@bongos/core 1.18.18 → 1.19.2

package/src/bongos/permission-path-check.js

@@ -223,7 +223,7 @@ function checkPermissionPaths({ changedFiles, builderRank } = {}) {
         `${h.file} is a permission-sensitive surface (matches \`${h.glob}\`). `
         + `Builder rank '${builderRank}' is below ${floorLabel} and may not modify the rank / permission / `
         + `ship-grade / deploy / migration machinery (ADR 0016, SEC #863). `
-        + `If this change is genuinely needed, an Archon must own it.`,
+        + `If this change is genuinely needed, a ${floorLabel}+ builder must own it.`,
     });
   }
   return {

package/src/bongos/route-rank-check.js

@@ -216,10 +216,15 @@ const EXPECTED_RANKS = {
   // (dev-box fleet pins likewise live in MODULE_EXPECTED_RANKS below — BV1.R43.)
   // security engagement docs — exploit-detail report store (task 991). Pinned
   // because a silent downgrade here leaks the attacker cookbook below the
-  // Archon line. (security-the-PROPERTY stays kernel — routes/security.js.)
-  'GET /security/docs': 'archon',
-  'GET /security/docs/:slug': 'archon',
-  'POST /security/docs': 'archon',
+  // trust line. (security-the-PROPERTY stays kernel — routes/security.js.)
+  // ADR 0157 lowered `security.report.adjudicate` archon→metic, so these are pinned by
+  // ATOM rather than by rank: the invariant worth guarding is "this route gates on the
+  // adjudication permission", and an atom pin states exactly that while surviving any
+  // future floor move without a pin edit (pinMismatch compares atom identity for
+  // `perm:` pins, rank only for rank pins).
+  'GET /security/docs': 'perm:security.report.adjudicate',
+  'GET /security/docs/:slug': 'perm:security.report.adjudicate',
+  'POST /security/docs': 'perm:security.report.adjudicate',
   // The full threat model + defenses inventory (ADR 0020). Same class as the docs
   // pins above — a silent downgrade puts the defense inventory below the trust line.
   // Newly VISIBLE in BV1.R109b (declared multi-line, so previously unpinnable).
@@ -248,10 +253,13 @@ const EXPECTED_RANKS = {
 // so tightening these to `perm:` pins is a clean follow-up once R104-R107 have landed.
 const MODULE_EXPECTED_RANKS = {
   'dev-box': {
-    'GET /boxes': 'archon',
-    'GET /boxes/cost-ledger': 'archon',
-    'POST /boxes/:builderId/close': 'archon',
-    'PATCH /boxes/:builderId/block': 'archon',
+    // ADR 0157 lowered `box.fleet.manage` archon→metic (operating paid infra is admin
+    // work, not an authority grant). Re-pinned by ATOM so the guarded invariant is
+    // "these gate on the fleet permission", independent of its floor.
+    'GET /boxes': 'perm:box.fleet.manage',
+    'GET /boxes/cost-ledger': 'perm:box.fleet.manage',
+    'POST /boxes/:builderId/close': 'perm:box.fleet.manage',
+    'PATCH /boxes/:builderId/block': 'perm:box.fleet.manage',
   },
   // The lifecycle module's privileged routes (carved BV1.R86 — the pins follow the
   // routes from EXPECTED_RANKS). Verified only when the lifecycle module is in scope.
@@ -264,12 +272,15 @@ const MODULE_EXPECTED_RANKS = {
     'POST /tasks/:id/promote': 'metic+archon',
     'POST /tasks/:id/abandon': 'metic+archon',
     // override-request adjudication (lands credit + ship attribution).
-    'GET /override-requests': 'archon',
-    'POST /override-requests/:id/decide': 'archon',
+    // ADR 0157: `override_request.decide` lowered archon→metic; pinned by atom.
+    'GET /override-requests': 'perm:override_request.decide',
+    'POST /override-requests/:id/decide': 'perm:override_request.decide',
     // polymorphic dependency edges (ADR 0086 §5) — authoring a cross-tier
     // dependency reshapes execution order + feeds the claim gate; both pinned.
-    'POST /dependencies': 'archon',
-    'DELETE /dependencies': 'archon',
+    // These STAYED archon under ADR 0157: `dependency.cross_tier.manage` is system:true,
+    // and the catalog forbids granting a system key below archon.
+    'POST /dependencies': 'perm:dependency.cross_tier.manage',
+    'DELETE /dependencies': 'perm:dependency.cross_tier.manage',
     // goal tier (ADR 0086 §3) — CREATE Metic+ (Archon for a protected-module scope,
     // enforced in-handler); member admission is the protected-scope approval grant.
     'POST /goals': 'metic+archon',
@@ -279,9 +290,10 @@ const MODULE_EXPECTED_RANKS = {
     // below). The wall is in-handler (owner | manager | Archon), with a protected-
     // scope goal staying Archon-only (actor AND Metic+ target) inside the handler.
     'POST /goals/:id/members': 'any-builder',
-    // per-version priority reorder (task 1760) — an owner decision, Archon-only;
-    // never self-granted by a goal's own member/manager authority.
-    'POST /goals/reorder': 'archon',
+    // per-version priority reorder (task 1760) — never self-granted by a goal's own
+    // member/manager authority. ADR 0157 lowered `goal.reorder` archon→metic (ordering
+    // work is prioritisation, not an authority grant); pinned by atom.
+    'POST /goals/reorder': 'perm:goal.reorder',
     // ask-to-widen (ADR 0086 §4) — widening a goal's scope_modules; never self-granted.
     'POST /goals/:id/scope': 'metic+archon',
     // goal lifecycle disposition (ADR 0086 §6) — a rank drop here would let any
@@ -342,23 +354,34 @@ const MODULE_EXPECTED_RANKS = {
     // shipped scope-truth; ADR 0154's whole safety argument is that the backward
     // ratchet did not move with the create. Previously unpinned — pinned here so a
     // silent downgrade reds the build (task 1002538).
-    'POST /done-when/:criterionId/unsatisfy': 'archon',
-    // gate-surface PR approval from the hall (task 1179, ADR 0058 amendment) — the
-    // approve route clears the gate-review hard floor; the list route exposes gate internals.
-    'GET /gate-approvals': 'archon',
-    'POST /gate-approvals/:pr/approve': 'archon',
+    // ADR 0157 lowered `criterion.unsatisfy` archon→metic. The backward-ratchet warning
+    // above still holds — un-flipping a confirmed criterion rewrites shipped scope-truth
+    // — but it is scope disposition, not an authority grant, so it delegates with the
+    // rest. Pinned by atom so the guarded invariant is the permission, not its floor.
+    'POST /done-when/:criterionId/unsatisfy': 'perm:criterion.unsatisfy',
+    // gate-surface PR approval from the hall (task 1179, ADR 0058 amendment). ADR 0157
+    // SPLIT these two: the list route is `gate_approval.read` (metic — the Gate page
+    // opens to the working rank), while APPROVING still clears the gate-review hard
+    // floor and stays `gate_approval.decide` (archon, system). The split is the reason
+    // the page is usable at all — see the atom's note in catalog.js.
+    'GET /gate-approvals': 'perm:gate_approval.read',
+    'POST /gate-approvals/:pr/approve': 'perm:gate_approval.decide',
   },
   // Ratifying a criterion proposal WRITES scope-truth (it creates a done-when
-  // criterion). Metic+ may file the proposal; only the Archon may ratify it.
+  // criterion). Metic+ may file the proposal; ADR 0157 also lets Metic ratify it
+  // (`idea.ratify` archon→metic) — the rank that triages ideas now also ratifies them.
   ideas: {
-    'POST /inbox/:id/ratify': 'archon',
+    'POST /inbox/:id/ratify': 'perm:idea.ratify',
   },
   // Cross-builder memory READS — the counterpart to the BFG cross-builder WRITE the
   // KNOWN_RANKS note above already protects. A downgrade here breaks the memory
   // isolation invariant: any builder could read every other builder's memory.
+  // ADR 0157 lowered `memory.read.any` archon→metic. The isolation invariant the note
+  // above protects is unchanged in KIND — a cross-builder read still requires an
+  // explicit permission no ordinary builder holds — only its floor moved. Pinned by atom.
   memory: {
-    'GET /memory/builders/:builderId/files': 'archon',
-    'GET /memory/builders/:builderId/file': 'archon',
+    'GET /memory/builders/:builderId/files': 'perm:memory.read.any',
+    'GET /memory/builders/:builderId/file': 'perm:memory.read.any',
   },
   // Vulnerability-report intake + adjudication. The four adjudication routes move a
   // PAYOUT (confirm awards drachmae, dispute clears it), and the list route exposes
@@ -367,12 +390,32 @@ const MODULE_EXPECTED_RANKS = {
   // is DELIBERATELY Metic+ (the rank gate is the bounty noise-floor, V3.R63): the pin
   // catches an accidental widening to Xenos as loudly as it catches a gate removal.
   security: {
-    'POST /security/reports': 'metic+archon',
-    'GET /security/reports': 'archon',
-    'POST /security/reports/:id/confirm': 'archon',
-    'POST /security/reports/:id/dispute': 'archon',
-    'POST /security/reports/:id/fix': 'archon',
-    'POST /security/reports/:id/link-fix': 'archon',
+    'POST /security/reports': 'perm:security.report.file',
+    // ADR 0157 lowered `security.report.adjudicate` archon→metic and extended its guards
+    // to name the LIST route, which BV1.R105 had left on raw requireRank for want of an
+    // atom that covered the read. All five now pin by atom.
+    'GET /security/reports': 'perm:security.report.adjudicate',
+    'POST /security/reports/:id/confirm': 'perm:security.report.adjudicate',
+    'POST /security/reports/:id/dispute': 'perm:security.report.adjudicate',
+    'POST /security/reports/:id/fix': 'perm:security.report.adjudicate',
+    'POST /security/reports/:id/link-fix': 'perm:security.report.adjudicate',
+  },
+  // The governance tab's server half (BV1.R110, ADR 0151) — the routes that EDIT
+  // the role/permission graph itself. Every route, the three reads included, is
+  // pinned to the `governance.manage` ATOM rather than a rank: on this surface
+  // the atom IS the authority (it is the catalog's meta-escalation key), and a
+  // downgrade here is the model's worst case — the routes that write authority
+  // drifting below the wall that guards authority. Reads are pinned too because
+  // the full role/grant/assignment map is the authority model's blueprint.
+  governance: {
+    'GET /governance/roles': 'perm:governance.manage',
+    'GET /governance/permissions': 'perm:governance.manage',
+    'GET /governance/assignments': 'perm:governance.manage',
+    'POST /governance/roles': 'perm:governance.manage',
+    'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+    'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+    'POST /governance/assignments': 'perm:governance.manage',
+    'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
   },
 };
 

package/src/bongos/routes/audit-log.js

@@ -19,8 +19,10 @@ module.exports = function buildAuditLogRouter() {
   // Paginated, newest-first. Clamps:
   //   limit  → 1..500, default 100
   //   offset → >= 0, default 0
-  // rank: archon — forensics surface; only the Archon should see who did what.
-  router.get('/audit-log', auth.requireBuilder, auth.requireRank('archon'), asyncHandler('GET /audit-log', async (req, res) => {
+  // rank: archon — forensics surface; only the Archon should see who did what. Gate:
+  // requirePermission('audit_log.read') — BV1.R104; the seeded rank-role makes the
+  // permission and the old rank floor identical (ADR 0151).
+  router.get('/audit-log', auth.requireBuilder, auth.requirePermission('audit_log.read'), asyncHandler('GET /audit-log', async (req, res) => {
     // R14 (#2001 / ADR 0119): adopt the shared helper (was a hand-rolled clamp);
     // per-endpoint cap preserved (limit 1..500 default 100, offset ≥ 0).
     const { limit, offset } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });

package/src/bongos/routes/auth.js

@@ -884,8 +884,10 @@ module.exports = function buildAuthRouter() {
   // its primary-key id. Used for surgical lockouts (e.g. a compromised CLI on
   // a known builder's laptop) without disturbing that builder's other sessions.
   // Body: { session_id: <bigint> }. Response: { ok, revoked: 0|1 }.
-  // rank: archon — kills an arbitrary session; can lock other builders out.
-  router.post('/auth/revoke', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — kills an arbitrary session; can lock other builders out. Gate:
+  // requirePermission('auth.session.revoke') — BV1.R104; the seeded rank-role makes
+  // the permission and the old rank floor identical (ADR 0151).
+  router.post('/auth/revoke', auth.requireBuilder, auth.requirePermission('auth.session.revoke'), async (req, res) => {
     if (validateOrRespond(req, res, { session_id: {} })) return;  // bigint as number or string; validated below
     const sessionId = req.body && req.body.session_id;
     if (sessionId === undefined || sessionId === null) {
@@ -910,8 +912,10 @@ module.exports = function buildAuthRouter() {
   // setBuilderRank when newRank moves down the ladder — C7 rank-change-near-
   // instant) and as a manual operator hammer.
   // Body: { builder_id: <bigint> }. Response: { ok, revoked: <count> }.
-  // rank: archon — same authority as PATCH /builders/:id/rank.
-  router.post('/auth/revoke-all', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — same authority as PATCH /builders/:id/rank. Gate:
+  // requirePermission('auth.session.revoke') — BV1.R104; the same atom /auth/revoke
+  // gates on (ADR 0151).
+  router.post('/auth/revoke-all', auth.requireBuilder, auth.requirePermission('auth.session.revoke'), async (req, res) => {
     if (validateOrRespond(req, res, { builder_id: {} })) return;  // bigint as number or string; validated below
     const builderId = req.body && req.body.builder_id;
     if (builderId === undefined || builderId === null) {

package/src/bongos/routes/backup.js

@@ -103,8 +103,10 @@ function latestDump(nowMs = Date.now()) {
 module.exports = function buildBackupRouter() {
   const router = express.Router();
 
-  // rank: metic+archon — any working builder may check or trigger a backup.
-  router.get('/backup/status', auth.requireBuilder, auth.requireRank('metic', 'archon'),
+  // rank: metic+archon — any working builder may check or trigger a backup. Gate:
+  // requirePermission('backup.manage') — BV1.R104; the seeded rank-role makes the
+  // permission and the old rank floor identical (ADR 0151).
+  router.get('/backup/status', auth.requireBuilder, auth.requirePermission('backup.manage'),
     asyncHandler('GET /backup/status', async (_req, res) => {
       const dump = latestDump();
       res.json({
@@ -120,8 +122,9 @@ module.exports = function buildBackupRouter() {
       });
     }));
 
-  // rank: metic+archon
-  router.post('/backup/trigger', auth.requireBuilder, auth.requireRank('metic', 'archon'),
+  // rank: metic+archon — kicks off a fresh dump; same gate as the status read.
+  // Gate: requirePermission('backup.manage') — BV1.R104.
+  router.post('/backup/trigger', auth.requireBuilder, auth.requirePermission('backup.manage'),
     asyncHandler('POST /backup/trigger', async (req, res) => {
       if (triggerRunning) {
         return res.fail('backup_already_running', { status: 409, message: 'A backup is already in progress — poll /backup/status to see it land.' });

package/src/bongos/routes/builders.js

@@ -113,7 +113,11 @@ module.exports = function buildBuildersRouter() {
   const router = express.Router();
 
   // rank: archon — sole chokepoint that mutates builders.rank; ADR 0016 §enforcement.
-  router.patch('/builders/:id/rank', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // Gate: requirePermission('builder.rank.set') — BV1.R104; the seeded rank-role makes
+  // the permission and the old rank floor identical (ADR 0151). The atom is
+  // `system: true`, so no CUSTOM role may ever be granted it — only the seeded archon
+  // role holds it, which is exactly the meta-escalation wall ADR 0016 wants.
+  router.patch('/builders/:id/rank', auth.requireBuilder, auth.requirePermission('builder.rank.set'), async (req, res) => {
     if (validateOrRespond(req, res, {
       rank: { required: true, type: 'string', maxLength: 32 },
     })) return;
@@ -188,8 +192,10 @@ module.exports = function buildBuildersRouter() {
   // claims, seals their session_logs, rank → xenos, blocks new claims while
   // preserving all credit/history); { status: 'active' } reactivates. Cannot
   // change your own status (no last-Archon footgun — same guard as /rank).
-  // rank: archon — deactivation/reactivation; preserves credit history but blocks claims.
-  router.patch('/builders/:id/status', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — deactivation/reactivation; preserves credit history but blocks
+  // claims. Gate: requirePermission('builder.status.set') — BV1.R104; the seeded
+  // rank-role makes the permission and the old rank floor identical (ADR 0151).
+  router.patch('/builders/:id/status', auth.requireBuilder, auth.requirePermission('builder.status.set'), async (req, res) => {
     if (validateOrRespond(req, res, {
       status: { required: true, type: 'string', enum: ['active', 'inactive'] },
       reason: { type: 'string', maxLength: LIMITS.NOTES },
@@ -238,8 +244,10 @@ module.exports = function buildBuildersRouter() {
   // engages the warn/over thresholds. { monthly_budget_usd: null } clears it: the
   // builder becomes UNCAPPED (there is no default cap — ADR 0085). This is the
   // "budget per-builder configurable by Archon" done-when. 404 if no such builder.
-  // rank: archon — changes another builder's cost ceiling.
-  router.patch('/builders/:id/budget', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — changes another builder's cost ceiling. NOT ownership-scoped:
+  // archon-only admin op. Gate: requirePermission('builder.budget.set') — BV1.R104;
+  // the seeded rank-role makes the permission and the old rank floor identical (ADR 0151).
+  router.patch('/builders/:id/budget', auth.requireBuilder, auth.requirePermission('builder.budget.set'), async (req, res) => {
     const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
     if (targetId === null) return;
     if (validateOrRespond(req, res, { monthly_budget_usd: {} })) return;  // number ≥0, or null to clear; validated below
@@ -277,8 +285,10 @@ module.exports = function buildBuildersRouter() {
   // stale-claim-release sweeper uses but exposed as a roster knob so the
   // Archon can dial it in if needed.
   //
-  // rank: archon — surfaces every builder's onboarding state.
-  router.get('/builders/roster', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — surfaces every builder's onboarding state. Gate:
+  // requirePermission('builder.roster.read') — BV1.R104; the same atom
+  // /grades/by-builder and /builders/:id/active-claims already gate on (ADR 0151).
+  router.get('/builders/roster', auth.requireBuilder, auth.requirePermission('builder.roster.read'), async (req, res) => {
     let staleHours = 24;
     if (req.query && req.query.stale_hours != null) {
       const n = Number(req.query.stale_hours);
@@ -323,8 +333,9 @@ module.exports = function buildBuildersRouter() {
   // the Ruling Hand's alone (the project-wide aggregate stays public via
   // /public/grades; this per-builder split does not).
   //
-  // rank: archon.
-  router.get('/grades/by-builder', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — NOT ownership-scoped: archon-only cross-builder read.
+  // Gate: requirePermission('builder.roster.read') — BV1.R104.
+  router.get('/grades/by-builder', auth.requireBuilder, auth.requirePermission('builder.roster.read'), async (req, res) => {
     let days = 30;
     if (req.query && req.query.days != null) {
       const n = Number(req.query.days);
@@ -349,8 +360,9 @@ module.exports = function buildBuildersRouter() {
   // boolean "has any stale claim?"; this endpoint surfaces *which* claim
   // is stale so the Archon can target the release.
   //
-  // rank: archon — privileged read of another builder's work surface.
-  router.get('/builders/:id/active-claims', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  // rank: archon — privileged read of another builder's work surface. NOT
+  // ownership-scoped. Gate: requirePermission('builder.roster.read') — BV1.R104.
+  router.get('/builders/:id/active-claims', auth.requireBuilder, auth.requirePermission('builder.roster.read'), async (req, res) => {
     const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
     if (targetId === null) return;
     let staleHours = 24;

package/src/bongos/routes/github.js

@@ -5,12 +5,13 @@
 // These act on the user's OWN GitHub identity, so they live in core auth alongside
 // the sign-in flow that captured the token — not the provisioning module (whose
 // charter holds no tokens / calls no cloud API, ADR 0111 §2). They read the
-// short-lived, secret-box-encrypted `public_repo` token the web callback stored
-// (db.js github_oauth_tokens). Two "please reconnect / fall back" signals the wizard
-// branches on:
+// short-lived, secret-box-encrypted `repo`-scoped token the web callback stored
+// (db.js github_oauth_tokens; `repo` since ADR 0155 — private repos must be
+// adoptable). Three "please reconnect / fall back" signals the wizard branches on:
 //   • no stored token           → repo_scope_required (403)  → prompt a repos sign-in
+//   • stale pre-0155 scope      → repo_scope_required (403)  → same reconnect path
 //   • secret-box unconfigured   → github_repos_unavailable (503) → manual repo entry
-// Both are behind requireBuilder + the router-wide rate-limit middleware.
+// All are behind requireBuilder + the router-wide rate-limit middleware.
 
 const express = require('express');
 const auth = require('../auth');
@@ -35,6 +36,16 @@ async function resolveRepoToken(req, res) {
     res.fail('repo_scope_required', { status: 403, message: 'Grant repository access to list or create repos.' });
     return null;
   }
+  // A token minted BEFORE ADR 0155 carries only `public_repo`. That is enough to
+  // list + create PUBLIC repos, so without this check every call below still 200s —
+  // while silently dropping the user's PRIVATE repos from the picker, and the real
+  // failure surfaces minutes later as an opaque 403 on the provisioner's push (the
+  // task-1002561 failure mode). Re-prompt instead: the wizard already branches on
+  // repo_scope_required, so this reuses the well-exercised reconnect path.
+  if (!auth.grantedScopeCoversRepos(row.scope)) {
+    res.fail('repo_scope_required', { status: 403, message: 'Reconnect GitHub to include your private repositories.' });
+    return null;
+  }
   return row.token;
 }
 

package/src/bongos/routes/llm-cache.js

@@ -59,7 +59,9 @@ module.exports = function buildLlmCacheRouter() {
   // POST /llm-cache/lookup — hit/miss + atomic hit_count bump. Best-effort:
   // any DB error inside lookup() already returns null → we report a miss.
   // rank: metic — only the same trust tier that can store may read a stored result.
-  router.post('/llm-cache/lookup', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  // Gate: requirePermission('llm_cache.use') — BV1.R104; the seeded rank-role makes
+  // the permission and the old rank floor identical (ADR 0151).
+  router.post('/llm-cache/lookup', auth.requireBuilder, auth.requirePermission('llm_cache.use'), async (req, res) => {
     // Fields validated in depth below (HEX64 key / clamp); schema declares the
     // accepted set so strict-mode rejects a typo'd extra field.
     if (validateOrRespond(req, res, { cache_key: {}, tokens_saved_est: {} })) return;
@@ -81,7 +83,8 @@ module.exports = function buildLlmCacheRouter() {
 
   // POST /llm-cache/store — upsert a freshly-produced result.
   // rank: metic — a store seeds a result that a later run replays at $0 and trusts.
-  router.post('/llm-cache/store', auth.requireBuilder, auth.requireRank('metic', 'archon'), bigJson, async (req, res) => {
+  // Gate: requirePermission('llm_cache.use') — BV1.R104.
+  router.post('/llm-cache/store', auth.requireBuilder, auth.requirePermission('llm_cache.use'), bigJson, async (req, res) => {
     // spec.* is re-built server-side (below) so its inner fields need no top-level
     // schema; declare the three top-level fields so strict-mode rejects extras.
     if (validateOrRespond(req, res, { spec: {}, result_stdout: {}, result_cost_usd: {} })) return;

package/src/bongos/routes/modules.js

@@ -117,8 +117,10 @@ module.exports = function buildModulesRouter() {
     });
   }));
 
-  // rank: metic+archon — toggling a module changes running behavior for the whole instance, not just the caller.
-  router.post('/modules/:key/enable', auth.requireBuilder, auth.requireRank('metic', 'archon'),
+  // rank: metic+archon — toggling a module changes running behavior for the whole
+  // instance, not just the caller. Gate: requirePermission('module.enable') — BV1.R104;
+  // the seeded rank-role makes the permission and the old rank floor identical (ADR 0151).
+  router.post('/modules/:key/enable', auth.requireBuilder, auth.requirePermission('module.enable'),
     asyncHandler('POST /modules/:key/enable', async (req, res) => {
       const { key } = req.params;
       if (validateOrRespond(req, res, { enabled: {} })) return;  // boolean; enforced by the handler check below (preserves invalid_body)
@@ -153,8 +155,9 @@ module.exports = function buildModulesRouter() {
   // signed_by records a NEW sign-off only if none is on file; an existing
   // .upstream-signoff.json is reused as-is (not overwritten).
   //
-  // rank: metic+archon — files into a shared review queue, not just a toggle for the caller.
-  router.post('/modules/:key/submit', auth.requireBuilder, auth.requireRank('metic', 'archon'),
+  // rank: metic+archon — files into a shared review queue, not just a toggle for
+  // the caller. Gate: requirePermission('module.submit') — BV1.R104.
+  router.post('/modules/:key/submit', auth.requireBuilder, auth.requirePermission('module.submit'),
     asyncHandler('POST /modules/:key/submit', async (req, res) => {
       const { key } = req.params;
       const known = listModules();
@@ -212,7 +215,8 @@ module.exports = function buildModulesRouter() {
   // future GET .../:id can add a with-files fetch if the review UI needs it).
   //
   // rank: metic+archon — the review queue, same rank as filing into it.
-  router.get('/modules/submissions', auth.requireBuilder, auth.requireRank('metic', 'archon'),
+  // Gate: requirePermission('module.submit') — BV1.R104.
+  router.get('/modules/submissions', auth.requireBuilder, auth.requirePermission('module.submit'),
     asyncHandler('GET /modules/submissions', async (req, res) => {
       const status = req.query.status ? String(req.query.status) : undefined;
       if (status && !['pending', 'accepted', 'rejected'].includes(status)) {

package/src/bongos/routes/security.js

@@ -81,12 +81,15 @@ module.exports = function buildSecurityRouter() {
   // Xenos sees 403 regardless of whether the document is provisioned — we
   // don't want existence-or-not to leak below the rank line.
   //
-  // rank: metic+archon — trust-tier access to the threat model + defenses
-  // inventory (ADR 0020).
+  // rank: metic+archon — trust-tier access to the threat model + defenses inventory
+  // (ADR 0020). Gate: requirePermission('security.report.file') — BV1.R104; the seeded
+  // rank-role makes the permission and the old rank floor identical (ADR 0151).
+  // NB the 403 code on this route is `permission_forbidden`, not `rank_forbidden`
+  // (ADR 0020 §"A Xenos hitting the endpoint" updated to match).
   router.get(
     '/security/adr',
     auth.requireBuilder,
-    auth.requireRank('metic', 'archon'),
+    auth.requirePermission('security.report.file'),
     async (_req, res) => {
       const result = await readFullAdr();
       if (result.ok) {
@@ -113,17 +116,21 @@ module.exports = function buildSecurityRouter() {
   // (threat-model §6.3 / ADR 0020), so a committed exploit report is an
   // attacker cookbook on every box. The SAFE conceptual docs (threat-model.md,
   // the README) stay in docs/security/; only the dated reports live here, and
-  // ALL three routes are requireRank('archon') because they serve exploit
-  // detail. Content is uploaded by the director via the POST route after
-  // deploy — no exploit content ever touches the repo.
+  // ALL three routes gate on requirePermission('security.report.adjudicate')
+  // — an archon-floored atom (BV1.R104; was requireRank('archon') and admits
+  // exactly the same builders, ADR 0151) — because they serve exploit detail.
+  // Content is uploaded by the director via the POST route after deploy — no
+  // exploit content ever touches the repo. NB the 403 code on these three is
+  // now `permission_forbidden`, not `rank_forbidden`.
   // -----------------------------------------------------------------------
 
   // GET /api/gds/security/docs — list doc METADATA (no content).
   //
-  // rank: archon — index of exploit-detail engagement reports.
+  // rank: archon — index of exploit-detail engagement reports. Gate:
+  // requirePermission('security.report.adjudicate') — BV1.R104.
   router.get('/security/docs',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('security.report.adjudicate'),
     async (_req, res) => {
       try {
         const docs = await db.listSecurityDocs();
@@ -138,10 +145,11 @@ module.exports = function buildSecurityRouter() {
 
   // GET /api/gds/security/docs/:slug — one doc WITH content, or 404.
   //
-  // rank: archon — reads the full exploit-detail report body.
+  // rank: archon — reads the full exploit-detail report body. Gate:
+  // requirePermission('security.report.adjudicate') — BV1.R104.
   router.get('/security/docs/:slug',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('security.report.adjudicate'),
     async (req, res) => {
       const slug = String(req.params.slug || '');
       if (!SECURITY_DOC_SLUG_RE.test(slug)) {
@@ -174,10 +182,11 @@ module.exports = function buildSecurityRouter() {
   // Body: { slug, title, content_md }. content_md uses a large explicit cap
   // (full reports), NOT the small LIMITS.DESCRIPTION. Returns 201 + the row.
   //
-  // rank: archon — writes exploit-detail report bodies.
+  // rank: archon — writes exploit-detail report bodies. Gate:
+  // requirePermission('security.report.adjudicate') — BV1.R104.
   router.post('/security/docs',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('security.report.adjudicate'),
     async (req, res) => {
       if (validateOrRespond(req, res, {
         slug:       { required: true, type: 'string', maxLength: 128, minLength: 1 },

package/src/bongos/serve-internal.js

@@ -673,21 +673,36 @@ function mountInternalSurfaces(app) {
   });
 
   // The /watch monitoring page and the /harbor dev-box management page (idea 257)
-  // and the /gate page (task 1179) are all Archon-only. Same server-side page
-  // gate, same posture: a non-Archon never receives the shell (requireArchonPage
-  // redirects a signed-in non-Archon to the hall, an unauthenticated visitor into
-  // sign-in). The subdomain shim above has already rewritten the bare
-  // /watch + /harbor + /gate onto /builders/*. (Defense in depth: every data
-  // endpoint these pages call is independently requireRank('archon').)
+  // and the /gate page (task 1179) all sit behind `page.view.governance` — Metic
+  // and up since ADR 0157. Same server-side page gate, same posture: a builder
+  // without the permission never receives the shell (requireGovernancePage — named
+  // requireArchonPage before ADR 0157 — redirects them to the hall, and an
+  // unauthenticated visitor into sign-in). The subdomain shim above has already
+  // rewritten the bare /watch + /harbor + /gate onto /builders/*. (Defense in
+  // depth: every data endpoint these pages call carries its own server-side gate.)
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const HARBOR_PAGE_RE = /^\/builders\/harbor(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
+  // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
+  // the `governance.manage` atom itself (archon), the same key its data routes
+  // check — requireGovernanceManagePage, not the metic-floored gate above.
+  const GOVERNANCE_PAGE_RE = /^\/builders\/governance(?:\.html)?\/?$/;
+  // The /people builder directory (task 1002577): gated on `project.curate`, the
+  // exact permission its data route (GET /scouting) checks — same posture as the
+  // /governance tab above (the page can never drift wider than the API it fronts).
+  const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
     const norm = path.posix.normalize(req.path);
     if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)) {
-      return gdsAuth.requireArchonPage(req, res, next);
+      return gdsAuth.requireGovernancePage(req, res, next);
+    }
+    if (GOVERNANCE_PAGE_RE.test(norm)) {
+      return gdsAuth.requireGovernanceManagePage(req, res, next);
+    }
+    if (PEOPLE_PAGE_RE.test(norm)) {
+      return gdsAuth.requireProjectCuratePage(req, res, next);
     }
     next();
   });