@bongos/core 1.19.64 → 1.19.65

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.64",
-  "core_contract": "1.19.64",
-  "source_commit": "ce3ba6421d4c20ca1f0b218a1b09d8825db932b1",
+  "core_version": "1.19.65",
+  "core_contract": "1.19.65",
+  "source_commit": "db66915ba598562a1b6021757007591b2e247921",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T03:26:56.981Z",
+  "built_at": "2026-08-12T04:07:14.147Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 291,
+    "docs_redacted": 292,
     "agent_docs_stubbed": 21,
     "functional_verbatim": 1220,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1532,
-  "tree_sha256": "c8e496c8bd2e61bc44e0ccb85fcceadb92acbeaa5ac0c7db1f856004a36f2728",
+  "file_count": 1533,
+  "tree_sha256": "154b6e613e151250a9ea9961f8a7e7528ee38fea05b2d7f921cb658a779a627e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1299,10 +1299,15 @@
       "mode": "0000644",
       "sha256": "d422e10adc391127a7f39b9eb8b5927c149ee455402bc5e4641f55e8b31b2d15"
     },
+    {
+      "path": "docs/adr/0166-module-maintenance-and-deprecation-policy.md",
+      "mode": "0000644",
+      "sha256": "3d260a52d4aa494e2df58f0db1c038c091786fbea99bad77d35b86b1a2024cf3"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "09a7ba734571fbb304c60a488fe9ccdb6ca06d01127cfb87f07b1cbb54d69408"
+      "sha256": "59110e7260facffd2771e1b3a4c411f238cd95d49ff07f1ac2be9541b9fda4c2"
     },
     {
       "path": "docs/api-reference.md",
@@ -1387,7 +1392,7 @@
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "ee6d466045b3275f96ed07ec78823069727fdd8eca6f5f643bab4d722647efe5"
+      "sha256": "ed108934d331507d3cd93644ca760149308ce4c6325778068b43e4ce78b0a1a7"
     },
     {
       "path": "docs/onboarding/browser-terminal-guide.md",
@@ -2247,7 +2252,7 @@
     {
       "path": "modules/autonomy/module.json",
       "mode": "0000644",
-      "sha256": "b812989750f484856e0d60116744c35e3ea35a4405be5a5f772c9ac165a95445"
+      "sha256": "269be1a175a8cb962c2caa4df523dfc5db49894f9e0645ee34c7200f8e8c85b2"
     },
     {
       "path": "modules/autonomy/pollers/routine-timers.js",
@@ -2297,7 +2302,7 @@
     {
       "path": "modules/builder-settings/module.json",
       "mode": "0000644",
-      "sha256": "1b81f127ae33c6e27a70557c03b39dacf2a2efbfde78d94a391ce209db128b4f"
+      "sha256": "5d79d4f6f0e24b0ae9731a31ebabadc43faa3b6a423d31800b664960dc16145c"
     },
     {
       "path": "modules/builder-settings/render-prefs.js",
@@ -2587,7 +2592,7 @@
     {
       "path": "modules/dev-box/module.json",
       "mode": "0000644",
-      "sha256": "da01810cb821e91f6b7620f7a7ea9b36152ec1b57cf6d09ad591e0ccb868bfd9"
+      "sha256": "821147f3783c85cb1a11c53d42008b73ccec68cf467cef35e25ae627772fe6a3"
     },
     {
       "path": "modules/dev-box/routes/box.js",
@@ -2662,7 +2667,7 @@
     {
       "path": "modules/discord/module.json",
       "mode": "0000644",
-      "sha256": "0d72296bbc30b6fa6fb2dbe7e0e8cda2c1b1705de116ba712e5a7e86f551a792"
+      "sha256": "20dbf26cfca116f5035e90a7ceec83baa29670bbd5c56dc03a1003db2983edf4"
     },
     {
       "path": "modules/discord/pollers/discord-bot.js",
@@ -2727,7 +2732,7 @@
     {
       "path": "modules/economy/module.json",
       "mode": "0000644",
-      "sha256": "0636888378cdc7fd4461fd7ad9cfa8ca743953d227e8cbc0eceba70be159e80f"
+      "sha256": "b8b3a4add551b32bc625dca0390afc2176dcd9e433b24d21128dd6e249e70623"
     },
     {
       "path": "modules/economy/reward.js",
@@ -2812,7 +2817,7 @@
     {
       "path": "modules/governance/module.json",
       "mode": "0000644",
-      "sha256": "3dd5a896829a0d2a4918e1d60fa06f8ad1d6b23b12909bc7c0bc30739c3a3b00"
+      "sha256": "f6de90de98b38a4e9fbdc495ecccd802362ae364f023474412a727c323478120"
     },
     {
       "path": "modules/governance/protected-surfaces.js",
@@ -2927,7 +2932,7 @@
     {
       "path": "modules/grading/module.json",
       "mode": "0000644",
-      "sha256": "3c6c74fa5fb64ffe2bcab52c2d1db6711e683ce824873d354c1f6d9d899e2d0d"
+      "sha256": "bedbba5af2bebf1563415da88977d451b511f64ddd0f7d0f366fdbcfb274441c"
     },
     {
       "path": "modules/grading/routes/grade.js",
@@ -2942,7 +2947,7 @@
     {
       "path": "modules/hall-ui/module.json",
       "mode": "0000644",
-      "sha256": "baedb2ce70ae8959556e99b5dd8a2fa6a9ed4602b2f2d3934b76154c2049ae14"
+      "sha256": "fd1220e4b2716912a03c78b23a7d0c78e4a5f4e325547cdd5207487147aad82c"
     },
     {
       "path": "modules/hall-ui/public/atlas.css",
@@ -3137,7 +3142,7 @@
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "78082fe1fb59816f531e9efa0ed2fdaba93da855f99aba5129a97046baaf7215"
+      "sha256": "dbe7a2d3455b5825c21c70b896dc953f380b6adb5ef6724318b8fd6030d3bca1"
     },
     {
       "path": "modules/hall-ui/public/my-projects.html",
@@ -3347,7 +3352,7 @@
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
-      "sha256": "66010ba9ca8f809e0515e1db83035d6f9a9c05182ff0553e614e628c110ead3b"
+      "sha256": "7aa38c4dc690735cea2c1ab1ea61b9fa34281ec6f3505ed091990949f741b77d"
     },
     {
       "path": "modules/ideas/routes/blockers.js",
@@ -3437,7 +3442,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "e35ba2340932506a579118794ffb136e603c5949f2967906e7b4c6ea463d2968"
+      "sha256": "1ccd8ce521c084ede265c318a71896b508aae0172fda2a67dd6e355c5dfefa0f"
     },
     {
       "path": "modules/lifecycle/pollers/publish-reconciler.js",
@@ -3532,7 +3537,7 @@
     {
       "path": "modules/memory/module.json",
       "mode": "0000644",
-      "sha256": "aaf2ce60c3ca4ba5980673eb2859b9c676a8783283999d92d8ce6d4880ba95bf"
+      "sha256": "ace721e3ae257aee7f9b13bfbb60b6959f9d72e11059c316d22701754db5b911"
     },
     {
       "path": "modules/memory/routes/learnings.js",
@@ -3577,7 +3582,7 @@
     {
       "path": "modules/onboarding/module.json",
       "mode": "0000644",
-      "sha256": "0fdcfa6b5448db8c2751e5a0084f5ccdc4e133ef8bd0b0bcc3b89f6fae715de2"
+      "sha256": "d121973873e2a38cdb2e6ad1096397a667bbd11b851a079c299d3fb6dbdd21be"
     },
     {
       "path": "modules/onboarding/newcomer-restock.js",
@@ -3652,7 +3657,7 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "eecf92c56fc58b81feb4d22ff14a2f6427744283a7ee06fb1d6424b136d8dd44"
+      "sha256": "71bd26b5e4ba6012e3119a99c1aa1046d61b12b17e1018f55c9ee11b6ec29895"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
@@ -3727,7 +3732,7 @@
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
-      "sha256": "3042d0301fce6922d76eb36aae11f22bbdddb98dc14b900c13aa33b16b0d198b"
+      "sha256": "a3ce933fa55e3d6e09dd76d24d105df649eb99911e0c3e3d4cb5b603eb8dafa0"
     },
     {
       "path": "modules/provisioning/onboard-plan.js",
@@ -3882,7 +3887,7 @@
     {
       "path": "modules/security/module.json",
       "mode": "0000644",
-      "sha256": "b087a1752b413882c8d3057867d8dcb464395831b9cc1be3b82a05607802cc26"
+      "sha256": "49d3d48925e814491c42f9f84d9fed2f8e16eeb42a89d3592fd99533c4dbbf1e"
     },
     {
       "path": "modules/security/routes/reports.js",
@@ -3962,7 +3967,7 @@
     {
       "path": "modules/sessions/module.json",
       "mode": "0000644",
-      "sha256": "226996238063e475e49e325e44df605f1b0ed90b0ba074422c202f04e41ca8ff"
+      "sha256": "9d49e5224482d5c0ccfd4797515464702a9784cdc513f151e9bdcda126d859c8"
     },
     {
       "path": "modules/sessions/pollers/session-reward-reconcile.js",
@@ -3987,7 +3992,7 @@
     {
       "path": "modules/status-ui/module.json",
       "mode": "0000644",
-      "sha256": "5167d1ac0da98df099b18b6b9e2d836e764b7cdb0cf0102780639250ed78dc0d"
+      "sha256": "628a567c023895b85a867ac986de3f8233cbd58fbb8ff682f33dbfb0d4fdec41"
     },
     {
       "path": "modules/status-ui/public/README.md",
@@ -4037,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "90fef156fcc7117e3a88064eaab10da019b48fc2b1b5586cbbfe7d4006333682"
+      "sha256": "cf5b7fc4bb1b701c8efcd01b0bf8022105c708c2d00710306516f5d93bcc3115"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9fd4475c4f673be84d4504811890f5ec5339a226e4c738d41b6bb94c808cc76e"
+      "sha256": "a65535de66d9fef5b7ff981e414c7bd6987d5c3cc29dd3005b951c26107d8d3b"
     },
     {
       "path": "public-docs/index.html",
@@ -4927,7 +4932,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "1f509bd5a7b6eacc85670441c5628c8093fd8b5c7453a25cedc7f4b1c2c3201a"
+      "sha256": "7a86a8ba599d3b0ef70e3ea450c7bb13a69f4167437227af8d98627400ee34d4"
     },
     {
       "path": "scripts/gds/newcomer-floor.config.json",
@@ -5297,7 +5302,7 @@
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "04d232931aed175ea53787cf07d8564fd2e306f369318057d078dca9769b138a"
+      "sha256": "4ba3cd406e82907ae554e90abb1c746ff7c9802c9fbed0c1eac241798860d0c6"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -5602,7 +5607,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "30be4d5a235cc704d4e1db264fb4e976ef6c614bc680fe90e05f3a199b62fd3d"
+      "sha256": "7596e6ed0ccb155d4cb4da8efa3d6db5db4d94e41e36bc041941d3474eee42cb"
     },
     {
       "path": "src/bongos/routes/optimizer.js",
@@ -5662,7 +5667,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d55be57d6e2c4435e3b1cdab9543b90c449358b26ba1035fdb82b097f41ca7d6"
+      "sha256": "ca30d7bde014a6b6d70412be637ec347f1d8d11a8ab371b319dcf3ba67e61695"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5672,7 +5677,7 @@
     {
       "path": "src/module-loader/manifest-schema.js",
       "mode": "0000644",
-      "sha256": "2aa977b9c95d59bc2fff38be0a31986daf04d427e9078a6e63a20d69f41624ae"
+      "sha256": "f6d4447503d31aa859a4f45ecd84dddbd5ff61ca1c158cec9e7c8974ce3fec6a"
     },
     {
       "path": "src/module-loader/provenance.js",
@@ -6937,7 +6942,7 @@
     {
       "path": "tests/module_cli.mjs",
       "mode": "0000644",
-      "sha256": "bc309cd6f6670f17ea64eb3fadd8cf6b27ecc00b0dbfca83a26451b43076ea1d"
+      "sha256": "6e084c70e4f3111a1b4ec5b7701c46b3c039364a1a4099b822afb788e0e279e6"
     },
     {
       "path": "tests/module_contributions.mjs",
@@ -6952,7 +6957,7 @@
     {
       "path": "tests/module_manifest.mjs",
       "mode": "0000644",
-      "sha256": "93d2e090cd853273b42112c680c7ec77c640c7d5234b44b8a38c0a69c825a700"
+      "sha256": "0a2d6f748d86793c398e959e4518b0ef54f3a2aac27d79eb243c71590a3523e2"
     },
     {
       "path": "tests/module_owned_tests.mjs",
@@ -7632,7 +7637,7 @@
     {
       "path": "tests/upgrade.mjs",
       "mode": "0000644",
-      "sha256": "442ebd94e35ecb96b2d569e4705a9f24b0e017e3968b3fb72e488c7dfdea0d2c"
+      "sha256": "3d7aaec00a43c303e0bb6e465f48fd8d6523844cd2414c2979ad6144424d2ebb"
     },
     {
       "path": "tests/verify_task_guard.mjs",

package/docs/adr/0166-module-maintenance-and-deprecation-policy.md

@@ -0,0 +1,91 @@
+# ADR 0166 — Module maintenance & deprecation policy for accepted modules
+
+- **Status:** Accepted
+- **Date:** 2026-08-11
+- **Track:** internal
+- **Task:** [#1001773](https://cloudbongos.com/builders#/task/1001773) (BONGOS-V1) — "Module upstreaming: maintenance & deprecation policy for accepted modules".
+- **Implements:** [ADR 0107](<redacted>.md) §7, which named the problem and deferred the mechanics to a follow-up. This is that follow-up.
+- **Builds on:** [ADR 0083](<redacted>.md) (the manifest + loader + `coreVersion` check), [ADR 0107](<redacted>.md) §§1/4/6 (submit → review → accept, the AGPL pre-check, default-off acceptance), [ADR 0135](<redacted>.md) (where submissions queue).
+
+## Context
+
+ADR 0107 §7 states the problem in one sentence: *"A module pinned to an old `coreVersion` rots as core advances… The catalog must not fill with silently-broken entries."* It set the direction — on acceptance a module is either **core-maintained** or carries a named **maintainer** and a deprecation path — and left the mechanics open.
+
+Three facts about the system as it stood made the rot silent rather than loud:
+
+1. **Nothing in the manifest said who owns upkeep.** `module.json` carried `maintainer` as free-text attribution (ADR 0107 §2) — a credit line, not a commitment, and never read by any check. A module could be accepted with `maintainer` unset and nothing anywhere would notice.
+
+2. **Accepted modules are default-off, and the disabled path was the silent one.** ADR 0107 §6 makes `default: false` the accept action, so an accepted catalog module is *disabled by construction* in any instance that hasn't opted in. `evaluateUpgrade` correctly classified an incompatible **enabled** module as blocking and an incompatible **disabled** module as a warning — but `preflightModules()` in `scripts/gds/upgrade.js`, the pre-check that runs during a **real** `bongos upgrade --to <version>`, returned only `blocking` and discarded `warnings` entirely. Its headline note read `"all enabled modules satisfy the target"` — true, and profoundly misleading, because every rotted catalog entry was in the bucket it had just thrown away. **The one code path where a module's incompatibility should have surfaced was the one path where it could not.**
+
+3. **A deprecated module had no way to say so.** There was no vocabulary for "on the way out", no successor pointer, and no removal date — so deprecation could only live in prose nobody reads at upgrade time.
+
+## Decision
+
+### 1. Upkeep is a declared, machine-readable property of the module — a `maintenance` block in `module.json`.
+
+```jsonc
+"maintenance": {
+  "status": "maintained",      // REQUIRED in-block. One of the four below.
+  "since":  "1.8.0",           // OPTIONAL. Core version the status took effect.
+  "removeAfter": "1.12.0",     // OPTIONAL. Core version after which it may be deleted.
+  "successor":   "econ-v2",    // OPTIONAL. Module key that replaces it.
+  "note":        "…"           // OPTIONAL. The path out, in one sentence.
+}
+```
+
+The block is **optional** at the schema level (pre-policy manifests keep validating) but **required to be upstreamed** — see §3. Its key set is closed, so a typo'd `removeafter` fails loud rather than quietly declaring no removal date at all.
+
+### 2. Four statuses, and each one owes something.
+
+| `status` | Means | The obligation the validator enforces |
+|---|---|---|
+| `core-maintained` | The core team owns it. A core change that breaks it is the core's problem to fix before shipping. | — |
+| `maintained` | A named person/handle owns it. | A non-empty top-level `maintainer`. **An unnamed maintainer is the orphaning failure this field exists to prevent**, so it is rejected rather than accepted-and-ignored. Use `orphaned` if that's the truth. |
+| `deprecated` | On the way out. | A `successor` and/or a `note` — the *deprecation path* ADR 0107 §7 requires. May carry `removeAfter`. |
+| `orphaned` | Nobody owns it. | A `successor` and/or a `note`, so the next reader gets the situation and not just the label. |
+
+`orphaned` is deliberately a **first-class, declarable state**. A policy that only permits happy statuses gets satisfied by lying; the useful system is one where "nobody owns this" is a thing a manifest can honestly say and the tooling can then surface.
+
+`removeAfter` is rejected on a non-sunset status — a removal date on a maintained module is a contradiction, and silently ignoring it would hide the author's actual intent.
+
+### 3. The accept gate: a module must state its upkeep before it may be submitted.
+
+`bongos module check` / `bongos module submit` (and the `POST /modules/:key/submit` route that is the authoritative copy of that check) now refuse a module that:
+
+- declares no `maintenance.status` — *acceptance into the shared catalog is a commitment to keep the module true as the core advances; the module must say who is committing*; or
+- declares `deprecated` / `orphaned` — a module already on its way out cannot be submitted *into* the catalog. Upstream a maintained module, or its successor.
+
+This sits alongside the existing §4 AGPL/publish pre-check as a third finding kind (`maintenance`), on the same fail-closed footing.
+
+### 4. `bongos upgrade` surfaces incompatibility for **disabled** modules too — the fix that makes the policy real.
+
+The enabled/disabled asymmetry stays where it belongs: an incompatible **enabled** module still **refuses** the bump (fail-closed, unchanged), and an incompatible **disabled** module still **does not block** — it genuinely breaks nothing at boot. What changes is that the disabled case is now *said out loud, with its owner named*, on both surfaces:
+
+- `preflightModules()` returns `warnings`, `deprecations`, and `expired` alongside `blocking`, and its headline note refuses to claim all-clear when disabled modules have rotted (`"all enabled modules satisfy the target, but 2 disabled module(s) do NOT"`).
+- `runUpgrade()` prints them via `reportModulePreflight()`, **before** the blocking check returns — so they appear on a refused bump too, which is exactly when someone is reading the output.
+- `bongos upgrade` (the bare pre-check) appends a maintenance hint to every mismatch row and rolls up deprecations, modules past their `removeAfter`, and modules with no declared upkeep at all.
+
+Every one of those lines names an owner, or says plainly that there isn't one. A warning that can't be actioned is noise; the maintainer is what makes it a next step.
+
+### 5. The catalog view shows upkeep.
+
+`GET /modules` returns `maintenance`, and the hall Modules tab renders an `upkeep:` chip — including `upkeep: undeclared` for a module with no block. An unowned catalog entry is precisely what this policy exists to catch, so it must be visible where builders browse modules, not only in a CLI they may never run.
+
+### 6. Every bundled module declares `core-maintained`.
+
+The 17 modules that ship inside `@bongos/core` are core-maintained by definition. Stamping them makes the policy true of the live catalog on day one instead of aspirational, and `tests/module_manifest.mjs` holds the line — a new bundled module with no declared posture fails the unit gate.
+
+## Alternatives considered (rejected)
+
+- **Make an incompatible disabled module BLOCK the upgrade.** Fail-closed everywhere is tempting, but it is wrong here: a disabled module is not running, and blocking an instance's core bump on the rot of a catalog entry it never opted into makes the shared catalog a liability for every consumer. Report, don't block.
+- **Make `maintenance` a required manifest field.** Would invalidate every existing manifest at once and break the loader for any instance mid-upgrade. Optional-in-schema + required-at-submit puts the gate at the moment of commitment, where it belongs.
+- **Track maintenance in the GDS database instead of the manifest.** Attribution deliberately travels *with* the module as portable metadata rather than as a cross-GDS foreign key (ADR 0107 §2); upkeep has the same property — it must survive the module moving between repos, and it must be readable by `bongos upgrade` on a box with no DB session.
+- **Auto-deprecate a module whose `coreVersion` stops matching.** Rejected — incompatibility is a fact, deprecation is a decision. Conflating them would let the tool retire a module its maintainer was about to fix.
+- **A separate `MAINTAINERS` file per module.** A second file to drift out of sync with `module.json`, and invisible to the manifest validator. The manifest is already the module's declared contract; upkeep belongs in it.
+
+## Consequences
+
+- **`bongos upgrade` gets noisier, on purpose.** An instance carrying rotted disabled modules now sees a line per module per bump. That is the intended pressure: the cure is to fix, deprecate, or delete the module, and each of those makes the line go away honestly.
+- **Submitting a module upstream now requires one more field.** `bongos module new` scaffolds `{"status": "maintained"}` (the author is the maintainer — the honest default), so the friction lands only on modules scaffolded before this ADR.
+- **`orphaned` is now sayable, which means it will be said.** Expect the catalog to acquire visibly-unowned entries. That is the policy working: a labelled orphan is a candidate for adoption or deletion, an unlabelled one is a trap.
+- **`removeAfter` is declarative, not enforced.** Nothing deletes a module automatically — `expired` only reports that the core has advanced past the declared date. Automatic removal would need the review/accept flow to own module deletion, which is [ADR 0107](<redacted>.md) §1 territory and a separate decision.

package/docs/adr/README.md

@@ -238,5 +238,6 @@ This keeps the decision history honest and traceable.
 | 0163 | [**Pre-197 display names: a transitional 'legacy' source, resolved at first sign-in** ([task 1002643](https://cloudbongos.com/builders#/task/1002643); idea 1000659). Amends [ADR 0156](<redacted>.md), whose migration defaulted every pre-existing row to `'github'` — false for builders who renamed after their last sign-in but before 197 landed, so their names kept reverting. No audit trail exists to backfill precisely, so `core_214` marks every pre-197 `'github'` row `'legacy'` (scoped by 197's `applied_at` on the instance — portable) and the upsert resolves each at its first sign-in: stored = incoming GitHub name → provably GitHub-derived → `'github'`; differs → treated as builder-set → kept, stamped `'user'`. Accepted misclassification: a GitHub-side rename in the window freezes a stale label (visible, self-fixable in Settings) — preferred over silently destroying deliberate renames. Rejected: `display_name <> github_login` heuristic (freezes nearly everyone), comparing forever on all `'github'` rows (turns every future GitHub rename into a frozen name).](<redacted>.md) | GDS / builder experience |
 | 0164 | [**The implausible-pass guard reads substance + evidence; the Metic+ honor-system residual is explicit** ([task 1002658](https://cloudbongos.com/builders#/task/1002658); grader-hardening goal 1000056). The guard fired only on `issues.length===0` — one fabricated `{}` defeated it, its magnitude inputs are client-supplied, and every in-sample firing (eval 2-for-2, tasks 1002643 ×2, 1002663) was a false positive on an honest unanimous zero-issue panel PASS. Redesign: count only SUBSTANTIVE issues (known severity + non-empty summary — padding trips the guard regardless), and waive the zero-issue pass when `signals.workers` carries the full &ge;3-worker panel shape, stamped `implausible_pass_waived` for /grade-audit. The residual is named, not hidden: every grade-time input is client-authored, so plausibility at grade time is honest-mistake hygiene; the binding authorities on the real diff are land-time (CI unit, gate-review, main audit) — Metic+ grade-time honesty is accepted honor-system per this ADR. The ADR-0042 CI grade-gate (land it vs record permanent deferral) goes to the owner as a blocker, not decided here. No approval step added or removed (ADR 0162).](<redacted>.md) | GDS / grading |
 | 0165 | [**Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in** ([task 1002641](https://cloudbongos.com/builders#/task/1002641); idea 1000655). Task 1002608 delivered the ADR 0043 Layer 1 pre-push gate for the CORE repo, but nothing materializes `.husky/` on a scaffolded standalone instance (`publish-manifest.js` excludes it by design). Decision: that is the accepted posture, not a gap. Sub-Metic instance builders hold no push credential at all (server-mediated publish, ADR 0053/0055) — a client pre-push hook guards a push that cannot happen; a client hook is not a security boundary (ADR 0016); the core cannot maintain hooks it deliberately does not ship (scaffolded hooks would be born orphans — the audit-authorship rot lesson, task 1002640); and ADR 0162 puts gates in CI, rank-consistent and hands-free. Secrets hooks follow the same rule (the PR-time CI secret scan enforces). The opt-in stays real and instance-owned: an instance commits its own `.husky/` and the core's `install-git-hooks.js` (already run by `/builder-setup`) activates it. Rejected: scaffolding wrappers at init, an `--with-hooks` flag (speculative), treating hooklessness as a regression. Revisit if an instance model has builders pushing directly with their own credentials.](<redacted>.md) | provisioning / trust boundary |
+| 0166 | [**Module maintenance & deprecation policy: upkeep is a declared `maintenance` block, and `bongos upgrade` surfaces rot in DISABLED modules too** ([task 1001773](https://cloudbongos.com/builders#/task/1001773)). Implements [ADR 0107](<redacted>.md) §7, which named the catalog-rot problem and deferred the mechanics. `module.json` gains an optional-in-schema, required-to-upstream `maintenance` block — `status` one of `core-maintained` / `maintained` / `deprecated` / `orphaned`, plus `since` / `removeAfter` / `successor` / `note`. Each status owes something the validator enforces: `maintained` requires a named top-level `maintainer` (an unnamed owner IS the orphaning failure), a sunset status requires a deprecation path, and `removeAfter` is rejected on a non-sunset status. `orphaned` is deliberately first-class — a policy that only permits happy statuses gets satisfied by lying. The load-bearing fix: accepted modules ship `default:false` (§6), so every rotted catalog entry is DISABLED by construction — and `preflightModules()` returned only `blocking`, discarding `warnings`, so a real `bongos upgrade --to X` reported `"all enabled modules satisfy the target"` while saying nothing about them. It now returns + prints `warnings`/`deprecations`/`expired` with the maintainer NAMED, before the blocking check returns (so a refused bump reports them too). Enabled mismatches still refuse; disabled ones still never block — report, don't block, because blocking an instance's bump on a catalog entry it never opted into makes the shared catalog a liability. `bongos module check`/`submit` refuse an undeclared posture or an already-sunset module; `GET /modules` + the hall Modules tab show an `upkeep:` chip (incl. `undeclared`); all 17 bundled modules stamped `core-maintained` with a unit test holding the line. Rejected: blocking on disabled rot, a required manifest field (breaks every existing manifest), DB-tracked upkeep (must travel with the module, ADR 0107 §2), auto-deprecating on incompatibility (a fact is not a decision), a separate MAINTAINERS file.](<redacted>.md) | modules / upstreaming |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/modules-contract.md

@@ -83,6 +83,13 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
   "origin":      "…",                 // OPTIONAL. Origin instance/project this module was built in.
   "license":     "AGPL-3.0",          // OPTIONAL. License this module is offered under.
   "maintainer":  "…",                 // OPTIONAL. Who to credit/contact if this module is upstreamed.
+  "maintenance": {                    // OPTIONAL in schema, REQUIRED to upstream (ADR 0166).
+    "status": "maintained",           //   core-maintained | maintained | deprecated | orphaned
+    "since":  "1.8.0",                //   OPTIONAL. Core version the status took effect.
+    "removeAfter": "1.12.0",          //   OPTIONAL (sunset only). Core version after which it may go.
+    "successor":   "econ-v2",         //   OPTIONAL. Module key that replaces it.
+    "note":        "…"                //   OPTIONAL. The path out, in one sentence.
+  },
   "contributes": {                    // REQUIRED object (may be empty {}).
     "routes":      ["box"],           //   route-factory files in routes/ (one export = () => Router())
     "rooms":       ["WorldRoom"],     //   Colyseus room classes (game module only)
@@ -108,7 +115,22 @@ An unknown key throws at validate time — typos fail loud (top-level attributio
 
 **Attribution (`author`/`origin`/`license`/`maintainer`) is portable metadata, not a cross-GDS link** — each repo runs its own GDS with its own builder identities ([ADR 0100](adr/<redacted>.md) §3), so credit travels *with the module* rather than through a foreign key ([ADR 0107](adr/<redacted>.md) §2). `bongos module new` stamps all four as TODO placeholders (license defaults to `AGPL-3.0`) so a module carries its authorship from the day it's scaffolded, not bolted on later at upstream-submit time.
 
-**`bongos module check <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/<redacted>.md) §4) is the submit-time pre-check a module must clear before it can be upstreamed. It reuses (never re-types) the public-mirror publish denylist (`scripts/gds/publish-manifest.js`'s `matchesDeny`) to reject content that cannot ship under AGPL (game content, pixel art, copyrighted reference material) — deliberately the DENY half only, since a brand-new module is never on the publish ALLOWLIST until it's accepted into core (§6). It also requires `module.json`'s `license` to be AGPL-3.0 (inbound = outbound). On a pass, `--sign-off` records a lightweight DCO-style affirmation (own work, licensed AGPL-3.0 — never a copyright-assignment CLA) to `modules/<key>/.upstream-signoff.json`.
+**`bongos module check <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/<redacted>.md) §4) is the submit-time pre-check a module must clear before it can be upstreamed. It reuses (never re-types) the public-mirror publish denylist (`scripts/gds/publish-manifest.js`'s `matchesDeny`) to reject content that cannot ship under AGPL (game content, pixel art, copyrighted reference material) — deliberately the DENY half only, since a brand-new module is never on the publish ALLOWLIST until it's accepted into core (§6). It also requires `module.json`'s `license` to be AGPL-3.0 (inbound = outbound) and a declared `maintenance` posture — acceptance is a commitment to upkeep, so a module with no `maintenance.status`, or one already `deprecated`/`orphaned`, is refused ([ADR 0166](adr/<redacted>.md); see below). On a pass, `--sign-off` records a lightweight DCO-style affirmation (own work, licensed AGPL-3.0 — never a copyright-assignment CLA) to `modules/<key>/.upstream-signoff.json`.
+
+### `maintenance` — who keeps this module true as the core advances ([ADR 0166](adr/<redacted>.md))
+
+A module pinned to an old `coreVersion` rots as the core advances ([ADR 0107](adr/<redacted>.md) §7). The `maintenance` block is where a module states, in a place the upgrade pre-check can read, **who owns that upkeep** — and what happens if nobody does. It is optional in the schema (pre-policy manifests keep validating) but **required to be upstreamed**.
+
+| `status` | Means | What it owes |
+|---|---|---|
+| `core-maintained` | The core team owns it; a core change that breaks it is the core's problem to fix before shipping. | — |
+| `maintained` | A named person/handle owns it. | A non-empty top-level `maintainer`. An unnamed maintainer is rejected — that *is* the orphaning failure; say `orphaned` instead. |
+| `deprecated` | On the way out. | A `successor` and/or a `note` (the deprecation path). May carry `removeAfter`. |
+| `orphaned` | Nobody owns it. | A `successor` and/or a `note`, so the next reader gets the situation and not just the label. |
+
+`orphaned` is a first-class, declarable state on purpose: a policy that only permits happy statuses gets satisfied by lying. `removeAfter` is rejected on a non-sunset status, and is **declarative** — nothing deletes a module automatically; `bongos upgrade` only reports that the core has advanced past the date.
+
+**What surfaces it.** `bongos upgrade` appends a maintenance hint to every `coreVersion` mismatch row and rolls up deprecations, modules past `removeAfter`, and modules with no declared upkeep. A **real** bump (`bongos upgrade --to <version>`) does the same via `preflightModules` → `reportModulePreflight`, printed before the blocking check returns so a refused bump reports them too. The asymmetry is deliberate: an incompatible **enabled** module refuses the bump; an incompatible **disabled** one never blocks but is always reported with its owner named — accepted catalog modules ship `default: false` ([ADR 0107](adr/<redacted>.md) §6), so *every* rotted catalog entry is disabled by construction, and silence there is exactly how the catalog fills with broken entries. `GET /modules` and the hall Modules tab show an `upkeep:` chip, including `upkeep: undeclared`.
 
 **`bongos module submit <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/<redacted>.md) §1) re-runs the §4 pre-check + requires a sign-off, then packages the module (manifest + a full file snapshot + the sign-off) and files it into the rank-gated (metic+archon) upstreaming review queue via `POST /modules/:key/submit` — the same route the hall "Modules" tab's submit button calls. Refuses (exit 1) if the pre-check fails or no sign-off can be found/recorded. The queue currently lives in **this instance's own DB**, not a live call to the extracted core repo — see [ADR 0135](adr/<redacted>.md) for why, and `GET /modules/submissions` to read it back.
 

package/modules/autonomy/module.json

@@ -4,6 +4,7 @@
   "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
   "coreVersion": "^1.11.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["autonomy"],
     "pollers": ["routine-timers"]

package/modules/builder-settings/module.json

@@ -4,6 +4,7 @@
   "description": "The per-builder PREFERENCE domain — the wandering knob (how readily the agent opens off-task threads, rank-clamped), per-skill model ceilings, per-sound + per-event-sound on/off, and the render-widgets toggle — plus builder-needs (the 'the system needs an input from you' list). A core-domain module carved out of the GDS core in BV1.R80 (ADR 0093 §1); default-on because every instance configures its own builders. The `/me/*-prefs` routes mount here; the `GET /me` aggregator stays a thin core facade that resolves the `builder-settings` kernel PORT for its wandering/render/needs slices (02-module-map §2).",
   "coreVersion": "^1.8.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["settings"] },
   "provides": ["builder-settings"],
   "consumes": []

package/modules/dev-box/module.json

@@ -4,6 +4,7 @@
   "description": "Per-builder cloud dev environments (DigitalOcean + Cloudflare tunnels), sandbox preview, server-mediated branch publish.",
   "coreVersion": "^1.12.0",
   "default": false,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["box"],
     "pollers": ["box-lifecycle"],

package/modules/discord/module.json

@@ -4,6 +4,7 @@
   "description": "Outbound ship broadcast + the inbound #ideas/#bugs bot + role-sync + channel management + account-link state. Mirror only, never authority (ADR 0033).",
   "coreVersion": "^1.4.0",
   "default": false,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["discord", "bug-attachments"],
     "pollers": ["discord-bot"],

package/modules/economy/module.json

@@ -4,6 +4,7 @@
   "description": "Credit allocation (the cost-plus + kind-multiplier reward model), the cost ledger + dashboard rollups, builder streaks, achievements/gamification, and the leaderboard. A core-domain module carved out of the GDS core in BV1.R77 (ADR 0093 §1-2); default-on because every instance rewards its own builders. Registers the `reward` kernel PORT the lifecycle resolves at confirm/ship/claim time.",
   "coreVersion": "^1.7.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["cost", "leaderboard", "reward"] },
   "provides": ["reward"],
   "consumes": []

package/modules/governance/module.json

@@ -4,6 +4,7 @@
   "description": "Discord-style configurable roles and permissions (ADR 0151, BONGOS-V1 goal 1000030). Permissions are the atomic authority unit and the four ranks (xenos/thetes/metic/archon) become seeded roles; this module owns the code-defined permission catalog (each key flagged `system` = trust-boundary, non-grantable, or operational = delegable) plus the compatibility seed that reproduces today's rank thresholds exactly. A core-domain module, default-on: a Cloud Bongos instance ships configurable roles the way it ships its status page. This first slice (BV1.R94) is the catalog + seed as code constants — the single source the resolver (R95), the requirePermission gate (R97), and the Archon tab (R110/R111) all read. Preserves ADR 0016 (authority resolved server-side, per request, uncached).",
   "coreVersion": "^1.18.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "migrations": true, "routes": ["governance", "role-sync"] },
   "provides": ["governance", "governance.roleSync"],
   "consumes": []

package/modules/grading/module.json

@@ -4,6 +4,7 @@
   "description": "The grade-a-diff adversarial worker panel (Narc/Quality/Hacker/Efficiency) + deterministic route-rank/permission-path pre-passes + the scoring rubric. A core-domain module carved out of the GDS core in BV1.R73 (ADR 0091); default-on because every instance grades its own ships. Registers the `grade` kernel PORT the lifecycle resolves at confirm/ship time.",
   "coreVersion": "^1.6.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["grade"]
   },

package/modules/hall-ui/module.json

@@ -4,6 +4,7 @@
   "description": "The authenticated builders' hall served at builders.<apex> (builders.amazonprimea.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/gds/* and the read-only /api/gds/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "webSurfaces": [
       { "host": "builders.", "dir": "public" }

package/modules/hall-ui/public/modules.js

@@ -39,6 +39,22 @@
     return chips.join('');
   }
 
+  // Upkeep posture (ADR 0107 §7 / ADR 0166) — who keeps this module true as the
+  // core advances. A module with no declared maintenance is shown as such rather
+  // than silently: an unowned catalog entry is the thing the policy exists to
+  // catch, so it must be visible here, not only in `bongos upgrade`'s output.
+  function maintenanceChip(m) {
+    const mt = m.maintenance;
+    if (!mt || !mt.status) return '<span class="mod-chip" title="No maintenance declared — nobody is on the hook for this module as the core advances.">upkeep: undeclared</span>';
+    const detail = [
+      mt.status === 'maintained' && m.maintainer ? `Maintainer: ${m.maintainer}` : '',
+      mt.successor ? `Superseded by "${mt.successor}"` : '',
+      mt.removeAfter ? `Removable after core ${mt.removeAfter}` : '',
+      mt.note || '',
+    ].filter(Boolean).join(' — ');
+    return `<span class="mod-chip" title="${escapeHtml(detail || mt.status)}">upkeep: ${escapeHtml(mt.status)}</span>`;
+  }
+
   function cardHTML(m) {
     return `
       <div class="mod-card" data-key="${escapeHtml(m.key)}">
@@ -49,7 +65,7 @@
           </div>
         </div>
         <p class="mod-card__desc">${escapeHtml(m.description || '')}</p>
-        <div class="mod-chips">${provenanceChip(m)}${attributionChips(m)}</div>
+        <div class="mod-chips">${provenanceChip(m)}${attributionChips(m)}${maintenanceChip(m)}</div>
         <div class="mod-card__actions">
           <button type="button" class="mod-toggle" data-on="${m.enabled ? '1' : '0'}"
             ${canToggle ? '' : 'disabled title="Metic+ can enable or disable a module"'}>

package/modules/ideas/module.json

@@ -4,6 +4,7 @@
   "description": "The idea inbox (capture, triage, criterion-proposal ratification) and the blockers queue — the methodology surfaces that feed the backlog. A core-domain module carved out of the GDS core in BV1.R78 (ADR 0093 §1); default-on because every instance captures ideas and tracks what's stuck on its owner. Registers the `ideas.capture` kernel PORT the discord #ideas inbound resolves (ADR 0093 §5 — retiring the temporary `captureIdea` doorway leak).",
   "coreVersion": "^1.8.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["inbox", "blockers"] },
   "provides": ["ideas.capture"],
   "consumes": []

package/modules/lifecycle/module.json

@@ -4,6 +4,7 @@
   "description": "The build state machine — tasks · claims · versions · done-when criteria · goals · dependencies · the claim→ship→grade→credit lifecycle · override requests · the ship/confirm/promote orchestration · github-push + merge-lease + conflict-resolve + the publish reconciler. The LAST and most-coupled core domain carved out of the GDS core in BV1.R86 (ADR 0093 §1,§3, 02-module-map §4 — kept whole, never split). default-on; every instance runs the lifecycle. Registers the `lifecycle` kernel PORT (createTask · VOTABLE_TASK_STATUSES · classifyTaskKind · tallyPeerVotes + the work-tracking reads) that core read routes + the ideas/discord/autonomy modules resolve. As a transaction-participant it RESOLVES the `reward` + `onboarding` ports inside its claim/ship/confirm txns — but via resolveOptional (graceful, like sessions→reward), so consumes is empty: a vanilla instance without those modules degrades the credit/onboarding writes to best-effort no-ops, it does not fail.",
   "coreVersion": "^1.12.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["tasks", "claims", "versions", "done-when", "goals", "dependencies", "gate-approvals", "analytics", "lifecycle"],
     "pollers": ["publish-reconciler"]

package/modules/memory/module.json

@@ -4,6 +4,7 @@
   "description": "Per-builder session memory, the lexical recall/search retrieval layer (ADR 0060), and durable learnings. A core-domain module carved out of the GDS core in BV1.R72 (ADR 0091); default-on because every instance needs the build system's memory.",
   "coreVersion": "^1.5.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["memory", "search", "learnings"]
   },

package/modules/onboarding/module.json

@@ -4,6 +4,7 @@
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
   "coreVersion": "^1.9.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["onboarding"] },
   "provides": ["onboarding"],
   "consumes": []

package/modules/platform-identity/module.json

@@ -8,6 +8,7 @@
   "origin": "Cloud Bongos platform (cloudbongos.com)",
   "license": "AGPL-3.0",
   "maintainer": "Cloud Bongos maintainers",
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["sso", "projects", "my-projects", "scouting"],
     "migrations": true,