@bongos/core 1.20.69 → 1.20.71

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.69",
-  "core_contract": "1.20.69",
-  "source_commit": "983e206de19e3e452119fa087677995534a0bd91",
+  "core_version": "1.20.71",
+  "core_contract": "1.20.71",
+  "source_commit": "80b594f7c46b42161be5a9453989b09495783332",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T14:04:36.716Z",
+  "built_at": "2026-10-01T15:04:18.463Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2794,
+    "functional_verbatim": 2798,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3394,
-  "tree_sha256": "251c283dabfc92029abfd63749f8c964092c6110a6773d446852b4f8f11ca724",
+  "file_count": 3398,
+  "tree_sha256": "5a489808d7d33aa65f957bcb1aa21323044cafe05a72d5d7293b255966c007b9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "3350163ed447189b523028f711e3ef1a400ea375ebe7123f2515add8b6a89de1"
+      "sha256": "472c0606ff4fe4e775d56e038702960834838d8767e984427f5de29d31f9cbe9"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "a863d3db1a112c490648e0f2b3eaddf3f2e8c9ebe107ec298ea5ff0c663a5e6a"
+      "sha256": "d641fbda06eb527c39d2eabbc7afc9f9182b03d766917e9fd84d69e86e9cc397"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "06bf39230e1c813494dc85130694754d1eb6b3fd55d3e93a684dd238bf6bc22b"
+      "sha256": "73b143d7faa4d930ab82f9f31b178816cc5a8ea87754de7e0575441905d4562a"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2345d96c47f3851443f8b1adc5dac4556705e7f63f9875a4c62252bf833f17d4"
+      "sha256": "05ba628ec9c3761d8814af291cd5b11a02dd279c6e8df232b20ca632cc1e4336"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "313cfd428b7fd04a9fec6e56cdc1ddabb69af6ca144d7e09d2384a50d48b53df"
+      "sha256": "11a7eb441c5533244c695a4c60fe7b170e87eb4081af77703e796e8370e971e5"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2262,17 +2262,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0abf904bcf32aef68bd70592d09cb986e4538cae62c2b9b268af8904d8a483fb"
+      "sha256": "a24995419c2daa05deca5f2ed06656801c313f7499039a739b1bfa2cbc87e595"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "026ea9ba339051ada00869b8363718fae4fcded3be6eae98bcc60a37b9e844dc"
+      "sha256": "63946432b10d130a8f1749ced38bb733449ea4ed8039c9794287d3a269249b0c"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "8b0fe800a7b4d60f4cb7f5eccd4fcab98d3e080a978ba3125dd9171c63cb5c78"
+      "sha256": "3f0c53c83d5faed4198a251f09c3ffa057aa3dfaec9912d5fc884b0f1d602ebe"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2802,12 +2802,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "36f8057dc29204b364c3d02c48b4ea21082a94915d187405dc863af09fda03d7"
+      "sha256": "487634be3dd64633b2ee526720bff74171601bc1e58c02cfd605914bf8a9984b"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "5d78d2fa2266bfed7e1034c0649274cb544333aa0c81ecdcb34413524729764f"
+      "sha256": "33eb2665aea5cc00feb1de80b673f6063f98b2a8bd2caeb6fa4b09e41965c1df"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -9457,12 +9457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d67978a0c965aad91f26a8f1c1b8e913cca63e4aeafb8348bf842d817a5078a6"
+      "sha256": "795a529e4e0cfa999a1e07d36b360e982ad712026d571679b59ca7202ffcb740"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "742449c7fddbb1eb1de87b87308a2cb3585f0a2e0b8ab5eba5818fbab42106f7"
+      "sha256": "e3a6640cc49059ed01f82ddb1212d14d65f76e562d066aca5ff55c64117b9d19"
     },
     {
       "path": "public-docs/index.html",
@@ -9482,7 +9482,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "b4ccf7b529c34b659f29b69fb6d06b0b53b534469c637f3bc2f8bf62d0623e7a"
+      "sha256": "ae2119391f14b5e1fda111e28b6cab08dd5ecb86826150cac145196b2f81b140"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10329,20 +10329,30 @@
       "mode": "0000644",
       "sha256": "7b10d8fd5146325c218d59eadfb6feaeb8819e14c4b27b166ad9ff714e1caed0"
     },
+    {
+      "path": "scripts/gds/module-assess-score.js",
+      "mode": "0000644",
+      "sha256": "526f3852778e708c6ffe4d6e0106a1617113e2e49aac8754b24321a68cddfaac"
+    },
     {
       "path": "scripts/gds/module-assess-security.js",
       "mode": "0000644",
-      "sha256": "0dad366dcabf453ae276e074aafa6bd71223853a31cfe005dac6f3d713e12e4a"
+      "sha256": "54a6c9c7ab8d0401eb5adf8b0025eac56f9c907ea19a868a38eb0d207befa058"
     },
     {
       "path": "scripts/gds/module-assess-tests.js",
       "mode": "0000644",
-      "sha256": "b86d6b3b98534c91b2dffe67f6c5335a09d2ef7c571c70e3a0871ab4929bc490"
+      "sha256": "83dc9529be926f8e10043ab78d644d1a72096d02000623035798bd420b2b3261"
+    },
+    {
+      "path": "scripts/gds/module-assess-version.js",
+      "mode": "0000644",
+      "sha256": "5891fdb5c464280801fbf401001d375ba93d5598d2190a9854f6dd2d61e0521b"
     },
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "7ac7a4234d44c592f51a28d95a91f14379c6271977eb05d1e89700ba72827817"
+      "sha256": "240a50d80078e81b692cea24d823340d797f3193afd6bec0dcb5d9afb0669c54"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -11147,7 +11157,7 @@
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "399c2225543fc0d37505bca9cd96e33cf5598aa1f364a458d5b5efb3a588ddb3"
+      "sha256": "0646b9d86c01d190ed1b670694d2585827241b94792c70852b670a06327afb40"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -11437,7 +11447,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "6e058031cd08e741f970c6f4a535e36ff96bd61a34d335e72ab82d91e508d21f"
+      "sha256": "4d4cb32e7fdc80c2f31c76a04d939c62980515eb06f7d3862a91c5163a9a70ce"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -11587,7 +11597,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "9a73d17319e72baaf1214bad5b8ae7847c8c11a4caa7cb7db74ef5b5dce1be8d"
+      "sha256": "65dcf7b704d1fa321c128b36f3147bf23f54b976f60980450b2ed8a8583a302a"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -11662,7 +11672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e1bae2a66ddf99dc54ceb55ce274d116780689f5ef224841d16106bc8b81701d"
+      "sha256": "93d4c7e2e57b155565f9e995e8fe091e8c1782254ea9d06d29367fbcb404b1bb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14714,6 +14724,11 @@
       "mode": "0000644",
       "sha256": "9183d78e4d195428afbee8c71746e12db2455f8529ac1223d690a7b8f7ded538"
     },
+    {
+      "path": "tests/module_assess_score.mjs",
+      "mode": "0000644",
+      "sha256": "fd919118055c14147c9b4d7649622c1ebb47ba48336d84fe2c2a35f859a20dd6"
+    },
     {
       "path": "tests/module_assess_security.mjs",
       "mode": "0000644",
@@ -14742,7 +14757,7 @@
     {
       "path": "tests/module_cli.mjs",
       "mode": "0000644",
-      "sha256": "cc3a4259d03582ca93287271ddc95bbeaea76447e104b8fb0f33aa6b154c8e7c"
+      "sha256": "18fa817150d1d390f5f1c44651aea7e667227c8063393b2d0f82ff0b9f7fbaa8"
     },
     {
       "path": "tests/module_contributions.mjs",
@@ -14824,6 +14839,11 @@
       "mode": "0000644",
       "sha256": "1b50c9f68bfe731b29ddcce6947847b6e6f3f7bc5b0a08bbacc4afb25d5a3d90"
     },
+    {
+      "path": "tests/module_upgrade_updates.mjs",
+      "mode": "0000644",
+      "sha256": "7260dabcf71a69d4ce41609e8a88c94c112fdda354f774dadf0a2648f4feacaf"
+    },
     {
       "path": "tests/modules.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 485 operations across 73 resource groups
+- 486 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1087,6 +1087,8 @@ function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
+      getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.cjs

@@ -1086,6 +1086,8 @@ function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
+      getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.d.ts

@@ -167,6 +167,7 @@ export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
 export interface GetStoreEntitlementsResponse { entitlements: unknown }
 export interface GetStoreModulesKeyVersionsVersionHowtoResponse { module_key: unknown; title: unknown; version: unknown; published_at: unknown; delisted: unknown; markdown: unknown; artifact_url: unknown }
+export interface GetStoreModulesLatestResponse { latest: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
 export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
@@ -1533,6 +1534,8 @@ export interface BongosClient {
     getStoreModulesKeyVersionsVersionHowto(args?: RequestArgs): Promise<GetStoreModulesKeyVersionsVersionHowtoResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /store/modules/latest — rank: any-builder */
+    getStoreModulesLatest(args?: RequestArgs): Promise<GetStoreModulesLatestResponse>;
   };
   "taskRecommendations": {
     /** POST /task-recommendations — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1083,6 +1083,8 @@ export function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
+      getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/docs/api/openapi.json

@@ -19794,6 +19794,44 @@
         ]
       }
     },
+    "/store/modules/latest": {
+      "get": {
+        "operationId": "get_store_modules_latest",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/modules/latest",
+        "description": "The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to report the updates available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS. rank: any-builder — a read of public store metadata (version numbers and the core range each needs, the same facts the how-to page shows). It takes no entitlement and changes nothing, unlike acquire; a key the store does not know is simply absent from the answer.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetStoreModulesLatestResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/acquire": {
       "post": {
         "operationId": "post_store_modules_key_acquire",
@@ -24851,6 +24889,15 @@
           "artifact_url"
         ]
       },
+      "GetStoreModulesLatestResponse": {
+        "type": "object",
+        "properties": {
+          "latest": {}
+        },
+        "required": [
+          "latest"
+        ]
+      },
       "GetTaskRecommendationsForMeResponse": {
         "type": "object",
         "properties": {
@@ -30997,9 +31044,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 485,
-  "x-schema-count": 513,
+  "x-endpoint-count": 486,
+  "x-schema-count": 514,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 343,
+  "x-response-schemas": 344,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 485 endpoints across 89 route files.
+> **Generated from the live route files** — the route file is authoritative. 486 endpoints across 89 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -769,7 +769,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (7)
+## `store` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -780,6 +780,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
+| GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
 
 ## `task-recommendations` (4)
 

package/docs/architecture.md

@@ -273,7 +273,7 @@ module_assessment_scores(id, version_id, kind IN (computed|override), overall 0-
               -- and is a new row on the computed history, never an edit (D6)
 ```
 
-Signals that fill it: **Tests** — `scripts/gds/module-assess-tests.js <version id>` (task 1003791) unpacks the published tarball to `<core root>/.module-assess-<run>/<key>/` (gitignored, removed after), runs each `tests/*.mjs` in its own node process with a timeout and a credential-free environment — regardless of `isModuleEnabled`, which skips every default-off catalog module in the unit gate — and appends one `tests` row: `scored` = % of test files passing (sample_size = files), `no_data` = declares no tests, `not_scored` = tarball unreadable. The store path **refuses unless `MODULE_TEST_SANDBOX=1`** — a published module's tests run only in a separate testing environment with no secrets on disk, never on the control plane (owner, 2026-09-30). `--dir modules/<key>` is a DB-free dry run on your own checkout. Nothing calls it on publish yet (task 1003794 wires that). **Security** — `scripts/gds/module-assess-security.js <version id>` (task 1003792, ADR 0343 D2 gate) appends one `security` row, `passed`/`failed` only: fails on a publish-denylist file, a `module.json` dependency fetched outside the registry (an allowlist: a plain npm name with a plain semver range or dist-tag, anything else fails and is never handed to npm), or a high/critical `npm audit` advisory (resolved metadata-only with `--ignore-scripts`; nothing of the module runs, so it is control-plane safe). An audit that cannot run is `not_scored` — the gate stays shut. Floating ranges and the `maintenance` posture (ADR 0166) are noted in `detail`, never failed on.
+Signals that fill it: **Tests** — `scripts/gds/module-assess-tests.js <version id>` (task 1003791) unpacks the published tarball to `<core root>/.module-assess-<run>/<key>/` (gitignored, removed after), runs each `tests/*.mjs` in its own node process with a timeout and a credential-free environment — regardless of `isModuleEnabled`, which skips every default-off catalog module in the unit gate — and appends one `tests` row: `scored` = % of test files passing (sample_size = files), `no_data` = declares no tests, `not_scored` = tarball unreadable. The store path **refuses unless `MODULE_TEST_SANDBOX=1`** — a published module's tests run only in a separate testing environment with no secrets on disk, never on the control plane (owner, 2026-09-30). `--dir modules/<key>` is a DB-free dry run on your own checkout. On publish the version's Tests part is recorded `pending` until that environment runs it. **Security** — `scripts/gds/module-assess-security.js <version id>` (task 1003792, ADR 0343 D2 gate) appends one `security` row, `passed`/`failed` only: fails on a publish-denylist file, a `module.json` dependency fetched outside the registry (an allowlist: a plain npm name with a plain semver range or dist-tag, anything else fails and is never handed to npm), or a high/critical `npm audit` advisory (resolved metadata-only with `--ignore-scripts`; nothing of the module runs, so it is control-plane safe). An audit that cannot run is `not_scored` — the gate stays shut. Floating ranges and the `maintenance` posture (ADR 0166) are noted in `detail`, never failed on. **Score** — `scripts/gds/module-assess-score.js` (task 1003794) composes a version's newest signal per part into a `module_assessment_scores` row: `security_passed` from the gate (NULL = not run), `overall` = the plain average of the SCORED parts among Tests, Install, Reliability and Tester feedback (a part with no data is left out, never zero; none → NULL), Docs shown but never averaged, `is_new` until Install or Reliability is scored, plus the signal ids and a readable `formula`. A recompose that would repeat the current score writes nothing. Both signal CLIs recompose after recording, and the store's publish route queues `assessVersion` after answering the author (one at a time per process, at most 20 waiting; past that it is logged as not assessed): Tests `pending` (only if no Tests result exists), the Security gate, then the score. `node scripts/gds/module-assess-version.js <id>` re-runs it by hand (`scripts/gds/module-assess-version.js` holds the publish-time half, apart from the composer so the signal CLIs recompose without a require cycle).
 
 Code: `src/bongos/module-entitlements.js` (`grantEntitlement`, `recordAcquired`, `revokeEntitlement`, `checkEntitlement`, `listEntitlements`). Read routes (own-scoped, `requireBuilder`): `GET /store/entitlements`, `GET /store/modules/:key/entitlement`. Install (task 1003785) grants a free module through `POST /store/modules/:key/acquire`; the buy action (area 8) will grant a paid one.
 

package/docs/module-api-changelog.md

@@ -2795,5 +2795,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.67 with no explicit bump. run 36871565601. (task 1002620)
   1.20.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.68 with no explicit bump. run 36873353617. (task 1002620)
+  1.20.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.69 with no explicit bump. run 36877499272. (task 1002620)
+  1.20.71 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.70 with no explicit bump. run 36881290177. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -380,6 +380,8 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - The new version is written beside the old one and swapped in; any failure leaves the installed version in place. Files the new version dropped are gone afterwards.
 - The on/off switch is untouched. A module bundled with the core is refused; it updates with the core (`bongos upgrade`).
 
+**`bongos upgrade` says which installed modules have an update** (task 1003787), below its compatibility rows, so one command answers "what is stale here" for the core and its modules. It asks `GET /store/modules/latest?keys=…` for the newest version of every module here with an exact version — a read that takes no entitlement — and lists each newer one with `bongos module update <key>`, or says it waits for the core when that version needs a newer one. A delisted module is flagged as getting no further versions (ADR 0338 D2). None of this changes the exit code: an incompatible enabled module still blocks and nothing else does. With no session or no reachable store it says "not checked" and the pre-check stands; `--no-store` skips the read.
+
 ## Carving an existing core domain (the `db.js` per-domain pattern)
 
 Most BONGOS-V1 module work is not scaffolding a *new* module — it's **carving an existing core domain out of the monolith** (ADR 0091, criterion C7). The reference carve is the kernel slice `src/bongos/db-kernel.js` (BV1.R69); the feature precedents are `modules/discord/db.js` + `modules/game/db.js`. Every later carve (memory R72, grading R73, …) copies this recipe. The invariant is **OTB byte-identical** at every step — you are *moving* code, not changing behavior.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.69",
+  "version": "1.20.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.69",
+      "version": "1.20.71",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.69",
+  "version": "1.20.71",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8543,5 +8543,17 @@
       "id": "1004490",
       "text": "Session notes for today's account-page work are on file, so the next session can pick up without re-discovering what was done."
     }
+  ],
+  "1.20.70": [
+    {
+      "id": "1003787",
+      "text": "Running 'bongos upgrade' now also tells you which installed modules have a newer version in the store, and the command to update each one. It never stops an upgrade on that account."
+    }
+  ],
+  "1.20.71": [
+    {
+      "id": "1003794",
+      "text": "Each module version in the store now gets one overall score built from its separate checks, and a newly published version is checked automatically. A version with no real-world data yet is marked New instead of scoring low."
+    }
   ]
 }

package/scripts/gds/module-assess-score.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-score.js — compose a store version's assessment
+// signals into its one overall score (task 1003794; ADR 0343 D2/D3/D5, ADR 0347 D5; tables from core_265).
+//
+// WHY one composer. The floor, the ranking and the cap (tasks 1003807-9) all read
+// one number, and an author appealing it must be able to redo the sum. So the rule
+// lives here once, as a pure function, and every writer of a signal calls the same
+// recompose afterwards:
+//   - Security is a GATE (D2): it sets security_passed (true / false / NULL = not
+//     run or could not run) and is never averaged in.
+//   - overall = the plain, unweighted average of the parts that are SCORED among
+//     Tests, Install, Reliability and Tester feedback (D3). A part with no data —
+//     no row, or no_data / pending / not_scored — is left out, never a zero.
+//     No such part at all → overall NULL.
+//   - Docs is shown with the parts and never averaged (ADR 0347 D5).
+//   - is_new (D5): the version has no scored Install or Reliability part yet.
+// The CURRENT result of a part is its newest signal row (core_265). Each score
+// row names the signal ids it was composed from and a formula a person can read,
+// so "why did I score 71?" is answered by the row. A recompose that would write
+// the same score as the current computed row writes nothing, so the history only
+// moves when the answer does.
+//
+// Re-assessment on publish lives in module-assess-version.js, which runs the
+// Security gate and then this recompose; it is a separate file so the signal
+// CLIs can call recompose without a require cycle.
+//
+// Both reads are served by core_265's indexes: signals on (version_id, part,
+// measured_at DESC, id DESC), scores on (version_id, computed_at DESC, id DESC).
+//
+//   node scripts/gds/module-assess-score.js <store_module_versions.id>   recompose + print
+
+const AVERAGED = ['tests', 'install', 'reliability', 'tester_feedback'];
+const REAL_WORLD = ['install', 'reliability'];
+const LABEL = { security: 'Security', tests: 'Tests', install: 'Install', reliability: 'Reliability', tester_feedback: 'Tester feedback', docs: 'Docs' };
+
+// Compose from the CURRENT signal per part ({ [part]: row }), pure. Returns the
+// fields of a module_assessment_scores row.
+function composeScore(current = {}) {
+  const sec = current.security;
+  const securityPassed = sec && sec.outcome === 'passed' ? true : sec && sec.outcome === 'failed' ? false : null;
+  const used = AVERAGED.filter((p) => current[p] && current[p].outcome === 'scored' && current[p].score != null);
+  const overall = used.length
+    ? Math.round(used.reduce((sum, p) => sum + Number(current[p].score), 0) / used.length)
+    : null;
+  const isNew = !REAL_WORLD.some((p) => used.includes(p));
+
+  const gate = securityPassed === true ? 'Security passed' : securityPassed === false ? 'Security FAILED (not listed, whatever the score)' : 'Security not checked yet';
+  const sum = used.length
+    ? `overall ${overall} = average of ${used.map((p) => `${LABEL[p]} ${current[p].score}`).join(', ')}`
+    : 'no overall score yet: no averaged part has data';
+  const left = AVERAGED.filter((p) => !used.includes(p));
+  const formula = `${gate}; ${sum}${left.length ? `; left out (no data): ${left.map((p) => LABEL[p]).join(', ')}` : ''}${isNew ? '; labelled New' : ''}`;
+
+  const signalIds = [sec, ...used.map((p) => current[p])].filter(Boolean).map((r) => Number(r.id)).sort((a, b) => a - b);
+  return { overall, security_passed: securityPassed, is_new: isNew, formula, signal_ids: signalIds };
+}
+
+const sameScore = (a, b) => !!a && !!b
+  && (a.overall == null ? null : Number(a.overall)) === b.overall
+  && a.security_passed === b.security_passed
+  && a.is_new === b.is_new
+  && (a.signal_ids || []).map(Number).join(',') === b.signal_ids.join(',');
+
+// Read a version's current signal per part, compose, and append a computed score
+// row unless it would repeat the current one. Resolves { ok, score, written }.
+async function recomposeScore(versionId, { db } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { rows } = await pool.query(
+    `SELECT DISTINCT ON (part) id, part, outcome, score, sample_size
+       FROM module_assessment_signals WHERE version_id = $1
+      ORDER BY part, measured_at DESC, id DESC`, [versionId]);
+  const current = {};
+  for (const r of rows) current[r.part] = r;
+  const next = composeScore(current);
+
+  const { rows: [last] } = await pool.query(
+    `SELECT id, overall, security_passed, is_new, signal_ids FROM module_assessment_scores
+      WHERE version_id = $1 AND kind = 'computed' ORDER BY computed_at DESC, id DESC LIMIT 1`, [versionId]);
+  if (sameScore(last, next)) return { ok: true, score: { ...last, formula: next.formula }, written: false };
+
+  const { rows: [row] } = await pool.query(
+    `INSERT INTO module_assessment_scores (version_id, kind, overall, security_passed, is_new, formula, signal_ids)
+     VALUES ($1, 'computed', $2, $3, $4, $5, $6)
+     RETURNING id, version_id, overall, security_passed, is_new, formula, signal_ids, computed_at`,
+    [versionId, next.overall, next.security_passed, next.is_new, next.formula, next.signal_ids]);
+  return { ok: true, score: row, written: true };
+}
+
+// After a signal CLI records a row: re-compose and print the score line.
+async function printRecomposed(versionId) {
+  const { score } = await recomposeScore(versionId);
+  console.log(`  score: ${score.formula}`);
+}
+
+async function main(argv) {
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-score.js <store_module_versions.id>');
+    return 2;
+  }
+  const res = await recomposeScore(id);
+  if (!res.ok) { console.error(res.message); return 1; }
+  console.log(`version ${id}: ${res.score.formula}`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => { process.exitCode = code; }, (e) => { console.error(e.stack || e.message); process.exitCode = 1; });
+}
+
+module.exports = { composeScore, recomposeScore, printRecomposed };

package/scripts/gds/module-assess-security.js

@@ -241,6 +241,7 @@ async function main(argv) {
   if (!res.ok) { console.error(res.message); return 1; }
   const s = res.signal;
   console.log(`${res.version.module_key} ${res.version.version}: security ${s.outcome} — ${s.reason} (signal ${s.id})`);
+  await require('./module-assess-score').printRecomposed(res.version.id); // new data re-composes the score (task 1003794)
   return 0;
 }
 

package/scripts/gds/module-assess-tests.js

@@ -238,6 +238,7 @@ async function main(argv) {
   if (!res.ok) { console.error(res.message); return 1; }
   const s = res.signal;
   console.log(`${res.version.module_key} ${res.version.version}: tests ${s.outcome}${s.score !== null ? ` ${s.score}/100` : ''} — ${s.reason} (signal ${s.id})`);
+  await require('./module-assess-score').printRecomposed(res.version.id); // new data re-composes the score (task 1003794)
   return 0;
 }