@bongos/core 1.18.19 → 1.19.3

package/tests/governance_live_proof.mjs

@@ -0,0 +1,201 @@
+// tests/governance_live_proof.mjs — the C6 governance LIVE proof (BV1.R114, ADR 0151).
+//
+// C6's live-demonstration clause: an Archon creates a CUSTOM role granting an
+// OPERATIONAL permission, assigns it to a low-trust builder, and that builder can
+// perform the operational action — WHILE a `system` permission the role also "has"
+// (a grant row forced past the API, straight into the DB) stays enforced by
+// substrate: the deploy/protected-path attempt is still blocked.
+//
+// This is the goal_wall_proof.mjs pattern: the abuse MATRIX
+// (tests/governance_abuse_matrix.mjs, R112) already proves every vector DB-free
+// with stubs; THIS file proves the same story END-TO-END on the real stack —
+// real Postgres rows, real sessions, real HTTP through the real router, the real
+// resolver behind the real `governance` kernel port, no stubs, no monkeypatches.
+// The captured sandbox transcript lives in docs/governance/bongos-v1-c6-live-proof.md.
+//
+// Real-DB integration test (the needs_rebase.mjs class): SELF-SKIPS (exit 0)
+// when DATABASE_URL is unset/unreachable or the governance tables are missing,
+// and is listed in run-unit-tests.js's INTEGRATION set so the DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/governance_live_proof.mjs
+//   GDS_BASE_URL=http://localhost:3000  — optional: drive an already-running
+//   sandbox server (sharing that DATABASE_URL) instead of booting the router
+//   in-process. Same routes either way; this is how the live sandbox transcript
+//   was captured.
+
+import { strict as assert } from 'node:assert';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = process.env.NODE_ENV || 'test';
+const require = createRequire(import.meta.url);
+
+if (!process.env.DATABASE_URL) {
+  console.log('governance_live_proof.mjs SKIPPED — DATABASE_URL not set.');
+  process.exit(0);
+}
+
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+try {
+  await pool.query('SELECT 1 FROM governance_roles LIMIT 1');
+} catch (e) {
+  console.log(`governance_live_proof.mjs SKIPPED — no migrated Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// ── fixtures (high-ID range; cleaned before AND after so reruns are safe) ────
+const ARCHON = 90000701;
+const THETES = 90000702;
+const ROLE_KEY = 'glp-demo-triager';
+const OPERATIONAL_KEY = 'idea.triage';      // system:false, floor metic — above thetes
+const SYSTEM_KEY = 'deploy.push_main';      // system:true — substrate-enforced
+const tok = () => 'glp' + crypto.randomBytes(24).toString('hex');
+const ARCHON_TOKEN = tok();
+const THETES_TOKEN = tok();
+
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+async function cleanup() {
+  await q(`DELETE FROM governance_roles WHERE role_key=$1`, [ROLE_KEY]); // grants+assignments cascade
+  await q(`DELETE FROM governance_builder_roles WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
+  await q(`DELETE FROM builder_sessions WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
+  await q(`DELETE FROM idea_inbox WHERE captured_by IN ($1,$2)`, [ARCHON, THETES]);
+  // The audit middleware records the demo's own writes; those rows FK the
+  // fixture builders, so they go first.
+  await q(`DELETE FROM audit_log WHERE builder_id IN ($1,$2)`, [ARCHON, THETES]);
+  await q(`DELETE FROM builders WHERE id IN ($1,$2)`, [ARCHON, THETES]);
+}
+
+async function seed() {
+  await q(
+    `INSERT INTO builders (id, github_id, github_login, display_name, rank, status)
+     VALUES ($1,'glp-archon','glp-archon','GLP Demo Archon','archon','active'),
+            ($2,'glp-thetes','glp-thetes','GLP Demo Thetes','thetes','active')`,
+    [ARCHON, THETES]
+  );
+  // The R95b rank-role sync runs at sign-in / rank writes; a directly-seeded
+  // builder mirrors its effect here (one seeded rank-role each, fail-closed
+  // otherwise — the archon would resolve ZERO permissions and deny itself).
+  await q(
+    `INSERT INTO governance_builder_roles (builder_id, role_key)
+     VALUES ($1,'archon'), ($2,'thetes')`,
+    [ARCHON, THETES]
+  );
+  await q(
+    `INSERT INTO builder_sessions (builder_id, token, source)
+     VALUES ($1,$2,'web'), ($3,$4,'web')`,
+    [ARCHON, ARCHON_TOKEN, THETES, THETES_TOKEN]
+  );
+  const [idea] = await q(
+    `INSERT INTO idea_inbox (title, body_md, captured_by)
+     VALUES ('glp live-proof fixture idea','(sandbox demo row)',$1) RETURNING id`,
+    [ARCHON]
+  );
+  return idea.id;
+}
+
+// ── the server: a live sandbox (GDS_BASE_URL) or the real router in-process ──
+let server = null;
+let base;
+if (process.env.GDS_BASE_URL) {
+  base = process.env.GDS_BASE_URL.replace(/\/$/, '');
+} else {
+  const express = require('express');
+  const { buildGdsRouter } = require('../src/bongos/routes.js');
+  const app = express();
+  app.use('/api/gds', buildGdsRouter());
+  server = await new Promise((resolve) => {
+    const s = app.listen(0, '127.0.0.1', () => resolve(s));
+  });
+  base = `http://127.0.0.1:${server.address().port}`;
+}
+
+const call = async (token, method, path, body) => {
+  const res = await fetch(`${base}/api/gds${path}`, {
+    method,
+    headers: {
+      authorization: `Bearer ${token}`,
+      ...(body ? { 'content-type': 'application/json' } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const json = await res.json().catch(() => ({}));
+  const code = json?.error?.code || json?.error || '';
+  console.log(`  ${method.padEnd(6)} ${path}  →  ${res.status}${code ? ` ${code}` : ''}`);
+  return { status: res.status, body: json };
+};
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); pass++; };
+
+try {
+  await cleanup();
+  const ideaId = await seed();
+  console.log(`live proof against ${base} (idea fixture #${ideaId})`);
+
+  // Act 1 — the gate is closed: thetes (floor for idea.triage is metic) is denied.
+  let r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });
+  ok(r.status === 403 && r.body.error.code === 'permission_forbidden',
+    'BEFORE: the thetes builder cannot triage (403 permission_forbidden)');
+
+  // Act 2 — an Archon creates a custom role and grants the operational permission.
+  r = await call(ARCHON_TOKEN, 'POST', '/governance/roles',
+    { role_key: ROLE_KEY, label: 'GLP demo triage role' });
+  ok(r.status === 201, 'the Archon creates a custom role (201)');
+  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${OPERATIONAL_KEY}`);
+  ok(r.status === 200 && r.body.ok === true,
+    `the Archon grants operational '${OPERATIONAL_KEY}' to the custom role (200)`);
+
+  // Act 3 — the locked wall: a system permission is refused through the same API.
+  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/${SYSTEM_KEY}`);
+  ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
+    `system '${SYSTEM_KEY}' is NOT grantable, even by the Archon (400 permission_not_grantable)`);
+  r = await call(ARCHON_TOKEN, 'PUT', `/governance/roles/${ROLE_KEY}/permissions/governance.manage`);
+  ok(r.status === 400 && r.body.error.code === 'permission_not_grantable',
+    'the meta-escalation (governance.manage) is refused the same way');
+
+  // Act 4 — assign, then the same builder performs the action: no re-login, no
+  // restart — the per-request, uncached resolve (ADR 0016) picks the role up.
+  r = await call(ARCHON_TOKEN, 'POST', '/governance/assignments',
+    { builder_id: THETES, role_key: ROLE_KEY });
+  ok(r.status === 201, 'the Archon assigns the custom role to the thetes builder (201)');
+  r = await call(THETES_TOKEN, 'PATCH', `/inbox/${ideaId}`, { status: 'discarded' });
+  ok(r.status === 200, 'AFTER: the same builder, same session, can now triage (200) — the custom role works');
+
+  // Act 5 — the wall behind the wall: force the grant row no API path can create,
+  // so the role now "has" a system permission in the DB…
+  await q(
+    `INSERT INTO governance_role_permissions (role_key, permission_key) VALUES ($1,$2)`,
+    [ROLE_KEY, SYSTEM_KEY]
+  );
+  console.log(`  (forced INTO the DB: grant ${ROLE_KEY} ← ${SYSTEM_KEY} — no API path can write this row)`);
+
+  // …the resolver reports it honestly (it is a defined catalog key; matrix V10
+  // proves no route consumes it via requirePermission, so it admits nothing
+  // in-app)…
+  const resolver = require('../modules/governance/resolver.js');
+  const perms = await resolver.resolveBuilderPermissions(THETES);
+  ok(perms.includes(OPERATIONAL_KEY), 'the resolved set includes the operational grant');
+  console.log(`  (resolved set ${perms.includes(SYSTEM_KEY) ? 'includes' : 'omits'} the forced '${SYSTEM_KEY}' — in-app it guards no route either way)`);
+
+  // …and the SUBSTRATE stays closed: the real checker the pre-push hook, grader
+  // pre-pass and main-audit run — structurally grant-blind (node-builtins-only
+  // imports; it cannot even reach a DB) — still blocks the sub-metic builder's
+  // protected-path diff while the forced grant row sits in the database.
+  const { checkPermissionPaths } = require('../src/bongos/permission-path-check.js');
+  const sub = checkPermissionPaths({
+    changedFiles: ['migrations/999_glp_demo_evil.sql', 'modules/governance/catalog.js'],
+    builderRank: 'thetes',
+  });
+  ok(sub.hardFail === true && sub.findings.length === 2,
+    'the substrate checker still BLOCKS the protected-path attempt (deploy/migration machinery), forced grant and all');
+
+  console.log(`\ngovernance_live_proof: ${pass} assertions passed`);
+} finally {
+  await cleanup().catch((e) => console.error('cleanup failed', e.message));
+  if (server) await new Promise((resolve) => server.close(resolve));
+  await pool.end().catch(() => {});
+}

package/tests/governance_page_gates.mjs

@@ -50,30 +50,42 @@ const resolver = require('../modules/governance/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
-const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireArchonPage'];
+const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireGovernancePage'];
 const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 
 // ═══ the ORACLE — hand-written, from the rank tests R107 deleted ═════════════
-// requireBuilderPage  admitted any session at all       → every live rank
-// requireNonXenosPage admitted rank !== 'xenos'         → thetes and up
-// requireArchonPage   admitted rank === 'archon'        → archon only
+// requireBuilderPage    admitted any session at all     → every live rank
+// requireNonXenosPage   admitted rank !== 'xenos'       → thetes and up
+// requireGovernancePage admitted rank === 'archon'      → archon only …until ADR 0157
+//
+// ADR 0157 (owner decision, 2026-08-05) lowered `page.view.governance` archon→metic, so
+// the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
+// was spelled `requireArchonPage` through R107 and ADR 0157 — the name the rows below
+// were first written against — and was renamed once the floor moved; the audience here,
+// not the name, is the contract.
+//
+// This is the ONE intentional widening in this table's history. Everything R107 promised
+// (identical audiences across the rank→permission migration) still holds for the other
+// two gates, and the widening is expressed here as DATA so the A1 oracle keeps proving
+// the gate matches its declared floor rather than merely "didn't change".
 const PRE_R107_AUDIENCE = {
   requireBuilderPage: { xenos: true, thetes: true, metic: true, archon: true },
   requireNonXenosPage: { xenos: false, thetes: true, metic: true, archon: true },
-  requireArchonPage: { xenos: false, thetes: false, metic: false, archon: true },
+  requireGovernancePage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
 // they already have a session, so that would loop.
 const DENIED_TO = {
   requireBuilderPage: '/builders',
   requireNonXenosPage: '/builders/not-ready',
-  requireArchonPage: '/builders',
+  requireGovernancePage: '/builders',
 };
 // The equivalent rank floor, for the independent cross-check below.
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
   requireNonXenosPage: 'thetes',
-  requireArchonPage: 'archon',
+  // ADR 0157: `page.view.governance` floor archon→metic.
+  requireGovernancePage: 'metic',
 };
 const SIGN_IN = '/api/gds/auth/web/start';
 
@@ -226,12 +238,12 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   });
   const req = { headers: { cookie: 'gds_session=validtoken' } };
   let admitted = false;
-  await auth.requireArchonPage(req, fakeRes(), () => { admitted = true; });
+  await auth.requireGovernancePage(req, fakeRes(), () => { admitted = true; });
   assert.equal(admitted, true, 'an Archon should reach the page');
   keys = []; // the role is revoked between requests
   const second = fakeRes();
   let admittedAgain = false;
-  await auth.requireArchonPage(req, second, () => { admittedAgain = true; });
+  await auth.requireGovernancePage(req, second, () => { admittedAgain = true; });
   seams._reset();
   assert.equal(calls, 2, 'the resolver must be consulted on every request');
   assert.equal(admittedAgain, false, 'a revoked role must deny on the very next request');

package/tests/governance_parity.mjs

@@ -239,8 +239,17 @@ test('B2: the route cross-reference actually covers a substantial slice of the c
     `only ${covered.length} permissions cross-reference a gated route (${floorPinned.length} by rank, ${atomPinned.length} by atom; expected >= 25)`);
   const archonCovered = covered.filter((r) => r.floor === 'archon');
   const meticCovered = covered.filter((r) => r.floor === 'metic');
-  assert.ok(archonCovered.length >= 10, `only ${archonCovered.length} archon-floored routes cross-referenced`);
-  assert.ok(meticCovered.length >= 10, `only ${meticCovered.length} metic-floored routes cross-referenced`);
+  // These minimums measure SAMPLE BREADTH — "the cross-reference exercises both sides of
+  // the metic/archon boundary" — not how much authority Archon ought to hold. ADR 0157
+  // moved 20 atoms archon→metic, so the archon population is now genuinely small by
+  // design (rank, identity, and the escalation keys) and the metic population is large.
+  // The floors moved with it: archon 10→4, metic 10→25. Lowering the archon minimum is
+  // NOT a weakening — the guard it replaces would now fail on a correct codebase, and a
+  // guard that must be deleted to ship a legitimate change stops being a guard. The
+  // strictness moved to where the population went: metic's minimum more than doubled, so
+  // a regression that quietly drained metic-floored routes still reds the build.
+  assert.ok(archonCovered.length >= 4, `only ${archonCovered.length} archon-floored routes cross-referenced`);
+  assert.ok(meticCovered.length >= 25, `only ${meticCovered.length} metic-floored routes cross-referenced`);
 });
 
 // B3 — the oracle that REPLACES B1 as routes migrate (BV1.R109). For a route gated by

package/tests/governance_require_permission.mjs

@@ -13,6 +13,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -188,11 +189,76 @@ test('over the four seeded ranks, requirePermission admits exactly who requireRa
   // gate the SEED a rank-role grants and it reproduces the rank gate's verdict.
   // Scoped to catalog.RANK_ORDER — the reserved/divine ranks above archon hold no
   // seeded role, so parity is defined only over the four live ranks.
+  // BV1.R105 migrated every rank-gated module route (modules/*/routes/) onto the
+  // atoms below. Listing each one beside the requireRank(...) call it REPLACED turns
+  // the migration's whole claim — "the atom admits exactly who the rank gate did" —
+  // into an assertion instead of prose. Grouped by the gate that stood there before.
+  // Atoms that replaced a requireRank('archon') gate AND are still archon after
+  // ADR 0157 — rank/identity plus the escalation keys that make the delegation
+  // irreversible if moved.
+  const REPLACED_ARCHON = [
+    'dependency.cross_tier.manage', 'gate_approval.decide',
+    'task.confirm.grade_bypass', 'access_request.review',
+  ];
+  // ADR 0157 (owner decision, 2026-08-05) — "the Archon rank is responsible for rank and
+  // identity only". Each of these replaced a requireRank('archon') gate in R104/R105 and
+  // then had its catalog floor lowered archon→metic, so the audience it must now match is
+  // requireRank('metic','archon').
+  //
+  // These are listed EXPLICITLY rather than derived from catalog.byKey(...).floor on
+  // purpose: this test is an independent oracle. Deriving the expectation from the same
+  // constant the implementation reads would make it assert `x === x` and it would pass
+  // through any future floor change — including an accidental one. A hand-written list
+  // means a floor moving without an owner decision reds the build, which is the whole
+  // point of keeping parity as an assertion instead of prose.
+  const DELEGATED_TO_METIC_BY_ADR_0155 = [
+    'autonomy.precheck', 'box.fleet.manage', 'discord.channels.manage', 'idea.ratify',
+    'claim.release.any', 'criterion.unsatisfy', 'goal.reorder', 'task.newcomer_restock',
+    'task.peer_votes.tally', 'override_request.decide', 'memory.read.any',
+    'project.curate', 'provisioning.fleet.manage', 'security.report.adjudicate',
+    'session.search',
+    // Minted by R105 (POST /versions had no atom); ADR 0157 then lowered it to metic.
+    // Its sibling `version.close` stayed archon — authoring delegates, disposition does not.
+    'version.create',
+    // Minted BY ADR 0157, splitting the Gate page's READ off `gate_approval.decide` so a
+    // Metic can open /gate while approving a held PR stays Archon.
+    'gate_approval.read',
+  ];
+  const REPLACED_METIC_PLUS = [
+    'blocker.review', 'idea.triage', 'criterion.create', 'criterion.review',
+    'criterion.satisfy', 'goal.create', 'goal.archive', 'goal.scope.widen',
+    'task.create', 'task.edit', 'task.promote', 'task.demote', 'task.abandon',
+    'task.vote', 'task.dependency.manage', 'task.criterion.manage',
+    'security.report.file',
+  ];
   const cases = [
-    ['idea.triage', ['metic', 'archon']],
     ['governance.manage', ['archon']],
     ['task.claim.any', ['thetes', 'metic', 'archon']],
     ['cost.log', ['xenos', 'thetes', 'metic', 'archon']],
+    // The CORE route gates migrated in BV1.R104, each paired with the requireRank
+    // allow-list it replaced. It is the cheapest proof that a swap did not change
+    // WHO can reach a route. R105's module atoms are spread in below; these stay
+    // listed explicitly because the REPLACED_* arrays cover modules/*/routes only,
+    // so dropping them would silently retire the parity proof for the core gates.
+    // (security.report.file / security.report.adjudicate are asserted by the R105
+    // arrays below and so are not repeated here.)
+    ['backup.manage', ['metic', 'archon']],          // GET /backup/status, POST /backup/trigger
+    ['llm_cache.use', ['metic', 'archon']],          // POST /llm-cache/{lookup,store}
+    ['module.enable', ['metic', 'archon']],          // POST /modules/:key/enable
+    ['module.submit', ['metic', 'archon']],          // POST /modules/:key/submit, GET /modules/submissions
+    // ADR 0157 lowered these three archon→metic: spending, reading the roster, and
+    // reading the audit log are administration, not authority over who holds authority.
+    ['builder.budget.set', ['metic', 'archon']],     // PATCH /builders/:id/budget
+    ['builder.roster.read', ['metic', 'archon']],    // GET /builders/roster, /grades/by-builder, /builders/:id/active-claims
+    ['audit_log.read', ['metic', 'archon']],         // GET /audit-log
+    // …while these three are the identity half of ADR 0157's rank/identity mandate and
+    // stay archon: whose sessions are valid, who holds which rank, and who exists at all.
+    ['auth.session.revoke', ['archon']],             // POST /auth/revoke, POST /auth/revoke-all
+    ['builder.rank.set', ['archon']],                // PATCH /builders/:id/rank
+    ['builder.status.set', ['archon']],              // PATCH /builders/:id/status
+    ...REPLACED_ARCHON.map((key) => [key, ['archon']]),
+    ...DELEGATED_TO_METIC_BY_ADR_0155.map((key) => [key, ['metic', 'archon']]),
+    ...REPLACED_METIC_PLUS.map((key) => [key, ['metic', 'archon']]),
   ];
   for (const [permission, allowedRanks] of cases) {
     for (const rank of catalog.RANK_ORDER) {
@@ -221,3 +287,61 @@ test('a principal permission (floor null) is held by NO rank-role', async () =>
     assert.equal(res._status, 403);
   }
 });
+
+// BV1.R105 completeness — the negative half of the parity proof above.
+//
+// The per-route pins in route-rank-check.js are satisfied by EITHER spelling, on
+// purpose, so the R104-R107 migration could land incrementally. The cost is that
+// nothing there fails when a call site is simply MISSED: a forgotten requireRank
+// keeps its pin green because the effective authority is unchanged. The parity
+// tests above have the same blind spot — they assert the atoms that WERE replaced
+// behave identically, never that none were left behind.
+//
+// So scan the source instead. R105 left four deliberate holdouts, each carrying a
+// "Still requireRank after BV1.R105" note at its site: their permission atom was
+// declared over the module's WRITES, so the read gate stayed rank-based rather than
+// minting a second atom meaning "may look at this". Anything else is a miss.
+//
+// ADR 0157 cleared THREE of those four. It had to: lowering a write atom to metic
+// while its read sibling stayed on requireRank('archon') would have left the read
+// STRICTER than the write — a Metic able to confirm a vulnerability report but not
+// list one, and a Gate page open to Metic whose only data endpoint 403s. So the ADR
+// extended each atom's declared guards to name its read (and split out
+// `gate_approval.read`, since approving must stay Archon while reading must not),
+// which is exactly the "mint an atom that covers the read" step R105 deferred.
+test('every modules/*/routes gate is migrated, bar the one documented holdout', () => {
+  const RETAINED = [
+    // Still requireRank after BV1.R105 — this route did not EXIST when R105 was
+    // written. modules/security/routes/scans.js landed on main from task 1002547
+    // while R105 sat at 'completed' awaiting an owner override decision, so it was
+    // authored against the requireRank spelling that was still current. Untouched by
+    // ADR 0157: its gate is already requireRank('metic','archon'), so it is not an
+    // Archon surface and the delegation had nothing to move. Migrating it is still
+    // worth doing — it means minting an atom over the write — but it is the
+    // continuing R107/R108 migration's job, not this ADR's.
+    'security/routes/scans.js',
+  ].sort();
+
+  const modulesDir = path.join(ROOT, 'modules');
+  const found = [];
+  for (const key of fs.readdirSync(modulesDir)) {
+    const routesDir = path.join(modulesDir, key, 'routes');
+    if (!fs.existsSync(routesDir)) continue;
+    for (const file of fs.readdirSync(routesDir)) {
+      if (!file.endsWith('.js')) continue;
+      const text = fs.readFileSync(path.join(routesDir, file), 'utf8');
+      // Line-based so a requireRank named in prose (there are ~20 such mentions)
+      // is not mistaken for a live gate. A gate is always a call.
+      const live = text.split('\n').some((line) => {
+        const t = line.trim();
+        if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) return false;
+        return /requireRank\s*\(/.test(line);
+      });
+      if (live) found.push(`${key}/routes/${file}`);
+    }
+  }
+
+  assert.deepEqual(found.sort(), RETAINED,
+    'a modules/*/routes gate still calls requireRank — migrate it to requirePermission, ' +
+    'or add it to RETAINED with a "Still requireRank after BV1.R105" note explaining why');
+});