@bongos/core 1.21.176 → 1.21.178

package/scripts/security/dep-audit.js

@@ -1,41 +1,33 @@
 #!/usr/bin/env node
-// Dependency vulnerability scan — single source of truth for both CI and the
-// droplet nightly cron (V3.R37 / #258).
+// Dependency vulnerability scan — single source of truth for the CLI and the
+// server's daily check (V3.R37 / #258; in-process since task 1004878).
 //
-// Two scans are run, in order:
-//   1. `npm audit --audit-level=high --json` against the root package.json.
-//   2. `python3 -m pip_audit -r art/pipeline/requirements.txt --format json`.
+// One scan: `npm audit --audit-level=high --json` against the root package.json.
+// (A second scan, pip-audit over art/pipeline/requirements.txt, went with the art
+// pipeline it audited — task 1004860 deleted that pipeline, task 1004878 the scan.)
 //
-// The script parses both outputs and emits ONE deterministic JSON report on
-// stdout containing every high/critical finding. A short, builder-readable
-// summary goes to stderr so a CI log is skim-able.
+// The script parses the output and emits ONE deterministic JSON report on stdout
+// containing every high/critical finding. A short, builder-readable summary goes
+// to stderr so a log is skim-able.
 //
 // Two modes:
 //
-//   --report-mode=ci         (default; used by .github/workflows/dep-audit.yml)
-//                            exit 1 if ANY finding is high or critical.
-//                            exit 0 if both scans clean.
+//   --report-mode=ci         (default) exit 1 if ANY finding is high or critical,
+//                            exit 0 if the scan is clean, exit 2 if npm is missing.
 //
-//   --report-mode=nightly    (used by .claude/scheduled-tasks/dep-audit-nightly)
-//                            ALWAYS exit 0 — a nightly cron must not block the
-//                            droplet's other routines. The skill consumes the
-//                            JSON, posts to the team chat-inbox, and creates a
-//                            vulnerability_report row in the Archon security
-//                            view via src/bongos/security.js.
+//   --report-mode=nightly    ALWAYS exit 0 — the report is the product.
 //
-// Tool resolution:
-//   - npm is required (CI image has it; droplet has it).
-//   - pip-audit is resolved as `python3 -m pip_audit` (works whether installed
-//     via pip, pipx, or pip --user — module form is the most portable).
-//     If neither is found, the script reports `tool_missing: pip-audit` and the
-//     mode decides whether to fail.
+// WHERE IT RUNS ON A SCHEDULE. Nowhere through this CLI: the always-on server runs
+// the same scan daily in-process (modules/autonomy/pollers/daily-checks.js), with an
+// ASYNC spawn — spawnSync here would freeze every request for the whole scan — and
+// hands the output to parseNpmAudit below, so the two cannot disagree about what a
+// finding is.
 //
 // Output schema (stdout, always valid JSON, even on failure):
 //   {
 //     "ran_at": "<ISO timestamp>",
 //     "mode": "ci" | "nightly",
 //     "npm": { "ok": true|false, "tool_missing": false|true, "findings": [...] },
-//     "pip": { "ok": true|false, "tool_missing": false|true, "findings": [...] },
 //     "high_or_critical_count": <int>,
 //     "exit_code": <int>
 //   }
@@ -46,10 +38,8 @@
 
 const { spawnSync } = require('node:child_process');
 const path = require('node:path');
-const fs = require('node:fs');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const PIP_REQUIREMENTS = path.join(REPO_ROOT, 'art', 'pipeline', 'requirements.txt');
 
 // CLI args ----------------------------------------------------------------
 
@@ -77,33 +67,47 @@ function printHelp() {
 
 // npm audit ---------------------------------------------------------------
 
-// npm audit emits a JSON document. `--audit-level=high` controls the EXIT CODE
-// only — the JSON still contains every level. We parse the full set, then we
-// filter to high+critical ourselves so the threshold is consistent across both
-// scanners.
-function runNpmAudit() {
-  const res = spawnSync('npm', ['audit', '--audit-level=high', '--json'], {
-    cwd: REPO_ROOT,
+// The npm invocation, shared with the server's async spawn. `--audit-level=high`
+// controls the EXIT CODE only — the JSON still contains every level, and
+// extractNpmFindings filters to high+critical itself.
+const NPM_AUDIT_ARGS = ['audit', '--audit-level=high', '--json'];
+
+function runNpmAudit({ cwd = REPO_ROOT } = {}) {
+  const res = spawnSync('npm', NPM_AUDIT_ARGS, {
+    cwd,
     encoding: 'utf8',
     maxBuffer: 32 * 1024 * 1024,
   });
-  // npm audit exits 1 when findings >= the threshold, 0 otherwise. Both cases
-  // still produce JSON on stdout. We don't trust the exit code; we read the
-  // JSON and decide for ourselves.
   if (res.error) {
     return { ok: false, tool_missing: true, findings: [], raw_error: String(res.error.message || res.error) };
   }
+  return parseNpmAudit(res.stdout, res.stderr);
+}
+
+// parseNpmAudit — npm audit's raw output → { ok, tool_missing, findings }. Pure.
+// npm audit exits 1 when findings >= the threshold, 0 otherwise, and both cases
+// still produce JSON on stdout — so the exit code is never read; the JSON decides.
+function parseNpmAudit(stdout, stderr = '') {
   let parsed;
   try {
-    parsed = JSON.parse(res.stdout || '{}');
+    parsed = JSON.parse(stdout || '{}');
   } catch (e) {
     return {
       ok: false, tool_missing: false, findings: [],
-      raw_error: `npm audit JSON parse failed: ${e.message}; stderr=${res.stderr.slice(0, 500)}`,
+      raw_error: `npm audit JSON parse failed: ${e.message}; stderr=${String(stderr || '').slice(0, 500)}`,
     };
   }
-  const findings = extractNpmFindings(parsed);
-  return { ok: true, tool_missing: false, findings };
+  // npm reports its own failures (no lockfile, registry unreachable) as JSON with
+  // an `error` object and no vulnerabilities. That is "could not audit", never a
+  // clean bill of health.
+  if (parsed && parsed.error && !parsed.vulnerabilities) {
+    const e = parsed.error;
+    return {
+      ok: false, tool_missing: false, findings: [],
+      raw_error: `npm audit failed: ${(e && (e.summary || e.code)) || 'unknown error'}`,
+    };
+  }
+  return { ok: true, tool_missing: false, findings: extractNpmFindings(parsed) };
 }
 
 // npm audit v7+ JSON shape: `vulnerabilities` is an object keyed by package
@@ -143,81 +147,6 @@ function extractNpmFindings(parsed) {
   return out;
 }
 
-// pip-audit ---------------------------------------------------------------
-
-function runPipAudit() {
-  if (!fs.existsSync(PIP_REQUIREMENTS)) {
-    return {
-      ok: false, tool_missing: false, findings: [],
-      raw_error: `requirements file not found: ${PIP_REQUIREMENTS}`,
-    };
-  }
-  const res = spawnSync('python3', [
-    '-m', 'pip_audit',
-    '-r', PIP_REQUIREMENTS,
-    '--format', 'json',
-    '--vulnerability-service', 'pypi',
-  ], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8',
-    maxBuffer: 32 * 1024 * 1024,
-  });
-  if (res.error) {
-    return { ok: false, tool_missing: true, findings: [], raw_error: String(res.error.message || res.error) };
-  }
-  if (res.status !== 0 && res.status !== 1) {
-    // pip-audit exits 0 on clean, 1 on findings. Anything else (missing module,
-    // bad requirements file) is a tool problem.
-    const stderr = (res.stderr || '').slice(0, 1000);
-    const missing = /No module named ['"]?pip_audit/.test(stderr);
-    return {
-      ok: false, tool_missing: missing, findings: [],
-      raw_error: `pip-audit exit=${res.status}; stderr=${stderr}`,
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(res.stdout || '{}');
-  } catch (e) {
-    return {
-      ok: false, tool_missing: false, findings: [],
-      raw_error: `pip-audit JSON parse failed: ${e.message}; stderr=${res.stderr.slice(0, 500)}`,
-    };
-  }
-  const findings = extractPipFindings(parsed);
-  return { ok: true, tool_missing: false, findings };
-}
-
-// pip-audit JSON shape: { "dependencies": [ { "name", "version",
-// "vulns": [ { "id", "fix_versions": [], "description", "aliases": [] } ] } ] }
-// pip-audit does NOT classify severity itself — PyPI/OSV advisories carry it
-// in `aliases` (CVE IDs) plus a `description` field. To stay conservative, we
-// treat EVERY pip-audit finding as high — by the time PyPI's advisory DB has
-// picked it up, the project's posture is "fix or document." This is the same
-// stance the GitHub `pip-audit-action` takes by default.
-function extractPipFindings(parsed) {
-  const out = [];
-  const deps = (parsed && parsed.dependencies) || [];
-  for (const dep of deps) {
-    const vulns = Array.isArray(dep.vulns) ? dep.vulns : [];
-    for (const v of vulns) {
-      out.push({
-        ecosystem: 'pypi',
-        package: dep.name,
-        version: dep.version,
-        severity: 'high', // see note above
-        id: v.id || (Array.isArray(v.aliases) && v.aliases[0]) || null,
-        summary: (v.description || '').split('\n')[0].slice(0, 240) || `${dep.name} ${dep.version}: ${v.id}`,
-        fix: Array.isArray(v.fix_versions) && v.fix_versions.length
-          ? `upgrade to ${v.fix_versions.join(' / ')}`
-          : 'no fix available',
-        url: v.id ? `https://osv.dev/vulnerability/${v.id}` : null,
-      });
-    }
-  }
-  return out;
-}
-
 // Main --------------------------------------------------------------------
 
 function main() {
@@ -226,14 +155,13 @@ function main() {
 
   const ranAt = new Date().toISOString();
   const npm = runNpmAudit();
-  const pip = runPipAudit();
 
-  const allFindings = [...npm.findings, ...pip.findings];
+  const allFindings = npm.findings;
   const highCount = allFindings.filter(f => f.severity === 'high' || f.severity === 'critical').length;
 
   // CI mode: a tool being entirely missing in a CI environment is a build
   // problem, not a security problem — fail loudly so we don't ship blind.
-  const toolProblem = (npm.tool_missing || pip.tool_missing) && args.mode === 'ci';
+  const toolProblem = npm.tool_missing && args.mode === 'ci';
 
   let exitCode = 0;
   if (toolProblem) exitCode = 2;
@@ -244,7 +172,6 @@ function main() {
     ran_at: ranAt,
     mode: args.mode,
     npm,
-    pip,
     high_or_critical_count: highCount,
     findings: allFindings,
     exit_code: exitCode,
@@ -253,8 +180,7 @@ function main() {
   // Human summary to stderr.
   const lines = [];
   lines.push(`dep-audit [${args.mode}] @ ${ranAt}`);
-  lines.push(`  npm:       ${npm.tool_missing ? 'TOOL MISSING' : (npm.ok ? `${npm.findings.length} high/critical` : `ERROR — ${npm.raw_error}`)}`);
-  lines.push(`  pip-audit: ${pip.tool_missing ? 'TOOL MISSING' : (pip.ok ? `${pip.findings.length} high/critical` : `ERROR — ${pip.raw_error}`)}`);
+  lines.push(`  npm: ${npm.tool_missing ? 'TOOL MISSING' : (npm.ok ? `${npm.findings.length} high/critical` : `ERROR — ${npm.raw_error}`)}`);
   if (allFindings.length) {
     lines.push(`  findings:`);
     for (const f of allFindings) {
@@ -271,6 +197,6 @@ function main() {
 
 if (require.main === module) main();
 
-// Exported for unit testing / for the nightly skill if it ever wants to drive
-// the scan in-process instead of via spawn.
-module.exports = { runNpmAudit, runPipAudit, extractNpmFindings, extractPipFindings };
+// Exported for unit testing and for the server's in-process daily check, which
+// spawns NPM_AUDIT_ARGS itself (asynchronously) and parses with parseNpmAudit.
+module.exports = { runNpmAudit, parseNpmAudit, extractNpmFindings, NPM_AUDIT_ARGS };

package/src/bongos/module-scope-map.js

@@ -93,7 +93,7 @@ const MODULE_GLOBS = {
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
-  // version/goal/done-when/dependency/gate-approvals routes + the db slice, the
+  // version/goal/done-when/dependency routes + the db slice, the
   // task-classifier + hierarchy + done-when libs, github-push + ship-card +
   // ship-preflight + merge-lock + conflict-resolve + publish-reconciler +
   // version-close, and the `lifecycle` kernel PORT — all under the
@@ -115,7 +115,7 @@ const MODULE_GLOBS = {
     'scripts/bongos/ship-regen.js', 'scripts/bongos/ship-resume.js', 'scripts/bongos/ship-session-upload.js',
     'scripts/bongos/ship-state.js', 'scripts/bongos/ship-surprise.js', 'scripts/bongos/ship-visual.js',
     'scripts/bongos/merge-mode.js', 'scripts/bongos/confirm.js', 'scripts/bongos/main-audit.js',
-    'scripts/bongos/gate-review.js', 'scripts/bongos/push-main.js', 'scripts/bongos/ci-grade.js',
+    'scripts/bongos/hard-floor.js', 'scripts/bongos/push-main.js',
     'scripts/bongos/merge-lock.js', 'scripts/bongos/version-close.js',
     'migrations/',
   

package/src/bongos/permission-path-check.js

@@ -43,7 +43,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // modules/government/protected-surfaces.json — no longer a constant baked into
 // this file. Re-mapping a floor there is a POLICY edit. It cannot move
 // enforcement into the app: the three layers above (git pre-push hook, grader
-// pre-pass, post-push main audit) plus gate-review.js and the goal-scope check
+// pre-pass, post-push main audit) plus the goal-scope check
 // read the registry out of band — no DB, no server, no HTTP — and remain the
 // authority (ADR 0043). Making the request path the enforcer is the exact
 // regression this task exists to prevent.

package/src/bongos/route-rank-check.js

@@ -220,7 +220,7 @@ const EXPECTED_RANKS = {
   'GET /builders/directory': 'any-builder',
   // (the lifecycle fleet pins — task authoring/promotion/abandonment, override
   //  adjudication, polymorphic dependency edges, goal tier + ask-to-widen,
-  //  criterion confirmation, and gate-approvals — moved to MODULE_EXPECTED_RANKS
+  //  and criterion confirmation — moved to MODULE_EXPECTED_RANKS
   //  ['lifecycle'] below in BV1.R86. They live in the lifecycle module now
   //  (modules/lifecycle/routes/…), so they're verified only when that module is in
   //  scope, not unconditionally from this core list — the pins follow the routes.)
@@ -500,13 +500,6 @@ const MODULE_EXPECTED_RANKS = {
     'POST /done-when/:criterionId/uat/recording': 'perm:criterion.review',
     'POST /done-when/:criterionId/uat': 'perm:criterion.review',
     'PUT /done-when/:criterionId/backend-only': 'perm:criterion.create',
-    // gate-surface PR approval from the hall (task 1179, ADR 0058 amendment). ADR 0157
-    // SPLIT these two: the list route is `gate_approval.read` (metic — the Gate page
-    // opens to the working rank), while APPROVING still clears the gate-review hard
-    // floor and stays `gate_approval.decide` (archon, system). The split is the reason
-    // the page is usable at all — see the atom's note in catalog.js.
-    'GET /gate-approvals': 'perm:gate_approval.read',
-    'POST /gate-approvals/:pr/approve': 'perm:gate_approval.decide',
   },
   // Ratifying a criterion proposal WRITES scope-truth (it creates a done-when
   // criterion). Metic+ may file the proposal; ADR 0157 also lets Metic ratify it

package/src/bongos/routes.js

@@ -31,7 +31,7 @@ const buildMySessionsRouter = require('./routes/my-sessions');
 const buildMyPasskeysRouter = require('./routes/my-passkeys');
 const buildBuildersRouter = require('./routes/builders');
 // The LIFECYCLE routes (tasks · claims · versions · done-when · goals ·
-// dependencies · gate-approvals · analytics) carved into modules/lifecycle/
+// dependencies · analytics) carved into modules/lifecycle/
 // (BV1.R86 / ADR 0093 §1,§3); moduleLoader.mountModuleRoutes (below) mounts them
 // via the lifecycle module's route factories — no core require. The `/tasks/:id/
 // publish-branch` body-parser bypass below STAYS (the route carries its own larger
@@ -187,7 +187,6 @@ function buildGdsRouter() {
   // and discord (with its bug-attachments route) have both graduated
   // into real modules (modules/<key>/) — they are discovered + mounted by
   // moduleLoader.mountModuleRoutes below, not here (BV1.R43 / R48 / R47 / R72).
-  // gate-approvals likewise moved to the lifecycle module (BV1.R86).
   router.use(buildLlmCacheRouter());
 
   // Loader-mounted module routers (ADR 0083 / BV1.R41). Discovers + mounts every

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.176'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.178'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/modules.js

@@ -44,7 +44,7 @@ const INSTANCE_PATH = path.join(resolveInstanceRoot(), 'config', 'modules.json')
 //
 // CORE (always on, never a module): auth, builders, tasks, claims, versions,
 // done-when, credits/cost, inbox, blockers, leaderboard, analytics,
-// audit-log, security, access-requests, sessions, gate-approvals, healthz,
+// audit-log, security, access-requests, sessions, healthz,
 // public. These mount unconditionally. The optional feature modules AND the
 // first TWO carved CORE-domain modules have graduated to modules/<key>/ (discord
 // BV1.R47, art-pipeline BV1.R48, game BV1.R49, memory BV1.R72 —

package/tests/acclaim_feed_evidence_db.mjs

@@ -16,21 +16,22 @@
 //   - a ship with several cost rows must sum them, not pick one;
 //   - the two LATERALs and the grades join must not multiply the row out.
 //
-// Runs the route's own query text — sliced out of the shipped source, never
-// retyped — so a future edit to the route is tested rather than a copy of it.
+// Calls the REAL route handler (GET /tasks/peer-votes/feed from the lifecycle
+// router) against the database, so a future edit to the route is tested rather
+// than a copy of it. It used to slice the query text out of the route's source and
+// re-interpolate it by hand; the route grew a second interpolation (the helper
+// join), the copy stopped resolving, and the test failed on its own scaffolding
+// rather than on the route (task 1004863). Driving the handler cannot drift that way.
 // Self-skips without a reachable Postgres; in the INTEGRATION set, so the
 // DB-free unit gate never runs it and .github/workflows/integration.yml does.
 //
 // Run:  DATABASE_URL=... node tests/acclaim_feed_evidence_db.mjs
 import { createRequire } from 'node:module';
 import { strict as assert } from 'node:assert';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { insertTestBuilders } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 try {
@@ -41,18 +42,30 @@ try {
   process.exit(0);
 }
 
-// The query under test, taken from the shipped route. gradeQualityWhere is
-// interpolated by the route at call time, so interpolate it the same way.
-const { gradeQualityWhere } = require('../modules/lifecycle/db-shared.js');
-const routeSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
-const start = routeSrc.indexOf('`SELECT t.id, t.title, t.value_summary, t.version_id, t.status,');
-assert.ok(start > 0, 'the peer-votes feed query is still where this test slices it from');
-const end = routeSrc.indexOf('LIMIT $2`', start);
-assert.ok(end > start, 'the feed query still ends at its LIMIT');
-const SQL = routeSrc
-  .slice(start + 1, end + 'LIMIT $2'.length)
-  .replace(/\$\{gradeQualityWhere\('g'\)\}/g, gradeQualityWhere('g'));
-assert.ok(!SQL.includes('${'), 'every interpolation in the sliced query was resolved');
+// The handler under test: the last stack entry of the shipped route (the first is
+// auth.requireBuilder, which needs a session; the handler reads req.builder, which
+// we supply). The router's pool is the core pool, which reads DATABASE_URL — the
+// same database this file writes its fixtures to.
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+const feedLayer = buildTasksRouter().stack
+  .find((l) => l.route && l.route.path === '/tasks/peer-votes/feed' && l.route.methods.get);
+assert.ok(feedLayer, 'the lifecycle router still serves GET /tasks/peer-votes/feed');
+const feedHandler = feedLayer.route.stack[feedLayer.route.stack.length - 1].handle;
+
+// Call the route as `builder` and return its JSON body; a failure surfaces as a throw.
+async function feed(builder, limit = 100) {
+  let body = null;
+  let failure = null;
+  const res = {
+    json(b) { body = b; return res; },
+    fail(code, opts) { failure = { code, opts }; return res; },
+    status() { return res; },
+  };
+  await feedHandler({ builder, query: { limit: String(limit) }, params: {}, headers: {}, get: () => undefined }, res);
+  if (failure) throw new Error(`the feed route failed: ${JSON.stringify(failure)}`);
+  assert.ok(body && Array.isArray(body.tasks), 'the feed answered with a task list');
+  return body;
+}
 
 const VOTER = 90000801;
 const SHIPPER = 90000802;
@@ -82,10 +95,13 @@ const check = (name, fn) => {
 try {
   await cleanup();
 
-  await q("INSERT INTO versions (id, name, status) VALUES ($1, 'acclaim evidence fixture', 'planning')", [VER]);
-  for (const [id, login] of [[VOTER, 'zz-acc-voter'], [SHIPPER, 'zz-acc-shipper']]) {
-    await q("INSERT INTO builders (id, github_login, display_name, rank) VALUES ($1, $2, $2, 'metic')", [id, login]);
-  }
+  // 'building', not 'planning': versions_one_planning_idx allows ONE planning row and
+  // the seeds own it — the collision that parked this test (task 1004042).
+  await q("INSERT INTO versions (id, name, status) VALUES ($1, 'acclaim evidence fixture', 'building')", [VER]);
+  await insertTestBuilders(pool, [
+    { id: VOTER, login: 'zz-acc-voter', rank: 'metic' },
+    { id: SHIPPER, login: 'zz-acc-shipper', rank: 'metic' },
+  ], { onConflict: '' });
   for (const [id, title] of [
     [T.GOOD, '__acc__ graded and costed'],
     [T.OUTAGE, '__acc__ grader outage'],
@@ -123,7 +139,10 @@ try {
   await cost(T.FREE, '0');
   // T.OUTAGE and T.UNGRADED get no cost row at all.
 
-  const rows = await q(SQL, [VOTER, 100]);
+  // A metic caller: cost reaches only the ranks that can vote, so this is the view
+  // that carries every figure under test.
+  const body = await feed({ id: VOTER, rank: 'metic' });
+  const rows = body.tasks;
   const byId = new Map(rows.map((r) => [String(r.id), r]));
   const got = (id) => {
     const row = byId.get(String(id));

package/tests/adr_0089_scope.mjs

@@ -28,9 +28,11 @@ const adr = read('docs/adr/0089-modular-multi-model-adversarial-grader.md');
 const section = adr.slice(adr.indexOf('### 8. Scope: what the engine does NOT own'), adr.indexOf('## Consequences'))
   .replaceAll('scripts/gds/', 'scripts/bongos/'); // rename-keep
 
+// §8 also names scripts/bongos/gate-review.js. Task 1004859 deleted it (the CI check it
+// drove never ran), so there is nothing left to hold to the boundary; the ADR keeps the
+// name as history.
 const SURFACES = [
   'scripts/bongos/session-eval.js',
-  'scripts/bongos/gate-review.js',
   'scripts/bongos/main-audit.js',
   'scripts/bongos/architect-audit.js',
 ];
@@ -40,7 +42,7 @@ test('ADR 0089 carries the §8 scope section, before Consequences', () => {
   assert.ok(section.length > 200, 'the section sits between §7 and Consequences');
 });
 
-test('§8 names each of the four surfaces by path, and each path exists', () => {
+test('§8 names each of the remaining surfaces by path, and each path exists', () => {
   for (const p of SURFACES) {
     assert.ok(section.includes(p), `§8 names ${p}`);
     assert.ok(fs.existsSync(new URL(`../${p}`, import.meta.url)), `${p} exists`);
@@ -56,14 +58,14 @@ test('the Architect uses exactly the three grader helpers §8 names — nothing
   for (const name of used) assert.ok(section.includes(name), `§8 names ${name}`);
 });
 
-test('session-eval, gate-review and main-audit import no grading module', () => {
+test('session-eval and main-audit import no grading module', () => {
   for (const p of SURFACES.filter((s) => !s.endsWith('architect-audit.js'))) {
     assert.doesNotMatch(read(p), /require\([^)]*modules\/grading/, `${p} must not require grading code`);
   }
 });
 
-test('main-audit and gate-review share only the rank-permission checker §8 names', () => {
-  for (const p of ['scripts/bongos/main-audit.js', 'scripts/bongos/gate-review.js']) {
+test('main-audit reads the rank-permission checker §8 names', () => {
+  for (const p of ['scripts/bongos/main-audit.js']) {
     assert.match(read(p), /permission-path-check/, `${p} reads the checker`);
   }
   assert.ok(section.includes('src/bongos/permission-path-check.js'), '§8 names the shared checker');