@bongos/core 1.20.70 → 1.20.71

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.70",
-  "core_contract": "1.20.70",
-  "source_commit": "31aa1da4c574b3429cbe3bea1cee188486c0845b",
+  "core_version": "1.20.71",
+  "core_contract": "1.20.71",
+  "source_commit": "80b594f7c46b42161be5a9453989b09495783332",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T14:41:01.807Z",
+  "built_at": "2026-10-01T15:04:18.463Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2795,
+    "functional_verbatim": 2798,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3395,
-  "tree_sha256": "ba829522471ea62d370430e52214b3298f81333cef684d98d98231286a345e34",
+  "file_count": 3398,
+  "tree_sha256": "5a489808d7d33aa65f957bcb1aa21323044cafe05a72d5d7293b255966c007b9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2272,7 +2272,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "8b0fe800a7b4d60f4cb7f5eccd4fcab98d3e080a978ba3125dd9171c63cb5c78"
+      "sha256": "3f0c53c83d5faed4198a251f09c3ffa057aa3dfaec9912d5fc884b0f1d602ebe"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "82e53cbebb5b042447d74679e2501c04a79e55d473e4cb3976578572152d5cf6"
+      "sha256": "487634be3dd64633b2ee526720bff74171601bc1e58c02cfd605914bf8a9984b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -9457,12 +9457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ce7e8e4e85602173606cdf3d320047cb41654ab0662ea2840537a7f10b4dfab4"
+      "sha256": "795a529e4e0cfa999a1e07d36b360e982ad712026d571679b59ca7202ffcb740"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f82ba870c1432fd2fd421397df493f3c052bab48a920d403558364ccd720a109"
+      "sha256": "e3a6640cc49059ed01f82ddb1212d14d65f76e562d066aca5ff55c64117b9d19"
     },
     {
       "path": "public-docs/index.html",
@@ -9482,7 +9482,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "936955084e861a2c76032f3219e888b6c83c137c2ad6f0ba744ad7f65c5492a3"
+      "sha256": "ae2119391f14b5e1fda111e28b6cab08dd5ecb86826150cac145196b2f81b140"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10329,15 +10329,25 @@
       "mode": "0000644",
       "sha256": "7b10d8fd5146325c218d59eadfb6feaeb8819e14c4b27b166ad9ff714e1caed0"
     },
+    {
+      "path": "scripts/gds/module-assess-score.js",
+      "mode": "0000644",
+      "sha256": "526f3852778e708c6ffe4d6e0106a1617113e2e49aac8754b24321a68cddfaac"
+    },
     {
       "path": "scripts/gds/module-assess-security.js",
       "mode": "0000644",
-      "sha256": "0dad366dcabf453ae276e074aafa6bd71223853a31cfe005dac6f3d713e12e4a"
+      "sha256": "54a6c9c7ab8d0401eb5adf8b0025eac56f9c907ea19a868a38eb0d207befa058"
     },
     {
       "path": "scripts/gds/module-assess-tests.js",
       "mode": "0000644",
-      "sha256": "b86d6b3b98534c91b2dffe67f6c5335a09d2ef7c571c70e3a0871ab4929bc490"
+      "sha256": "83dc9529be926f8e10043ab78d644d1a72096d02000623035798bd420b2b3261"
+    },
+    {
+      "path": "scripts/gds/module-assess-version.js",
+      "mode": "0000644",
+      "sha256": "5891fdb5c464280801fbf401001d375ba93d5598d2190a9854f6dd2d61e0521b"
     },
     {
       "path": "scripts/gds/module.js",
@@ -11587,7 +11597,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "abf74a67f9706eed2d8134c8bff0e1ab55831493aeb4217e5a0f16326e85c64b"
+      "sha256": "65dcf7b704d1fa321c128b36f3147bf23f54b976f60980450b2ed8a8583a302a"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -11662,7 +11672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4ac89563e04b58f5b2a3662990aeb1916f614ba099fe1414f10a51865168cb48"
+      "sha256": "93d4c7e2e57b155565f9e995e8fe091e8c1782254ea9d06d29367fbcb404b1bb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14714,6 +14724,11 @@
       "mode": "0000644",
       "sha256": "9183d78e4d195428afbee8c71746e12db2455f8529ac1223d690a7b8f7ded538"
     },
+    {
+      "path": "tests/module_assess_score.mjs",
+      "mode": "0000644",
+      "sha256": "fd919118055c14147c9b4d7649622c1ebb47ba48336d84fe2c2a35f859a20dd6"
+    },
     {
       "path": "tests/module_assess_security.mjs",
       "mode": "0000644",

package/docs/architecture.md

@@ -273,7 +273,7 @@ module_assessment_scores(id, version_id, kind IN (computed|override), overall 0-
               -- and is a new row on the computed history, never an edit (D6)
 ```
 
-Signals that fill it: **Tests** — `scripts/gds/module-assess-tests.js <version id>` (task 1003791) unpacks the published tarball to `<core root>/.module-assess-<run>/<key>/` (gitignored, removed after), runs each `tests/*.mjs` in its own node process with a timeout and a credential-free environment — regardless of `isModuleEnabled`, which skips every default-off catalog module in the unit gate — and appends one `tests` row: `scored` = % of test files passing (sample_size = files), `no_data` = declares no tests, `not_scored` = tarball unreadable. The store path **refuses unless `MODULE_TEST_SANDBOX=1`** — a published module's tests run only in a separate testing environment with no secrets on disk, never on the control plane (owner, 2026-09-30). `--dir modules/<key>` is a DB-free dry run on your own checkout. Nothing calls it on publish yet (task 1003794 wires that). **Security** — `scripts/gds/module-assess-security.js <version id>` (task 1003792, ADR 0343 D2 gate) appends one `security` row, `passed`/`failed` only: fails on a publish-denylist file, a `module.json` dependency fetched outside the registry (an allowlist: a plain npm name with a plain semver range or dist-tag, anything else fails and is never handed to npm), or a high/critical `npm audit` advisory (resolved metadata-only with `--ignore-scripts`; nothing of the module runs, so it is control-plane safe). An audit that cannot run is `not_scored` — the gate stays shut. Floating ranges and the `maintenance` posture (ADR 0166) are noted in `detail`, never failed on.
+Signals that fill it: **Tests** — `scripts/gds/module-assess-tests.js <version id>` (task 1003791) unpacks the published tarball to `<core root>/.module-assess-<run>/<key>/` (gitignored, removed after), runs each `tests/*.mjs` in its own node process with a timeout and a credential-free environment — regardless of `isModuleEnabled`, which skips every default-off catalog module in the unit gate — and appends one `tests` row: `scored` = % of test files passing (sample_size = files), `no_data` = declares no tests, `not_scored` = tarball unreadable. The store path **refuses unless `MODULE_TEST_SANDBOX=1`** — a published module's tests run only in a separate testing environment with no secrets on disk, never on the control plane (owner, 2026-09-30). `--dir modules/<key>` is a DB-free dry run on your own checkout. On publish the version's Tests part is recorded `pending` until that environment runs it. **Security** — `scripts/gds/module-assess-security.js <version id>` (task 1003792, ADR 0343 D2 gate) appends one `security` row, `passed`/`failed` only: fails on a publish-denylist file, a `module.json` dependency fetched outside the registry (an allowlist: a plain npm name with a plain semver range or dist-tag, anything else fails and is never handed to npm), or a high/critical `npm audit` advisory (resolved metadata-only with `--ignore-scripts`; nothing of the module runs, so it is control-plane safe). An audit that cannot run is `not_scored` — the gate stays shut. Floating ranges and the `maintenance` posture (ADR 0166) are noted in `detail`, never failed on. **Score** — `scripts/gds/module-assess-score.js` (task 1003794) composes a version's newest signal per part into a `module_assessment_scores` row: `security_passed` from the gate (NULL = not run), `overall` = the plain average of the SCORED parts among Tests, Install, Reliability and Tester feedback (a part with no data is left out, never zero; none → NULL), Docs shown but never averaged, `is_new` until Install or Reliability is scored, plus the signal ids and a readable `formula`. A recompose that would repeat the current score writes nothing. Both signal CLIs recompose after recording, and the store's publish route queues `assessVersion` after answering the author (one at a time per process, at most 20 waiting; past that it is logged as not assessed): Tests `pending` (only if no Tests result exists), the Security gate, then the score. `node scripts/gds/module-assess-version.js <id>` re-runs it by hand (`scripts/gds/module-assess-version.js` holds the publish-time half, apart from the composer so the signal CLIs recompose without a require cycle).
 
 Code: `src/bongos/module-entitlements.js` (`grantEntitlement`, `recordAcquired`, `revokeEntitlement`, `checkEntitlement`, `listEntitlements`). Read routes (own-scoped, `requireBuilder`): `GET /store/entitlements`, `GET /store/modules/:key/entitlement`. Install (task 1003785) grants a free module through `POST /store/modules/:key/acquire`; the buy action (area 8) will grant a paid one.
 

package/docs/module-api-changelog.md

@@ -2797,5 +2797,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.68 with no explicit bump. run 36873353617. (task 1002620)
   1.20.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.69 with no explicit bump. run 36877499272. (task 1002620)
+  1.20.71 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.70 with no explicit bump. run 36881290177. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.70",
+  "version": "1.20.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.70",
+      "version": "1.20.71",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.70",
+  "version": "1.20.71",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8549,5 +8549,11 @@
       "id": "1003787",
       "text": "Running 'bongos upgrade' now also tells you which installed modules have a newer version in the store, and the command to update each one. It never stops an upgrade on that account."
     }
+  ],
+  "1.20.71": [
+    {
+      "id": "1003794",
+      "text": "Each module version in the store now gets one overall score built from its separate checks, and a newly published version is checked automatically. A version with no real-world data yet is marked New instead of scoring low."
+    }
   ]
 }

package/scripts/gds/module-assess-score.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-score.js — compose a store version's assessment
+// signals into its one overall score (task 1003794; ADR 0343 D2/D3/D5, ADR 0347 D5; tables from core_265).
+//
+// WHY one composer. The floor, the ranking and the cap (tasks 1003807-9) all read
+// one number, and an author appealing it must be able to redo the sum. So the rule
+// lives here once, as a pure function, and every writer of a signal calls the same
+// recompose afterwards:
+//   - Security is a GATE (D2): it sets security_passed (true / false / NULL = not
+//     run or could not run) and is never averaged in.
+//   - overall = the plain, unweighted average of the parts that are SCORED among
+//     Tests, Install, Reliability and Tester feedback (D3). A part with no data —
+//     no row, or no_data / pending / not_scored — is left out, never a zero.
+//     No such part at all → overall NULL.
+//   - Docs is shown with the parts and never averaged (ADR 0347 D5).
+//   - is_new (D5): the version has no scored Install or Reliability part yet.
+// The CURRENT result of a part is its newest signal row (core_265). Each score
+// row names the signal ids it was composed from and a formula a person can read,
+// so "why did I score 71?" is answered by the row. A recompose that would write
+// the same score as the current computed row writes nothing, so the history only
+// moves when the answer does.
+//
+// Re-assessment on publish lives in module-assess-version.js, which runs the
+// Security gate and then this recompose; it is a separate file so the signal
+// CLIs can call recompose without a require cycle.
+//
+// Both reads are served by core_265's indexes: signals on (version_id, part,
+// measured_at DESC, id DESC), scores on (version_id, computed_at DESC, id DESC).
+//
+//   node scripts/gds/module-assess-score.js <store_module_versions.id>   recompose + print
+
+const AVERAGED = ['tests', 'install', 'reliability', 'tester_feedback'];
+const REAL_WORLD = ['install', 'reliability'];
+const LABEL = { security: 'Security', tests: 'Tests', install: 'Install', reliability: 'Reliability', tester_feedback: 'Tester feedback', docs: 'Docs' };
+
+// Compose from the CURRENT signal per part ({ [part]: row }), pure. Returns the
+// fields of a module_assessment_scores row.
+function composeScore(current = {}) {
+  const sec = current.security;
+  const securityPassed = sec && sec.outcome === 'passed' ? true : sec && sec.outcome === 'failed' ? false : null;
+  const used = AVERAGED.filter((p) => current[p] && current[p].outcome === 'scored' && current[p].score != null);
+  const overall = used.length
+    ? Math.round(used.reduce((sum, p) => sum + Number(current[p].score), 0) / used.length)
+    : null;
+  const isNew = !REAL_WORLD.some((p) => used.includes(p));
+
+  const gate = securityPassed === true ? 'Security passed' : securityPassed === false ? 'Security FAILED (not listed, whatever the score)' : 'Security not checked yet';
+  const sum = used.length
+    ? `overall ${overall} = average of ${used.map((p) => `${LABEL[p]} ${current[p].score}`).join(', ')}`
+    : 'no overall score yet: no averaged part has data';
+  const left = AVERAGED.filter((p) => !used.includes(p));
+  const formula = `${gate}; ${sum}${left.length ? `; left out (no data): ${left.map((p) => LABEL[p]).join(', ')}` : ''}${isNew ? '; labelled New' : ''}`;
+
+  const signalIds = [sec, ...used.map((p) => current[p])].filter(Boolean).map((r) => Number(r.id)).sort((a, b) => a - b);
+  return { overall, security_passed: securityPassed, is_new: isNew, formula, signal_ids: signalIds };
+}
+
+const sameScore = (a, b) => !!a && !!b
+  && (a.overall == null ? null : Number(a.overall)) === b.overall
+  && a.security_passed === b.security_passed
+  && a.is_new === b.is_new
+  && (a.signal_ids || []).map(Number).join(',') === b.signal_ids.join(',');
+
+// Read a version's current signal per part, compose, and append a computed score
+// row unless it would repeat the current one. Resolves { ok, score, written }.
+async function recomposeScore(versionId, { db } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { rows } = await pool.query(
+    `SELECT DISTINCT ON (part) id, part, outcome, score, sample_size
+       FROM module_assessment_signals WHERE version_id = $1
+      ORDER BY part, measured_at DESC, id DESC`, [versionId]);
+  const current = {};
+  for (const r of rows) current[r.part] = r;
+  const next = composeScore(current);
+
+  const { rows: [last] } = await pool.query(
+    `SELECT id, overall, security_passed, is_new, signal_ids FROM module_assessment_scores
+      WHERE version_id = $1 AND kind = 'computed' ORDER BY computed_at DESC, id DESC LIMIT 1`, [versionId]);
+  if (sameScore(last, next)) return { ok: true, score: { ...last, formula: next.formula }, written: false };
+
+  const { rows: [row] } = await pool.query(
+    `INSERT INTO module_assessment_scores (version_id, kind, overall, security_passed, is_new, formula, signal_ids)
+     VALUES ($1, 'computed', $2, $3, $4, $5, $6)
+     RETURNING id, version_id, overall, security_passed, is_new, formula, signal_ids, computed_at`,
+    [versionId, next.overall, next.security_passed, next.is_new, next.formula, next.signal_ids]);
+  return { ok: true, score: row, written: true };
+}
+
+// After a signal CLI records a row: re-compose and print the score line.
+async function printRecomposed(versionId) {
+  const { score } = await recomposeScore(versionId);
+  console.log(`  score: ${score.formula}`);
+}
+
+async function main(argv) {
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-score.js <store_module_versions.id>');
+    return 2;
+  }
+  const res = await recomposeScore(id);
+  if (!res.ok) { console.error(res.message); return 1; }
+  console.log(`version ${id}: ${res.score.formula}`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => { process.exitCode = code; }, (e) => { console.error(e.stack || e.message); process.exitCode = 1; });
+}
+
+module.exports = { composeScore, recomposeScore, printRecomposed };

package/scripts/gds/module-assess-security.js

@@ -241,6 +241,7 @@ async function main(argv) {
   if (!res.ok) { console.error(res.message); return 1; }
   const s = res.signal;
   console.log(`${res.version.module_key} ${res.version.version}: security ${s.outcome} — ${s.reason} (signal ${s.id})`);
+  await require('./module-assess-score').printRecomposed(res.version.id); // new data re-composes the score (task 1003794)
   return 0;
 }
 

package/scripts/gds/module-assess-tests.js

@@ -238,6 +238,7 @@ async function main(argv) {
   if (!res.ok) { console.error(res.message); return 1; }
   const s = res.signal;
   console.log(`${res.version.module_key} ${res.version.version}: tests ${s.outcome}${s.score !== null ? ` ${s.score}/100` : ''} — ${s.reason} (signal ${s.id})`);
+  await require('./module-assess-score').printRecomposed(res.version.id); // new data re-composes the score (task 1003794)
   return 0;
 }
 

package/scripts/gds/module-assess-version.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-version.js — re-assess a store version when it is
+// published: record Tests as pending, run the Security gate, compose the score
+// (task 1003794; ADR 0343; tables from core_265).
+//
+// WHY. A new version is a new thing to judge, so the store's publish route queues
+// this after it answers the author. Tests is recorded `pending`, and only when the
+// version has no Tests result yet: a published module's tests run only in the
+// separate test environment, never on the control plane (module-assess-tests.js).
+// The Security gate reads the tarball and asks npm about the declared dependencies
+// — it never runs the module's code, so it is safe here. Then the score is
+// composed (module-assess-score.js). Install, Reliability and Tester feedback
+// arrive later from their own tasks; each recompose picks them up.
+//
+// The route goes through queueAssessment, so the web process runs one assessment
+// at a time (the gate's npm resolve + audit can take two minutes) and holds at most
+// QUEUE_MAX waiting; past that a publish is logged as not assessed, and the CLI
+// below re-runs it. This file is apart from the composer so the signal CLIs can
+// recompose without a require cycle (composer <- security, tests, this).
+//
+//   node scripts/gds/module-assess-version.js <store_module_versions.id>   assess + print
+
+const { recomposeScore } = require('./module-assess-score');
+
+// Re-assess one version (on publish): Tests pending, the Security gate, then the
+// score. `recordSecurity` is injectable so tests need no npm. Never throws for a
+// failed measurement — that is recorded as the signal's outcome — and resolves
+// { ok: false, code } only when the version does not exist.
+async function assessVersion(versionId, { db, recordSecurity } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { rows: [ver] } = await pool.query(
+    'SELECT id, module_key, version FROM store_module_versions WHERE id = $1', [versionId]);
+  if (!ver) return { ok: false, code: 'version_not_found', message: `no store_module_versions row ${versionId}` };
+
+  // Only a version with no Tests result yet: a re-assess must never hide a real
+  // score behind a newer "pending".
+  await pool.query(
+    `INSERT INTO module_assessment_signals (version_id, part, outcome, score, sample_size, reason, detail)
+     SELECT $1::bigint, 'tests', 'pending', NULL, NULL, $2::text, '{}'::jsonb
+      WHERE NOT EXISTS (SELECT 1 FROM module_assessment_signals WHERE version_id = $1::bigint AND part = 'tests')`,
+    [ver.id, 'waiting for the separate test environment: a published module\'s tests never run on the control plane']);
+  const record = recordSecurity || require('./module-assess-security').recordSecuritySignal;
+  const security = await record(ver.id, { db: pool });
+  const composed = await recomposeScore(ver.id, { db: pool });
+  return { ok: true, version: ver, security: security && security.signal, score: composed.score };
+}
+
+// One assessment at a time in this process, at most QUEUE_MAX waiting. Resolves
+// at once with whether the version was queued; a failed assessment is logged and
+// never stops the next one. `run` is injectable for tests.
+const QUEUE_MAX = 20;
+let tail = Promise.resolve();
+let waiting = 0;
+function queueAssessment(versionId, { log = console, run = (id) => module.exports.assessVersion(id) } = {}) {
+  if (waiting >= QUEUE_MAX) {
+    log.warn({ versionId }, `assessment queue full (${QUEUE_MAX} waiting): version not assessed; run module-assess-version.js ${versionId}`);
+    return false;
+  }
+  waiting += 1;
+  tail = tail.then(() => run(versionId))
+    .catch((e) => { log.error({ versionId, err: e && e.message }, 'assessment after publish failed'); })
+    .finally(() => { waiting -= 1; });
+  return true;
+}
+
+async function main(argv) {
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-version.js <store_module_versions.id>');
+    return 2;
+  }
+  const res = await assessVersion(id);
+  if (!res.ok) { console.error(res.message); return 1; }
+  console.log(`version ${id}: ${res.score.formula}`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => { process.exitCode = code; }, (e) => { console.error(e.stack || e.message); process.exitCode = 1; });
+}
+
+module.exports = { assessVersion, queueAssessment, QUEUE_MAX };

package/src/bongos/routes/modules.js

@@ -78,6 +78,7 @@ const modulesLib = require('../../modules');
 const moduleCli = require('../../../scripts/gds/module');
 const moduleSubmissions = require('../module-submissions');
 const moduleArtifact = require('../../../scripts/gds/module-artifact');
+const moduleAssessVersion = require('../../../scripts/gds/module-assess-version');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
@@ -393,6 +394,12 @@ module.exports = function buildModulesRouter() {
 
       console.log(`[gds] module "${key}" ${v.version} published to the store by builder ${req.builder.id}`);
       res.status(201).json({ ok: true, created_module: result.created, version: result.version });
+      // A new version is a new thing to judge (task 1003794, ADR 0343): queue its
+      // assessment after answering, since the Security gate asks npm about its
+      // dependencies and can take a minute. The queue runs one at a time and is
+      // capped; a failure is logged, never the author's error, and
+      // `node scripts/gds/module-assess-version.js <id>` re-runs it.
+      setImmediate(() => moduleAssessVersion.queueAssessment(result.version.id, { log }));
     }));
 
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.70'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.71'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_assess_score.mjs

@@ -0,0 +1,276 @@
+// tests/module_assess_score.mjs — composing a store version's assessment signals
+// into its one overall score, and re-assessing a version when it is published
+// (task 1003794; ADR 0343 D2/D3/D5, ADR 0347 D5; tables from core_265). No real
+// DB and no npm: the composer is pure, the writers run against a fake pool that
+// keeps core_265's append-only rows in memory, and the Security gate is injected.
+//
+// Run:  node tests/module_assess_score.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { composeScore, recomposeScore } = require('../scripts/gds/module-assess-score.js');
+const { assessVersion, queueAssessment, QUEUE_MAX } = require('../scripts/gds/module-assess-version.js');
+
+const sig = (id, part, outcome, score = null) => ({ id, part, outcome, score });
+
+// ---------------------------------------------------------------------------
+// composeScore — the rule, pure
+// ---------------------------------------------------------------------------
+
+test('overall is the plain average of the scored averaged parts, rounded', () => {
+  const s = composeScore({
+    security: sig(1, 'security', 'passed'),
+    tests: sig(2, 'tests', 'scored', 80),
+    install: sig(3, 'install', 'scored', 95),
+    reliability: sig(4, 'reliability', 'scored', 70),
+  });
+  assert.equal(s.overall, 82, '(80 + 95 + 70) / 3 = 81.67 → 82');
+  assert.equal(s.security_passed, true);
+  assert.equal(s.is_new, false);
+  assert.deepEqual(s.signal_ids, [1, 2, 3, 4]);
+  assert.match(s.formula, /Security passed; overall 82 = average of Tests 80, Install 95, Reliability 70; left out \(no data\): Tester feedback/);
+});
+
+test('a part with no data is left out, never a zero (D3)', () => {
+  const s = composeScore({
+    security: sig(1, 'security', 'passed'),
+    tests: sig(2, 'tests', 'scored', 60),
+    install: sig(3, 'install', 'no_data'),
+    reliability: sig(4, 'reliability', 'pending'),
+    tester_feedback: sig(5, 'tester_feedback', 'not_scored'),
+  });
+  assert.equal(s.overall, 60, 'only Tests counts');
+  assert.deepEqual(s.signal_ids, [1, 2], 'the score names only the rows it was composed from');
+});
+
+test('Security is a gate, never averaged in (D2): a failed gate keeps its parts visible', () => {
+  const s = composeScore({ security: sig(1, 'security', 'failed'), tests: sig(2, 'tests', 'scored', 100) });
+  assert.equal(s.security_passed, false);
+  assert.equal(s.overall, 100, 'the gate does not lower the number — it keeps the version off the listing');
+  assert.match(s.formula, /Security FAILED \(not listed, whatever the score\)/);
+});
+
+test('a Security check that has not run, or could not, is NULL — not a pass', () => {
+  assert.equal(composeScore({}).security_passed, null);
+  assert.equal(composeScore({ security: sig(1, 'security', 'not_scored') }).security_passed, null);
+  assert.match(composeScore({}).formula, /Security not checked yet/);
+});
+
+test('Docs is shown with the parts and never averaged (ADR 0347 D5)', () => {
+  const s = composeScore({ tests: sig(2, 'tests', 'scored', 50), docs: sig(9, 'docs', 'scored', 100) });
+  assert.equal(s.overall, 50);
+  assert.equal(s.signal_ids.includes(9), false);
+});
+
+test('no averaged part with data → overall NULL, labelled New', () => {
+  const s = composeScore({ security: sig(1, 'security', 'passed'), tests: sig(2, 'tests', 'pending') });
+  assert.equal(s.overall, null);
+  assert.equal(s.is_new, true);
+  assert.match(s.formula, /no overall score yet: no averaged part has data; .*labelled New/);
+});
+
+test('New until Install or Reliability is scored (D5) — Tests and Tester feedback alone do not lift it', () => {
+  assert.equal(composeScore({ tests: sig(1, 'tests', 'scored', 90), tester_feedback: sig(2, 'tester_feedback', 'scored', 90) }).is_new, true);
+  assert.equal(composeScore({ reliability: sig(1, 'reliability', 'scored', 40) }).is_new, false);
+});
+
+test('price is never an input: nothing in the composer reads one (D6)', () => {
+  for (const f of ['module-assess-score.js', 'module-assess-version.js']) {
+    const src = fs.readFileSync(new URL(`../scripts/gds/${f}`, import.meta.url), 'utf8').replace(/\/\/.*$/gm, '');
+    assert.doesNotMatch(src, /price|credits|cents/i, f);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// recomposeScore / assessVersion — against an append-only fake
+// ---------------------------------------------------------------------------
+
+function fakeDb({ versions = [{ id: 7, module_key: 'weather', version: '1.0.0' }] } = {}) {
+  const signals = [];
+  const scores = [];
+  let clock = 0;
+  const db = {
+    signals, scores,
+    async query(sql, params = []) {
+      if (/^SELECT id, module_key, version FROM store_module_versions WHERE id/.test(sql)) {
+        return { rows: versions.filter((v) => String(v.id) === String(params[0])) };
+      }
+      if (/SELECT DISTINCT ON \(part\)/.test(sql)) {
+        const cur = {};
+        for (const s of signals.filter((x) => String(x.version_id) === String(params[0]))) {
+          if (!cur[s.part] || s.t > cur[s.part].t || (s.t === cur[s.part].t && s.id > cur[s.part].id)) cur[s.part] = s;
+        }
+        return { rows: Object.values(cur) };
+      }
+      if (/FROM module_assessment_scores/.test(sql) && /^SELECT/.test(sql.trim())) {
+        const mine = scores.filter((x) => String(x.version_id) === String(params[0]) && x.kind === 'computed');
+        return { rows: mine.length ? [mine[mine.length - 1]] : [] };
+      }
+      if (/INSERT INTO module_assessment_scores/.test(sql)) {
+        const row = { id: scores.length + 1, version_id: params[0], kind: 'computed', overall: params[1], security_passed: params[2], is_new: params[3], formula: params[4], signal_ids: params[5].map(String) };
+        scores.push(row); return { rows: [row] };
+      }
+      if (/INSERT INTO module_assessment_signals/.test(sql) && /'pending'/.test(sql)) {
+        if (signals.some((s) => String(s.version_id) === String(params[0]) && s.part === 'tests')) return { rows: [] };
+        signals.push({ id: signals.length + 1, version_id: params[0], part: 'tests', outcome: 'pending', score: null, reason: params[1], t: ++clock });
+        return { rows: [] };
+      }
+      throw new Error(`unexpected SQL: ${sql.slice(0, 80)}`);
+    },
+  };
+  db.add = (versionId, part, outcome, score = null) => {
+    const row = { id: signals.length + 1, version_id: versionId, part, outcome, score, t: ++clock };
+    signals.push(row); return row;
+  };
+  return db;
+}
+
+test('recompose reads the NEWEST signal per part, so a re-run moves the score', async () => {
+  const db = fakeDb();
+  db.add(7, 'security', 'passed');
+  db.add(7, 'tests', 'scored', 40);
+  const first = await recomposeScore(7, { db });
+  assert.equal(first.written, true);
+  assert.equal(first.score.overall, 40);
+  db.add(7, 'tests', 'scored', 90);
+  const second = await recomposeScore(7, { db });
+  assert.equal(second.score.overall, 90);
+  assert.equal(db.scores.length, 2, 'append-only: the history keeps the 40');
+});
+
+test('a recompose that would repeat the current score writes nothing', async () => {
+  const db = fakeDb();
+  db.add(7, 'tests', 'scored', 70);
+  await recomposeScore(7, { db });
+  const again = await recomposeScore(7, { db });
+  assert.equal(again.written, false);
+  assert.equal(db.scores.length, 1);
+});
+
+test('assessVersion on publish: Tests pending, the Security gate, then the score — and the version is New', async () => {
+  const db = fakeDb();
+  const seen = [];
+  const recordSecurity = async (id, { db: d }) => { seen.push(id); const row = d.add(id, 'security', 'passed'); return { ok: true, signal: row }; };
+  const res = await assessVersion(7, { db, recordSecurity });
+  assert.equal(res.ok, true);
+  assert.deepEqual(seen, [7]);
+  const tests = db.signals.find((s) => s.part === 'tests');
+  assert.equal(tests.outcome, 'pending', 'a published module\'s tests never run on the control plane');
+  assert.match(tests.reason, /separate test environment/);
+  assert.equal(res.score.security_passed, true);
+  assert.equal(res.score.overall, null);
+  assert.equal(res.score.is_new, true);
+});
+
+test('re-assessing never hides a real Tests score behind a newer "pending"', async () => {
+  const db = fakeDb();
+  db.add(7, 'tests', 'scored', 85);
+  const res = await assessVersion(7, { db, recordSecurity: async (id, { db: d }) => ({ ok: true, signal: d.add(id, 'security', 'passed') }) });
+  assert.equal(db.signals.filter((s) => s.part === 'tests').length, 1);
+  assert.equal(res.score.overall, 85);
+});
+
+test('assessVersion on an unknown version writes nothing', async () => {
+  const db = fakeDb({ versions: [] });
+  const res = await assessVersion(99, { db, recordSecurity: async () => { throw new Error('must not run'); } });
+  assert.equal(res.ok, false);
+  assert.equal(res.code, 'version_not_found');
+  assert.equal(db.signals.length + db.scores.length, 0);
+});
+
+// ---------------------------------------------------------------------------
+// the queue — one assessment at a time, capped
+// ---------------------------------------------------------------------------
+
+const quietLog = () => { const lines = []; return { lines, warn: (o, m) => lines.push(['warn', m]), error: (o, m) => lines.push(['error', m, o.err]) }; };
+const gate = () => { let open; const p = new Promise((r) => { open = r; }); return { p, open }; };
+
+test('the queue runs one assessment at a time, in order', async () => {
+  const log = quietLog();
+  const order = [];
+  const g = gate();
+  const run = async (id) => { order.push(`start ${id}`); if (id === 1) await g.p; order.push(`end ${id}`); };
+  queueAssessment(1, { log, run });
+  queueAssessment(2, { log, run });
+  await new Promise((r) => setImmediate(r));
+  assert.deepEqual(order, ['start 1'], 'the second waits while the first runs');
+  g.open();
+  await new Promise((r) => setTimeout(r, 10));
+  assert.deepEqual(order, ['start 1', 'end 1', 'start 2', 'end 2']);
+});
+
+test('a failed assessment is logged and never stops the next one', async () => {
+  const log = quietLog();
+  const ran = [];
+  queueAssessment(5, { log, run: async () => { throw new Error('npm unreachable'); } });
+  queueAssessment(6, { log, run: async (id) => { ran.push(id); } });
+  await new Promise((r) => setTimeout(r, 10));
+  assert.deepEqual(ran, [6]);
+  assert.deepEqual(log.lines, [['error', 'assessment after publish failed', 'npm unreachable']]);
+});
+
+test(`past ${QUEUE_MAX} waiting, a publish is logged as not assessed instead of piling up`, async () => {
+  const log = quietLog();
+  const g = gate();
+  const accepted = [];
+  for (let i = 0; i < QUEUE_MAX + 3; i += 1) accepted.push(queueAssessment(100 + i, { log, run: () => g.p }));
+  assert.equal(accepted.filter(Boolean).length, QUEUE_MAX);
+  assert.equal(log.lines.filter(([lvl]) => lvl === 'warn').length, 3);
+  assert.match(log.lines[0][1], /queue full .*module-assess-version\.js/);
+  g.open();
+  await new Promise((r) => setTimeout(r, 10));
+  assert.equal(queueAssessment(200, { log, run: async () => {} }), true, 'room again once it drains');
+});
+
+// ---------------------------------------------------------------------------
+// the publish route triggers it
+// ---------------------------------------------------------------------------
+
+test('publishing a version re-assesses that version, after the author has their answer', async () => {
+  const STORE = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-score-store-'));
+  process.env.MODULE_STORE_DIR = STORE;
+  const state = { modules: {}, versions: [] };
+  const client = {
+    async query(sql, params = []) {
+      if (/^SELECT module_key, author_id, status FROM store_modules/.test(sql)) { const m = state.modules[params[0]]; return { rows: m ? [m] : [] }; }
+      if (/^INSERT INTO store_modules/.test(sql)) { state.modules[params[0]] = { module_key: params[0], author_id: params[3], status: 'listed' }; return { rows: [] }; }
+      if (/^SELECT version FROM store_module_versions/.test(sql)) return { rows: [] };
+      if (/^\s*INSERT INTO store_module_versions/.test(sql)) { const row = { id: 41, module_key: params[0], version: params[1] }; state.versions.push(row); return { rows: [row] }; }
+      return { rows: [] };
+    },
+    release() {},
+  };
+  const poolPath = require.resolve('../src/bongos/pool.js');
+  require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => client, query: client.query } } };
+  const score = require('../scripts/gds/module-assess-version.js');
+  const real = score.queueAssessment;
+  const calls = [];
+  score.queueAssessment = (id) => { calls.push(id); return true; };
+  try {
+    const buildModulesRouter = require('../src/bongos/routes/modules.js');
+    const artifact = require('../scripts/gds/module-artifact.js');
+    const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-score-src-'));
+    fs.mkdirSync(path.join(src, 'weather'));
+    fs.writeFileSync(path.join(src, 'weather', 'module.json'), JSON.stringify({ key: 'weather', title: 'Weather', description: 'd', version: '1.0.0', coreVersion: '^1.0.0', contributes: {} }));
+    fs.writeFileSync(path.join(src, 'weather', 'HOWTO.md'), artifact.HOWTO_SECTIONS.map((h) => `## ${h}\nSome text.\n`).join('\n'));
+    const { tgz } = artifact.packModule('weather', { modulesDir: src, modeOf: () => '644' });
+
+    const router = buildModulesRouter();
+    const layer = router.stack.find((l) => l.route && l.route.path === '/store/modules/:key/versions' && l.route.methods.post);
+    const handle = layer.route.stack[layer.route.stack.length - 1].handle;
+    const res = { statusCode: 200, body: null, json(b) { this.body = b; return this; }, status(c) { this.statusCode = c; return this; }, fail(code, o) { this.statusCode = o.status; this.body = { error: code }; return this; } };
+    await handle({ params: { key: 'weather' }, body: tgz, builder: { id: 42 } }, res, (e) => { if (e) throw e; });
+    assert.equal(res.statusCode, 201, JSON.stringify(res.body));
+    assert.deepEqual(calls, [], 'the author is answered first — the gate can take a minute');
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(calls, [41], 'then the new version is queued for assessment');
+  } finally {
+    score.queueAssessment = real;
+  }
+});