@bongos/core 1.20.41 → 1.20.43

package/docs/onboarding/slash-commands.md

@@ -42,29 +42,31 @@ Every one of these talks to the build system. They're grouped by when you'd reac
 | `/builder-setup` | One-time enrolment — signs you in and registers you |
 | `/builder-reauth` | Refresh an expired session |
 | `/builder-key` | Check / set your own API key status |
-| `/builder-cost` | Log a cost entry against your claim |
-| `/builder-backup` | Check or trigger a database backup before risky work |
-| `/builder-exit` | Offboard or reactivate a builder *(Archon only)* |
+| `/builder-cost` † | Log or read project spend |
+| `/builder-backup` † | Check or trigger a database backup before risky work |
+| `/builder-exit` † | Offboard or reactivate a builder *(Archon only)* |
 
 ### Triage and planning *(Metic and above)*
 
 | Command | What it does |
 |---|---|
-| `/idea-triage` | Walk the idea inbox — promote, discard, or merge each |
+| `/owner-review` | One walk through everything waiting on a decision: backlog → bugs → ideas → priorities. Say *"triage ideas"* or *"review the backlog"* and it opens at that step |
 | `/blocker-review` · `/blocker-solve` | Walk open blockers, or drive one to done |
 | `/goal-create` | Plan and create one goal — scope wall, criteria, seed tasks |
-| `/goal-review` | Confirm criteria that are flagged met-pending-review |
-| `/planning-session` | Scope an upcoming version and seed its task list |
-| `/priority-session` | Reweight the inbox from a few plain-speech answers |
+| `/goal-close` † | Close a goal's criteria: test them on the live site and sign off, then decide the ones nothing was delivered for |
+| `/planning-session` † | Scope an upcoming version and seed its task list |
+| `/grade-sweep` † | Check the grader is healthy, then audit what shipped past it |
 | `/merge-mode` | Manual fallback when a confirmed task didn't land |
 
+The four steps of `/owner-review` still answer to their old names — `/backlog-review`, `/bug-triage`, `/idea-triage`, `/priority-session` — and so do `/goal-uat` · `/goal-review` (now the two parts of `/goal-close`) and `/grader-health` · `/grade-audit` (now the two parts of `/grade-sweep`). All of those are typed-only (†).
+
 ### Discipline modes — not slash commands any more
 
 The three core crafts no longer have a slash command. `/dev`, `/paint` and `/ideate` were **deleted** when the root instructions split into a role-neutral kernel (`CLAUDE.md`) plus one **role pack** per craft: `docs/packs/engineer.md`, `docs/packs/artist.md`, `docs/packs/ideator.md`. A claimed task's discipline routes you to your pack — the Conductor injects its path into your session on the next prompt, and `claim.js` prints a one-line reminder — and you read it. A module-contributed discipline can still ship a skill, which is how `ui` → `/design` below works.
 
 ### Design and art pipeline
 
-`/design` is the ui-discipline playbook (world-first, show-first — shipped by the `ui-design` module, ADR 0197); `/design-sync` and `/figma-design-sync` round-trip the UI design system. The `/otb-*` family — `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — is the reference instance's pixel-art pipeline; it's only meaningful on an instance that runs that pipeline, so it ships in the `pixel-art` module, which is off unless the project turns it on. The design-style skills (`/impeccable`, `/style`, the taste and look skills) are the same: the `design-styles` module, off unless turned on — `/design` tells you which.
+`/design` is the ui-discipline playbook (world-first, show-first — shipped by the `ui-design` module, ADR 0197); `/design-sync` † and `/figma-design-sync` † round-trip the UI design system. `/tweak` † applies the next page an artist rewrote in the studio; it ships in the `copy-desk` module, where the studio lives. The `/otb-*` family — `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — is the reference instance's pixel-art pipeline; it's only meaningful on an instance that runs that pipeline, so it ships in the `pixel-art` module, which is off unless the project turns it on. The design-style skills (`/impeccable`, `/style`, the taste and look skills) are the same: the `design-styles` module, off unless turned on — `/design` tells you which.
 
 ### Session and meta
 
@@ -73,9 +75,13 @@ The three core crafts no longer have a slash command. `/dev`, `/paint` and `/ide
 | `/session-handoff` | Emit a paste-ready prompt to start a fresh session with |
 | `/read-session-export` | Read a past session's `/export` zip |
 | `/feedback` | Pull in the latest recorded walkthrough bundle |
-| `/new-project` | Zero-to-live runbook for a brand-new instance |
+| `/new-project` † | Zero-to-live runbook for a brand-new instance |
 | `/builder-redteam` | File a security / vulnerability report |
 
+### † Typed-only commands
+
+A command marked † is **hidden from Claude's own menu but still works when you type it**. Every listed command's description sits in every session's context whether it is used or not, so the rarely-used admin ones carry `disable-model-invocation: true` in their `SKILL.md`: Claude Code leaves them out of what the model sees, and only a person typing `/name` runs them (task 1004471). The catch: plain English will not reach them, and Claude will not start one on its own — type the slash form.
+
 ## Claude Code's own commands
 
 These work in **any** repository — they have nothing to do with this project. `/help` prints the live, authoritative list for your version; the ones below are simply the ones you'll actually meet.
@@ -111,11 +117,11 @@ These are the ones that actually cause confusion.
 
 **`/export` vs `/read-session-export`.** Claude's `/export` *writes* a transcript zip; our `/read-session-export` *reads* one back.
 
-**`/review` reviews a GitHub PR.** The project's review commands are `/goal-review`, `/blocker-review`, and `/idea-triage` — different jobs entirely.
+**`/review` reviews a GitHub PR.** The project's review commands are `/owner-review`, `/blocker-review`, and `/goal-close` — different jobs entirely.
 
 ## Two more things worth knowing
 
-**Every command has a plain-English twin.** Each skill lists trigger phrases, so *"what can I work on"* reaches `/builder-start` and *"ship it"* reaches `/builder-ship`. You never have to memorise the slash form.
+**Every listed command has a plain-English twin.** Each skill lists trigger phrases, so *"what can I work on"* reaches `/builder-start` and *"ship it"* reaches `/builder-ship`. You never have to memorise the slash form — except for the typed-only † commands above.
 
 **Same commands, outside Claude.** The work-loop commands are also a terminal CLI: `bongos start`, `bongos claim N`, `bongos ship`. Same actions, same API — usable from any terminal, a Chromebook, or CI. Run `bongos help` for the verb list.
 

package/docs/packs/artist.md

@@ -27,7 +27,7 @@ The studio's own words (the greeting and its sub-line) are the studio page itsel
 
 Only the holder writes. A page someone else holds is read-only and names them. A draft left unsubmitted keeps its words and can be taken up again.
 
-**Between submit and approval, a session applies it.** Submitted pages wait for a builder session running `/tweak` ([the skill](../../.claude/skills/tweak/SKILL.md), Metic+). It transcribes every line, renders the page before and after, and parks it. **It never lands the page.**
+**Between submit and approval, a session applies it.** Submitted pages wait for a builder session running `/tweak` ([the skill](../../modules/copy-desk/skills/tweak/SKILL.md), Metic+). It transcribes every line, renders the page before and after, and parks it. **It never lands the page.**
 
 **The Approval queue.** Pictures of the applied page, desktop or phone, light or dark, flipped **before / after**. Beside them, the changed lines ("was:" / "becomes:"); a line the applier could not apply says why. Then:
 

package/docs/packs/engineer.md

@@ -74,7 +74,7 @@ If this is an autonomous, bypass-permissions, or scheduled run and no one will a
 
 1. **Resolve your claim** — `/builder-ship` with handoff notes and a value summary, or `/builder-release` on abandonment. Bongos records the session-log row and awards credits.
 2. **Write a session log** as its own file at `docs/session-logs/YYYY-MM-DD-<slug>.md`, using [`docs/handoff-template.md`](../handoff-template.md). Do not hand-edit the kernel's §13 index or `docs/session-log-index.md` — both regenerate from your file at ship. For a single-task session the Bongos `session_logs` row is enough and a separate file isn't needed.
-3. **Review the `idea_inbox`** via `GET /api/bongos/inbox`, or run `/idea-triage`.
+3. **Review the `idea_inbox`** via `GET /api/bongos/inbox`, or run `/owner-review ideas`.
 4. **Update the detail files** if anything changed: a new gotcha → a recipe or a captured learning; a new blocker → `POST /api/bongos/blockers`; a decision → a new ADR.
 5. **Update [`docs/architecture.md`](../architecture.md)** if the live system changed, and [`docs/file-map.md`](../file-map.md) if files or folders moved.
 
@@ -82,13 +82,12 @@ If nothing changed in a section, leave it alone — don't churn.
 
 ### Daily cadence (once per day, not per session)
 
-Three manual slash-commands keep the methodology surfaces from accumulating drift. Any session can pick them up; it only matters that they happen.
+Two manual slash-commands keep the methodology surfaces from accumulating drift. Any session can pick them up; it only matters that they happen.
 
-- **`/idea-triage`** — walk the open `idea_inbox` rows: promote, discard, merge, or defer. Deferring is fine; the cadence is the discipline.
+- **`/owner-review`** — one walk through backlog → bugs → ideas → priorities (task 1004471); each step is still typeable alone (`/backlog-review`, `/bug-triage`, `/idea-triage`, `/priority-session`). Ideas: promote, discard, merge, or defer — deferring is fine; the cadence is the discipline. Backlog: rows waiting on a **person** get walked (promote / kill / water); rows waiting on a **trigger** are counted, never walked (a satisfied dep auto-promotes), and rows stranded behind an abandoned dep are surfaced. `/demote` is invalid on a backlog row (409 `cannot_demote` — it requires `ready`).
 - **`/blocker-review`** — walk the open blockers: resolved (which auto-promotes linked tasks via a DB trigger), still blocked with a note, or escalate.
-- **`/backlog-review`** — walk `status='backlog'`, the pre-workable state a human must say go on. Rows waiting on a **person** get walked (promote / kill / water); rows waiting on a **trigger** are counted, never walked (a satisfied dep auto-promotes). It also surfaces rows stranded behind an abandoned dep, which the trigger can never fire for. `/demote` is invalid on a backlog row (409 `cannot_demote` — it requires `ready`).
 
-**`/tweak`** (Metic+) works a fourth queue: pages an artist submitted from the studio wait there until a session applies them. It never lands one; the artist approves first (ADR 0341).
+**`/tweak`** (Metic+, typed-only, in the `copy-desk` module) works a fourth queue: pages an artist submitted from the studio wait there until a session applies them. It never lands one; the artist approves first (ADR 0341).
 
 If a day passes without them, the queues quietly grow. Running them is the structural cure for the markdown-graveyard pattern.
 

package/modules/copy-desk/module.json

@@ -6,7 +6,7 @@
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["copy-desk"], "migrations": true },
+  "contributes": { "routes": ["copy-desk"], "migrations": true, "skills": ["tweak"] },
   "provides": [],
   "consumes": ["lifecycle"]
 }

package/{.claude → modules/copy-desk}/skills/tweak/SKILL.md

@@ -2,6 +2,7 @@
 name: tweak
 description: >-
   Apply the next submitted page tweak: claim the round, apply every line, render the page before and after, attach the renders and ship it to wait for the artist. Metic+. Triggers: "/tweak", "apply the next page tweak", "work the tweak queue".
+disable-model-invocation: true
 plain: >-
   Applies the next set of change requests someone made to a page, and shows before and after pictures for the artist to approve.
 reach-for: >-

package/modules/lifecycle/dependency-advisory.js

@@ -17,9 +17,9 @@
 //   1. POST /tasks attaches `dependency_advisory` to its 201 body (this
 //      file's `buildDependencyAdvisory`), read by the /goal-create skill's
 //      "sibling advisory" section (.claude/skills/goal-create/SKILL.md).
-//   2. The periodic sweep: `/goal-review`'s daily walk runs
+//   2. The periodic sweep: `/goal-close`'s residue walk (was `/goal-review`) runs
 //      `node scripts/gds/audit-deps.js --min high` as one more housekeeping
-//      step (idea 1000276's half — see .claude/skills/goal-review/SKILL.md).
+//      step (idea 1000276's half — see .claude/skills/goal-close/SKILL.md, Part 2).
 //
 // HARD CONSTRAINT, same as goal-advisory.js: advisory only (a finding addressed
 // to a human never acts by itself — ADR 0158 §2). This

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.41",
+  "version": "1.20.43",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.41",
+      "version": "1.20.43",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.41",
+  "version": "1.20.43",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8355,5 +8355,17 @@
       "id": "1004470",
       "text": "Projects that don't do pixel art or design styling no longer carry 18 unused AI commands in every session (about a third less to load); projects that want them turn them on with one setting."
     }
+  ],
+  "1.20.42": [
+    {
+      "id": "1003792",
+      "text": "The module store can now run a security check on each module version: it fails a version that ships a secret file, pulls code from outside the official package registry, or depends on a package with a known serious vulnerabili"
+    }
+  ],
+  "1.20.43": [
+    {
+      "id": "1004471",
+      "text": "Claude's list of project commands is now short enough to read in full every session: the rarely used admin commands still work when you type them but no longer take up room, and one new /owner-review walks the backlog, bugs, i"
+    }
   ]
 }

package/scripts/gds/fitness-ratchets.js

@@ -423,6 +423,8 @@ function skillListingMetrics() {
     const lint = require('./skill-lint.js');
     // Resident skills only (task 1004470): a skill owned by a module this checkout leaves
     // off (pixel-art, design-styles — both default: false) is in no session's listing here.
+    // listingChars also leaves out HIDDEN skills (disable-model-invocation: true, task 1004471):
+    // Claude Code keeps their descriptions out of the model's context entirely.
     const files = lint.listSkillFiles();
     return { skill_listing_chars: lint.lintSkills(files, { resident: lint.residentSkillFiles(undefined, { files }) }).listingChars };
   } catch (e) {

package/scripts/gds/module-artifact.js

@@ -216,4 +216,4 @@ async function verifyModuleArtifact(tgz, { key, maxBytes = MAX_TARBALL_BYTES, in
   return out;
 }
 
-module.exports = { MAX_TARBALL_BYTES, packModule, verifyModuleArtifact };
+module.exports = { MAX_TARBALL_BYTES, packModule, verifyModuleArtifact, deniedFiles };

package/scripts/gds/module-assess-security.js

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-security.js — the Security part of a module's
+// assessment: a pass/fail GATE over one published store version, recorded as a
+// module_assessment_signals row (task 1003792; ADR 0343 D2; table from core_265).
+//
+// WHY a gate and not a score. ADR 0343 D2: a version that fails the security
+// check is not listed, whatever else it scores, and security is never averaged
+// in — so a module cannot buy back a vulnerability with good tests. The outcome
+// is therefore only ever passed / failed, or not_scored when the check could not
+// be completed (which is NOT a pass: a gate that cannot run must not open).
+//
+// The check reuses what the project already enforces rather than re-typing it:
+//   1. the publish denylist — module-artifact.js deniedFiles (the repo-wide
+//      matchesDeny list + credential-named files; ADR 0107 §4). Publish already
+//      refuses these; re-checking here means a rule added later still reaches
+//      versions published before it.
+//   2. dependency SOURCES — every entry in module.json `dependencies` (ADR 0138)
+//      must be a plain registry package name with a plain semver range or dist-
+//      tag. That is an ALLOWLIST (registrySpec below), deliberately stricter than
+//      a list of bad protocols: a git/http/file, aliased or GitHub-shorthand spec
+//      — or anything else unrecognised — installs code from somewhere nobody
+//      vetted, and fails the gate. (It mirrors the artifact-scan floor's grading,
+//      but a core script may not require a module's files, so it is its own
+//      small rule.) Floating ranges and wildcards are only noted.
+//   3. KNOWN VULNERABILITIES in those dependencies — only when every spec passed
+//      check 2, so nothing a module names is ever fetched from a place of its
+//      choosing and no `file:` path is ever resolved on this host. npm resolves the ranges in a
+//      throwaway directory (--package-lock-only --ignore-scripts: registry
+//      metadata only, no package code downloaded or run), then `npm audit`; any
+//      high or critical advisory fails the gate (the threshold scripts/security/
+//      dep-audit.js uses for the core, whose parser this reuses).
+// And one input that is reported, never failed on: the `maintenance` posture
+// (ADR 0166). "Undeclared", "deprecated" or "orphaned" is something a buyer
+// should see, but it is upkeep, not a vulnerability — that call is recorded in
+// the row's detail so the hall (task 1003799) can surface it.
+//
+// Nothing here executes the module's own code, so unlike module-assess-tests.js
+// this is safe to run on the control plane.
+//
+//   node scripts/gds/module-assess-security.js <store_module_versions.id>   run + record
+//   node scripts/gds/module-assess-security.js --dir modules/<key>          dry run (prints; no DB)
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFile } = require('node:child_process');
+const { deniedFiles, verifyModuleArtifact } = require('./module-artifact');
+const { extractNpmFindings } = require('../security/dep-audit');
+
+const AUDIT_TIMEOUT_MS = 120_000;
+// npm is a .cmd shim on Windows, which execFile cannot start without a shell; go
+// through cmd.exe explicitly rather than shell:true (the args are fixed constants).
+const npmCommand = (args) => (process.platform === 'win32'
+  ? ['cmd.exe', ['/d', '/s', '/c', 'npm', ...args]]
+  : ['npm', args]);
+
+// Run one npm command in `cwd`; resolve { ok, stdout, stderr, error }. Never rejects.
+function npmRun(args, cwd, { exec = execFile, timeoutMs = AUDIT_TIMEOUT_MS } = {}) {
+  return new Promise((resolve) => {
+    const [cmd, argv] = npmCommand(args);
+    exec(cmd, argv, { cwd, timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true },
+      (err, stdout, stderr) => resolve({ err, stdout: String(stdout || ''), stderr: String(stderr || '') }));
+  });
+}
+
+// Audit a dependency map { name: range } for known high/critical advisories.
+// Resolves { ok: true, findings } or { ok: false, reason } when npm could not
+// resolve or audit (offline, unknown package, npm missing) — the caller treats
+// that as not_scored, never as a pass.
+async function auditDependencies(deps, { exec, timeoutMs } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'module-assess-security-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'module-assess-audit', private: true, version: '0.0.0', dependencies: deps }));
+    const lock = await npmRun(['install', '--package-lock-only', '--ignore-scripts', '--no-audit', '--no-fund'], dir, { exec, timeoutMs });
+    if (lock.err || !fs.existsSync(path.join(dir, 'package-lock.json'))) {
+      return { ok: false, reason: 'npm could not resolve the declared dependencies' };
+    }
+    // npm audit exits 1 when it finds anything; the JSON on stdout is the answer either way.
+    const audit = await npmRun(['audit', '--json'], dir, { exec, timeoutMs });
+    let parsed;
+    try { parsed = JSON.parse(audit.stdout || ''); } catch { return { ok: false, reason: 'npm audit produced no readable report' }; }
+    if (parsed && parsed.error) return { ok: false, reason: 'npm audit could not reach the advisory database' };
+    return { ok: true, findings: extractNpmFindings(parsed) };
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// npm's package-name rule (scoped or not, lowercase, no path segments).
+const NPM_NAME_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+// A semver range: versions, x/* wildcards, ^ ~ comparators, hyphen and || unions,
+// prerelease/build suffixes. No ':' '/' '#' '@' — so no protocol, path, alias or ref.
+const RANGE_RE = /^[0-9A-Za-z.*^~<>=|\s+-]+$/;
+const DIST_TAGS = new Set(['latest', 'next']);
+
+// Grade one declared dependency. { ok: false } means it would install from
+// somewhere other than the public registry (or cannot be read as a registry
+// spec): the gate fails and it is never handed to npm. { ok: true, kind } is a
+// registry spec; kind names how much the registry decides at install time.
+function registrySpec(name, spec) {
+  const s = String(spec).trim();
+  if (!NPM_NAME_RE.test(name)) return { ok: false, kind: 'invalid package name' };
+  if (DIST_TAGS.has(s) || s === '*' || s === '' || /^[xX]$/.test(s)) return { ok: true, kind: 'wildcard' };
+  if (/^[a-z+]+:/i.test(s)) return { ok: false, kind: 'non-registry source' };
+  // Every whitespace/||-separated token must start with a comparator or a digit/x.
+  const tokens = s.split(/\s*\|\|\s*|\s+/).filter(Boolean);
+  if (!RANGE_RE.test(s) || !tokens.every((t) => t === '-' || /^(?:[\^~]|[<>]=?|=)?\s*[0-9xX*]/.test(t))) {
+    return { ok: false, kind: 'not a registry range' };
+  }
+  if (/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(s)) return { ok: true, kind: 'pinned' };
+  return { ok: true, kind: 'floating range' };
+}
+
+// The maintenance posture as a buyer would read it (ADR 0166).
+function maintenancePosture(moduleJson) {
+  const m = moduleJson && moduleJson.maintenance;
+  return m && typeof m.status === 'string' ? m.status : 'undeclared';
+}
+
+// The gate over one version's files ([{ path, buf }], module-relative) and its
+// parsed module.json. Returns the signal fields { outcome, score, sample_size,
+// reason, detail }. `audit` is injectable so tests need no network.
+async function assessSecurity(key, files, moduleJson, { audit = auditDependencies } = {}) {
+  const failures = [];
+  const notes = [];
+
+  const denied = deniedFiles(key, files.map((f) => f.path));
+  if (denied.length) failures.push({ check: 'denylist', files: denied });
+
+  const deps = (moduleJson && moduleJson.dependencies) || {};
+  const names = Object.keys(deps).sort();
+  const sources = [];
+  for (const name of names) {
+    const graded = registrySpec(name, deps[name]);
+    const entry = { package: name.slice(0, 214), spec: String(deps[name]).slice(0, 200), kind: graded.kind };
+    if (!graded.ok) sources.push(entry);
+    else if (graded.kind === 'wildcard') notes.push({ check: 'dependency_wildcard', ...entry });
+    else if (graded.kind === 'floating range') notes.push({ check: 'dependency_range', ...entry });
+  }
+  if (sources.length) failures.push({ check: 'dependency_source', dependencies: sources });
+
+  // Audit only an all-registry list: a failed source already fails the gate, and
+  // handing it to npm would make this host fetch (or resolve a file: path) of the
+  // module's choosing.
+  let advisories = [];
+  if (names.length && !sources.length) {
+    const a = await audit(deps);
+    if (!a.ok) {
+      return {
+        outcome: 'not_scored', score: null, sample_size: names.length,
+        reason: `the dependency audit could not run: ${a.reason}`,
+        detail: { failures, notes, maintenance: maintenancePosture(moduleJson) },
+      };
+    }
+    advisories = a.findings.map((f) => ({ package: f.package, severity: f.severity, id: f.id, summary: f.summary, fix: f.fix }));
+    if (advisories.length) failures.push({ check: 'vulnerable_dependency', advisories });
+  }
+
+  const maintenance = maintenancePosture(moduleJson);
+  if (maintenance !== 'maintained' && maintenance !== 'core-maintained') {
+    notes.push({ check: 'maintenance', status: maintenance });
+  }
+
+  const detail = { failures, notes, maintenance, dependencies_checked: names.length };
+  if (failures.length) {
+    return { outcome: 'failed', score: null, sample_size: names.length, reason: `failed: ${failures.map((f) => f.check).join(', ')}`, detail };
+  }
+  return {
+    outcome: 'passed', score: null, sample_size: names.length,
+    reason: names.length ? `passed: ${names.length} dependency(ies) from the registry, no high or critical advisory` : 'passed: no denied files and no dependencies',
+    detail,
+  };
+}
+
+// Append one Security row. Never UPDATEs (core_265 is append-only).
+async function insertSecuritySignal(versionId, s, { db }) {
+  const { rows: [row] } = await db.query(
+    `INSERT INTO module_assessment_signals (version_id, part, outcome, score, sample_size, reason, detail)
+     VALUES ($1, 'security', $2, $3, $4, $5, $6)
+     RETURNING id, version_id, part, outcome, score, sample_size, reason, measured_at`,
+    [versionId, s.outcome, s.score, s.sample_size, s.reason, JSON.stringify(s.detail || {})]);
+  return row;
+}
+
+// Read and verify one published version, run the gate, record the result. A
+// tarball that is missing or fails verification is not_scored — the gate could
+// not be run, so it stays closed.
+async function recordSecuritySignal(versionId, { db, storeDir, audit } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { versionArtifactFile } = require('../../src/bongos/module-store');
+  const { rows: [ver] } = await pool.query(
+    'SELECT id, module_key, version, artifact_path FROM store_module_versions WHERE id = $1', [versionId]);
+  if (!ver) return { ok: false, code: 'version_not_found', message: `no store_module_versions row ${versionId}` };
+
+  let signal;
+  try {
+    const tgz = await fs.promises.readFile(versionArtifactFile(ver, storeDir ? { dir: storeDir } : {}));
+    const v = await verifyModuleArtifact(tgz, { key: ver.module_key, includeFiles: true });
+    if (v.ok) {
+      signal = await assessSecurity(ver.module_key, v.files, v.moduleJson, { audit });
+    } else if (v.code === 'denied_content') {
+      signal = { outcome: 'failed', score: null, sample_size: null, reason: 'failed: denylist', detail: { failures: [{ check: 'denylist' }] } };
+    } else {
+      signal = { outcome: 'not_scored', score: null, sample_size: null, reason: `the tarball failed verification (${v.code})`, detail: {} };
+    }
+  } catch (e) {
+    signal = { outcome: 'not_scored', score: null, sample_size: null, reason: `the check could not run (${e.code || 'error'})`, detail: {} };
+  }
+  const row = await insertSecuritySignal(ver.id, signal, { db: pool });
+  return { ok: true, version: ver, signal: row };
+}
+
+function readModuleDir(dir) {
+  const out = [];
+  const walk = (rel) => {
+    for (const e of fs.readdirSync(path.join(dir, rel), { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name === '.git') continue;
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) walk(r);
+      else if (e.isFile()) out.push({ path: r, buf: fs.readFileSync(path.join(dir, r)) });
+    }
+  };
+  walk('');
+  return out;
+}
+
+async function main(argv) {
+  const i = argv.indexOf('--dir');
+  if (i !== -1) {
+    const dir = path.resolve(argv[i + 1] || '');
+    const moduleJson = JSON.parse(fs.readFileSync(path.join(dir, 'module.json'), 'utf8'));
+    console.log(JSON.stringify(await assessSecurity(moduleJson.key, readModuleDir(dir), moduleJson), null, 2));
+    return 0;
+  }
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-security.js <store_module_versions.id> | --dir modules/<key>');
+    return 2;
+  }
+  const res = await recordSecuritySignal(id);
+  if (!res.ok) { console.error(res.message); return 1; }
+  const s = res.signal;
+  console.log(`${res.version.module_key} ${res.version.version}: security ${s.outcome} — ${s.reason} (signal ${s.id})`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => process.exit(code), (e) => { console.error(e.stack || e.message); process.exit(1); });
+}
+
+module.exports = { assessSecurity, auditDependencies, recordSecuritySignal, insertSecuritySignal, maintenancePosture, registrySpec };

package/scripts/gds/skill-lint.js

@@ -14,6 +14,12 @@
 // context window, and a description is resident in EVERY session, so long ones
 // crowd the others out and get truncated (skill routing degrades).
 //
+// A HIDDEN skill — frontmatter `disable-model-invocation: true` — is not in that
+// listing at all: Claude Code keeps its description out of the model's context and
+// loads it only when a person types /name (the model cannot invoke it). So the
+// budget counts LISTED skills only, and hidden ones are reported on their own line
+// (task 1004471, owner ruling on blocker 1000139).
+//
 // NOT A YAML PARSER, on purpose. These are targeted regex checks for the hazards that
 // actually bit us (a plain scalar carrying ": " or " #", an unclosed quote or flow
 // collection, a tab, a continuation line), so the repo gains a CI gate with no new
@@ -95,11 +101,19 @@ function lintFrontmatter(lines) {
   return { errors, warnings, fields };
 }
 
+// Whether a skill is HIDDEN from the model's listing: `disable-model-invocation: true`
+// (Claude Code: "description not in context"; typeable as /name, never model-invoked).
+// Anything but a literal true — absent, false, a typo — leaves it listed, so a mistake
+// can only ever over-count the budget, never hide a skill nobody meant to hide.
+function isHidden(fields) {
+  return String((fields && fields['disable-model-invocation']) || '').trim().toLowerCase() === 'true';
+}
+
 // Lint one SKILL.md file's text. `file` is used for the name check and messages.
 function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   const dirName = path.basename(path.dirname(file));
   const fm = splitFrontmatter(text);
-  const res = { file, errors: [], warnings: [], name: null, description: '', listingChars: 0 };
+  const res = { file, errors: [], warnings: [], name: null, description: '', listingChars: 0, hidden: false };
   if (!fm) { res.errors.push('no YAML frontmatter (the file must start with --- and carry name + description)'); return res; }
   const { errors, warnings, fields } = lintFrontmatter(fm.lines);
   res.errors.push(...errors); res.warnings.push(...warnings);
@@ -107,8 +121,10 @@ function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   if (!name) res.errors.push('missing "name"');
   else if (name !== dirName && dirName !== 'SKILL.md') res.warnings.push(`name "${name}" differs from its folder "${dirName}" — the folder name wins in listings`);
   if (!desc) res.errors.push('missing or empty "description" — the skill would match on its body text');
+  res.hidden = isHidden(fields);
   if (desc.length > DESC_HARD_CHARS) res.errors.push(`description is ${desc.length} chars — over Claude Code's ${DESC_HARD_CHARS}-char cap`);
-  else if (desc.length > DESC_WARN_CHARS) res.warnings.push(`description is ${desc.length} chars — over the ~${DESC_WARN_CHARS} we aim for; every char is resident in every session`);
+  else if (desc.length > DESC_WARN_CHARS && !res.hidden) res.warnings.push(`description is ${desc.length} chars — over the ~${DESC_WARN_CHARS} we aim for; every char is resident in every session`);
+  // listingChars is what the entry WOULD cost if listed; lintSkills leaves hidden ones out of the total.
   res.name = name || dirName; res.description = desc; res.listingChars = res.name.length + desc.length;
   return res;
 }
@@ -164,13 +180,18 @@ function residentSkillFiles(root = REPO_ROOT, { instanceDir = root, files = list
 }
 
 // Lint a set of files; returns per-file results plus the listing total vs budget. The
-// listing counts `resident` (a list of paths) when given, else every linted file.
+// listing counts `resident` (a list of paths) when given, else every linted file — and of
+// those, only the LISTED ones: a hidden skill (isHidden) is resident but costs the model
+// nothing, so it is tallied separately as hiddenSkills / hiddenChars (task 1004471).
 function lintSkills(files, { resident } = {}) {
   const results = files.map((f) => lintSkillFile(fs.readFileSync(f, 'utf8'), { file: f }));
   const counted = resident ? new Set(resident.map((f) => path.resolve(f))) : null;
-  const listed = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
+  const here = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
+  const listed = here.filter((r) => !r.hidden);
+  const hidden = here.filter((r) => r.hidden);
   const listingChars = listed.reduce((a, r) => a + r.listingChars, 0);
-  return { results, listingChars, listedSkills: listed.length, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
+  const hiddenChars = hidden.reduce((a, r) => a + r.listingChars, 0);
+  return { results, listingChars, listedSkills: listed.length, residentSkills: here.length, hiddenSkills: hidden.length, hiddenChars, hiddenNames: hidden.map((r) => r.name), budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
 // The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
@@ -190,8 +211,10 @@ function format(report, { relTo = REPO_ROOT } = {}) {
   }
   const errs = report.results.reduce((a, r) => a + r.errors.length, 0);
   const warns = report.results.reduce((a, r) => a + r.warnings.length, 0);
-  const resident = report.listedSkills !== undefined && report.listedSkills !== report.results.length ? ` (the ${report.listedSkills} resident here; the rest belong to modules this instance leaves off)` : '';
-  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s); listing ${report.listingChars} chars${resident} (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
+  const residentN = report.residentSkills !== undefined ? report.residentSkills : report.listedSkills;
+  const resident = residentN !== undefined && residentN !== report.results.length ? ` ${residentN} resident here (the rest belong to modules this instance leaves off);` : '';
+  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s);${resident} listing ${report.listingChars} chars over ${report.listedSkills} listed skill(s) (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
+  if (report.hiddenSkills) out.push(`skill-lint: ${report.hiddenSkills} hidden skill(s) (disable-model-invocation — typeable as /name, not in the model's listing, not counted): ${report.hiddenChars} chars — ${report.hiddenNames.join(', ')}`);
   return out.join('\n');
 }
 
@@ -210,7 +233,7 @@ function main() {
         if (!isSkillMd(fp) || !fs.existsSync(fp)) return;
         const report = lintSkills([fp]);
         const r = report.results[0];
-        if (r.errors.length || r.warnings.length) console.log('[skill-lint] ' + format(report).split('\n').slice(0, -1).join('\n[skill-lint] '));
+        if (r.errors.length || r.warnings.length) console.log('[skill-lint] ' + format(report).split('\n').filter((l) => !l.startsWith('skill-lint:')).join('\n[skill-lint] '));
       } catch (_) { /* a hook never breaks the edit */ }
       process.exitCode = 0;
     });
@@ -223,5 +246,5 @@ function main() {
   process.exitCode = report.results.some((r) => r.errors.length) ? 1 : 0;
 }
 
-module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
+module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, isHidden, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
 if (require.main === module) main();

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.41'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.43'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');