, github_login: `b${id}`, display_name: `B${id}` })),
+    builderHoldsRankActive: async (id) => members.includes(String(id)),
+    getBoardItemForVote: async () => ({ ...item }),
+    getBoardItemAuthor: async () => '42',
+    insertBoardVote: async (v) => { const row = { item_id: String(v.itemId), voter_id: String(v.voterId), direction: v.direction, cast_via: v.castVia || 'ballot', cast_at: '2026-11-13T12:00:00.000Z' }; votes.push(row); return row; },
+    getBoardVote: async () => null,
+    insertVoteKarma: async () => { throw new Error('a confirm given by filing earns no vote karma'); },
+  };
+  const boardStubs = {
+    maybeCloseAfterVote: async (id) => { closes.push(id); return { closed: true, outcome: 'passed', item: { id } }; },
+  };
+  for (const f of FILERS) boardStubs[f] = async () => (filedOk ? { ok: true, amendment: { id: 3 }, item: { ...item } } : { ok: false, reason: 'proposer_would_lose_their_seat' });
+  const saved = {};
+  for (const [k, v] of Object.entries(stubs)) { saved[`db.${k}`] = db[k]; db[k] = v; }
+  for (const [k, v] of Object.entries(boardStubs)) { saved[`board.${k}`] = board[k]; board[k] = v; }
+  try {
+    return await fn({ votes, closes });
+  } finally {
+    for (const [k, v] of Object.entries(saved)) {
+      const [obj, key] = k.split('.');
+      (obj === 'db' ? db : board)[key] = v;
+    }
+  }
+}
+
+for (const filer of FILERS) {
+  test(`${filer}: the sole member of a one-yes board decides by filing, and the vote is theirs on the record`, async () => {
+    await world({}, async ({ votes, closes }) => {
+      const out = await sole[filer]({ proposedBy: '42' });
+      assert.equal(out.ok, true);
+      assert.deepEqual(out.decided, { closed: true, outcome: 'passed', cast_via: 'filed' });
+      assert.equal(votes.length, 1);
+      assert.equal(votes[0].voter_id, '42', 'attributed to the member who filed');
+      assert.equal(votes[0].direction, 'yes');
+      assert.equal(votes[0].cast_via, 'filed', 'the record says how it was cast');
+      assert.ok(votes[0].cast_at, 'and when');
+      assert.deepEqual(closes, [7], 'closed through the ordinary close path');
+    });
+  });
+
+  test(`${filer}: a second member on the board — nothing is cast, the sitting waits`, async () => {
+    await world({ members: ['42', '43'] }, async ({ votes, closes }) => {
+      const out = await sole[filer]({ proposedBy: '42' });
+      assert.equal(out.decided, undefined);
+      assert.deepEqual(votes, []);
+      assert.deepEqual(closes, []);
+    });
+  });
+
+  for (const rule of ['consent', 'majority', 'unanimous']) {
+    test(`${filer}: under ${rule} a sole member's filing still waits for their vote`, async () => {
+      await world({ constitution: { ...MONARCHY, pass_rule: rule } }, async ({ votes, closes }) => {
+        const out = await sole[filer]({ proposedBy: '42' });
+        assert.equal(out.decided, undefined);
+        assert.deepEqual(votes, []);
+        assert.deepEqual(closes, []);
+      });
+    });
+  }
+
+  test(`${filer}: a caller who is not the sole member — the sitting is left open, exactly as today`, async () => {
+    await world({ members: ['42'] }, async ({ votes, closes }) => {
+      const out = await sole[filer]({ proposedBy: '43' });
+      assert.equal(out.ok, true);
+      assert.equal(out.decided, undefined);
+      assert.deepEqual(votes, []);
+      assert.deepEqual(closes, []);
+    });
+  });
+
+  test(`${filer}: a refused filing comes back untouched, and nothing is cast`, async () => {
+    await world({ filedOk: false }, async ({ votes }) => {
+      assert.deepEqual(await sole[filer]({ proposedBy: '42' }), { ok: false, reason: 'proposer_would_lose_their_seat' });
+      assert.deepEqual(votes, []);
+    });
+  });
+}
+
+test('the yes goes through the real castVote: membership is re-checked under the item\'s snapshot', async () => {
+  // resolve says 42 is the one member, but the per-request re-check says 42 no longer
+  // holds the rank (demoted between the two reads): the cast is refused, nothing closes.
+  await world({}, async ({ votes, closes }) => {
+    db.builderHoldsRankActive = async () => false;
+    const out = await sole.proposeLaws({ proposedBy: '42' });
+    assert.equal(out.decided, undefined);
+    assert.deepEqual(votes, []);
+    assert.deepEqual(closes, []);
+  });
+});
+
+test('a cast marked "filed" is refused on anything but an amendment, and as a no', async () => {
+  await world({ subjectType: 'full_idea' }, async ({ votes }) => {
+    assert.equal((await board.castVote({ itemId: 7, voterId: '42', direction: 'yes', castVia: 'filed' })).reason, 'bad_cast_via');
+    assert.deepEqual(votes, []);
+  });
+  await world({ subjectType: 'genesis_stage' }, async () => {
+    assert.equal((await board.castVote({ itemId: 7, voterId: '42', direction: 'yes', castVia: 'filed' })).reason, 'bad_cast_via');
+  });
+  await world({}, async () => {
+    assert.equal((await board.castVote({ itemId: 7, voterId: '42', direction: 'no', reasonMd: 'no', sectionKey: 'purpose', castVia: 'filed' })).reason, 'bad_cast_via');
+    assert.equal((await board.castVote({ itemId: 7, voterId: '42', direction: 'yes', castVia: 'by_magic' })).reason, 'bad_cast_via');
+  });
+});
+
+test('a confirm that fails leaves the filing standing and the sitting open', async () => {
+  await world({}, async () => {
+    board.maybeCloseAfterVote = async () => { throw new Error('db down'); };
+    const out = await sole.proposeCharter({ proposedBy: '42' });
+    assert.equal(out.ok, true);
+    assert.equal(out.decided, undefined);
+  });
+});

package/tests/project_catalog_routes.mjs

@@ -50,6 +50,8 @@ let published = [];
 let healed = [];
 
 provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+// The gate also admits an owner-made grant (task 1004161, ADR 0407); nobody in this file holds one.
+require('../modules/provisioning/grants.js').liveGrant = async () => null;
 provisioning.getInstanceBySlug = async (_db, slug) => (instance && instance.slug === slug ? { ...instance } : null);
 provisioning.getInstanceByDomain = async () => null;
 provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project

package/tests/provisioning_env_manifest.mjs

@@ -235,6 +235,10 @@ console.log('\nthe routes:');
 
 let instance = null;
 provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+// The routes also admit an owner-made grant (task 1004161) and audit each change: nobody here
+// holds a grant, and the audit rows are not this file's subject.
+require('../modules/provisioning/grants.js').liveGrant = async () => null;
+provisioning.recordEvent = async () => {};
 
 const api = require('../src/module-api.js');
 let builder = { id: 7, rank: 'xenos', github_login: 'owner' };

package/tests/provisioning_env_manifest_edit_delete.mjs

@@ -32,6 +32,8 @@ const express = require('express');
 
 const api = require('../src/module-api.js');
 const provisioning = require('../modules/provisioning/provisioning.js');
+// The gate also admits an owner-made grant (task 1004161, ADR 0407); nobody in this file holds one.
+require('../modules/provisioning/grants.js').liveGrant = async () => null;
 const envManifest = require('../modules/provisioning/env-manifest.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');