@bongos/core 1.19.1040 → 1.19.1042

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-26-own1"></script>
+<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/panel-family.md

@@ -17,3 +17,12 @@ Also fixed here, as the board task handed forward: the two sub-24px links on Hom
 - **Honest empties, one line each.** Signed out (or a 401 mid-way) the grid is the same permission sentence the activity ledgers use; an empty record is "No works shipped yet"; a failed read says so. Never three empty cards.
 - **The Works key, and its public fallback.** Works is the full server-paged ledger from `/builders/:id/activity?section=tasks` (any signed-in viewer, any builder); signed out, the page's PUBLIC `recent_ships` stand in with a sign-in line, so a stranger still sees the last few. The Overview no longer carries a works strip — that removes the duplicate the DONE-WHEN named.
 - **A lookback control (owner request, task 1003489) scopes every chart** — 30 days / 90 days / 1 year / All time, one segmented row above the grid (the dataviz date-range-first rule). The cumulative charts clip their axis to the window and ENTER it at the running total, not at zero (`clipToWindow`); the craft mix counts within it; the pace chart passes the window to `/analytics/builder/:id?days=`. Remembered per viewer; changing it re-draws from the rows already in hand — no re-fetch. (A chart LIBRARY was floated by the owner and deliberately NOT taken here — the hall ships none, the hand-drawn charts satisfy the ask, and the swap is its own idea to weigh CSP/weight/theming/table-twin against.)
+
+**Settings gained a sixth group, Software update (task 1004296)** — every project's running core, the newest release its update channel lets it take, and what each version in between brings, like a phone's Software Update screen. `settings-software-update.js` renders it from `GET /api/bongos/software-update`; the reading is `src/bongos/software-update.js` over the core's registry reader.
+
+- **It is read when its group opens, not with the page.** An update's notes come out of the newer package's download, and most visits to Settings are for something else, so `activateGroup` in `settings.js` announces each switch as a `settings:group` event and the panel loads on its own group, once.
+- **The Update button leads to the door; it is not the door.** The act is the deploy door's two steps and auto-rollback (ADR 0293): `/deploy` in the platform's hall, the hub's `/deploy?project=` for a hosted project (ADR 0339 D3), and a `bongos upgrade` sentence where there is no door at all. A second copy of that flow here would be a second place for its safety rules to drift. The button is drawn only when the server says the viewer holds `core.pin.move` — cosmetic, the door re-checks.
+- **Everyone reads it.** The version and what's new are for every builder (the owner's ask); the route discloses nothing the public `/version` and npm do not already publish.
+- **"Up to date" is said only from an answer.** A failed registry read, an unnamed running version and unread release notes each render as what they are; unread notes are never drawn as a version with no changes.
+- **The notes are the soft ink, underlined, on the platform.** There every entry links to its task, and a list of accent-coloured sentences read as a warning. Elsewhere the ids belong to another project's ledger, so the entries are plain text.
+- **Kit:** `settings.states.json` `update`, ALL CLEAN at 1440/390/320 × dark/light against the harness with the fixture `software-update.json` (a live reading for 1.19.1033). Tests: `tests/software_update.mjs`.

package/modules/npm-release/public/work.js

@@ -64,8 +64,13 @@
 
   // The title IS the link, the hall's own row idiom (oversight.css `a.ov-row__title`),
   // which is what buys it the 24px floor and the row's ink rather than link colour.
+  // Voice rule V4 (docs/voice.md): a dash is banned in QUOTED data — and a task title and a
+  // release-note line are both handed over by the ledger — so it becomes a comma at render,
+  // the way goal-inbox.js and the public feed's cleanTitle() do. Never by editing the data.
+  const unDash = (raw) => String(raw == null ? '' : raw).replace(/\s*[—–]\s*/g, ', ').replace(/,\s*,/g, ',').trim();
+
   function taskTitle(id, title) {
-    return `<a class="ov-row__title" href="/task/${encodeURIComponent(id)}">${escapeHtml(title || `Task ${id}`)}</a>`;
+    return `<a class="ov-row__title" href="/task/${encodeURIComponent(id)}">${escapeHtml(unDash(title) || `Task ${id}`)}</a>`;
   }
 
   function taskRow(t, { offeredInNote = false } = {}) {
@@ -151,8 +156,8 @@
       const shown = expanded.has(key) ? v.entries : v.entries.slice(0, ENTRIES_SHOWN);
       body = `<ul class="ov-rows">${shown.map((e) => `<li class="ov-row ov-row--dense">
           <div class="ov-row__main">
-            ${e.id ? taskTitle(e.id, e.title) : `<span class="ov-row__title">${escapeHtml(e.text)}</span>`}
-            ${e.id ? `<p class="ov-row__sub">${escapeHtml(e.text)}</p>` : ''}
+            ${e.id ? taskTitle(e.id, e.title) : `<span class="ov-row__title">${escapeHtml(unDash(e.text))}</span>`}
+            ${e.id ? `<p class="ov-row__sub">${escapeHtml(unDash(e.text))}</p>` : ''}
           </div>
         </li>`).join('')}</ul>${moreButton(key, v.entries.length, shown.length)}`;
     }

package/modules/npm-release/work.js

@@ -30,12 +30,18 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const api = require('../../src/module-api');
-const { readRegistry, compareVersions } = require('./registry');
 
 // The package this server runs — the one whose "live" version is this process's own core.
 // Any other package has no "live on this hall" stage: nothing here runs it.
 const CORE_PACKAGE = '@bongos/core';
 const VERSION_RE = /^\d+\.\d+\.\d+$/;
+
+function compareVersions(a, b) {
+  const x = String(a).split('.').map(Number);
+  const y = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] - y[i];
+  return 0;
+}
 const TEXT_MAX = 400;
 const DEFAULT_DAYS = 14;
 const MAX_DAYS = 60;
@@ -201,7 +207,7 @@ async function readWork({
   const localVersions = versionsIn(local);
   const localTop = localVersions.length ? localVersions[localVersions.length - 1].version : null;
 
-  const { registry, notes } = await readRegistry({
+  const { registry, notes } = await api.readPackageRegistry({
     pkg, get, now, store,
     haveNotesFor: (v) => !!localTop && compareVersions(localTop, v) >= 0,
   });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1040",
+  "version": "1.19.1042",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1040",
+      "version": "1.19.1042",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1040",
+  "version": "1.19.1042",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7537,5 +7537,21 @@
       "id": "1003368",
       "text": "Closed a security hole where a builder's branch could choose the program the server runs while auto-resolving merge conflicts; the server now always uses its own trusted copy."
     }
+  ],
+  "1.19.1041": [
+    {
+      "id": "1000380",
+      "text": "The grader's reviewers now see only the file-reading tool they need. Before, they could also reach every service connected on the machine running them, such as documents and email, with no approval prompts, while reading code"
+    }
+  ],
+  "1.19.1042": [
+    {
+      "id": "1004296",
+      "text": "Every project's Settings now has a Software update page: the version it runs, whether a newer one is ready, what each newer version brings, and an Update button for the people allowed to upgrade."
+    },
+    {
+      "id": "1001433",
+      "text": "The nightly security check of the main code line no longer trusts the name typed on each change, which anyone can fake. It now checks that every change to a sensitive file carries the server's own sign-off from a senior builde"
+    }
   ]
 }

package/scripts/gds/fitness.js

@@ -586,6 +586,13 @@ const KERNEL_FILES = [
   // the composed door, so reader and composer had to sit together or the two would
   // cycle.) The ARTIST GATE joins for the same reason — task 1003575, ADR 0241.
   'src/bongos/project-door.js', 'src/bongos/artist-gate.js',
+  // task 1004296 (ADR 0340 D5): the npm registry reader — packument, the in-process
+  // tarball stream and its small tar reader. It moved INTO the core because Settings →
+  // Software update needs it in every hall, and the doorway re-exports it
+  // (readPackageRegistry) for the module that publishes a package, so leaving it off
+  // this roster reads as a kernel->non-kernel leak. It imports only node built-ins
+  // (https, zlib), so joining costs nothing.
+  'src/bongos/package-registry.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a

package/scripts/gds/main-audit.js

@@ -26,6 +26,20 @@
 // rank on a protected-path commit is a 'review' finding (in --verify-head it
 // blocks unless --allow-unverified, fail-closed).
 //
+// THE ATTESTATION PASS (task 1001433; owner's option 1, 2026-09-26). The author
+// NAME above is typed text — anyone can commit as 'IAMMASTERQUA'. What cannot be
+// typed is the `gate-author-trust` commit status the SERVER posts on a ship's
+// pushed tip after resolving the builder's CLI session to a Metic+ rank
+// (POST /tasks/:id/attest-gate + publish-branch, ADR 0058). So each protected-path
+// commit is traced to the pull request that brought it onto main (the second
+// parent of its first-parent merge) and that head must carry a SUCCESS status of
+// that context, posted by the server's own GitHub identity. A status with the same
+// name posted by any other account is ignored: anyone with write access can post a
+// status, so the CREATOR is the part that cannot be faked. FLAG-ONLY for now, by
+// the owner's ruling: an unattested commit is a 'review' finding and never changes
+// the exit code. It needs a GitHub token (GITHUB_TOKEN / GH_TOKEN); without one it
+// says it did not run rather than passing.
+//
 // Usage:
 //   node scripts/gds/main-audit.js                       # audit last 50 on origin/main
 //   node scripts/gds/main-audit.js --range A..B          # audit an explicit range
@@ -35,6 +49,10 @@
 //   node scripts/gds/main-audit.js --strict              # also block on unresolved authors
 //   node scripts/gds/main-audit.js --db                  # resolve ranks from Postgres instead of the API
 //   node scripts/gds/main-audit.js --require-roster      # CI: an empty roster is a loud DID-NOT-RUN, not a vacuous green
+//   node scripts/gds/main-audit.js --require-attestation # CI: an attestation pass that could not run exits 2
+//   node scripts/gds/main-audit.js --attest-login <login> # the account the server posts statuses as (default: the repo owner)
+//   node scripts/gds/main-audit.js --no-attestation      # skip the attestation pass
+//   GH_TOKEN=$(gh auth token) node scripts/gds/main-audit.js   # a local run with the attestation pass
 //
 // EXIT CONTRACT — never `process.exit()` here, use `cliExit(code)` + `return`
 // (task 1003772). Every exit in this file lands after the roster request, and a
@@ -160,6 +178,102 @@ function strictestFloorLabel(hits, registry) {
   return top ? top.charAt(0).toUpperCase() + top.slice(1) : 'Metic';
 }
 
+// ---------- attestation pass (task 1001433) — pure half ----------
+
+// The status context the server posts on a ship's pushed tip (task-route-helpers.js
+// postGateAuthorTrust). Only a SUCCESS of this context by the trusted creator counts.
+const ATTEST_CONTEXT = 'gate-author-trust';
+
+// Which pull-request head vouches for each commit. For every MAINLINE merge (a
+// first-parent commit of main with two parents), the commits it brought in —
+// reachable from its second parent and not from its first — are covered by that
+// second parent: the PR head the server attested at ship time. `revList(range)`
+// returns the shas of a `git rev-list` range; it is a parameter so the mapping is
+// testable without a repository.
+//
+// Only MAINLINE merges may be passed in. A merge INSIDE a pull request ("Merge
+// origin/main into my-branch") has main commits as its second parent, and letting
+// it vouch would credit a branch's merge-from-main for work it never carried.
+function mapIntroducingHeads(mainlineMerges, revList) {
+  const headOf = new Map();
+  for (const m of mainlineMerges || []) {
+    const [first, second] = m.parents || [];
+    if (!first || !second) continue;
+    for (const sha of revList(`${first}..${second}`)) {
+      if (!headOf.has(sha)) headOf.set(sha, second);
+    }
+  }
+  return headOf;
+}
+
+// Did the trusted account attest this head? `statuses` is GitHub's list for one
+// commit, newest first. Statuses from any other creator are ignored outright —
+// they can neither attest nor revoke — and of the trusted creator's own statuses
+// for the context, only the newest decides, so a later failure withdraws a success.
+function isAttested(statuses, trustedLogin) {
+  const want = String(trustedLogin || '').toLowerCase();
+  if (!want) return false;
+  const latest = (Array.isArray(statuses) ? statuses : []).find((s) => s
+    && s.context === ATTEST_CONTEXT
+    && String(s.creator?.login || '').toLowerCase() === want);
+  return !!latest && latest.state === 'success';
+}
+
+// commits: parsed commits (only the protected-path ones matter; others are skipped).
+// headOf: Map sha → the PR head that brought it in (mapIntroducingHeads). A commit
+// with no entry — a direct push to main, or a merge's own smuggled --cc surface —
+// can only be vouched for by an attestation on ITSELF.
+// attested: Set of head shas that carry the trusted attestation (fetchAttestations).
+// Returns { checked, findings[] }. Every finding is severity 'review': the owner
+// ruled this pass flag-only, so it can never make the audit fail.
+function analyzeAttestation(commits, { headOf = new Map(), attested = new Set(), trustedLogin = '', registry = ppc } = {}) {
+  const findings = [];
+  let checked = 0;
+  for (const c of commits || []) {
+    const hits = registry.matchProtected(c.files || []);
+    if (hits.length === 0) continue;
+    checked += 1;
+    // `viaPr`, not `head === c.sha`: a one-commit pull request's head IS the commit.
+    const viaPr = headOf.has(c.sha);
+    const head = viaPr ? headOf.get(c.sha) : c.sha;
+    if (attested.has(head)) continue;
+    const fileList = hits.map((h) => h.file).join(', ');
+    const mark = `successful '${ATTEST_CONTEXT}' status from '${trustedLogin}'`;
+    const confirm = `Confirm it came through a Bongos ship by a ${strictestFloorLabel(hits, registry)}+ builder.`;
+    const summary = viaPr
+      ? `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}], but the pull request that brought it in (head ${short(head)}) carries no ${mark}. ${confirm}`
+      : `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}] and reached main without passing through a pull request (a direct push, or changes a merge made itself), and it carries no ${mark} of its own. ${confirm}`;
+    findings.push({
+      severity: 'review',
+      kind: 'unattested',
+      sha: c.sha,
+      author: c.authorName,
+      head,
+      files: hits.map((h) => h.file),
+      summary,
+    });
+  }
+  return { checked, findings };
+}
+
+// Where the pass reads GitHub from. The token and repository come from the
+// environment GitHub Actions already provides (GITHUB_TOKEN, GITHUB_REPOSITORY),
+// with GH_TOKEN and the origin remote as the laptop fallbacks. The trusted login
+// defaults to the repository OWNER: this platform's server posts statuses with the
+// owner's push token (observed on PR 1233: the status creator is the owner's account), and the owner can
+// push to main directly anyway, so trusting that identity grants nothing new. An
+// instance whose server posts as a GitHub App passes --attest-login <app>[bot].
+function attestationConfig({ env = process.env, remoteUrl = '', loginArg = null } = {}) {
+  const token = env.GITHUB_TOKEN || env.GH_TOKEN || null;
+  let repo = env.GITHUB_REPOSITORY || null;
+  if (!repo && remoteUrl) {
+    const m = /github\.com[:/]([^/\s]+\/[^/\s]+?)(?:\.git)?\/?$/.exec(String(remoteUrl).trim());
+    if (m) repo = m[1];
+  }
+  const trustedLogin = (typeof loginArg === 'string' && loginArg) || (repo ? repo.split('/')[0] : null);
+  return { token, repo, trustedLogin };
+}
+
 // ---------- git + API glue (CLI) ----------
 
 function git(args) {
@@ -219,8 +333,10 @@ function parseCommits(range) {
     const subject = rest.shift();
     const files = rest.map((s) => s.trim()).filter(Boolean);
     if (!sha) continue;
-    const isMerge = parents.split(/\s+/).filter(Boolean).length > 1;
-    commits.push({ sha, subject, authorName, authorEmail, isMerge, files });
+    // Kept in order: the attestation pass needs a merge's SECOND parent (the PR head).
+    const parentList = parents.split(/\s+/).filter(Boolean);
+    const isMerge = parentList.length > 1;
+    commits.push({ sha, subject, authorName, authorEmail, isMerge, parents: parentList, files });
   }
   // #863-followup (finding #5): `git log --name-only` emits NO files for merge
   // commits, so a merge that SMUGGLES a protected change (an "evil merge" /
@@ -310,6 +426,69 @@ async function fetchRankMap({ useDb = false } = {}) {
   return {};
 }
 
+// ---------- attestation pass (task 1001433) — I/O half ----------
+
+const GITHUB_API = 'https://api.github.com';
+
+// Read each head's statuses and keep the ones the trusted account attested. A head
+// whose statuses could not be read is reported as `unreadable`, never guessed at:
+// an unread head is not an unattested one, and treating it as attested would be
+// the vacuous pass this file keeps refusing.
+async function fetchAttestations(heads, { repo, token, trustedLogin, fetchImpl = fetch, apiBase = GITHUB_API } = {}) {
+  const attested = new Set();
+  const unreadable = [];
+  for (const sha of new Set(heads || [])) {
+    try {
+      const res = await fetchImpl(`${apiBase}/repos/${repo}/commits/${sha}/statuses?per_page=100`, {
+        headers: { Accept: 'application/vnd.github+json', Authorization: `Bearer ${token}`, 'X-GitHub-Api-Version': '2022-11-28' },
+      });
+      if (!res.ok) { unreadable.push({ sha, reason: `HTTP ${res.status}` }); continue; }
+      if (isAttested(await res.json(), trustedLogin)) attested.add(sha);
+    } catch (e) {
+      unreadable.push({ sha, reason: e.message });
+    }
+  }
+  return { attested, unreadable };
+}
+
+function shaLines(out) {
+  return String(out || '').split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+// The whole pass for one audited range. Returns { ran: true, checked, findings }
+// or { ran: false, reason } — the caller prints either, and only
+// --require-attestation turns a pass that could not run into a non-zero exit.
+async function runAttestationPass(commits, range, { loginArg = null, env = process.env, gitImpl = git, fetchImpl } = {}) {
+  const protectedCommits = (commits || []).filter((c) => ppc.matchProtected(c.files || []).length > 0);
+  if (protectedCommits.length === 0) return { ran: true, checked: 0, findings: [] };
+  let remoteUrl = '';
+  try { remoteUrl = gitImpl('remote get-url origin').trim(); } catch (_) { /* no origin: env must name the repo */ }
+  const cfg = attestationConfig({ env, remoteUrl, loginArg });
+  if (!cfg.token) return { ran: false, reason: 'no GitHub token (set GITHUB_TOKEN or GH_TOKEN) to read commit statuses with' };
+  if (!cfg.repo) return { ran: false, reason: 'could not tell which GitHub repository this is (set GITHUB_REPOSITORY=owner/repo)' };
+
+  let mainline;
+  try {
+    mainline = new Set(shaLines(gitImpl(`rev-list --first-parent ${range}`)));
+  } catch (e) {
+    return { ran: false, reason: `git could not list the first-parent history of ${range}: ${e.message}` };
+  }
+  const merges = (commits || []).filter((c) => mainline.has(c.sha) && (c.parents || []).length > 1);
+  let headOf;
+  try {
+    headOf = mapIntroducingHeads(merges, (r) => shaLines(gitImpl(`rev-list ${r}`)));
+  } catch (e) {
+    return { ran: false, reason: `git could not trace which pull request brought each commit in: ${e.message}` };
+  }
+  const heads = protectedCommits.map((c) => headOf.get(c.sha) || c.sha);
+  const { attested, unreadable } = await fetchAttestations(heads, { ...cfg, ...(fetchImpl ? { fetchImpl } : {}) });
+  if (unreadable.length) {
+    const sample = unreadable.slice(0, 3).map((u) => `${short(u.sha)} (${u.reason})`).join(', ');
+    return { ran: false, reason: `could not read the commit statuses of ${unreadable.length} pull-request head(s): ${sample}` };
+  }
+  return { ran: true, ...analyzeAttestation(protectedCommits, { headOf, attested, trustedLogin: cfg.trustedLogin }), trustedLogin: cfg.trustedLogin };
+}
+
 function arg(name, fallback = null) {
   const i = process.argv.indexOf(name);
   return i >= 0 ? (process.argv[i + 1] && !process.argv[i + 1].startsWith('--') ? process.argv[i + 1] : true) : fallback;
@@ -381,14 +560,28 @@ async function main() {
   }
 
   const result = analyzeCommits(parsed.commits, rankMap, { strict });
+  // Task 1001433: the attestation pass. FLAG-ONLY — its findings are 'review' and
+  // never reach `hardFail`; the one thing it can do to the exit code is report
+  // that it did not run, and only when the caller asked with --require-attestation.
+  const loginArg = arg('--attest-login');
+  const attestation = process.argv.includes('--no-attestation')
+    ? { ran: false, skipped: true, reason: 'skipped (--no-attestation)' }
+    : await runAttestationPass(parsed.commits, range, { loginArg: loginArg === true ? null : loginArg });
+  const findings = result.findings.concat(attestation.findings || []);
 
   console.log(`\nMain audit (SEC #863) — range ${range}, ${parsed.commits.length} commit(s)`);
-  if (result.findings.length === 0) {
+  if (attestation.ran) {
+    console.log(`  attestation (task 1001433, flag-only): ${attestation.checked} permission-sensitive commit(s) checked, ${attestation.findings.length} without the server's '${ATTEST_CONTEXT}' mark.`);
+  } else {
+    console.log(`  attestation (task 1001433, flag-only): DID NOT RUN — ${attestation.reason}.`);
+  }
+  const attestationMissing = !attestation.ran && !attestation.skipped && process.argv.includes('--require-attestation');
+  if (findings.length === 0) {
     console.log('  ✓ clean — no sub-Metic edits to permission-sensitive paths.\n');
-    cliExit(0);
+    cliExit(attestationMissing ? 2 : 0);
     return;
   }
-  for (const f of result.findings) {
+  for (const f of findings) {
     const tag = f.severity === 'blocker' ? '\x1b[31m[BLOCKER]\x1b[0m' : '\x1b[33m[review]\x1b[0m';
     console.log(`  ${tag} ${f.summary}`);
   }
@@ -407,8 +600,9 @@ async function main() {
     cliExit(result.hardFail ? 1 : 0);
     return;
   }
-  // report mode: non-zero on a real blocker so CI can fail.
-  cliExit(result.hardFail ? 1 : 0);
+  // report mode: non-zero on a real blocker so CI can fail. A blocker outranks an
+  // attestation pass that did not run: 1 is a definite answer, 2 is "no answer".
+  cliExit(result.hardFail ? 1 : (attestationMissing ? 2 : 0));
 }
 
 if (require.main === module) {
@@ -425,4 +619,7 @@ module.exports = {
   // path was dead for as long as the db.js carve has been landed precisely because
   // nothing checked that this require target still exports what it is called for.
   ROSTER_DB_MODULE, fetchRankMap,
+  // The attestation pass (task 1001433): pure halves + the I/O half with its seams.
+  ATTEST_CONTEXT, mapIntroducingHeads, isAttested, analyzeAttestation, attestationConfig,
+  fetchAttestations, runAttestationPass,
 };

package/{modules/npm-release/registry.js → src/bongos/package-registry.js}

@@ -1,14 +1,21 @@
 'use strict';
 
-// modules/npm-release/registry.js — what the npm registry says about the package: which
+// src/bongos/package-registry.js — what the npm registry says about a package: which
 // versions exist, when each was published, which one carries the `latest` label, and the
-// release notes the newest version was packed with (task 1002622).
+// release notes the newest version was packed with (task 1002622; moved into the core by
+// task 1004296).
+//
+// WHY IT IS THE CORE'S. Two readers need it. Settings → Software update (software-update.js)
+// runs in EVERY project's hall, because every project installs releases; a deploy-page
+// module runs in the one hall that publishes them and reaches this through the doorway
+// (`readPackageRegistry` in src/module-api.js). Kept in a module, the one reader every hall
+// needs would have been inside the one module only one hall runs.
 //
 // WHY THE NEWEST PACKAGE'S NOTES. package-core writes release-notes.json from the WHOLE
 // history at pack time (scripts/gds/release-notes.js, task 1004218), so the newest version
-// alone lists every version before it. One file answers the whole page. The copy the
-// running core carries stops at its own version, which is exactly the range the deploy
-// page is asked about least: the work that is published but not running yet.
+// alone lists every version before it. One file answers every reader. The copy the
+// running core carries stops at its own version, which is exactly the range both readers
+// are asked about most: what is published but not running yet.
 //
 // NEVER A CHILD PROCESS, NEVER A SYNC CALL. This runs inside the web process, so the
 // upgrade runner's `npm pack` + `tar -xzOf` (provision-core-upgrade.js readPackagedNotes)
@@ -242,7 +249,7 @@ async function cached(slot, fresh, load, t) {
 }
 
 /**
- * Everything the registry can tell the deploy page about `pkg`, in one call.
+ * Everything the registry can tell a reader about `pkg`, in one call.
  *
  * Returns `{ registry, notes }`:
  *   registry — `{ ok, versions, published, latest, newest }` or `{ ok:false, error }`
@@ -268,4 +275,4 @@ async function readRegistry({ pkg, haveNotesFor = () => false, get = https.get,
   return { registry, notes: { ...notes, version } };
 }
 
-module.exports = { readRegistry, compareVersions };
+module.exports = { readRegistry };

package/src/bongos/routes/core-update.js

@@ -17,11 +17,21 @@
 //      press the button is a worse experience than showing nothing.
 // The gate costs its real audience nothing: an owner holds the atom on their own
 // instance by construction.
+//
+// GET /software-update (task 1004296) is the exception, and deliberately so: it is the
+// Settings panel's read, and the owner asked for the version and what's new to be shown in
+// EVERY builder's Settings, like a phone's Software Update screen. It discloses nothing the
+// public GET /version does not already publish (the running core) or npm does not (what is
+// newer, and its release notes), so the vulnerability-window reason above does not apply to
+// it — and it offers no act itself. Who may press Update is still the door's decision; this
+// only says, cosmetically, whether the viewer holds the atom the door checks.
 
 const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
 const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
+const { readSoftwareUpdate } = require('../software-update');
+const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
 
 // WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
@@ -30,7 +40,9 @@ const { loadIdpConfig } = require('../auth-config');
 // no capability. Both halves are already here on a federated project: provisioning
 // writes the hub origin and this project's hub client id, which IS its slug (ADR 0246),
 // into web.env. null when this instance is not federated with a hub — a self-hosted
-// instance, or the hub itself — so the hall offers no link rather than a wrong one.
+// instance, or the hub itself — so the hall offers no link rather than a wrong one. Since
+// task 1004296 it is the Settings panel's Update button that carries it (updateDoor below),
+// not the banner or the rail.
 // Only the origin and the client id are read; the client secret never leaves auth-config.
 function hubDeployUrl(config) {
   if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
@@ -38,6 +50,35 @@ function hubDeployUrl(config) {
   return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
 }
 
+// WHERE THIS PROJECT'S UPDATE BUTTON GOES (task 1004296). The act itself never happens in
+// Settings: it is the deploy door's two-step confirm and auto-rollback (ADR 0293), and that
+// door is the provisioning module's — so only a hall that runs provisioning has one.
+//   local — this hall runs the door: its own /deploy.
+//   hub   — a hosted project: the hub's door for this project (ADR 0339 D3).
+//   cli   — neither: a self-hosted instance, upgraded on its server with `bongos upgrade`.
+function updateDoor({ provisioning, idp }) {
+  if (provisioning) return { kind: 'local', url: '/deploy' };
+  const url = hubDeployUrl(idp);
+  return url ? { kind: 'hub', url } : { kind: 'cli', url: null };
+}
+
+function provisioningEnabled() {
+  try { return require('../../modules').isModuleEnabled('provisioning'); } catch { return false; }
+}
+
+// Does the viewer hold `core.pin.move`? COSMETIC — it decides whether the panel draws the
+// Update button, never whether an update may happen; the door re-checks per request. The
+// same read GET /me's nav permissions make, and the same fail-closed reading: authority that
+// cannot be established is "no".
+async function holdsCorePin(req) {
+  try {
+    const government = seams.resolveOptional('government');
+    if (!government || typeof government.resolveBuilderPermissions !== 'function') return false;
+    const held = (await government.resolveBuilderPermissions(req.builder && req.builder.id)) || [];
+    return held.includes('core.pin.move');
+  } catch { return false; }
+}
+
 function safeIdpConfig() {
   try { return loadIdpConfig(); } catch { return null; }
 }
@@ -49,7 +90,12 @@ function upgradesLimit(raw) {
   return Math.min(100, Math.max(1, n));
 }
 
-function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
+function buildCoreUpdateRouter({
+  upgrades = readCoreUpgrades,
+  softwareUpdate = readSoftwareUpdate,
+  canUpdate = holdsCorePin,
+  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig() }),
+} = {}) {
   const router = express.Router();
 
   router.get(
@@ -67,7 +113,9 @@ function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
       // that cannot name its own core reports `no_answer` and renders no banner.
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      res.json({ ok: true, update: await readCoreUpdate({ running }), deploy_url: hubDeployUrl(safeIdpConfig()) });
+      // No `deploy_url` any more (task 1004296): the banner on a hall without a door of its
+      // own links to Settings → Software update, and the hand-off lives on GET /software-update.
+      res.json({ ok: true, update: await readCoreUpdate({ running }) });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -89,6 +137,20 @@ function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
     }, { errorCode: 'core_upgrades_unreadable', message: false }),
   );
 
+  // GET /software-update — Settings → Software update (task 1004296): this project's core,
+  // the newest release its channel allows, what the versions between them carry, and where
+  // this project's Update button leads. Any signed-in builder (see the header).
+  router.get(
+    '/software-update',
+    auth.requireBuilder,
+    asyncHandler('GET /software-update', async (req, res) => {
+      let running = null;
+      try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      const [update, can] = await Promise.all([softwareUpdate({ running }), canUpdate(req)]);
+      res.json({ ok: true, update, door: updateDoor(doorInputs()), can_update: can === true });
+    }, { errorCode: 'software_update_failed', message: false }),
+  );
+
   return router;
 }
 

package/src/bongos/serve-internal.js

@@ -975,6 +975,23 @@ function mountInternalSurfaces(app) {
     return res.redirect(301, `${isBuildersHost(req) ? '' : '/builders'}/people${qs}`);
   });
 
+  // /deploy EXISTS ONLY WHERE THE DOOR DOES (task 1004296). The owner, 2026-09-25: /deploy is
+  // "only for bongos builders hall itself, not for all production ones". Every datum and
+  // both acts on that page are provisioning-module routes, so a hall that does not run the
+  // module — a hosted project, a self-hosted instance — was serving a page with nothing
+  // behind it. It now answers with Settings → Software update, where every hall reads its
+  // version and takes its update. Like the /scouting redirect above it carries no gate: the
+  // redirect discloses nothing, and Settings' own wall applies the moment it is followed.
+  app.use((req, res, next) => {
+    if (isModuleSurfaceHost(req)) return next();
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+    if (!DEPLOY_PAGE_RE.test(path.posix.normalize(req.path))) return next();
+    let door = false;
+    try { door = isModuleEnabled('provisioning'); } catch { door = false; }
+    if (door) return next();
+    return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/settings#software-update`);
+  });
+
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();