diff --git a/app/plugins/builtins/forgejo_error_reporter/plugin.py b/app/plugins/builtins/forgejo_error_reporter/plugin.py
index 2dd9e33..a823404 100644
--- a/app/plugins/builtins/forgejo_error_reporter/plugin.py
+++ b/app/plugins/builtins/forgejo_error_reporter/plugin.py
@@ -29,19 +29,21 @@ class ForgejoErrorReporterPlugin(BasePlugin):
         dependencies=[],
         events=[],
         migrations=[],
-        permissions=[],
+        # Audit P1 (permission catalog): /status route requires system:read —
+        # the key must be grantable via the manifest.
+        permissions=["system:read"],
         routes=[
             PluginRouteDef(
                 path="/api/v1/forgejo-error-reporter",
                 module="app.plugins.builtins.forgejo_error_reporter.routes",
                 router_attr="router",
-        permissions=["system:read"],
-    ),
+            ),
         ],
 
         author="LeoCRM Team",
         min_app_version="1.0.0",
-        contract_version="1.0.0")
+        contract_version="1.0.0",
+    )
 
     def __init__(self) -> None:
         super().__init__()
diff --git a/tests/test_audit_architecture_fixes.py b/tests/test_audit_architecture_fixes.py
index 8af3172..c8677f6 100644
--- a/tests/test_audit_architecture_fixes.py
+++ b/tests/test_audit_architecture_fixes.py
@@ -344,11 +344,26 @@ def test_f9_all_audit_permission_keys_registered():
     )
 
     init_permission_registry(set())
+    # Register from the REAL manifests (not hand-picked lists) — this catches
+    # kwargs-level corruption like the bug where permissions=[...] had landed
+    # inside PluginRouteDef kwargs instead of the manifest level.
+    from app.plugins.builtins.forgejo_error_reporter.plugin import (
+        ForgejoErrorReporterPlugin,
+    )
+    from app.plugins.builtins.permissions.plugin import PermissionsPlugin
+
+    assert PermissionsPlugin().manifest.permissions == [
+        "permissions:read", "permissions:admin",
+    ]
+    assert ForgejoErrorReporterPlugin().manifest.permissions == ["system:read"], (
+        "system:read must be declared at MANIFEST level (not PluginRouteDef kwargs)"
+    )
+
     get_permission_registry().register_plugin_permissions(
-        "permissions", ["permissions:read", "permissions:admin"]
+        "permissions", PermissionsPlugin().manifest.permissions
     )
     get_permission_registry().register_plugin_permissions(
-        "forgejo_error_reporter", ["system:read"]
+        "forgejo_error_reporter", ForgejoErrorReporterPlugin().manifest.permissions
     )
 
     known = get_permission_registry().get_all()