@bongos/core 1.19.98 → 1.19.100

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.98",
-  "core_contract": "1.19.98",
-  "source_commit": "6616c83d7f0ee7029db21b183e3983fc16568aad",
+  "core_version": "1.19.100",
+  "core_contract": "1.19.100",
+  "source_commit": "7b80b662d17af4b1be962ab5d755604ad8a8723f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T22:25:33.504Z",
+  "built_at": "2026-08-13T22:46:41.158Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 298,
+    "docs_redacted": 299,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1230,
+    "functional_verbatim": 1232,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1549,
-  "tree_sha256": "729068034b75cf1c5878e8099c36f949384e07228d6337ea7387c7d586abd68e",
+  "file_count": 1552,
+  "tree_sha256": "9a68e40f31c8eeee4090d108b208194fa3338756974d81dcc6a967456a3715b7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4deeae55ba58483557310d768a63df7cd75a1219137539b7ccbbf4481f09f5d9"
+      "sha256": "e7bc974c5ea756d1c197c1c8e52b902049af23e335149ff76e1ade248eb623d1"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1309,6 +1309,11 @@
       "mode": "0000644",
       "sha256": "bb187a29953ba5c316977f09fe86e26ca200693b23cf5c41ece93e9dd24f337e"
     },
+    {
+      "path": "docs/adr/0167-module-catalog-source-vs-provenance.md",
+      "mode": "0000644",
+      "sha256": "fb36d5641ff0829a453815351cbf790d56982089558854a97ec18bebecca8949"
+    },
     {
       "path": "docs/adr/0168-scaffold-packs-installed-core.md",
       "mode": "0000644",
@@ -1317,7 +1322,7 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "a96302a9849a2d7225b4a47ce0d7a7ac5f66d6849e80781f9a8e5aa32eba51d4"
+      "sha256": "fad8c85a5e99cb222616afcdc2efaa139f3795e1a71f13f9f6fac2cf0bacddef"
     },
     {
       "path": "docs/api-reference.md",
@@ -1327,7 +1332,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "9a551d5c62209f2c1b935194cc37e86ca5c44b317901499da84126e3868df1fa"
+      "sha256": "2cb65f1332abf4cb1a232df38caedf38399f34edd7058b27458b75e51cd564c7"
     },
     {
       "path": "docs/architecture.md",
@@ -1452,7 +1457,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "4b3ee1ce8445659a2660263cbbd9e2a903d010410b8ff8f89e2ed61ed54c6eab"
+      "sha256": "e4df7e072247c388228632abf5cb2ed0fdae535d09ea06c4f87e9bcae056769e"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1462,7 +1467,7 @@
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "ed108934d331507d3cd93644ca760149308ce4c6325778068b43e4ce78b0a1a7"
+      "sha256": "23df6c619e715cf6dab1890a27b3885f624f006407bc89f2f90664c32aa6c7fa"
     },
     {
       "path": "docs/onboarding/browser-terminal-guide.md",
@@ -3202,17 +3207,17 @@
     {
       "path": "modules/hall-ui/public/modules.css",
       "mode": "0000644",
-      "sha256": "a5dd258daa1eebdc71f59c57e29aaf578f20201568a55c738b4140ac4a45cd55"
+      "sha256": "2d97352fa1b8d11dc29e83f824faf9cc14ffe8b1977d02bf8824d87cbc4a9c78"
     },
     {
       "path": "modules/hall-ui/public/modules.html",
       "mode": "0000644",
-      "sha256": "c8e550d1817ea9d9e783b1987e79f39487635a5a04cc4b174b7e1ea2f248b39f"
+      "sha256": "0d24557440ae02e3aba8e70246ce1e25d5e3ba5ad2c6c53643749062ec2bd5a8"
     },
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "dbe7a2d3455b5825c21c70b896dc953f380b6adb5ef6724318b8fd6030d3bca1"
+      "sha256": "9df48fd541deabb6765cb622fc00f829edc4d6605c746f28a6d76cbfc07e22ad"
     },
     {
       "path": "modules/hall-ui/public/my-projects.html",
@@ -4127,12 +4132,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1fac3202890f9d9899a8aaa72a473e4f73b6c27dccc28dd7a064a3c5b1367b85"
+      "sha256": "0d50d0845267723058ce6795117975622643fe75f7fc8314bcc1e47a5660fd7e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b8338943bf583ab9caa3686836ebeafb43be12df7f156f991763278abcca02dc"
+      "sha256": "fb9adb2ceb26de87deae215aa38c85b6408a5d7b8555a090482357044bd938eb"
     },
     {
       "path": "public-docs/index.html",
@@ -4962,7 +4967,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "7a86a8ba599d3b0ef70e3ea450c7bb13a69f4167437227af8d98627400ee34d4"
+      "sha256": "1ae452fc21ade9a39d7b0f9e13825f45e4a3402eddb1cbfee3c2d63ba35dd5df"
     },
     {
       "path": "scripts/gds/newcomer-floor.config.json",
@@ -5642,7 +5647,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "7596e6ed0ccb155d4cb4da8efa3d6db5db4d94e41e36bc041941d3474eee42cb"
+      "sha256": "54a42c37d4afd403a13aa5e9fda6a7d95cb0fca70dfe3cb4daef318c099a5f00"
     },
     {
       "path": "src/bongos/routes/optimizer.js",
@@ -5702,7 +5707,12 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fb7a891d2f7b815e57271245e93c4e4ede5f78bedb76e4648fcbf56b69ad3de3"
+      "sha256": "4ac4d646de8c683999e2767139efbcee06b0f05d5435707e281bca8498081aa8"
+    },
+    {
+      "path": "src/module-loader/catalog.js",
+      "mode": "0000644",
+      "sha256": "a1af1014d2face153e6e0a93fff67a479faee452f3cdf3d0fbeaee3bf2e933ee"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5737,7 +5747,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "181c9850c374b653136a259d80e276ac285d2ee5f55fadeb9109aef418190d91"
+      "sha256": "6ffe23398bc452b4224e7c4aa49dbd3c4f61a61da0fd51d43bb6c5ce0bd51aa7"
     },
     {
       "path": "src/ui/adapters/claude-design/index.js",
@@ -7004,6 +7014,11 @@
       "mode": "0000644",
       "sha256": "f9142ae695964882ef4d6c4b83fec12c9ab32d0e31b3135333c27d695afb3262"
     },
+    {
+      "path": "tests/module_catalog.mjs",
+      "mode": "0000644",
+      "sha256": "e559a037714bd0b0e1cfb03c8560e07a24a050e4a2bbe4dd3c4c2e291eea2601"
+    },
     {
       "path": "tests/module_cli.mjs",
       "mode": "0000644",
@@ -7247,7 +7262,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "489ad330f7fe118ffd66a22b0a437743a2f3d3610a5324ba764abc4fc88b0c74"
+      "sha256": "e03bbf258cb4b8ffd3e242ab2ddd927d1f52706347d06b539a386ca502caf1e4"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/clients/bongos-client/index.d.ts

@@ -62,7 +62,7 @@ export interface GetMemoryBuildersBuilderIdFileResponse { builder_id: unknown; f
 export interface GetMemoryBuildersBuilderIdFilesResponse { builder_id: unknown; forensic: boolean; count: unknown; files: unknown }
 export interface GetMemoryFileResponse { builder_id: unknown; path: unknown; content: unknown; sha256: unknown; byte_len: unknown; mtime: unknown; updated_at: unknown; created_at: unknown }
 export interface GetMemoryFilesResponse { builder_id: unknown; count: unknown; files: unknown }
-export interface GetModulesResponse { modules: unknown; own_built: unknown; core_loaded: unknown; submit_pipeline_live: boolean }
+export interface GetModulesResponse { modules: unknown; own_built: unknown; core_loaded: unknown; catalog: unknown; submit_pipeline_live: boolean }
 export interface GetModulesSubmissionsResponse { submissions: unknown }
 export interface GetMyProjectsInvitesResponse { invites: unknown }
 export interface GetMyProjectsResponse { owned: unknown; building: unknown }

package/docs/adr/0167-module-catalog-source-vs-provenance.md

@@ -0,0 +1,44 @@
+# 0167 — The module catalog: `source` (which tree) and `provenance` (who built it) are two axes
+
+- **Status:** Accepted
+- **Date:** 2026-08-12
+- **Track:** internal
+- **Task:** [#1001772](https://cloudbongos.com/builders#/task/1001772) (BONGOS-V1, goal 1000029) — the browsable module catalog with author + origin credit.
+- **Builds on:** [ADR 0107](<redacted>.md) §2/§3/§6/§9 (upstreaming, attribution-as-portable-record, credit-now-money-later, default-off, the hall Modules tab), [ADR 0108](<redacted>.md) §1 (the loader discovers across BOTH the core package's `modules/` and the instance's own), [ADR 0083](<redacted>.md) (the manifest + loader), [ADR 0166](<redacted>.md) (the `maintenance` block the catalog surfaces).
+
+## Context
+
+ADR 0107 §9 shipped a hall "Modules" tab that split modules into **"built by this project"** vs **"core-loaded from Cloud Bongos"**. That split was derived from one field: the manifest's `origin` string (`src/module-loader/provenance.js` — no origin, or an origin naming this instance, means own-built).
+
+Closing out the goal with the catalog itself (§2/§3 — "a browsable catalog of available core modules, each shown with its author + origin credit") exposed that this single field is being asked two different questions at once:
+
+1. **Can this instance enable it?** — i.e. did the core ship it. This is what makes a catalog a catalog.
+2. **Who gets the credit?** — the attribution record ADR 0107 §2 defined.
+
+`origin` only answers the second. Attribution is **optional** in the manifest schema, and core's own modules mostly leave it unset because none of them was upstreamed from anywhere — so on a split instance every core module (`economy`, `governance`, `hall-ui`, …) classified as *built here*, and the catalog of things you could opt into read as empty. The two questions had been collapsed into the one field that cannot answer the first.
+
+A second, smaller problem: a catalog whose author/origin columns are blank for most rows is not a credit surface. But filling them by writing `"author": "Cloud Bongos"` into fifteen core manifests would be a large, self-repeating diff that a sixteenth module would immediately forget.
+
+## Decision
+
+**Split the two questions into two fields on one shared model** — `src/module-loader/catalog.js`, which the hall route (`GET /api/bongos/modules`) and the CLI (`bongos module list --catalog`) both build from, so the two surfaces cannot drift.
+
+- **`source` — which tree the module ships from.** Read *structurally* from the loader's discovery root (ADR 0108 §1): a module found under `resolveCoreRoot()/modules` is `core` (the catalog an instance opts into); one under `resolveInstanceRoot()/modules` is `instance`. This is the catalog axis and it needs no manifest cooperation, so it cannot rot.
+  - **When the roots coincide** (a single checkout — the two candidates dedupe to one directory), structure can no longer answer it. There we fall back to what the checkout *says it is*: a `package.json` naming `@bongos/core` / `cloud-bongos` means this is the core repo and its `modules/` **is** the catalog; any other checkout's `modules/` are that instance's own. Fail-soft — an unreadable `package.json` degrades to "instance", which understates the catalog rather than inventing one.
+- **`provenance` — who built it.** Unchanged: still `deriveProvenance(manifest.origin, ownProjectName)`, still derived from the **declared** manifest fields, which is why the row keeps `author`/`origin` verbatim (null when the manifest says nothing) beside the display credit below.
+
+**Credit is resolved for display, and an inferred value is marked as inferred.** A `credit: { author, origin, inferred }` field falls back to the platform name for a core-shipped module that declares no attribution — so no catalog row is blank — while `inferred: true` makes both surfaces mark it (`*` in the CLI, a hoverable `<abbr>` in the hall). An instance module that declares nothing stays uncredited rather than borrowing the platform's name.
+
+## Alternatives considered (rejected)
+
+- **Stamp `author`/`origin` into all ~15 core manifests.** Rejected: a repetitive diff that states the same fact fifteen times, and nothing keeps module sixteen from omitting it. The fallback derives it once, for every module, forever. (A module that *wants* a specific credit still declares one and wins — the fallback only fills a hole.)
+- **Overload `origin` to also mean "core-shipped".** Rejected — it is the attribution record ADR 0107 §2 deliberately defined as portable metadata, and `tests/modules_route.mjs` correctly pins provenance to the declared value. Writing a derived value into it would silently reclassify every core module as *core-loaded* and destroy the credit axis to fix the catalog one.
+- **Decide `source` from `default: true`** (core modules mostly ship default-on). Rejected as a coincidence, not a rule: ADR 0107 §6 requires *accepted* catalog modules to ship `default: false`, so the newest and most interesting catalog entries are exactly the ones this heuristic gets wrong.
+- **A `catalog` table in the DB.** Rejected as premature — the on-disk manifests already are the catalog, and a table would need writing at deploy time and could disagree with what actually mounted. Revisit if/when accepted submissions land from a real cross-repo channel ([ADR 0135](<redacted>.md)'s open question).
+
+## Consequences
+
+- **The hall's Modules tab sections by `source`, not `provenance`** — "Module catalog" (what the core ships, opt-in) and "Built by this project". The credit axis moved to the per-card chips where it belongs, and the "Submit for review" list is now drawn from `source: 'instance'`: a module that already ships with the core is by definition already in the catalog and cannot be submitted into it.
+- **The catalog is browsable from both surfaces with the same filter rule** — `searchCatalog()` over key/title/description/credit/licence, mirrored in the page's `matchesQuery()`. The hall filters client-side (the whole payload is already there); the CLI takes `--search`.
+- **`GET /modules` grew a `catalog` roll-up** and each row grew `source` + `credit`. Every pre-existing field is byte-identical, so an un-redeployed hall keeps working — `modules.js` falls back to the credit axis when `source` is absent.
+- **The credit fallback names the platform, not the host instance.** That string is the core's own name (like `CORE_PKG`), not host identity, so it does not cross the [ADR 0062](<redacted>.md) §7 core/host line and the BV1.R76 hardcoded-identity fitness check stays green.

package/docs/adr/README.md

@@ -239,6 +239,7 @@ This keeps the decision history honest and traceable.
 | 0164 | [**The implausible-pass guard reads substance + evidence; the Metic+ honor-system residual is explicit** ([task 1002658](https://cloudbongos.com/builders#/task/1002658); grader-hardening goal 1000056). The guard fired only on `issues.length===0` — one fabricated `{}` defeated it, its magnitude inputs are client-supplied, and every in-sample firing (eval 2-for-2, tasks 1002643 ×2, 1002663) was a false positive on an honest unanimous zero-issue panel PASS. Redesign: count only SUBSTANTIVE issues (known severity + non-empty summary — padding trips the guard regardless), and waive the zero-issue pass when `signals.workers` carries the full &ge;3-worker panel shape, stamped `implausible_pass_waived` for /grade-audit. The residual is named, not hidden: every grade-time input is client-authored, so plausibility at grade time is honest-mistake hygiene; the binding authorities on the real diff are land-time (CI unit, gate-review, main audit) — Metic+ grade-time honesty is accepted honor-system per this ADR. The ADR-0042 CI grade-gate (land it vs record permanent deferral) goes to the owner as a blocker, not decided here. No approval step added or removed (ADR 0162).](<redacted>.md) | GDS / grading |
 | 0165 | [**Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in** ([task 1002641](https://cloudbongos.com/builders#/task/1002641); idea 1000655). Task 1002608 delivered the ADR 0043 Layer 1 pre-push gate for the CORE repo, but nothing materializes `.husky/` on a scaffolded standalone instance (`publish-manifest.js` excludes it by design). Decision: that is the accepted posture, not a gap. Sub-Metic instance builders hold no push credential at all (server-mediated publish, ADR 0053/0055) — a client pre-push hook guards a push that cannot happen; a client hook is not a security boundary (ADR 0016); the core cannot maintain hooks it deliberately does not ship (scaffolded hooks would be born orphans — the audit-authorship rot lesson, task 1002640); and ADR 0162 puts gates in CI, rank-consistent and hands-free. Secrets hooks follow the same rule (the PR-time CI secret scan enforces). The opt-in stays real and instance-owned: an instance commits its own `.husky/` and the core's `install-git-hooks.js` (already run by `/builder-setup`) activates it. Rejected: scaffolding wrappers at init, an `--with-hooks` flag (speculative), treating hooklessness as a regression. Revisit if an instance model has builders pushing directly with their own credentials.](<redacted>.md) | provisioning / trust boundary |
 | 0166 | [**Module maintenance & deprecation policy: upkeep is a declared `maintenance` block, and `bongos upgrade` surfaces rot in DISABLED modules too** ([task 1001773](https://cloudbongos.com/builders#/task/1001773)). Implements [ADR 0107](<redacted>.md) §7, which named the catalog-rot problem and deferred the mechanics. `module.json` gains an optional-in-schema, required-to-upstream `maintenance` block — `status` one of `core-maintained` / `maintained` / `deprecated` / `orphaned`, plus `since` / `removeAfter` / `successor` / `note`. Each status owes something the validator enforces: `maintained` requires a named top-level `maintainer` (an unnamed owner IS the orphaning failure), a sunset status requires a deprecation path, and `removeAfter` is rejected on a non-sunset status. `orphaned` is deliberately first-class — a policy that only permits happy statuses gets satisfied by lying. The load-bearing fix: accepted modules ship `default:false` (§6), so every rotted catalog entry is DISABLED by construction — and `preflightModules()` returned only `blocking`, discarding `warnings`, so a real `bongos upgrade --to X` reported `"all enabled modules satisfy the target"` while saying nothing about them. It now returns + prints `warnings`/`deprecations`/`expired` with the maintainer NAMED, before the blocking check returns (so a refused bump reports them too). Enabled mismatches still refuse; disabled ones still never block — report, don't block, because blocking an instance's bump on a catalog entry it never opted into makes the shared catalog a liability. `bongos module check`/`submit` refuse an undeclared posture or an already-sunset module; `GET /modules` + the hall Modules tab show an `upkeep:` chip (incl. `undeclared`); all 17 bundled modules stamped `core-maintained` with a unit test holding the line. Rejected: blocking on disabled rot, a required manifest field (breaks every existing manifest), DB-tracked upkeep (must travel with the module, ADR 0107 §2), auto-deprecating on incompatibility (a fact is not a decision), a separate MAINTAINERS file.](<redacted>.md) | modules / upstreaming |
+| 0167 | [**The module catalog: `source` (which tree ships it) and `provenance` (who built it) are two axes** ([task 1001772](https://cloudbongos.com/builders#/task/1001772) — the last task of goal 1000029). Closes [ADR 0107](<redacted>.md) §2/§3: a browsable catalog of enable-able core modules, each with author + origin credit, in the hall AND via `bongos module list --catalog`. The bug it fixes: the Modules tab derived its own/core-loaded split from the manifest's `origin` alone, but attribution is OPTIONAL and core's own modules declare none (nothing upstreamed them) — so on a split instance every core module read as *built here* and the catalog you could opt into read as empty. One field was answering two questions. Fix: a shared model (`src/module-loader/catalog.js`) that both the hall route and the CLI build from, carrying `source` — read STRUCTURALLY from the loader's discovery root ([ADR 0108](<redacted>.md) §1: core package vs instance tree), falling back on coincident roots to whether `package.json` names the core — beside the unchanged `provenance` credit axis. Plus `credit: {author, origin, inferred}`, which fills a core module's blank attribution with the platform name and MARKS it inferred (`*` in the CLI, a hoverable `<abbr>` in the hall) so it never reads as a claim the author typed. The tab now sections by `source` ("Module catalog" / "Built by this project"), gains a search box, and draws "Submit for review" from instance-source modules only. Rejected: stamping author/origin into 15 core manifests (repetitive, and module 16 forgets), overloading `origin` (destroys the credit axis), inferring from `default:true` (§6 makes accepted catalog modules default-OFF — exactly backwards), a DB catalog table (premature; the manifests already are the catalog).](<redacted>.md) | modules / upstreaming |
 | 0168 | [**The scaffold vendors the hub's RUNNING core (`npm pack` of the installed package); registry-default deferred to the go-public step** ([task 1002706](https://cloudbongos.com/builders#/task/1002706); gap 13 of the project-creation audit). Two collided facts: children were born pinned to a frozen `file:vendor/bongos-core-1.19.2.tgz` (installedCoreTarball reuses the hub's own file: pin — task 1002275 — and the hub's pin sat at 1.19.2), and the task-1002621 registry cutover (hub pin now `"@bongos/core": "1.19.56"`, verified on the box) made installedCoreTarball return null — dropping the scaffold into the package-core.js source rebuild that ABORTS on a consumer instance (empty core set → empty child repo, the 1002275 failure resurrected). Fix: a three-rung ladder — file:-pin reuse → NEW `installedCorePackDir()` + `npm pack` of the hub's installed core (child pins the SAME, CURRENT core, stays file:-pinned, owner needs no token) → source rebuild. The brief's "make registry the default now that the package is public" was verified FALSE (both npm scopes 404 anonymously; ADR 0134 keeps them private until go-public) — a registry-default child would be born UNINSTALLABLE for a tokenless owner. Registry-default is deferred to the go-public step (idea 1000700); the gap-13 "flip the box env" ops leg is explicitly a no-op until then; child freshness rides this ladder + the hub-pin lane (task 1002708). Rejected: registry-default now, dropping NPM_TOKEN, vendoring from the npm cacache.](<redacted>.md) | provisioning / distribution |
 | 0167 | [**The /create gate trust link defaults to the AGPL-3.0 license text, not the npm package page** ([task 1002705](https://cloudbongos.com/builders#/task/1002705); gap 1 of the project-creation audit). The gate's "open source" link pointed at a nonexistent repo (404); the task brief's suggested default — the npm package page — is ALSO dead for the gate's actual audience (signed-out visitors): `@cloudbongos/core` and `@bongos/core` both 404 anonymously (private scopes, ADR 0134), and the ADR 0099 public mirror stays dormant until ~2026-11. The license text is the one live, instance-neutral artifact behind the claim today. The browsable-code upgrade is the owner's filed choice (idea 1000700): public repo now (forfeits the ADR 0065 §4 redaction window) / public npm package / wait for the mirror. Rejected: the npm link (verified dead), flipping the repo public (not a builder's call), plain unlinked text (less information, same cost).](<redacted>.md) | public landing / governance |
 

package/docs/api/openapi.json

@@ -12964,6 +12964,7 @@
           "modules": {},
           "own_built": {},
           "core_loaded": {},
+          "catalog": {},
           "submit_pipeline_live": {
             "type": "boolean"
           }
@@ -12972,6 +12973,7 @@
           "modules",
           "own_built",
           "core_loaded",
+          "catalog",
           "submit_pipeline_live"
         ]
       },

package/docs/file-map.md

@@ -188,6 +188,8 @@
 │   ├── module-loader/          ← the loader that makes `modules/<key>/` discoverable (BV1.R38–R41)
 │   │   ├── loader.js           ← discover modules/*/module.json → validate manifest → coreVersion-check → enabled-filter → mount routes behind kernel auth → start pollers. <redacted> on empty modules/. Used by modules.js + routes.js.
 │   │   ├── manifest-schema.js  ← module.json schema + validator (key, title, description, coreVersion, default, contributes, provides, consumes, prerequisites). Unknown keys throw. Used by loader + bongos module new.
+│   │   ├── provenance.js       ← pure "who BUILT this module" classifier from manifest.origin — the CREDIT axis (ADR 0107 §9). own-built vs core-loaded.
+│   │   ├── catalog.js          ← the browsable module catalog model (ADR 0167 / ADR 0107 §2/§3): `source` (which TREE ships it — core package vs instance, read off the loader's discovery root) + resolved author/origin `credit` with an `inferred` flag. The ONE builder behind both `GET /api/bongos/modules` and `bongos module list --catalog`, so the hall + CLI can't drift.
 │   │   └── semver.js           ← minimal semver `satisfies(version, range)` used by the loader (no npm dep).
 │   ├── platform-server.js       ← GDS-ONLY entrypoint (ADR 0062 R51, task 1190): boots Express + the shared internal surface (API + hall + status) with NO game in the process; the inverse of preview-server.js. `node src/platform-server.js`
 │   ├── preview-server.js        ← GAME-ONLY entrypoint for the per-box sandbox (ADR 0052): Phaser/Colyseus + tiles, NO /api/gds

package/docs/modules-contract.md

@@ -115,6 +115,8 @@ An unknown key throws at validate time — typos fail loud (top-level attributio
 
 **Attribution (`author`/`origin`/`license`/`maintainer`) is portable metadata, not a cross-GDS link** — each repo runs its own GDS with its own builder identities ([ADR 0100](adr/<redacted>.md) §3), so credit travels *with the module* rather than through a foreign key ([ADR 0107](adr/<redacted>.md) §2). `bongos module new` stamps all four as TODO placeholders (license defaults to `AGPL-3.0`) so a module carries its authorship from the day it's scaffolded, not bolted on later at upstream-submit time.
 
+**`bongos module list [--catalog] [--search <text>] [--json]`** ([ADR 0107](adr/<redacted>.md) §2/§3, [ADR 0167](adr/<redacted>.md)) is the browsable catalog from the terminal: every module on disk with its enabled state, its author + origin credit, and its upkeep posture. `--catalog` narrows to the **core-shipped** modules — the shared catalog an instance opts into (§6, default-off). Two axes travel on each row and they are *not* the same question: **`source`** (which tree ships it — the core package or this instance's own repo, read structurally from the loader's discovery root, [ADR 0108](adr/<redacted>.md) §1) and **`provenance`** (who built it, derived from the declared `origin`). A core module that declares no attribution is credited to the platform and the credit is **marked inferred** (`*`) rather than left blank or silently invented. The hall's Modules tab renders the same model (`src/module-loader/catalog.js`) via `GET /modules`, so the two surfaces cannot drift.
+
 **`bongos module check <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/<redacted>.md) §4) is the submit-time pre-check a module must clear before it can be upstreamed. It reuses (never re-types) the public-mirror publish denylist (`scripts/gds/publish-manifest.js`'s `matchesDeny`) to reject content that cannot ship under AGPL (game content, pixel art, copyrighted reference material) — deliberately the DENY half only, since a brand-new module is never on the publish ALLOWLIST until it's accepted into core (§6). It also requires `module.json`'s `license` to be AGPL-3.0 (inbound = outbound) and a declared `maintenance` posture — acceptance is a commitment to upkeep, so a module with no `maintenance.status`, or one already `deprecated`/`orphaned`, is refused ([ADR 0166](adr/<redacted>.md); see below). On a pass, `--sign-off` records a lightweight DCO-style affirmation (own work, licensed AGPL-3.0 — never a copyright-assignment CLA) to `modules/<key>/.upstream-signoff.json`.
 
 ### `maintenance` — who keeps this module true as the core advances ([ADR 0166](adr/<redacted>.md))

package/modules/hall-ui/public/modules.css

@@ -60,4 +60,33 @@ button.mod-submit {
 }
 button.mod-submit:disabled { opacity: 0.45; cursor: not-allowed; }
 .mod-empty { color: var(--ink-faint); font-style: italic; font-size: 13px; padding: 10px 0; }
-.mod-note { font-size: 12px; color: var(--ink-faint); margin-top: 4px; }
+.mod-note { font-size: 12px; color: var(--ink-faint); margin-top: 4px; }
+
+/* Catalog browse bar (task 1001772) — one filter over both grids. */
+.mod-browse { margin: 0 0 16px; }
+.mod-browse__label {
+  display: block;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--ink-soft);
+  margin-bottom: 6px;
+}
+.mod-browse__input {
+  font-family: var(--font-body);
+  font-size: 13.5px;
+  width: 100%;
+  max-width: 420px;
+  padding: 8px 12px;
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--border-strong);
+  background: var(--surface);
+  color: var(--ink);
+}
+/* The marker on an inferred credit — quiet, but hoverable for the reason. */
+.mod-inferred {
+  border: 0;
+  text-decoration: none;
+  cursor: help;
+  color: var(--ink-faint);
+  margin-left: 1px;
+}

package/modules/hall-ui/public/modules.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Modules — {{worldName}}</title>
-  <meta name="description" content="What this instance runs: enable or disable modules, see which are your own vs. core-loaded, and submit one upstream.">
+  <meta name="description" content="Browse the Cloud Bongos module catalog: what the core ships, who built each module and where it came from, what this instance runs, and how to submit one upstream.">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -23,19 +23,30 @@
       <div class="page-head"><p class="page-head__sub" id="modules-sub">Loading modules…</p></div>
 
       <main>
-        <!-- Built by this project — modules with no foreign origin (ADR 0107 §9). -->
-        <section class="scroll" id="own-scroll" aria-labelledby="own-h">
-          <h2 id="own-h" class="scroll__h">Built by this project</h2>
-          <p class="scroll__lede">Modules this instance built itself. Toggle which ones are active; Metic+ can flip the switch, everyone can see the state.</p>
-          <div class="mod-grid" id="own-grid"><div class="mod-empty">Loading…</div></div>
-        </section>
+        <!-- Browse — one filter over both grids below (task 1001772). -->
+        <div class="mod-browse">
+          <label class="mod-browse__label" for="mod-search">Search the catalog</label>
+          <input type="search" id="mod-search" class="mod-browse__input" autocomplete="off"
+                 placeholder="name, author, origin project, or licence…">
+          <p class="mod-note" id="mod-browse-count" role="status" aria-live="polite"></p>
+        </div>
 
-        <!-- Core-loaded — pulled in from the shared Cloud Bongos catalog. Empty
-             until the upstream/submit pipeline (task 1770/1772) actually lands one. -->
+        <!-- The catalog — every module the CORE ships, which this instance can
+             opt into (ADR 0107 §6: accepted modules land default-off). Each row
+             carries its author + origin credit (§2/§3: credit now, money later). -->
         <section class="scroll" id="core-scroll" aria-labelledby="core-h">
-          <h2 id="core-h" class="scroll__h">Core-loaded (from Cloud Bongos)</h2>
-          <p class="scroll__lede">Modules built by other Cloud Bongos instances and pulled into this one. None yet — this instance hasn't adopted a module from the shared catalog.</p>
-          <div class="mod-grid" id="core-grid"><div class="mod-empty">None yet.</div></div>
+          <h2 id="core-h" class="scroll__h">Module catalog</h2>
+          <p class="scroll__lede">Modules the Cloud Bongos core ships — the shared repository built by its sub-projects, each credited to its author and the project it came from. Enable the ones you want; Metic+ can flip the switch, everyone can see the state.</p>
+          <div class="mod-grid" id="core-grid"><div class="mod-empty">Loading…</div></div>
+        </section>
+
+        <!-- This instance's own modules — the pool `bongos module submit` draws
+             from. Separate from the catalog because these ship from this repo,
+             not from the core package. -->
+        <section class="scroll" id="own-scroll" aria-labelledby="own-h">
+          <h2 id="own-h" class="scroll__h">Built by this project</h2>
+          <p class="scroll__lede">Modules that live in this instance's own repo rather than arriving with the core. Submit one upstream below to offer it to every other instance.</p>
+          <div class="mod-grid" id="own-grid"><div class="mod-empty">None on disk.</div></div>
         </section>
 
         <!-- Submit for review — the front door to bongos module submit (ADR 0107 §1/§9). -->
@@ -57,6 +68,6 @@
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/modules.js?v=2026-07-03-modtab"></script>
+<script src="/builders/modules.js?v=2026-08-12-catalog"></script>
 </body>
 </html>

package/modules/hall-ui/public/modules.js

@@ -1,16 +1,23 @@
 // public-builders/modules.js — the hall "Modules" tab (/builders/modules).
 //
-// ADR 0107 §9 / task 1776. Three jobs:
-//   1. List every on-disk module, split "built by this project" vs. "core-loaded
-//      from Cloud Bongos" (src/module-loader/provenance.js decides the split —
-//      see GET /api/bongos/modules).
+// ADR 0107 §9 (task 1776) + §2/§3 the browsable catalog (task 1001772). Jobs:
+//   1. BROWSE the catalog — every module the core ships that this instance can
+//      enable, each with its author + origin credit, filterable by a single
+//      search box over name/author/origin/licence. Split from the instance's
+//      OWN modules by `source` (which TREE it ships from — the core package or
+//      this repo), which GET /api/bongos/modules reads structurally off the
+//      loader's discovery roots. That is a different axis from `provenance`
+//      (WHO built it, read off the manifest's origin) and both are shown: the
+//      section says where it ships from, the chips say who to credit.
 //   2. Enable/disable — a toggle over config/modules.json (POST /modules/:key/enable).
 //      Any signed-in builder sees the state; only metic+archon can flip it (the
 //      server enforces this — a lower-rank click just gets a 403 + a friendly
 //      toast, same as every other rank-gated write in this hall).
-//   3. "Submit for review" front door — returns 501 today (the submit pipeline,
-//      task 1770, hasn't landed) so the button stays visibly disabled with a
-//      tooltip rather than pretending to queue something.
+//   3. "Submit for review" front door — files one of this project's own modules
+//      into the upstreaming review queue (POST /modules/:key/submit, task 1770).
+//
+// The rows come from the SAME builder as `bongos module list --catalog`
+// (src/module-loader/catalog.js), so the two surfaces cannot drift.
 
 (() => {
   'use strict';
@@ -24,6 +31,8 @@
 
   let viewerRank = 'xenos';
   let canToggle = false;
+  // The last payload, held so the search box can re-filter without a refetch.
+  let allModules = [];
 
   function provenanceChip(m) {
     return m.provenance === 'core'
@@ -31,14 +40,30 @@
       : '<span class="mod-chip mod-chip--own">built here</span>';
   }
 
+  // Author + origin credit (ADR 0107 §2/§3 — credit now, money later). Reads
+  // `credit`, not the raw manifest fields, so a core module whose manifest
+  // declares no author still shows who ships it rather than a blank card; an
+  // INFERRED credit is marked so it never reads as something the author typed.
   function attributionChips(m) {
+    const credit = m.credit || { author: m.author, origin: m.origin, inferred: false };
+    const mark = credit.inferred ? '<abbr class="mod-inferred" title="Not declared in module.json — this is who ships the module.">*</abbr>' : '';
     const chips = [];
-    if (m.author) chips.push(`<span class="mod-chip">by ${escapeHtml(m.author)}</span>`);
-    if (m.origin) chips.push(`<span class="mod-chip">from ${escapeHtml(m.origin)}</span>`);
+    if (credit.author) chips.push(`<span class="mod-chip">by ${escapeHtml(credit.author)}${mark}</span>`);
+    if (credit.origin && credit.origin !== credit.author) chips.push(`<span class="mod-chip">from ${escapeHtml(credit.origin)}${mark}</span>`);
     if (m.license) chips.push(`<span class="mod-chip">${escapeHtml(m.license)}</span>`);
     return chips.join('');
   }
 
+  // Free-text browse over the fields a builder would search by. Mirrors
+  // searchCatalog() in src/module-loader/catalog.js — same fields, same
+  // case-insensitive substring rule — so the hall and the CLI filter alike.
+  function matchesQuery(m, q) {
+    if (!q) return true;
+    const credit = m.credit || {};
+    return [m.key, m.title, m.description, credit.author, credit.origin, m.license]
+      .some((f) => f && String(f).toLowerCase().includes(q));
+  }
+
   // Upkeep posture (ADR 0107 §7 / ADR 0166) — who keeps this module true as the
   // core advances. A module with no declared maintenance is shown as such rather
   // than silently: an unowned catalog entry is the thing the policy exists to
@@ -75,19 +100,59 @@
       </div>`;
   }
 
-  function render(data) {
-    const own = data.modules.filter((m) => m.provenance === 'own');
-    const core = data.modules.filter((m) => m.provenance === 'core');
+  // `source` splits the page: 'core' = shipped by the core package (the
+  // catalog you opt into), 'instance' = lives in this repo. Older payloads
+  // predate the field, so fall back to the credit axis rather than emptying
+  // the page against a server that hasn't been redeployed yet.
+  function sourceOf(m) {
+    if (m.source) return m.source;
+    return m.provenance === 'core' ? 'core' : 'instance';
+  }
 
-    const sub = $('#modules-sub');
-    if (sub) sub.textContent = `${data.modules.length} module(s) — ${own.length} built by this project, ${core.length} core-loaded.`;
+  function renderGrids() {
+    const input = $('#mod-search');
+    const q = input ? input.value.trim().toLowerCase() : '';
+    const matching = allModules.filter((m) => matchesQuery(m, q));
+    const core = matching.filter((m) => sourceOf(m) === 'core');
+    const own = matching.filter((m) => sourceOf(m) === 'instance');
 
+    const coreGrid = $('#core-grid');
+    if (coreGrid) {
+      coreGrid.innerHTML = core.length ? core.map(cardHTML).join('')
+        : `<div class="mod-empty">${q ? 'No catalog module matches that search.' : 'The core ships no modules this instance can see.'}</div>`;
+    }
     const ownGrid = $('#own-grid');
-    if (ownGrid) ownGrid.innerHTML = own.length ? own.map(cardHTML).join('') : '<div class="mod-empty">None on disk.</div>';
+    if (ownGrid) {
+      ownGrid.innerHTML = own.length ? own.map(cardHTML).join('')
+        : `<div class="mod-empty">${q ? 'None of this project\'s own modules match that search.' : 'None on disk — everything here ships with the core.'}</div>`;
+    }
 
-    const coreGrid = $('#core-grid');
-    if (coreGrid) coreGrid.innerHTML = core.length ? core.map(cardHTML).join('') : '<div class="mod-empty">None yet.</div>';
+    const count = $('#mod-browse-count');
+    if (count) {
+      count.textContent = q
+        ? `${matching.length} of ${allModules.length} module(s) match “${input.value.trim()}”.`
+        : '';
+    }
+
+    document.querySelectorAll('.mod-toggle').forEach((btn) => btn.addEventListener('click', onToggle));
+  }
+
+  function render(data) {
+    allModules = Array.isArray(data.modules) ? data.modules : [];
+    const core = allModules.filter((m) => sourceOf(m) === 'core');
+    const own = allModules.filter((m) => sourceOf(m) === 'instance');
+    const enabled = core.filter((m) => m.enabled).length;
+
+    const sub = $('#modules-sub');
+    if (sub) {
+      sub.textContent = `${allModules.length} module(s) — ${core.length} in the core catalog (${enabled} enabled here), `
+        + `${own.length} built by this project.`;
+    }
+
+    renderGrids();
 
+    // Only this project's OWN modules can be submitted upstream: a module that
+    // already ships with the core is, by definition, already in the catalog.
     const submitStatus = $('#submit-status');
     if (submitStatus) {
       submitStatus.innerHTML = own.length
@@ -98,16 +163,12 @@
               Submit "${escapeHtml(m.key)}" for review
             </button>
           </span>`).join('')
-        : '<span class="mod-note">No modules of this project\'s own to submit.</span>';
+        : '<span class="mod-note">Nothing to submit — every module here already ships with the core.</span>';
+      document.querySelectorAll('[data-submit-key]').forEach((btn) => btn.addEventListener('click', onSubmit));
     }
 
-    // Wire toggles.
-    document.querySelectorAll('.mod-toggle').forEach((btn) => {
-      btn.addEventListener('click', onToggle);
-    });
-    document.querySelectorAll('[data-submit-key]').forEach((btn) => {
-      btn.addEventListener('click', onSubmit);
-    });
+    const search = $('#mod-search');
+    if (search) search.addEventListener('input', renderGrids);
   }
 
   async function onToggle(ev) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.98",
+  "version": "1.19.100",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.98",
+      "version": "1.19.100",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.98",
+  "version": "1.19.100",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",