@bongos/core 1.19.1070 → 1.19.1071

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1070",
-  "core_contract": "1.19.1070",
-  "source_commit": "29b03916fdfb3db5873c375368034d583292771c",
+  "core_version": "1.19.1071",
+  "core_contract": "1.19.1071",
+  "source_commit": "e952aeff8fd966ba7aea8a72df82e4d825c22648",
   "source_ref": "HEAD",
-  "built_at": "2026-09-28T19:26:10.902Z",
+  "built_at": "2026-09-28T19:35:40.500Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 548,
+    "docs_redacted": 549,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2560,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3135,
-  "tree_sha256": "5963a33209a60bdef8a18d5e3079f967a2904f56eb3d1c272ae6732bca49b6d7",
+  "file_count": 3136,
+  "tree_sha256": "364a060541bc6ea130edf33f92ee954d0ccf420f8727ea29239c18392f5621c1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2179,10 +2179,15 @@
       "mode": "0000644",
       "sha256": "f847a769842c5c57a86ef8951e685da3b61474029b54b6620046713de7c6c93c"
     },
+    {
+      "path": "docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md",
+      "mode": "0000644",
+      "sha256": "821f3c073de063aa9f3df9622a5b138cc5060754bb986cd5c747494150ec59db"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "9191ebf6660a5edb6ab14ece27019e8c1a5a6dae90df22dc1ec90b0cb1f331d1"
+      "sha256": "36568b2672c4b2ea76feda41fa9fe5bdffa3c10a1aaa56f862c663559712ed8b"
     },
     {
       "path": "docs/api-reference.md",
@@ -2752,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9b2a2c13ff569477f2f082fa8b9d55b8d0a67ba4bbb4984f082b622d1e11020b"
+      "sha256": "e8f17d79acc62fcacbcdb415295e23a8385bb050cc544b1c20fb3328b05eaa49"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8642,12 +8647,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3019ba0c99d39d85cc43a7d282172015e852587e60a74d25488747923c86fd09"
+      "sha256": "b8899117fdc884212b4d763f9a01641137ac5e5b148f2b608d5866137ec86afe"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d72cc720cb066ca355eacbf9cb7dfe58b705321eb8f6f7c399bea6ce595cff77"
+      "sha256": "d5ff7c99d5927cf91fc93d442725c14383695ed34576cd76840ae3d1579336a3"
     },
     {
       "path": "public-docs/index.html",
@@ -8667,7 +8672,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "2af6ab7d17b6dbe0b5d4cd3f4b78cc6867b3e15c9ea184e464b8d34a5b6637ca"
+      "sha256": "71549984e44e3f37dd1b858db883c2f9916ad409dff338a42e2664258980c420"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10757,7 +10762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0a84382c9ce6c0a49fe3e6bcc694047b8cda6c731c57d10e99c71819d606d340"
+      "sha256": "f05875c00f06c453f995f13626deff2da66a9a31730d4f483756f4d74cbcc588"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md

@@ -0,0 +1,86 @@
+# ADR 0343 — A module's score is a security gate, then an average of parts every buyer can see
+
+- **Status:** accepted
+- **Date:** 2026-09-28
+- **Task:** [task 1003790](https://cloudbongos.com/builders#/task/1003790) (goal 1000091 — working area 5, Module distribution & economy)
+- **Deciders:** Will (owner of working area 5) chose how the signals combine, and added that each part's score must be visible; Claude inventoried the measurable signals and wrote the record.
+- **Related:** [ADR 0338](0338-modules-travel-through-a-bongos-hosted-store.md) (the hosted store) · [ADR 0342](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) (the sub-category the ranking runs in) · [ADR 0027](0027-bfg-session-inefficiency-evaluator.md) (prior art: a multi-dimension evaluation) · [session log 2026-09-10](../session-logs/2026-09-10-goal-1000091-area-5-criteria.md)
+
+## Context
+
+Criterion `wa5-quality-assessed` says Bongos scores each module **from what the platform can
+measure itself**, with a Metic+ override and delist, and free modules assessed identically. No
+module score exists today. `bongos module check` is a pass/fail submit gate, not a grade. The
+quality floor (task 1003807), the ranking (task 1003808) and the cap (task 1003809) all derive
+from this score. That makes the formula the thing an author appeals against, so it has to be
+explainable in a sentence.
+
+## Decision
+
+### D1 — The parts, and when each one arrives
+
+| Part | What it measures | Available |
+|---|---|---|
+| **Security** | dependency and code scan (task 1003792) | day one |
+| **Tests** | pass rate of the module's own tests, run by the platform (task 1003791) | day one |
+| **Install** | share of installs that complete cleanly (task 1003793) | once real installs exist |
+| **Reliability** | runtime error and crash rate from real installs (task 1003793) | once real installs exist |
+| **Tester feedback** | what testers hit during staged rollout (task 1003806) | once staged rollout exists |
+
+Each part is scored 0–100 per module **version**, because a new version can be better or worse
+than the last.
+
+### D2 — Security is a gate, not an ingredient
+
+A version that **fails the security check is not listed**, whatever else it scores. Security is
+never averaged in, so a module can't make up for a vulnerability with good tests.
+
+### D3 — The overall score is the plain average of the other parts that have data
+
+Overall = the unweighted average of whichever of Tests, Install, Reliability and Tester
+feedback have data for that version. A part with no data yet is left out, not counted as zero.
+
+Unweighted on purpose: an author who asks "why did I score 71?" gets an answer they can check
+themselves. Weights can be added later by a superseding ADR, if real data shows one part
+predicts quality better than the others.
+
+### D4 — Every part is visible, not just the overall number (owner)
+
+The owner's addition: **each part's score is shown to buyers alongside the overall score**, so
+someone comparing two modules can pick the one that is strongest where it matters to them. One
+buyer might care most about reliability, another about test coverage. The overall number sorts
+the listing; the parts explain it. This is the requirement tasks 1003798 (store per-part
+scores) and 1003799 (show strengths and weaknesses in the API and hall) build to.
+
+### D5 — A version without real-world data is labelled "New", not scored low
+
+Until a version has Install or Reliability data, it shows as **New**, with its day-one parts
+(Security passed, Tests score) visible. It isn't pushed below the floor for lacking data it
+couldn't have yet. The floor and the ranking decide how New modules are placed (tasks 1003807,
+1003808). This ADR only says a missing part is never a zero.
+
+### D6 — Free and paid are scored identically; Metic+ can override with an audit entry
+
+Price is never an input. The Metic+ override (task 1003796) and delist (task 1003797) sit on
+top of the computed score and never replace how it is computed. Every override is recorded.
+
+## Consequences
+
+- **Day one, only Tests counts toward the overall score**, behind the Security gate. The number
+  becomes more meaningful as installs and testers arrive. The "New" label (D5) makes that honest
+  rather than hidden.
+- **Re-assessment runs per version** (task 1003794) and whenever new install, reliability or
+  tester data arrives.
+- **A score an author can reproduce** is the appeal path: every part and the averaging rule are
+  public.
+
+## Rejected
+
+- **A simple average including security.** A module with a known vulnerability could still
+  score well.
+- **A weighted average from day one.** The weights would be guesses, and harder to justify to an
+  author asking why they scored low.
+- **One overall number only.** Two modules with the same score can be good at different things,
+  and the owner wants buyers to see that.
+- **Counting a missing part as zero.** It would punish every new module for data it couldn't
+  have yet.

package/docs/adr/README.md

@@ -434,3 +434,4 @@ This keeps the decision history honest and traceable.
 | 0340 | [**Every hall takes its update from Settings, and /deploy is the platform hall's page** ([task 1004296](https://cloudbongos.com/builders#/task/1004296), goal 1000090 — the owner's 2026-09-25 asks: a Settings version panel "just like iOS", and /deploy only in the Bongos hall). Amends ADR 0339 D3 and the reach of ADR 0293's page. **D1:** Settings → Software update in the core — the running core, the newest release the runner's own channel rule allows, and what each version in between carries from the newest package's release notes; every signed-in builder reads it, and "up to date" is said only from an answer. **D2:** its Update button leads to the door (local /deploy, the hub's /deploy?project=, or a `bongos upgrade` sentence), drawn only for holders of core.pin.move. **D3:** /deploy 302s to Settings on a hall without the provisioning module. **D4:** the banner links Settings everywhere but the platform; the rail is no longer re-pointed; /core-update drops deploy_url. **D5:** the registry reader moved into the core (module-api readPackageRegistry). Rejected: a second copy of the two-step door, gating the panel on the atom, a "moved" page.](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) | deploy door / settings / core update |
 | 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks are listed for the owner to confirm.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
 | 0342 | [**Module categories are eight fixed parents, with narrow sub-categories an author proposes and Metic+ approves** ([task 1003783](https://cloudbongos.com/builders#/task/1003783), goal 1000091 — working area 5, owner Will). The owner's cap of ten listed modules needs a comparable set, and nothing carried a category. **D1:** eight parents derived from the live roster — Work & planning, Team & people, Quality & review, Money, Communication, Pages & design, Hosting & deploy, Knowledge — for browsing only; the cap never applies to a parent. **D2:** the sub-category (the narrow set a buyer chooses between, e.g. "Stripe payments") is where the cap, ranking and comparison run. **D3 (owner):** an author proposes a sub-category and a Metic+ builder approves, renames or merges it, because free-naming would split one comparable set into near-duplicates and the cap would never bite; a pending module lists under its parent and counts toward no cap. **D4:** one sub-category per module. Rejected: free naming, Metic+-only creation, a flat list, parent-level caps.](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) | modules / store / economy |
+| 0343 | [**A module's score is a security gate, then an average of parts every buyer can see** ([task 1003790](https://cloudbongos.com/builders#/task/1003790), goal 1000091 — working area 5, owner Will). No module score existed; the floor, ranking and cap all derive from this one. **D1:** five parts, each 0–100 per version — Security and Tests day one; Install, Reliability (from real installs) and Tester feedback later. **D2 (owner):** failing Security means not listed, never averaged in. **D3 (owner):** overall = unweighted average of the other parts that have data; a missing part is left out, not zero. **D4 (owner):** every part's score is shown to buyers beside the overall, so they can pick the module strongest where they care (tasks 1003798/1003799). **D5:** a version without real-world data is labelled "New". **D6:** price is never an input; the Metic+ override/delist sits on top and is audited. Rejected: security in the average, day-one weights, a single number, missing-as-zero.](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) | modules / store / quality |

package/docs/module-api-changelog.md

@@ -2627,5 +2627,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1068 with no explicit bump. run 36470192310. (task 1002620)
   1.19.1070 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1069 with no explicit bump. run 36472133987. (task 1002620)
+  1.19.1071 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1070 with no explicit bump. run 36473239367. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1070",
+  "version": "1.19.1071",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1070",
+      "version": "1.19.1071",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1070",
+  "version": "1.19.1071",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7725,5 +7725,11 @@
       "id": "1003783",
       "text": "Decided how modules in the store are grouped: eight broad sections, each with narrow sub-categories that authors suggest and trusted builders approve, so the top-ten limit compares like with like."
     }
+  ],
+  "1.19.1071": [
+    {
+      "id": "1003790",
+      "text": "Decided how the store scores modules: a failed security check keeps a module out, the rest is averaged, and buyers can see each part of the score to pick the module that is best at what they need."
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1070'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1071'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');