@bongos/core 1.19.1070 → 1.19.1072

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1070",
-  "core_contract": "1.19.1070",
-  "source_commit": "29b03916fdfb3db5873c375368034d583292771c",
+  "core_version": "1.19.1072",
+  "core_contract": "1.19.1072",
+  "source_commit": "48d55ade62291fbba8936935b42af6a649afe2fb",
   "source_ref": "HEAD",
-  "built_at": "2026-09-28T19:26:10.902Z",
+  "built_at": "2026-09-28T19:44:55.659Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 548,
+    "docs_redacted": 550,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2560,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3135,
-  "tree_sha256": "5963a33209a60bdef8a18d5e3079f967a2904f56eb3d1c272ae6732bca49b6d7",
+  "file_count": 3137,
+  "tree_sha256": "9f1989ff166c82430f3ddabbe39fefb2fb4ddee0f2e12cf747c100b5954c9957",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2179,10 +2179,20 @@
       "mode": "0000644",
       "sha256": "f847a769842c5c57a86ef8951e685da3b61474029b54b6620046713de7c6c93c"
     },
+    {
+      "path": "docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md",
+      "mode": "0000644",
+      "sha256": "821f3c073de063aa9f3df9622a5b138cc5060754bb986cd5c747494150ec59db"
+    },
+    {
+      "path": "docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md",
+      "mode": "0000644",
+      "sha256": "ca2a376a0c555f28a3ce82542f9e7b5ac4d5da1713bf0a423087515a81d8ee7e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "9191ebf6660a5edb6ab14ece27019e8c1a5a6dae90df22dc1ec90b0cb1f331d1"
+      "sha256": "f319359f17b3ae842b73ea32f7150915189048d7faf55b77d43fa0129835daf0"
     },
     {
       "path": "docs/api-reference.md",
@@ -2752,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9b2a2c13ff569477f2f082fa8b9d55b8d0a67ba4bbb4984f082b622d1e11020b"
+      "sha256": "45f4eae24f6557f3bbec81455b4ec6020f9941477f557415f184ff2c0287490e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8642,12 +8652,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3019ba0c99d39d85cc43a7d282172015e852587e60a74d25488747923c86fd09"
+      "sha256": "6d69aeb12a310ff98b05459e0a7a9d070267e953de7d9dc9836368b4d3034090"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d72cc720cb066ca355eacbf9cb7dfe58b705321eb8f6f7c399bea6ce595cff77"
+      "sha256": "45e245a9e6d915f4e6625b5bf21be85d69a5d97a787acf1f790ff75e65f41d46"
     },
     {
       "path": "public-docs/index.html",
@@ -8667,7 +8677,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "2af6ab7d17b6dbe0b5d4cd3f4b78cc6867b3e15c9ea184e464b8d34a5b6637ca"
+      "sha256": "f04ac4ef2f41e8c246bc190e16b649ff8251a49d682a3eec0830a6595d816756"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10757,7 +10767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0a84382c9ce6c0a49fe3e6bcc694047b8cda6c731c57d10e99c71819d606d340"
+      "sha256": "c62ff0384b44fb6900657484cd1e5d53e8920d1f815d8af3b247aecc605f795c"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md

@@ -0,0 +1,86 @@
+# ADR 0343 — A module's score is a security gate, then an average of parts every buyer can see
+
+- **Status:** accepted
+- **Date:** 2026-09-28
+- **Task:** [task 1003790](https://cloudbongos.com/builders#/task/1003790) (goal 1000091 — working area 5, Module distribution & economy)
+- **Deciders:** Will (owner of working area 5) chose how the signals combine, and added that each part's score must be visible; Claude inventoried the measurable signals and wrote the record.
+- **Related:** [ADR 0338](0338-modules-travel-through-a-bongos-hosted-store.md) (the hosted store) · [ADR 0342](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) (the sub-category the ranking runs in) · [ADR 0027](0027-bfg-session-inefficiency-evaluator.md) (prior art: a multi-dimension evaluation) · [session log 2026-09-10](../session-logs/2026-09-10-goal-1000091-area-5-criteria.md)
+
+## Context
+
+Criterion `wa5-quality-assessed` says Bongos scores each module **from what the platform can
+measure itself**, with a Metic+ override and delist, and free modules assessed identically. No
+module score exists today. `bongos module check` is a pass/fail submit gate, not a grade. The
+quality floor (task 1003807), the ranking (task 1003808) and the cap (task 1003809) all derive
+from this score. That makes the formula the thing an author appeals against, so it has to be
+explainable in a sentence.
+
+## Decision
+
+### D1 — The parts, and when each one arrives
+
+| Part | What it measures | Available |
+|---|---|---|
+| **Security** | dependency and code scan (task 1003792) | day one |
+| **Tests** | pass rate of the module's own tests, run by the platform (task 1003791) | day one |
+| **Install** | share of installs that complete cleanly (task 1003793) | once real installs exist |
+| **Reliability** | runtime error and crash rate from real installs (task 1003793) | once real installs exist |
+| **Tester feedback** | what testers hit during staged rollout (task 1003806) | once staged rollout exists |
+
+Each part is scored 0–100 per module **version**, because a new version can be better or worse
+than the last.
+
+### D2 — Security is a gate, not an ingredient
+
+A version that **fails the security check is not listed**, whatever else it scores. Security is
+never averaged in, so a module can't make up for a vulnerability with good tests.
+
+### D3 — The overall score is the plain average of the other parts that have data
+
+Overall = the unweighted average of whichever of Tests, Install, Reliability and Tester
+feedback have data for that version. A part with no data yet is left out, not counted as zero.
+
+Unweighted on purpose: an author who asks "why did I score 71?" gets an answer they can check
+themselves. Weights can be added later by a superseding ADR, if real data shows one part
+predicts quality better than the others.
+
+### D4 — Every part is visible, not just the overall number (owner)
+
+The owner's addition: **each part's score is shown to buyers alongside the overall score**, so
+someone comparing two modules can pick the one that is strongest where it matters to them. One
+buyer might care most about reliability, another about test coverage. The overall number sorts
+the listing; the parts explain it. This is the requirement tasks 1003798 (store per-part
+scores) and 1003799 (show strengths and weaknesses in the API and hall) build to.
+
+### D5 — A version without real-world data is labelled "New", not scored low
+
+Until a version has Install or Reliability data, it shows as **New**, with its day-one parts
+(Security passed, Tests score) visible. It isn't pushed below the floor for lacking data it
+couldn't have yet. The floor and the ranking decide how New modules are placed (tasks 1003807,
+1003808). This ADR only says a missing part is never a zero.
+
+### D6 — Free and paid are scored identically; Metic+ can override with an audit entry
+
+Price is never an input. The Metic+ override (task 1003796) and delist (task 1003797) sit on
+top of the computed score and never replace how it is computed. Every override is recorded.
+
+## Consequences
+
+- **Day one, only Tests counts toward the overall score**, behind the Security gate. The number
+  becomes more meaningful as installs and testers arrive. The "New" label (D5) makes that honest
+  rather than hidden.
+- **Re-assessment runs per version** (task 1003794) and whenever new install, reliability or
+  tester data arrives.
+- **A score an author can reproduce** is the appeal path: every part and the averaging rule are
+  public.
+
+## Rejected
+
+- **A simple average including security.** A module with a known vulnerability could still
+  score well.
+- **A weighted average from day one.** The weights would be guesses, and harder to justify to an
+  author asking why they scored low.
+- **One overall number only.** Two modules with the same score can be good at different things,
+  and the owner wants buyers to see that.
+- **Counting a missing part as zero.** It would punish every new module for data it couldn't
+  have yet.

package/docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md

@@ -0,0 +1,77 @@
+# ADR 0344 — A tester is a project that opts in once; an untested version reaches everyone after seven days
+
+- **Status:** accepted
+- **Date:** 2026-09-28
+- **Task:** [task 1003801](https://cloudbongos.com/builders#/task/1003801) (goal 1000091 — working area 5, Module distribution & economy)
+- **Deciders:** Will (owner of working area 5) chose the opt-in shape and the no-volunteer rule, and accepted the defaults for updates and tester pricing; Claude wrote the record.
+- **Related:** [ADR 0338](0338-modules-travel-through-a-bongos-hosted-store.md) (the hosted store and its channel check) · [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) (the security gate and tester feedback as a score part) · [ADR 0264](0264-the-ten-working-areas.md)
+
+## Context
+
+Criterion `wa5-staged-rollout` says willing users test a version before everyone gets it.
+"Willing" was undecided, and the build depends on it. The open questions: does a project opt in
+once or per module; who can opt in; what happens when nobody volunteers; does this cover
+updates; and do testers pay.
+
+## Decision
+
+### D1 — A project opts in once, and can skip individual modules (owner)
+
+Being a tester is a **per-project** setting, switched on by that project's own admin. A tester
+project gets tester-channel versions of **every module it has**, except any module it has
+switched to "general only".
+
+- It is the **project**, not an individual builder, that opts in, because the project is what
+  runs the module. A builder cannot opt in someone else's project.
+- The switch is visible and reversible. Turning it off puts the project back on general
+  versions from its next update.
+- "Willing" is load-bearing: a project is never a tester by default.
+
+### D2 — Testing covers updates, not only first releases
+
+Every new version, first release or update, goes to the tester channel first. An update to a
+module people already rely on is where an untested version does the most damage.
+
+### D3 — An untested version reaches everyone after seven days (owner)
+
+A new version moves from the tester channel to general **after seven days**, if it still passes
+the security gate and its tests (ADR 0343). This applies whether or not any tester picked it up,
+so a module nobody volunteers for still gets updated.
+
+The seven days is the baseline. The promotion gate (task 1003804) may also promote **earlier** on
+evidence (for example, enough clean tester installs) or **hold** a version on evidence (tester
+errors), but it never holds one forever for lack of testers.
+
+### D4 — Testers pay the normal price
+
+A tester gets an early version of a module it already has, on the same terms. Being a tester is
+not a way to get a paid module for free. **A discount or free access for testers is area 8's
+call** (credits and payments, goal 1000092). This ADR names the question rather than deciding it.
+
+### D5 — What testers see feeds the score
+
+A tester project's install success, errors and crashes on a tester version are the tester
+feedback part of the module's score (ADR 0343 D1, task 1003806).
+
+## Consequences
+
+- **Task 1003802** (opt in) builds a per-project tester switch plus a per-module
+  "general only" override, on the project's own admin surface.
+- **Task 1003803** (tester channel first) applies to every published version, updates included.
+- **Task 1003804** (promotion gate) builds to D3: seven days by default, may promote earlier or
+  hold on evidence, and never waits forever.
+- **Task 1003805** (install/update honour the channel) serves a tester project tester versions,
+  except for its "general only" modules.
+- **Removal is unchanged.** Under ADR 0338 D2, a version a tester already installed keeps
+  working even if it is later withdrawn.
+
+## Rejected
+
+- **Opt in per module only.** More control, but few projects would bother, leaving too few
+  testers.
+- **One all-or-nothing switch.** There'd be no way to avoid early versions of a module a project
+  depends on heavily.
+- **Waiting for a tester before general release.** A module nobody volunteers for would never be
+  updated.
+- **Releasing to everyone at once.** Testing would only happen when volunteers happened to be
+  there.

package/docs/adr/README.md

@@ -434,3 +434,5 @@ This keeps the decision history honest and traceable.
 | 0340 | [**Every hall takes its update from Settings, and /deploy is the platform hall's page** ([task 1004296](https://cloudbongos.com/builders#/task/1004296), goal 1000090 — the owner's 2026-09-25 asks: a Settings version panel "just like iOS", and /deploy only in the Bongos hall). Amends ADR 0339 D3 and the reach of ADR 0293's page. **D1:** Settings → Software update in the core — the running core, the newest release the runner's own channel rule allows, and what each version in between carries from the newest package's release notes; every signed-in builder reads it, and "up to date" is said only from an answer. **D2:** its Update button leads to the door (local /deploy, the hub's /deploy?project=, or a `bongos upgrade` sentence), drawn only for holders of core.pin.move. **D3:** /deploy 302s to Settings on a hall without the provisioning module. **D4:** the banner links Settings everywhere but the platform; the rail is no longer re-pointed; /core-update drops deploy_url. **D5:** the registry reader moved into the core (module-api readPackageRegistry). Rejected: a second copy of the two-step door, gating the panel on the atom, a "moved" page.](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) | deploy door / settings / core update |
 | 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks are listed for the owner to confirm.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
 | 0342 | [**Module categories are eight fixed parents, with narrow sub-categories an author proposes and Metic+ approves** ([task 1003783](https://cloudbongos.com/builders#/task/1003783), goal 1000091 — working area 5, owner Will). The owner's cap of ten listed modules needs a comparable set, and nothing carried a category. **D1:** eight parents derived from the live roster — Work & planning, Team & people, Quality & review, Money, Communication, Pages & design, Hosting & deploy, Knowledge — for browsing only; the cap never applies to a parent. **D2:** the sub-category (the narrow set a buyer chooses between, e.g. "Stripe payments") is where the cap, ranking and comparison run. **D3 (owner):** an author proposes a sub-category and a Metic+ builder approves, renames or merges it, because free-naming would split one comparable set into near-duplicates and the cap would never bite; a pending module lists under its parent and counts toward no cap. **D4:** one sub-category per module. Rejected: free naming, Metic+-only creation, a flat list, parent-level caps.](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) | modules / store / economy |
+| 0343 | [**A module's score is a security gate, then an average of parts every buyer can see** ([task 1003790](https://cloudbongos.com/builders#/task/1003790), goal 1000091 — working area 5, owner Will). No module score existed; the floor, ranking and cap all derive from this one. **D1:** five parts, each 0–100 per version — Security and Tests day one; Install, Reliability (from real installs) and Tester feedback later. **D2 (owner):** failing Security means not listed, never averaged in. **D3 (owner):** overall = unweighted average of the other parts that have data; a missing part is left out, not zero. **D4 (owner):** every part's score is shown to buyers beside the overall, so they can pick the module strongest where they care (tasks 1003798/1003799). **D5:** a version without real-world data is labelled "New". **D6:** price is never an input; the Metic+ override/delist sits on top and is audited. Rejected: security in the average, day-one weights, a single number, missing-as-zero.](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) | modules / store / quality |
+| 0344 | [**A tester is a project that opts in once; an untested version reaches everyone after seven days** ([task 1003801](https://cloudbongos.com/builders#/task/1003801), goal 1000091 — working area 5, owner Will). Settles "willing user" for criterion `wa5-staged-rollout`. **D1 (owner):** a project's own admin switches on "tester" once and gets tester versions of every module it has, with a per-module "general only" override; never on by default; a builder cannot opt in someone else's project. **D2:** first releases and updates alike go to testers first. **D3 (owner):** a version moves to general after seven days if it still passes the security gate and tests, tested or not; the promotion gate may promote earlier or hold on evidence, never forever. **D4:** testers pay the normal price; any tester discount is area 8's call, named not decided. **D5:** tester installs, errors and crashes feed the score (ADR 0343). Rejected: per-module-only opt-in, one all-or-nothing switch, waiting for a tester, releasing at once.](0344-a-tester-is-a-project-that-opts-in-once.md) | modules / store / rollout |

package/docs/module-api-changelog.md

@@ -2627,5 +2627,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1068 with no explicit bump. run 36470192310. (task 1002620)
   1.19.1070 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1069 with no explicit bump. run 36472133987. (task 1002620)
+  1.19.1071 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1070 with no explicit bump. run 36473239367. (task 1002620)
+  1.19.1072 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1071 with no explicit bump. run 36474285523. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1070",
+  "version": "1.19.1072",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1070",
+      "version": "1.19.1072",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1070",
+  "version": "1.19.1072",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7725,5 +7725,17 @@
       "id": "1003783",
       "text": "Decided how modules in the store are grouped: eight broad sections, each with narrow sub-categories that authors suggest and trusted builders approve, so the top-ten limit compares like with like."
     }
+  ],
+  "1.19.1071": [
+    {
+      "id": "1003790",
+      "text": "Decided how the store scores modules: a failed security check keeps a module out, the rest is averaged, and buyers can see each part of the score to pick the module that is best at what they need."
+    }
+  ],
+  "1.19.1072": [
+    {
+      "id": "1003801",
+      "text": "Decided who tests new module versions first: projects that switch on testing once, and a version nobody tests still reaches everyone after seven days."
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1070'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1072'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');