@bongos/core 1.19.1071 → 1.19.1072

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1071",
-  "core_contract": "1.19.1071",
-  "source_commit": "e952aeff8fd966ba7aea8a72df82e4d825c22648",
+  "core_version": "1.19.1072",
+  "core_contract": "1.19.1072",
+  "source_commit": "48d55ade62291fbba8936935b42af6a649afe2fb",
   "source_ref": "HEAD",
-  "built_at": "2026-09-28T19:35:40.500Z",
+  "built_at": "2026-09-28T19:44:55.659Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 549,
+    "docs_redacted": 550,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2560,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3136,
-  "tree_sha256": "364a060541bc6ea130edf33f92ee954d0ccf420f8727ea29239c18392f5621c1",
+  "file_count": 3137,
+  "tree_sha256": "9f1989ff166c82430f3ddabbe39fefb2fb4ddee0f2e12cf747c100b5954c9957",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2184,10 +2184,15 @@
       "mode": "0000644",
       "sha256": "821f3c073de063aa9f3df9622a5b138cc5060754bb986cd5c747494150ec59db"
     },
+    {
+      "path": "docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md",
+      "mode": "0000644",
+      "sha256": "ca2a376a0c555f28a3ce82542f9e7b5ac4d5da1713bf0a423087515a81d8ee7e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "36568b2672c4b2ea76feda41fa9fe5bdffa3c10a1aaa56f862c663559712ed8b"
+      "sha256": "f319359f17b3ae842b73ea32f7150915189048d7faf55b77d43fa0129835daf0"
     },
     {
       "path": "docs/api-reference.md",
@@ -2757,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e8f17d79acc62fcacbcdb415295e23a8385bb050cc544b1c20fb3328b05eaa49"
+      "sha256": "45f4eae24f6557f3bbec81455b4ec6020f9941477f557415f184ff2c0287490e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8647,12 +8652,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b8899117fdc884212b4d763f9a01641137ac5e5b148f2b608d5866137ec86afe"
+      "sha256": "6d69aeb12a310ff98b05459e0a7a9d070267e953de7d9dc9836368b4d3034090"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d5ff7c99d5927cf91fc93d442725c14383695ed34576cd76840ae3d1579336a3"
+      "sha256": "45e245a9e6d915f4e6625b5bf21be85d69a5d97a787acf1f790ff75e65f41d46"
     },
     {
       "path": "public-docs/index.html",
@@ -8672,7 +8677,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "71549984e44e3f37dd1b858db883c2f9916ad409dff338a42e2664258980c420"
+      "sha256": "f04ac4ef2f41e8c246bc190e16b649ff8251a49d682a3eec0830a6595d816756"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10762,7 +10767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f05875c00f06c453f995f13626deff2da66a9a31730d4f483756f4d74cbcc588"
+      "sha256": "c62ff0384b44fb6900657484cd1e5d53e8920d1f815d8af3b247aecc605f795c"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md

@@ -0,0 +1,77 @@
+# ADR 0344 — A tester is a project that opts in once; an untested version reaches everyone after seven days
+
+- **Status:** accepted
+- **Date:** 2026-09-28
+- **Task:** [task 1003801](https://cloudbongos.com/builders#/task/1003801) (goal 1000091 — working area 5, Module distribution & economy)
+- **Deciders:** Will (owner of working area 5) chose the opt-in shape and the no-volunteer rule, and accepted the defaults for updates and tester pricing; Claude wrote the record.
+- **Related:** [ADR 0338](0338-modules-travel-through-a-bongos-hosted-store.md) (the hosted store and its channel check) · [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) (the security gate and tester feedback as a score part) · [ADR 0264](0264-the-ten-working-areas.md)
+
+## Context
+
+Criterion `wa5-staged-rollout` says willing users test a version before everyone gets it.
+"Willing" was undecided, and the build depends on it. The open questions: does a project opt in
+once or per module; who can opt in; what happens when nobody volunteers; does this cover
+updates; and do testers pay.
+
+## Decision
+
+### D1 — A project opts in once, and can skip individual modules (owner)
+
+Being a tester is a **per-project** setting, switched on by that project's own admin. A tester
+project gets tester-channel versions of **every module it has**, except any module it has
+switched to "general only".
+
+- It is the **project**, not an individual builder, that opts in, because the project is what
+  runs the module. A builder cannot opt in someone else's project.
+- The switch is visible and reversible. Turning it off puts the project back on general
+  versions from its next update.
+- "Willing" is load-bearing: a project is never a tester by default.
+
+### D2 — Testing covers updates, not only first releases
+
+Every new version, first release or update, goes to the tester channel first. An update to a
+module people already rely on is where an untested version does the most damage.
+
+### D3 — An untested version reaches everyone after seven days (owner)
+
+A new version moves from the tester channel to general **after seven days**, if it still passes
+the security gate and its tests (ADR 0343). This applies whether or not any tester picked it up,
+so a module nobody volunteers for still gets updated.
+
+The seven days is the baseline. The promotion gate (task 1003804) may also promote **earlier** on
+evidence (for example, enough clean tester installs) or **hold** a version on evidence (tester
+errors), but it never holds one forever for lack of testers.
+
+### D4 — Testers pay the normal price
+
+A tester gets an early version of a module it already has, on the same terms. Being a tester is
+not a way to get a paid module for free. **A discount or free access for testers is area 8's
+call** (credits and payments, goal 1000092). This ADR names the question rather than deciding it.
+
+### D5 — What testers see feeds the score
+
+A tester project's install success, errors and crashes on a tester version are the tester
+feedback part of the module's score (ADR 0343 D1, task 1003806).
+
+## Consequences
+
+- **Task 1003802** (opt in) builds a per-project tester switch plus a per-module
+  "general only" override, on the project's own admin surface.
+- **Task 1003803** (tester channel first) applies to every published version, updates included.
+- **Task 1003804** (promotion gate) builds to D3: seven days by default, may promote earlier or
+  hold on evidence, and never waits forever.
+- **Task 1003805** (install/update honour the channel) serves a tester project tester versions,
+  except for its "general only" modules.
+- **Removal is unchanged.** Under ADR 0338 D2, a version a tester already installed keeps
+  working even if it is later withdrawn.
+
+## Rejected
+
+- **Opt in per module only.** More control, but few projects would bother, leaving too few
+  testers.
+- **One all-or-nothing switch.** There'd be no way to avoid early versions of a module a project
+  depends on heavily.
+- **Waiting for a tester before general release.** A module nobody volunteers for would never be
+  updated.
+- **Releasing to everyone at once.** Testing would only happen when volunteers happened to be
+  there.

package/docs/adr/README.md

@@ -435,3 +435,4 @@ This keeps the decision history honest and traceable.
 | 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks are listed for the owner to confirm.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
 | 0342 | [**Module categories are eight fixed parents, with narrow sub-categories an author proposes and Metic+ approves** ([task 1003783](https://cloudbongos.com/builders#/task/1003783), goal 1000091 — working area 5, owner Will). The owner's cap of ten listed modules needs a comparable set, and nothing carried a category. **D1:** eight parents derived from the live roster — Work & planning, Team & people, Quality & review, Money, Communication, Pages & design, Hosting & deploy, Knowledge — for browsing only; the cap never applies to a parent. **D2:** the sub-category (the narrow set a buyer chooses between, e.g. "Stripe payments") is where the cap, ranking and comparison run. **D3 (owner):** an author proposes a sub-category and a Metic+ builder approves, renames or merges it, because free-naming would split one comparable set into near-duplicates and the cap would never bite; a pending module lists under its parent and counts toward no cap. **D4:** one sub-category per module. Rejected: free naming, Metic+-only creation, a flat list, parent-level caps.](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) | modules / store / economy |
 | 0343 | [**A module's score is a security gate, then an average of parts every buyer can see** ([task 1003790](https://cloudbongos.com/builders#/task/1003790), goal 1000091 — working area 5, owner Will). No module score existed; the floor, ranking and cap all derive from this one. **D1:** five parts, each 0–100 per version — Security and Tests day one; Install, Reliability (from real installs) and Tester feedback later. **D2 (owner):** failing Security means not listed, never averaged in. **D3 (owner):** overall = unweighted average of the other parts that have data; a missing part is left out, not zero. **D4 (owner):** every part's score is shown to buyers beside the overall, so they can pick the module strongest where they care (tasks 1003798/1003799). **D5:** a version without real-world data is labelled "New". **D6:** price is never an input; the Metic+ override/delist sits on top and is audited. Rejected: security in the average, day-one weights, a single number, missing-as-zero.](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) | modules / store / quality |
+| 0344 | [**A tester is a project that opts in once; an untested version reaches everyone after seven days** ([task 1003801](https://cloudbongos.com/builders#/task/1003801), goal 1000091 — working area 5, owner Will). Settles "willing user" for criterion `wa5-staged-rollout`. **D1 (owner):** a project's own admin switches on "tester" once and gets tester versions of every module it has, with a per-module "general only" override; never on by default; a builder cannot opt in someone else's project. **D2:** first releases and updates alike go to testers first. **D3 (owner):** a version moves to general after seven days if it still passes the security gate and tests, tested or not; the promotion gate may promote earlier or hold on evidence, never forever. **D4:** testers pay the normal price; any tester discount is area 8's call, named not decided. **D5:** tester installs, errors and crashes feed the score (ADR 0343). Rejected: per-module-only opt-in, one all-or-nothing switch, waiting for a tester, releasing at once.](0344-a-tester-is-a-project-that-opts-in-once.md) | modules / store / rollout |

package/docs/module-api-changelog.md

@@ -2629,5 +2629,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1069 with no explicit bump. run 36472133987. (task 1002620)
   1.19.1071 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1070 with no explicit bump. run 36473239367. (task 1002620)
+  1.19.1072 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1071 with no explicit bump. run 36474285523. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1071",
+  "version": "1.19.1072",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1071",
+      "version": "1.19.1072",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1071",
+  "version": "1.19.1072",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7731,5 +7731,11 @@
       "id": "1003790",
       "text": "Decided how the store scores modules: a failed security check keeps a module out, the rest is averaged, and buyers can see each part of the score to pick the module that is best at what they need."
     }
+  ],
+  "1.19.1072": [
+    {
+      "id": "1003801",
+      "text": "Decided who tests new module versions first: projects that switch on testing once, and a version nobody tests still reaches everyone after seven days."
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1071'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1072'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');