@bongos/core 1.19.1041 → 1.19.1043

package/modules/npm-release/work.js

@@ -30,12 +30,18 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const api = require('../../src/module-api');
-const { readRegistry, compareVersions } = require('./registry');
 
 // The package this server runs — the one whose "live" version is this process's own core.
 // Any other package has no "live on this hall" stage: nothing here runs it.
 const CORE_PACKAGE = '@bongos/core';
 const VERSION_RE = /^\d+\.\d+\.\d+$/;
+
+function compareVersions(a, b) {
+  const x = String(a).split('.').map(Number);
+  const y = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] - y[i];
+  return 0;
+}
 const TEXT_MAX = 400;
 const DEFAULT_DAYS = 14;
 const MAX_DAYS = 60;
@@ -51,9 +57,16 @@ function configuredPackage(env = process.env) {
   return v || CORE_PACKAGE;
 }
 
+// READ ONCE PER PROCESS. The file ships inside the installed package, so it cannot change
+// while this process runs — an upgrade replaces the package AND restarts the server. The
+// deploy page's reading reached it rarely; a task's own page (task 1004301) reaches it on
+// every view by every builder, and a synchronous disk read has no business on that path.
+let installedNotesMemo;
 function readInstalledNotes() {
-  try { return JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
-  catch { return null; }
+  if (installedNotesMemo !== undefined) return installedNotesMemo;
+  try { installedNotesMemo = JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
+  catch { installedNotesMemo = null; }
+  return installedNotesMemo;
 }
 
 function boundText(text) {
@@ -188,12 +201,9 @@ function clampInt(v, dflt, max) {
  * `now`, `store` and `installedNotes` are the seams tests drive; `live` defaults to this
  * process's own core version when the package is the core.
  */
-async function readWork({
-  pool, pkg = configuredPackage(), live, days, before, limit,
-  installedNotes = readInstalledNotes, get, now, store,
-} = {}) {
-  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
-  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+// What versions exist and what each carried — the half of the reading both the deploy page
+// and a task's own page need (task 1004301 split it out of readWork unchanged).
+async function readVersions({ pkg, live, installedNotes, get, now, store }) {
   const running = live !== undefined ? live : (pkg === CORE_PACKAGE ? api.CORE_VERSION : null);
   const liveVersion = VERSION_RE.test(String(running || '')) ? running : null;
 
@@ -201,7 +211,7 @@ async function readWork({
   const localVersions = versionsIn(local);
   const localTop = localVersions.length ? localVersions[localVersions.length - 1].version : null;
 
-  const { registry, notes } = await readRegistry({
+  const { registry, notes } = await api.readPackageRegistry({
     pkg, get, now, store,
     haveNotesFor: (v) => !!localTop && compareVersions(localTop, v) >= 0,
   });
@@ -219,6 +229,17 @@ async function readWork({
   const coversTo = versions.length ? versions[versions.length - 1].version : null;
   const published = registry.ok ? registry.published : {};
   const released = registry.ok ? registry.latest : null;
+  return { liveVersion, registry, versions, source, notesError, coversTo, published, released };
+}
+
+async function readWork({
+  pool, pkg = configuredPackage(), live, days, before, limit,
+  installedNotes = readInstalledNotes, get, now, store,
+} = {}) {
+  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
+  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+  const { liveVersion, registry, versions, source, notesError, coversTo, published, released } =
+    await readVersions({ pkg, live, installedNotes, get, now, store });
 
   const tasks = await recentTasks(pool, windowDays);
   const stages = placeTasks({ tasks, versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
@@ -249,4 +270,50 @@ async function readWork({
   };
 }
 
-module.exports = { readWork };
+/**
+ * Where ONE task's code is (task 1004301) — the line its own page shows: the same
+ * placement the deploy page's list makes, for one task and without the 14-day window.
+ *
+ * Returns null for an id that is not a task. For a task not yet declared done, `stage` is
+ * null: there is no code to place. Otherwise `stage` is one of the deploy page's six, with
+ * the version that carries it when there is one.
+ *
+ * WHAT IT DISCLOSES, because every builder can open a task page: the version that names the
+ * task (the package's own release notes, published on npm), whether that version is the one
+ * this hall runs (GET /version already says which core runs), and whether it is released
+ * (the registry's `latest` label). Nothing here is not already public, which is why its
+ * route asks only for a signed-in builder — unlike the deploy page, whose ledger view and
+ * upgrade door are the owner's.
+ */
+async function readTaskWhere({ pool, id, pkg = configuredPackage(), live, installedNotes = readInstalledNotes, get, now, store } = {}) {
+  const taskId = String(id == null ? '' : id);
+  if (!/^\d{1,12}$/.test(taskId)) return null;
+  const { rows } = await pool.query(
+    `SELECT id, status, value_summary, COALESCE(shipped_at, updated_at) AS at FROM tasks WHERE id = $1::bigint`,
+    [taskId],
+  );
+  if (!rows.length) return null;
+  const r = rows[0];
+  const task = { id: String(r.id), status: r.status, summary: r.value_summary || null, at: r.at instanceof Date ? r.at.toISOString() : r.at };
+  const base = { task_id: task.id, package: pkg, status: task.status };
+  if (!['completed', 'confirmed', 'shipped'].includes(task.status)) return { ...base, stage: null };
+
+  const { liveVersion, registry, versions, notesError, coversTo, published, released } =
+    await readVersions({ pkg, live, installedNotes, get, now, store });
+  const stages = placeTasks({ tasks: [task], versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
+  const stage = Object.keys(stages).find((k) => stages[k].length) || null;
+  const row = stage ? stages[stage][0] : {};
+  return {
+    ...base,
+    stage,
+    version: row.version || null,
+    offered: !!row.offered,
+    live: liveVersion,
+    released,
+    // A partial reading is said, not hidden: without the notes a shipped task reads as "in no
+    // version", which would be a claim the page cannot back.
+    partial: !registry.ok || !!notesError,
+  };
+}
+
+module.exports = { readWork, readTaskWhere };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1041",
+  "version": "1.19.1043",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1041",
+      "version": "1.19.1043",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1041",
+  "version": "1.19.1043",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7543,5 +7543,21 @@
       "id": "1000380",
       "text": "The grader's reviewers now see only the file-reading tool they need. Before, they could also reach every service connected on the machine running them, such as documents and email, with no approval prompts, while reading code"
     }
+  ],
+  "1.19.1042": [
+    {
+      "id": "1004296",
+      "text": "Every project's Settings now has a Software update page: the version it runs, whether a newer one is ready, what each newer version brings, and an Update button for the people allowed to upgrade."
+    },
+    {
+      "id": "1001433",
+      "text": "The nightly security check of the main code line no longer trusts the name typed on each change, which anyone can fake. It now checks that every change to a sensitive file carries the server's own sign-off from a senior builde"
+    }
+  ],
+  "1.19.1043": [
+    {
+      "id": "1004301",
+      "text": "A task's own page now says where its code is — which version carries it, whether it is running on Bongos, whether it is released — and says plainly when a task marked done never actually landed."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:299',
+    at: 'src/module-loader/loader.js:309',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/fitness.js

@@ -586,6 +586,13 @@ const KERNEL_FILES = [
   // the composed door, so reader and composer had to sit together or the two would
   // cycle.) The ARTIST GATE joins for the same reason — task 1003575, ADR 0241.
   'src/bongos/project-door.js', 'src/bongos/artist-gate.js',
+  // task 1004296 (ADR 0340 D5): the npm registry reader — packument, the in-process
+  // tarball stream and its small tar reader. It moved INTO the core because Settings →
+  // Software update needs it in every hall, and the doorway re-exports it
+  // (readPackageRegistry) for the module that publishes a package, so leaving it off
+  // this roster reads as a kernel->non-kernel leak. It imports only node built-ins
+  // (https, zlib), so joining costs nothing.
+  'src/bongos/package-registry.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a

package/scripts/gds/main-audit.js

@@ -26,6 +26,20 @@
 // rank on a protected-path commit is a 'review' finding (in --verify-head it
 // blocks unless --allow-unverified, fail-closed).
 //
+// THE ATTESTATION PASS (task 1001433; owner's option 1, 2026-09-26). The author
+// NAME above is typed text — anyone can commit as 'IAMMASTERQUA'. What cannot be
+// typed is the `gate-author-trust` commit status the SERVER posts on a ship's
+// pushed tip after resolving the builder's CLI session to a Metic+ rank
+// (POST /tasks/:id/attest-gate + publish-branch, ADR 0058). So each protected-path
+// commit is traced to the pull request that brought it onto main (the second
+// parent of its first-parent merge) and that head must carry a SUCCESS status of
+// that context, posted by the server's own GitHub identity. A status with the same
+// name posted by any other account is ignored: anyone with write access can post a
+// status, so the CREATOR is the part that cannot be faked. FLAG-ONLY for now, by
+// the owner's ruling: an unattested commit is a 'review' finding and never changes
+// the exit code. It needs a GitHub token (GITHUB_TOKEN / GH_TOKEN); without one it
+// says it did not run rather than passing.
+//
 // Usage:
 //   node scripts/gds/main-audit.js                       # audit last 50 on origin/main
 //   node scripts/gds/main-audit.js --range A..B          # audit an explicit range
@@ -35,6 +49,10 @@
 //   node scripts/gds/main-audit.js --strict              # also block on unresolved authors
 //   node scripts/gds/main-audit.js --db                  # resolve ranks from Postgres instead of the API
 //   node scripts/gds/main-audit.js --require-roster      # CI: an empty roster is a loud DID-NOT-RUN, not a vacuous green
+//   node scripts/gds/main-audit.js --require-attestation # CI: an attestation pass that could not run exits 2
+//   node scripts/gds/main-audit.js --attest-login <login> # the account the server posts statuses as (default: the repo owner)
+//   node scripts/gds/main-audit.js --no-attestation      # skip the attestation pass
+//   GH_TOKEN=$(gh auth token) node scripts/gds/main-audit.js   # a local run with the attestation pass
 //
 // EXIT CONTRACT — never `process.exit()` here, use `cliExit(code)` + `return`
 // (task 1003772). Every exit in this file lands after the roster request, and a
@@ -160,6 +178,102 @@ function strictestFloorLabel(hits, registry) {
   return top ? top.charAt(0).toUpperCase() + top.slice(1) : 'Metic';
 }
 
+// ---------- attestation pass (task 1001433) — pure half ----------
+
+// The status context the server posts on a ship's pushed tip (task-route-helpers.js
+// postGateAuthorTrust). Only a SUCCESS of this context by the trusted creator counts.
+const ATTEST_CONTEXT = 'gate-author-trust';
+
+// Which pull-request head vouches for each commit. For every MAINLINE merge (a
+// first-parent commit of main with two parents), the commits it brought in —
+// reachable from its second parent and not from its first — are covered by that
+// second parent: the PR head the server attested at ship time. `revList(range)`
+// returns the shas of a `git rev-list` range; it is a parameter so the mapping is
+// testable without a repository.
+//
+// Only MAINLINE merges may be passed in. A merge INSIDE a pull request ("Merge
+// origin/main into my-branch") has main commits as its second parent, and letting
+// it vouch would credit a branch's merge-from-main for work it never carried.
+function mapIntroducingHeads(mainlineMerges, revList) {
+  const headOf = new Map();
+  for (const m of mainlineMerges || []) {
+    const [first, second] = m.parents || [];
+    if (!first || !second) continue;
+    for (const sha of revList(`${first}..${second}`)) {
+      if (!headOf.has(sha)) headOf.set(sha, second);
+    }
+  }
+  return headOf;
+}
+
+// Did the trusted account attest this head? `statuses` is GitHub's list for one
+// commit, newest first. Statuses from any other creator are ignored outright —
+// they can neither attest nor revoke — and of the trusted creator's own statuses
+// for the context, only the newest decides, so a later failure withdraws a success.
+function isAttested(statuses, trustedLogin) {
+  const want = String(trustedLogin || '').toLowerCase();
+  if (!want) return false;
+  const latest = (Array.isArray(statuses) ? statuses : []).find((s) => s
+    && s.context === ATTEST_CONTEXT
+    && String(s.creator?.login || '').toLowerCase() === want);
+  return !!latest && latest.state === 'success';
+}
+
+// commits: parsed commits (only the protected-path ones matter; others are skipped).
+// headOf: Map sha → the PR head that brought it in (mapIntroducingHeads). A commit
+// with no entry — a direct push to main, or a merge's own smuggled --cc surface —
+// can only be vouched for by an attestation on ITSELF.
+// attested: Set of head shas that carry the trusted attestation (fetchAttestations).
+// Returns { checked, findings[] }. Every finding is severity 'review': the owner
+// ruled this pass flag-only, so it can never make the audit fail.
+function analyzeAttestation(commits, { headOf = new Map(), attested = new Set(), trustedLogin = '', registry = ppc } = {}) {
+  const findings = [];
+  let checked = 0;
+  for (const c of commits || []) {
+    const hits = registry.matchProtected(c.files || []);
+    if (hits.length === 0) continue;
+    checked += 1;
+    // `viaPr`, not `head === c.sha`: a one-commit pull request's head IS the commit.
+    const viaPr = headOf.has(c.sha);
+    const head = viaPr ? headOf.get(c.sha) : c.sha;
+    if (attested.has(head)) continue;
+    const fileList = hits.map((h) => h.file).join(', ');
+    const mark = `successful '${ATTEST_CONTEXT}' status from '${trustedLogin}'`;
+    const confirm = `Confirm it came through a Bongos ship by a ${strictestFloorLabel(hits, registry)}+ builder.`;
+    const summary = viaPr
+      ? `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}], but the pull request that brought it in (head ${short(head)}) carries no ${mark}. ${confirm}`
+      : `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}] and reached main without passing through a pull request (a direct push, or changes a merge made itself), and it carries no ${mark} of its own. ${confirm}`;
+    findings.push({
+      severity: 'review',
+      kind: 'unattested',
+      sha: c.sha,
+      author: c.authorName,
+      head,
+      files: hits.map((h) => h.file),
+      summary,
+    });
+  }
+  return { checked, findings };
+}
+
+// Where the pass reads GitHub from. The token and repository come from the
+// environment GitHub Actions already provides (GITHUB_TOKEN, GITHUB_REPOSITORY),
+// with GH_TOKEN and the origin remote as the laptop fallbacks. The trusted login
+// defaults to the repository OWNER: this platform's server posts statuses with the
+// owner's push token (observed on PR 1233: the status creator is the owner's account), and the owner can
+// push to main directly anyway, so trusting that identity grants nothing new. An
+// instance whose server posts as a GitHub App passes --attest-login <app>[bot].
+function attestationConfig({ env = process.env, remoteUrl = '', loginArg = null } = {}) {
+  const token = env.GITHUB_TOKEN || env.GH_TOKEN || null;
+  let repo = env.GITHUB_REPOSITORY || null;
+  if (!repo && remoteUrl) {
+    const m = /github\.com[:/]([^/\s]+\/[^/\s]+?)(?:\.git)?\/?$/.exec(String(remoteUrl).trim());
+    if (m) repo = m[1];
+  }
+  const trustedLogin = (typeof loginArg === 'string' && loginArg) || (repo ? repo.split('/')[0] : null);
+  return { token, repo, trustedLogin };
+}
+
 // ---------- git + API glue (CLI) ----------
 
 function git(args) {
@@ -219,8 +333,10 @@ function parseCommits(range) {
     const subject = rest.shift();
     const files = rest.map((s) => s.trim()).filter(Boolean);
     if (!sha) continue;
-    const isMerge = parents.split(/\s+/).filter(Boolean).length > 1;
-    commits.push({ sha, subject, authorName, authorEmail, isMerge, files });
+    // Kept in order: the attestation pass needs a merge's SECOND parent (the PR head).
+    const parentList = parents.split(/\s+/).filter(Boolean);
+    const isMerge = parentList.length > 1;
+    commits.push({ sha, subject, authorName, authorEmail, isMerge, parents: parentList, files });
   }
   // #863-followup (finding #5): `git log --name-only` emits NO files for merge
   // commits, so a merge that SMUGGLES a protected change (an "evil merge" /
@@ -310,6 +426,69 @@ async function fetchRankMap({ useDb = false } = {}) {
   return {};
 }
 
+// ---------- attestation pass (task 1001433) — I/O half ----------
+
+const GITHUB_API = 'https://api.github.com';
+
+// Read each head's statuses and keep the ones the trusted account attested. A head
+// whose statuses could not be read is reported as `unreadable`, never guessed at:
+// an unread head is not an unattested one, and treating it as attested would be
+// the vacuous pass this file keeps refusing.
+async function fetchAttestations(heads, { repo, token, trustedLogin, fetchImpl = fetch, apiBase = GITHUB_API } = {}) {
+  const attested = new Set();
+  const unreadable = [];
+  for (const sha of new Set(heads || [])) {
+    try {
+      const res = await fetchImpl(`${apiBase}/repos/${repo}/commits/${sha}/statuses?per_page=100`, {
+        headers: { Accept: 'application/vnd.github+json', Authorization: `Bearer ${token}`, 'X-GitHub-Api-Version': '2022-11-28' },
+      });
+      if (!res.ok) { unreadable.push({ sha, reason: `HTTP ${res.status}` }); continue; }
+      if (isAttested(await res.json(), trustedLogin)) attested.add(sha);
+    } catch (e) {
+      unreadable.push({ sha, reason: e.message });
+    }
+  }
+  return { attested, unreadable };
+}
+
+function shaLines(out) {
+  return String(out || '').split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+// The whole pass for one audited range. Returns { ran: true, checked, findings }
+// or { ran: false, reason } — the caller prints either, and only
+// --require-attestation turns a pass that could not run into a non-zero exit.
+async function runAttestationPass(commits, range, { loginArg = null, env = process.env, gitImpl = git, fetchImpl } = {}) {
+  const protectedCommits = (commits || []).filter((c) => ppc.matchProtected(c.files || []).length > 0);
+  if (protectedCommits.length === 0) return { ran: true, checked: 0, findings: [] };
+  let remoteUrl = '';
+  try { remoteUrl = gitImpl('remote get-url origin').trim(); } catch (_) { /* no origin: env must name the repo */ }
+  const cfg = attestationConfig({ env, remoteUrl, loginArg });
+  if (!cfg.token) return { ran: false, reason: 'no GitHub token (set GITHUB_TOKEN or GH_TOKEN) to read commit statuses with' };
+  if (!cfg.repo) return { ran: false, reason: 'could not tell which GitHub repository this is (set GITHUB_REPOSITORY=owner/repo)' };
+
+  let mainline;
+  try {
+    mainline = new Set(shaLines(gitImpl(`rev-list --first-parent ${range}`)));
+  } catch (e) {
+    return { ran: false, reason: `git could not list the first-parent history of ${range}: ${e.message}` };
+  }
+  const merges = (commits || []).filter((c) => mainline.has(c.sha) && (c.parents || []).length > 1);
+  let headOf;
+  try {
+    headOf = mapIntroducingHeads(merges, (r) => shaLines(gitImpl(`rev-list ${r}`)));
+  } catch (e) {
+    return { ran: false, reason: `git could not trace which pull request brought each commit in: ${e.message}` };
+  }
+  const heads = protectedCommits.map((c) => headOf.get(c.sha) || c.sha);
+  const { attested, unreadable } = await fetchAttestations(heads, { ...cfg, ...(fetchImpl ? { fetchImpl } : {}) });
+  if (unreadable.length) {
+    const sample = unreadable.slice(0, 3).map((u) => `${short(u.sha)} (${u.reason})`).join(', ');
+    return { ran: false, reason: `could not read the commit statuses of ${unreadable.length} pull-request head(s): ${sample}` };
+  }
+  return { ran: true, ...analyzeAttestation(protectedCommits, { headOf, attested, trustedLogin: cfg.trustedLogin }), trustedLogin: cfg.trustedLogin };
+}
+
 function arg(name, fallback = null) {
   const i = process.argv.indexOf(name);
   return i >= 0 ? (process.argv[i + 1] && !process.argv[i + 1].startsWith('--') ? process.argv[i + 1] : true) : fallback;
@@ -381,14 +560,28 @@ async function main() {
   }
 
   const result = analyzeCommits(parsed.commits, rankMap, { strict });
+  // Task 1001433: the attestation pass. FLAG-ONLY — its findings are 'review' and
+  // never reach `hardFail`; the one thing it can do to the exit code is report
+  // that it did not run, and only when the caller asked with --require-attestation.
+  const loginArg = arg('--attest-login');
+  const attestation = process.argv.includes('--no-attestation')
+    ? { ran: false, skipped: true, reason: 'skipped (--no-attestation)' }
+    : await runAttestationPass(parsed.commits, range, { loginArg: loginArg === true ? null : loginArg });
+  const findings = result.findings.concat(attestation.findings || []);
 
   console.log(`\nMain audit (SEC #863) — range ${range}, ${parsed.commits.length} commit(s)`);
-  if (result.findings.length === 0) {
+  if (attestation.ran) {
+    console.log(`  attestation (task 1001433, flag-only): ${attestation.checked} permission-sensitive commit(s) checked, ${attestation.findings.length} without the server's '${ATTEST_CONTEXT}' mark.`);
+  } else {
+    console.log(`  attestation (task 1001433, flag-only): DID NOT RUN — ${attestation.reason}.`);
+  }
+  const attestationMissing = !attestation.ran && !attestation.skipped && process.argv.includes('--require-attestation');
+  if (findings.length === 0) {
     console.log('  ✓ clean — no sub-Metic edits to permission-sensitive paths.\n');
-    cliExit(0);
+    cliExit(attestationMissing ? 2 : 0);
     return;
   }
-  for (const f of result.findings) {
+  for (const f of findings) {
     const tag = f.severity === 'blocker' ? '\x1b[31m[BLOCKER]\x1b[0m' : '\x1b[33m[review]\x1b[0m';
     console.log(`  ${tag} ${f.summary}`);
   }
@@ -407,8 +600,9 @@ async function main() {
     cliExit(result.hardFail ? 1 : 0);
     return;
   }
-  // report mode: non-zero on a real blocker so CI can fail.
-  cliExit(result.hardFail ? 1 : 0);
+  // report mode: non-zero on a real blocker so CI can fail. A blocker outranks an
+  // attestation pass that did not run: 1 is a definite answer, 2 is "no answer".
+  cliExit(result.hardFail ? 1 : (attestationMissing ? 2 : 0));
 }
 
 if (require.main === module) {
@@ -425,4 +619,7 @@ module.exports = {
   // path was dead for as long as the db.js carve has been landed precisely because
   // nothing checked that this require target still exports what it is called for.
   ROSTER_DB_MODULE, fetchRankMap,
+  // The attestation pass (task 1001433): pure halves + the I/O half with its seams.
+  ATTEST_CONTEXT, mapIntroducingHeads, isAttested, analyzeAttestation, attestationConfig,
+  fetchAttestations, runAttestationPass,
 };

package/scripts/gds/seam-wiring-guard.js

@@ -95,11 +95,13 @@ const SEAM_CONSUMERS = {
     artifact: (dir, entry) => path.join(dir, 'rooms', `${entry}.js`),
   },
   uiSections: {
-    // Per-MODULE, not per-entry: hallWidgetScripts looks for one hall-widget.js
-    // however many sections the module names.
+    // Per-MODULE, not per-entry: hallWidgetScripts looks for one widget file per page
+    // however many sections the module names — hall-widget.js for the index, and since
+    // task 1004301 task-widget.js for a task's page. Either one wires the declaration.
     consumer: 'src/module-loader/loader.js hallWidgetScripts',
     kind: 'file',
     artifact: (dir) => path.join(dir, 'public', 'hall-widget.js'),
+    alternates: (dir) => [path.join(dir, 'public', 'task-widget.js')],
   },
   skills: {
     // moduleSkillSources resolves a declared name against the module's OWN tree or

package/scripts/hall-preview/server.js

@@ -77,7 +77,8 @@ let express;
 try { express = require(path.join(ROOT, 'node_modules', 'express')); }
 catch (_) { express = require('express'); }
 const { buildStampedHtml } = require(path.join(ROOT, 'src', 'asset-version.js'));
-const { injectBrandingGlobal, mountInternalSurfaces } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
+const { injectBrandingGlobal, mountInternalSurfaces, injectModuleHallWidgets } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
+const { hallWidgetScripts } = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
 const { clientModules } = require(path.join(ROOT, 'src', 'modules.js'));
 const { overrideKey, resolveLiveIdentity } = require('./live-identity');
 
@@ -128,6 +129,9 @@ const FIXTURE_FALLBACKS = [
   // without it /deploy?project=… only ever rendered its "could not read" state, which
   // is the trap this directory's README calls out by name.
   [/^provisioning\/instances\/\d+\/core-upgrade$/, 'provisioning__instances__core-upgrade'],
+  // the npm-release module's line on a task's page (task 1004301): one reading serves any
+  // id, as the core-upgrade preview above does — the page shows one task.
+  [/^npm-release\/task\/\d+$/, 'npm-release__task'],
 ];
 
 // A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request
@@ -283,6 +287,15 @@ for (const key of MODULES_OFF) {
 for (const key of MODULES_ON) {
   (mods.enabled = mods.enabled || {})[key] = true;
 }
+// Module page widgets, injected at boot exactly as serve-internal.js does for prod: the
+// hall index's hall-widget.js and a task page's task-widget.js (task 1004301), for the
+// modules THIS harness runs with. Without it a module's line on a page could never be
+// previewed — the page would only ever render its empty slot.
+{
+  const isOn = (k) => !!(mods.enabled && mods.enabled[k]);
+  if (stamped['index.html']) stamped['index.html'] = injectModuleHallWidgets(stamped['index.html'], hallWidgetScripts({ isEnabled: isOn }));
+  if (stamped['task.html']) stamped['task.html'] = injectModuleHallWidgets(stamped['task.html'], hallWidgetScripts({ isEnabled: isOn, file: 'task-widget.js' }), 'task');
+}
 
 function sendPage(res, name) {
   const html = stamped[name];

package/{modules/npm-release/registry.js → src/bongos/package-registry.js}

@@ -1,14 +1,21 @@
 'use strict';
 
-// modules/npm-release/registry.js — what the npm registry says about the package: which
+// src/bongos/package-registry.js — what the npm registry says about a package: which
 // versions exist, when each was published, which one carries the `latest` label, and the
-// release notes the newest version was packed with (task 1002622).
+// release notes the newest version was packed with (task 1002622; moved into the core by
+// task 1004296).
+//
+// WHY IT IS THE CORE'S. Two readers need it. Settings → Software update (software-update.js)
+// runs in EVERY project's hall, because every project installs releases; a deploy-page
+// module runs in the one hall that publishes them and reaches this through the doorway
+// (`readPackageRegistry` in src/module-api.js). Kept in a module, the one reader every hall
+// needs would have been inside the one module only one hall runs.
 //
 // WHY THE NEWEST PACKAGE'S NOTES. package-core writes release-notes.json from the WHOLE
 // history at pack time (scripts/gds/release-notes.js, task 1004218), so the newest version
-// alone lists every version before it. One file answers the whole page. The copy the
-// running core carries stops at its own version, which is exactly the range the deploy
-// page is asked about least: the work that is published but not running yet.
+// alone lists every version before it. One file answers every reader. The copy the
+// running core carries stops at its own version, which is exactly the range both readers
+// are asked about most: what is published but not running yet.
 //
 // NEVER A CHILD PROCESS, NEVER A SYNC CALL. This runs inside the web process, so the
 // upgrade runner's `npm pack` + `tar -xzOf` (provision-core-upgrade.js readPackagedNotes)
@@ -242,7 +249,7 @@ async function cached(slot, fresh, load, t) {
 }
 
 /**
- * Everything the registry can tell the deploy page about `pkg`, in one call.
+ * Everything the registry can tell a reader about `pkg`, in one call.
  *
  * Returns `{ registry, notes }`:
  *   registry — `{ ok, versions, published, latest, newest }` or `{ ok:false, error }`
@@ -268,4 +275,4 @@ async function readRegistry({ pkg, haveNotesFor = () => false, get = https.get,
   return { registry, notes: { ...notes, version } };
 }
 
-module.exports = { readRegistry, compareVersions };
+module.exports = { readRegistry };