@bongos/core 1.19.644 → 1.19.645

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.644",
-  "core_contract": "1.19.644",
-  "source_commit": "cdc649c80e371715361cb64f295771663d028801",
+  "core_version": "1.19.645",
+  "core_contract": "1.19.645",
+  "source_commit": "14b1d4c19840d818f49d383ed7c50189913860ac",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T17:41:14.263Z",
+  "built_at": "2026-09-10T18:02:00.629Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2600,
-  "tree_sha256": "8c4305075a816844d4abcbe56b413fa30c26237b066800b86dc6c4b348bef90b",
+  "tree_sha256": "39c1aaa7c37d7537a2b25d18b8de6e6096cef248e1549d529398fe0d2282e2c2",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "013f4da6dd306f5c4107b1527c38e9a422511b7b81e1ac7b33a2239c3e14c302"
+      "sha256": "7decbd6be1709b8c7fe6173a659d2caa8594bb766d353bece00c88a1e316f57e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5547,12 +5547,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "5e7bdb2c09e1e62aacb4b40843392e2c1ca1534a69191c00c3103a257f086c31"
+      "sha256": "b3df5f0d4273f44af60a7e09a8bef026a0f02085c7823c7912c70d067e55e127"
     },
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
-      "sha256": "ddedb76f43edbe3e7c918578fda94b97cb3822d97074af33393791fb1ec1cbef"
+      "sha256": "da653f475d6c91db8e84bff46c797bb68b61e48d561eacf7bfd228a119ac7266"
     },
     {
       "path": "modules/ideas/templates.js",
@@ -7722,12 +7722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f96527ae9191d470397057ba5d9df620b485cfac53854b04c6b4a9f4b2dd0073"
+      "sha256": "de884c55a00c4f37989b00d9c574fdcde904f617941dc65ee21ece636efd63c8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "11cc56ca7e914c5f0956f4c65d277cf92ca8098e62d987a907a43033886570ae"
+      "sha256": "a2949e78ffe45c9e0442261dd19892266aa1930607dfaa309ce10754b119921e"
     },
     {
       "path": "public-docs/index.html",
@@ -9217,7 +9217,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "8ee4e492d700f44d80c3e2deead51cc468f4c62fe3e473497f7b003a7aec8480"
+      "sha256": "88e734e42d8fd15ba24d75cafcc611de90e16362200e198e9a9bc4ee825bfbaf"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -9482,7 +9482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9784cea15d64b5a9b88797988bfd3e863c9a4d44b45126c77a9502d87ae5a2b0"
+      "sha256": "e5d854562fcdec46abd9212cfdfc5c05bd1b29b43525d00abb9d6acb39dac48c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9742,7 +9742,7 @@
     {
       "path": "tests/auth_page_gate.mjs",
       "mode": "0000644",
-      "sha256": "3ed218eada5e36170217ded839fdc80d1cbad4ec71086d9707f00115d6c622d2"
+      "sha256": "8011ca574306df12ae1e046e6a37ca9e779b29ad26d2bfc0508ae8d6b9f5a0b2"
     },
     {
       "path": "tests/auth_resolve_failure.mjs",
@@ -10502,7 +10502,7 @@
     {
       "path": "tests/filing_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "2a6de0e7411bb4796fe4f301af77c33f08a99307f2298ed83cd32c38cf059dc5"
+      "sha256": "815f2fa2ffd6e7a721507852d43b0490115a0b15393670f6035626bdf000e99c"
     },
     {
       "path": "tests/first_admin_bootstrap.mjs",
@@ -10902,7 +10902,7 @@
     {
       "path": "tests/government_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "eff61f5299bcaaf21e19dfa84eb4ff6b92d480f708568bc243e784953d1db40a"
+      "sha256": "8ae3eaaf0b7d9a0e93d58eda3d877abe4f59bed25ffbcdc4e42a67497398debf"
     },
     {
       "path": "tests/government_resolver.mjs",

package/docs/module-api-changelog.md

@@ -1737,5 +1737,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.642 with no explicit bump. run 34509123612. (task 1002620)
   1.19.644 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.643 with no explicit bump. run 34509682128. (task 1002620)
+  1.19.645 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.644 with no explicit bump. run 34511775606. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/routes/inbox.js

@@ -39,6 +39,9 @@ const inbox = require('../inbox');
 // and the deterministic scorer (R142) — both pure, both walk the declaration.
 const { validateFieldValues, templateFor, fieldOrder } = require('../templates');
 const { completenessScore, weakestSectionPayload, scoreFieldValues } = require('../completeness');
+// The trusted tier, spelled once (task 1003197 (D)) — routing.js owns METIC_PLUS
+// and already names 'criterion-proposal' in NEVER_ROUTE_KINDS.
+const { mayProposeCriterion, METIC_PLUS } = require('../routing');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('ideas');
 const { validateOrRespond, LIMITS, parseId } = api;
@@ -93,9 +96,16 @@ module.exports = function buildInboxRouter() {
     })) return;
     const body = req.body || {};
     if (body.kind === 'criterion-proposal') {
-      const rank = (req.builder?.rank || '').toLowerCase();
-      if (rank && rank !== 'metic' && rank !== 'archon') {
-        return res.fail('rank_forbidden', 403, { required: ['metic', 'archon'], actual: rank, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
+      // FAIL CLOSED (task 1003197 (D)). This was inline and read
+      // `if (rank && rank !== 'metic' && …)`, so an ABSENT rank ADMITTED. The
+      // predicate now sits with the one trusted-tier definition (routing.js), pure
+      // and denying by default. Still a rank test rather than
+      // requirePermission('idea.triage'): the gate is conditional on the request
+      // BODY, and requirePermission is route-level middleware that cannot be mounted
+      // per-payload — which is why that atom's catalog `guards` note names only
+      // PATCH /inbox/:id. Same audience either way; idea.triage floors at metic.
+      if (!mayProposeCriterion(req.builder?.rank)) {
+        return res.fail('rank_forbidden', 403, { required: [...METIC_PLUS], actual: req.builder?.rank ?? null, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
       }
     }
     // Full Idea capture (task 1002919 / BV1.R143). Only 'full' means anything

package/modules/ideas/routing.js

@@ -49,6 +49,25 @@ const NEVER_ROUTE_KINDS = new Set(['criterion-proposal', 'decision']);
 // separate, load-bearing gates (R05), and this decision is subordinate to both.
 const METIC_PLUS = new Set(['metic', 'archon']);
 
+// Who may FILE a kind='criterion-proposal' (V3.R87 / #306) — the same trusted tier,
+// read from the one definition above rather than a second copy. A proposal reshapes
+// the next version's scope-truth, so it is a trusted write even though ordinary
+// filing is open to everyone; POST /inbox asks this so a Xenos cannot slip one in by
+// raw curl after the /planning-session skill refuses to run for them.
+//
+// FAIL-CLOSED (task 1003197 (D)). The route held this inline as
+// `if (rank && rank !== 'metic' && …)`, so an ABSENT rank ADMITTED. Unreachable
+// today — builders.rank is NOT NULL behind an enum CHECK and requireBuilder 401s
+// first — but the gate was leaning on a schema invariant it never stated, and an
+// unknown rank is not evidence of authority. Case-insensitive but NOT trimmed:
+// 'METIC ' is a hostile shape, not a rank. Non-strings stringify and refuse rather
+// than throwing on .toLowerCase(). Lives here beside NEVER_ROUTE_KINDS, which
+// already names this same kind, and keeps the trusted tier spelled ONCE
+// (tests/filing_abuse_matrix.mjs holds both lines).
+function mayProposeCriterion(rank) {
+  return METIC_PLUS.has(String(rank ?? '').toLowerCase());
+}
+
 // A Full Idea (grade='full') is the Board Room's subject — it is ratified by
 // peers (goal 1000069), not converted into a task by its own filer. 'spark' and
 // 'quick' carry no such meaning and route normally.
@@ -292,4 +311,5 @@ module.exports = {
   NEVER_ROUTE_KINDS,
   HOMELESS_ROUTING_VECTORS,
   METIC_PLUS,
+  mayProposeCriterion,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.644",
+  "version": "1.19.645",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.644",
+      "version": "1.19.645",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.644",
+  "version": "1.19.645",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth.js

@@ -117,10 +117,15 @@ async function resolveSession(req) {
 //
 // A SESSION-SCOPE CAN ONLY EVER NARROW. Effective authority is (what the builder's
 // roles confer) ∩ (what this session's scope allows), with the allow-list
-// DENY-BY-DEFAULT. The intersection itself lives in the governance resolver
-// (resolveSessionPermissions — the composed answer the tab and permission gates
-// read); THIS file carries its route-reachability projection: "is this route
-// inside the session's scope at all". That projection is deliberately the ROLE-FREE
+// DENY-BY-DEFAULT. The governance resolver COMPOSES that intersection
+// (resolveSessionPermissions), but nothing on the request path reads it — it is
+// exported on the `government` port and exercised by
+// tests/government_session_scope.mjs, and that is the whole of its live use. The
+// ENFORCEMENT is the kernel's own route-reachability projection below: "is this
+// route inside the session's scope at all", run by requireBuilder and by
+// runPageGate. This comment used to say the permission gates read the resolver's
+// composed answer; they never have, and the next reviewer should not lose an hour
+// to that ghost (task 1003197 (B)). The projection is deliberately the ROLE-FREE
 // half — folding the builder's roles in here would change who can reach the
 // bootstrap routes (a builder on a rank with no seeded governance role resolves to
 // zero permissions by design — see tests/government_parity.mjs Part D), and R99 is
@@ -352,11 +357,15 @@ function signInWithReturn(req) {
 // unauthorized request is bounced before the file is ever served (curl-proof,
 // JS-disabled-proof). The client-side link-hiding in the hall is cosmetic UX.
 //
-// Each gate asks TWO questions, in order:
+// Each gate asks THREE questions, in order:
 //   1. IDENTITY  — is there a live session? (token from the gds_session cookie /
 //      legacy pms_session / Bearer, looked up fresh against builder_sessions).
 //      No → 302 into the web sign-in flow.
-//   2. AUTHORITY — does the builder HOLD the page's catalog permission, resolved
+//   2. SCOPE     — is a page inside this SESSION's scope at all? A narrowing scope
+//      (a box-baked token) reaches no page, whatever its builder's rank, exactly as
+//      requireBuilder denies it every route that declared nothing (task 1003197).
+//      No → 302 into the web sign-in flow: the remedy is a different session.
+//   3. AUTHORITY — does the builder HOLD the page's catalog permission, resolved
 //      per request through the `governance` port exactly as requirePermission
 //      does? No → 302 to an UNGATED hall page.
 //
@@ -504,6 +513,24 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
+  // SECURITY (task 1003197 (A)): SESSION-SCOPE, the same deny-by-default check
+  // requireBuilder runs above — the two auth paths must not diverge. resolveSession
+  // accepts a Bearer token with NO source filter, so before this a box-baked token
+  // could fetch a gated page SHELL (/builders, /watch, the tab shells) whenever its
+  // builder's rank held the page's permission. Every data endpoint underneath
+  // re-gates through requireBuilder and 403s box_scope, so the exposure was shells
+  // only — but a shell is still a surface a token living outside the ADR 0016 trust
+  // boundary was never meant to reach. Page routes declare no capability, so
+  // scopeCovers refuses EVERY narrowing scope here (and an unrecognised source with
+  // it), while an unscoped cli/web session passes untouched.
+  //
+  // Sign-in, not `deniedTo`: unlike the authority branch below, the remedy is a
+  // DIFFERENT SESSION — /builder-reauth mints a normal one — not a different page,
+  // and a box session has no browser cookie to loop the sign-in flow with.
+  if (!scopeCovers(sessionScopeFor(session.source), req.sessionScopeNeeds)) {
+    res.redirect(302, signInWithReturn(req));
+    return;
+  }
   const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
     // The rank door said no. A page whose data route admits a SECOND audience
@@ -759,6 +786,32 @@ function requirePermission(...perms) {
     const builderId = req.builder && req.builder.id;
     if (!builderId) return deny(null);
     if (required.length === 0) return deny(null);
+    // R100 (task 1003197 (C)): an ownership-scoped key has NO unconditional answer.
+    // It is parameterized by a concrete row this gate was never handed, so admitting
+    // on `held.has(key)` would collapse `.own` into `.any` — precisely the
+    // degradation the ownership axis exists to prevent. The resolver's
+    // builderHasPermissions refuses these for the same reason (resolver.js); mirror
+    // it so the kernel gate can never be the softer of the two doors. ZERO call
+    // sites pass an own-scoped key today (full enumeration, task 1003197) — this
+    // guards the future mis-authored gate that would otherwise be silently
+    // unconditional. The route wants authorizeOwned() in its handler, which cannot
+    // be called without naming the owner. LOUD, because this is a wiring bug in the
+    // route, not a fact about the caller.
+    const governance = seams.resolveOptional('government');
+    if (governance && typeof governance.isOwnershipScoped === 'function') {
+      const owned = required.filter((key) => {
+        try { return governance.isOwnershipScoped(key); } catch { return false; }
+      });
+      if (owned.length > 0) {
+        require('./logger').logger.child({ src: 'auth' })
+          .error({ keys: owned }, 'requirePermission: an ownership-scoped key cannot gate a route unconditionally — the handler must call authorizeOwned() with the row\'s owner');
+        return res.fail('permission_forbidden', {
+          status: 403,
+          message: `this route is gated on ownership-scoped permission${owned.length === 1 ? '' : 's'} ${owned.join(', ')}, which cannot be answered without a resource owner — denied fail-closed`,
+          details: { required, held: null, floors: null },
+        });
+      }
+    }
     // Shared with the page gates (R107): null = authority could not be established
     // (no port / malformed port / a throwing resolver) and is always a denial.
     // req.rawPermissionKeys rides the fold (task 1002556) when the session query

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.644'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.645'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -99,6 +99,64 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
+// ---- SESSION-SCOPE on the page path (task 1003197 (A)) ----------------------
+//
+// resolveSession accepts a Bearer token with no source filter, so before this the
+// page gate never asked the question requireBuilder asks: is a page inside this
+// SESSION's scope at all? A box-baked token (which lives on the box, outside the
+// ADR 0016 trust boundary) could therefore fetch a gated page SHELL whenever its
+// builder's rank held the page permission. The stub above resolves the permission
+// for EVERY builder, which is what makes these assertions about scope alone.
+
+console.log('\nrequireBuilderPage — session scope:');
+
+await t('box-scoped session → 302 to sign-in even though its builder holds the permission', async () => {
+  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'archon', status: 'active', source: 'box' };
+  lookupThrows = false;
+  const req = { headers: { authorization: 'Bearer boxtoken' } }; // a page route declares no scope
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'a box session must not be served a gated page shell');
+  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+    'the remedy is a different session (/builder-reauth), so sign-in — not deniedTo');
+});
+
+await t('a source the registry does not declare → denied, never treated as unscoped', async () => {
+  nextSession = { builder_id: 4, github_login: 'mystery', rank: 'archon', status: 'active', source: 'not-a-scope' };
+  const req = { headers: { authorization: 'Bearer whoknows' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'an unrecognised scope must fail closed, exactly as requireBuilder does');
+  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start');
+});
+
+await t('cli and web sessions are untouched by the scope check', async () => {
+  for (const source of ['cli', 'web']) {
+    nextSession = { builder_id: 1, github_login: 'someone', rank: 'xenos', status: 'active', source };
+    const req = { headers: { cookie: 'gds_session=validtoken' } };
+    const res = fakeRes();
+    let nexted = false;
+    await auth.requireBuilderPage(req, res, () => { nexted = true; });
+    assert.equal(nexted, true, `an unscoped ${source} session must still reach the page`);
+    assert.equal(res._redirect, null);
+  }
+});
+
+await t('a legacy session with no source field still reaches the page', async () => {
+  // The same invariant tests/box_scope_session.mjs pins for requireBuilder: absent
+  // source resolves to the UNSCOPED scope, so this gate can never lock out a real
+  // browser session minted before `source` was recorded.
+  nextSession = { builder_id: 2, github_login: 'legacy', rank: 'metic', status: 'active' };
+  const req = { headers: { cookie: 'gds_session=validtoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'absent source must never trip the page scope gate');
+  assert.equal(res._redirect, null);
+});
+
 seams._reset(); // leave the seam registry as we found it (the governance_* suites' pattern)
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/filing_abuse_matrix.mjs

@@ -36,6 +36,7 @@
 //   F17 get a keyword-guessed 'bug' from #ideas to mint work   → cannot: vector not trusted
 //   F18 forge/omit the vector to reach the homeless-bug door   → fail-closed, an inbox row
 //   F19 file a homeless NON-bug hoping for a free home         → inbox; only bugs get one
+//   F20 file a criterion-proposal with no/blank/padded rank    → refused, fail-closed
 //   P1  a Metic+ files a bug in an ordinary goal               → 'ready' (the C1 grant)
 //   P2  a Metic+ files into protected scope                    → allowed, floored to metic
 //   P3  a Metic+ files a HOMELESS bug from a trusted vector    → 'ready', in the maintenance goal
@@ -76,7 +77,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
 
 const routing = require('../modules/ideas/routing.js');
-const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR } = routing;
+const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR, mayProposeCriterion } = routing;
 const bugs = require('../modules/discord/discord-bugs.js');
 const { rateLimitPerHour } = bugs;
 const { scopeIncludesProtected, isModuleKey } = require('../src/bongos/module-scope-map.js');
@@ -477,6 +478,57 @@ await test('[pin] no OTHER module file mints a task from a filing without a row
     `a new filing vector must be added to KNOWN_FILING_VECTORS and given a matrix row: ${unaudited.join(', ')}`);
 });
 
+// =========================================================================
+// F20 — the criterion-proposal door (task 1003197 (D))
+// =========================================================================
+//
+// Filing is open to everyone, but kind='criterion-proposal' reshapes the next
+// version's scope-truth, so POST /inbox holds a Metic+ door in front of it. That
+// door was written `if (rank && rank !== 'metic' && …)`: an ABSENT rank walked
+// straight through. Unreachable today (builders.rank is NOT NULL behind an enum
+// CHECK, and requireBuilder 401s first) — but it was a gate leaning on a schema
+// invariant it never stated, which is the same shape as every "unreachable" bug
+// that later became reachable. The predicate is now pure and denies by default.
+
+await test('[F20] the criterion-proposal door refuses every sub-Metic shape, absent rank included', () => {
+  for (const rank of SUB_METIC) {
+    assert.equal(mayProposeCriterion(rank), false,
+      `rank ${JSON.stringify(rank)} must not be able to file a criterion proposal`);
+  }
+  // Named explicitly, because these three are the bug: they are the shapes the old
+  // `rank &&` guard ADMITTED, and a list-driven loop can lose a case silently.
+  for (const falsy of [null, undefined, '']) {
+    assert.equal(mayProposeCriterion(falsy), false,
+      'an unknown rank is not evidence of authority — the gate must fail CLOSED');
+  }
+});
+
+await test('[F20] it still admits Metic and Archon, in any casing', () => {
+  for (const rank of TRUSTED) {
+    assert.equal(mayProposeCriterion(rank), true,
+      `${JSON.stringify(rank)} is a trusted filer and must keep the door`);
+  }
+});
+
+await test('[F20] a padded rank is a hostile shape, not a rank — no trimming', () => {
+  // 'METIC ' appears in SUB_METIC on purpose. Trimming would WIDEN the audience,
+  // so the predicate lowercases and nothing else.
+  for (const padded of ['metic ', ' metic', 'archon ', '\tarchon']) {
+    assert.equal(mayProposeCriterion(padded), false);
+  }
+});
+
+await test('[F20] the route reads the domain predicate — no second copy of the door', () => {
+  const routeSrc = read('modules/ideas/routes/inbox.js');
+  const code = routeSrc.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.match(code, /mayProposeCriterion\(req\.builder\?\.rank\)/,
+    'the route must ask routing.js, so the fail-closed posture cannot drift');
+  assert.match(code, /require\('\.\.\/routing'\)/,
+    'and reach it by import, never by re-spelling the tier');
+  assert.ok(!/rank\s*&&\s*rank\s*!==/.test(code),
+    'the admits-on-falsy guard must not come back');
+});
+
 await test('[pin] there is ONE trusted-tier definition, and #bugs no longer keeps a copy', () => {
   // This pin used to assert that two spellings of "Metic+" AGREED — routing.js and
   // discord-bugs.js each carried one. R11 deleted the second, which is the better

package/tests/government_require_permission.mjs

@@ -403,3 +403,106 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     'a modules/*/routes gate still calls requireRank — migrate it to requirePermission, ' +
     'or add it to RETAINED with a "Still requireRank after BV1.R105" note explaining why');
 });
+
+// ---------------------------------------------------------------------------
+// the OWNERSHIP axis cannot gate a route (task 1003197 (C))
+// ---------------------------------------------------------------------------
+//
+// `held.has('box.manage.own')` is true for anyone whose rank carries the atom, so a
+// gate mounted on an ownership-scoped key would admit UNCONDITIONALLY — `.own`
+// collapsed into `.any`, the exact degradation the axis exists to prevent, because
+// the gate is never handed the row whose owner is the other half of the question.
+// The resolver's builderHasPermissions refuses these already; the kernel gate must
+// not be the softer door. Zero call sites pass one today — this is the guard on the
+// future mis-authored gate.
+//
+// `run` above stubs a port with resolveBuilderPermissions ONLY, so this needs its
+// own runner that also stubs isOwnershipScoped (the live port always carries it).
+async function runOwned(gate, req, { resolve, isOwnershipScoped }) {
+  seams._reset();
+  seams.registerProvider('government', { resolveBuilderPermissions: resolve, isOwnershipScoped });
+  const res = fakeRes();
+  let nexted = false;
+  await gate(req, res, () => { nexted = true; });
+  seams._reset();
+  return { res, nexted };
+}
+
+const OWNED_KEY = catalog.permissionKeys().find((k) => catalog.isOwnershipScoped(k));
+
+test('the catalog still declares at least one ownership-scoped key', () => {
+  // If the axis were ever emptied, the assertions below would pass vacuously.
+  assert.ok(OWNED_KEY, 'expected an ownership-scoped atom in the catalog (e.g. box.manage.own)');
+});
+
+test('an ownership-scoped key 403s even when the builder HOLDS it', async () => {
+  const { res, nexted } = await runOwned(
+    auth.requirePermission(OWNED_KEY), { builder: BUILDER },
+    { resolve: holding(OWNED_KEY), isOwnershipScoped: catalog.isOwnershipScoped },
+  );
+  assert.equal(nexted, false, 'holding an own-scoped atom is not an unconditional admit');
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.code, 'permission_forbidden');
+  assert.match(res._json.error.message, /ownership-scoped/,
+    'the denial must name the reason — a route wiring bug, not a missing grant');
+  assert.equal(res._json.error.details.held, null,
+    'never echo the held set on this branch: the denial is about the gate, not the caller');
+});
+
+test('one own-scoped key in a multi-key gate poisons the whole gate', async () => {
+  const { res, nexted } = await runOwned(
+    auth.requirePermission('idea.triage', OWNED_KEY), { builder: BUILDER },
+    { resolve: holding('idea.triage', OWNED_KEY), isOwnershipScoped: catalog.isOwnershipScoped },
+  );
+  assert.equal(nexted, false, 'the gate must refuse as a whole — a partial answer is not an answer');
+  assert.equal(res._status, 403);
+});
+
+test('an ordinary key still passes with isOwnershipScoped present on the port', async () => {
+  // The guard must be inert for every real gate in the tree.
+  const { res, nexted } = await runOwned(
+    auth.requirePermission('idea.triage'), { builder: BUILDER },
+    { resolve: holding('idea.triage'), isOwnershipScoped: catalog.isOwnershipScoped },
+  );
+  assert.equal(nexted, true);
+  assert.equal(res._status, null);
+});
+
+test('a throwing isOwnershipScoped does not admit and does not crash the gate', async () => {
+  // Fall through to the ordinary held check rather than 500 — but a key the caller
+  // does not hold must still deny, so the outcome is never an admit-by-error.
+  const { res, nexted } = await runOwned(
+    auth.requirePermission('government.manage'), { builder: BUILDER },
+    { resolve: holding('idea.triage'), isOwnershipScoped: () => { throw new Error('catalog blew up'); } },
+  );
+  assert.equal(nexted, false);
+  assert.equal(res._status, 403);
+});
+
+test('no route in the tree is gated on an ownership-scoped key today', () => {
+  // The enumeration the fix was written against, kept honest. A new gate mounted on
+  // an own-scoped atom would now 403 at runtime; this fails at BUILD time instead,
+  // naming the file, so nobody ships a route that can only ever deny.
+  const owned = catalog.permissionKeys().filter((k) => catalog.isOwnershipScoped(k));
+  const dirs = [path.join(ROOT, 'src', 'bongos', 'routes'), path.join(ROOT, 'modules')];
+  const offenders = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) { if (entry.name !== 'node_modules') walk(full); continue; }
+      if (!entry.name.endsWith('.js')) continue;
+      const text = fs.readFileSync(full, 'utf8');
+      for (const key of owned) {
+        // A gate is a call: requirePermission('<key>'), in any of its spellings.
+        if (new RegExp(`requirePermission\\s*\\([^)]*['"\`]${key.replace(/\./g, '\\.')}['"\`]`).test(text)) {
+          offenders.push(`${path.relative(ROOT, full)} :: ${key}`);
+        }
+      }
+    }
+  };
+  dirs.forEach(walk);
+  assert.deepEqual(offenders, [],
+    'requirePermission cannot answer an ownership-scoped key — the handler must call ' +
+    'authorizeOwned() with the row\'s owner instead');
+});