@bongos/core 1.20.72 → 1.20.73

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.72",
-  "core_contract": "1.20.72",
-  "source_commit": "1b8205006fdecfe57f2908b856fb0df2a5f61f6e",
+  "core_version": "1.20.73",
+  "core_contract": "1.20.73",
+  "source_commit": "801daee11330f1b0e8072594fd9d007194d82ff7",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T15:30:26.777Z",
+  "built_at": "2026-10-01T15:43:17.489Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2800,
+    "functional_verbatim": 2801,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3400,
-  "tree_sha256": "f0893799d3b2d94852ce0f7cfa3a4189fcd1a20481dac1b9e596f23ef8971084",
+  "file_count": 3401,
+  "tree_sha256": "00438ba77e638f59bbf2b7e542f64a5651f030603d42887ba570dad90d40e7b0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "35268be856fb1c445d7092f01b251ccd8c891bc4d5037548a581891151833adf"
+      "sha256": "a1158e3a1bb0e3daf32f0ec0592b3956071f4eaf712a567ddb702c52392e4b69"
     },
     {
       "path": "docs/modules-contract.md",
@@ -9457,12 +9457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3c57608794638c93c7dae2ccb49459646d64d836e842a05748f0da78f57a1c90"
+      "sha256": "f383e88aef6668d55f149d2df43507dbbd0596d7d91f40b2027e29588a8b7bb6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6570d6e6a26b59165f041e6bac7201b855bc0876f9ea9a45bf4733da1ab2e4ac"
+      "sha256": "774a78ab94f32c857b8de59046bf54910f743c6e7c2e78be80d8019029dd4cb2"
     },
     {
       "path": "public-docs/index.html",
@@ -9482,7 +9482,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0f8c8e892bac50f1d519f86871c6a9eb2c93bad81984a6000546ec945d28f1bf"
+      "sha256": "e63c13e0213b9008d28ee2c938a5a9ac2b280e2a20e8aec1fb8d9ce92791ed2b"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11677,7 +11677,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "54662cdfd15931333470431aefb25deff3da4015340e78448781d2909c7004cc"
+      "sha256": "73fdbcf183fb1dd260fbb16ea0a5f1dfe053d1f06d53b31d0af695f80ec28cc8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14734,6 +14734,11 @@
       "mode": "0000644",
       "sha256": "c3c74387af6972760f6701efb80aaa588634965528d79d4ca881bca051e534e5"
     },
+    {
+      "path": "tests/module_assess_price_parity.mjs",
+      "mode": "0000644",
+      "sha256": "78f36a8bbbd948c4485dfd80df55e1ee053af1b510b4d98607c0d2545bcfa66c"
+    },
     {
       "path": "tests/module_assess_score.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2801,5 +2801,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.70 with no explicit bump. run 36881290177. (task 1002620)
   1.20.72 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.71 with no explicit bump. run 36884685441. (task 1002620)
+  1.20.73 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.72 with no explicit bump. run 36886320087. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.72",
+  "version": "1.20.73",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.72",
+      "version": "1.20.73",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.72",
+  "version": "1.20.73",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8561,5 +8561,11 @@
       "id": "1004367",
       "text": "Every module published to the store now gets its how-to guide read and scored by AI for clarity, with a short reason for each part so authors know what to fix. If the AI can't run, the guide shows 'not scored' rather than a ze"
     }
+  ],
+  "1.20.73": [
+    {
+      "id": "1003795",
+      "text": "There is now an automatic check that free modules are scored exactly like paid ones. If anyone ever makes price affect a module's score, the check fails and points at the line."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.72'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.73'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_assess_price_parity.mjs

@@ -0,0 +1,174 @@
+// tests/module_assess_price_parity.mjs — free modules are assessed identically to
+// paid ones: price neither buys nor excuses a score (task 1003795; owner decision
+// on criterion wa5-quality-assessed; ADR 0343 D6).
+//
+// Two proofs, like the update-parity test proves its own criterion:
+//   1. STATIC — no file on the assessment path (scripts/gds/module-assess-*.js)
+//      names a price, a currency amount, free/paid or an entitlement in its code
+//      (comments are allowed to explain the rule). A price-conditional branch
+//      added anywhere there fails this test, naming the file and line.
+//   2. BEHAVIOUR — the same signals give the same score for a paid version and
+//      for the three ways a module can be free: a zero price, no price set, and a
+//      core-bundled module. The fake pool holds every case's price state and
+//      refuses any query that reads it.
+//
+// Run:  node tests/module_assess_price_parity.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { composeScore, recomposeScore } = require('../scripts/gds/module-assess-score.js');
+const { assessVersion } = require('../scripts/gds/module-assess-version.js');
+
+// ---------------------------------------------------------------------------
+// 1. static — the assessment path never reads price
+// ---------------------------------------------------------------------------
+
+const PRICE_WORD = /\b(price\w*|isFree\w*|free|paid|cents|credits|store_module_prices|entitlement\w*|purchase\w*)\b/i;
+
+// The code lines of a JS source, comments blanked (line numbers kept).
+function codeLines(src) {
+  const noBlock = src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '));
+  return noBlock.split('\n').map((l) => l.replace(/(^|[^:'"`\\])\/\/.*$/, '$1'));
+}
+function priceHits(src) {
+  return codeLines(src).flatMap((l, i) => (PRICE_WORD.test(l) ? [`${i + 1}: ${l.trim()}`] : []));
+}
+
+const ASSESS_DIR = path.join(root, 'scripts', 'gds');
+const assessFiles = fs.readdirSync(ASSESS_DIR).filter((f) => /^module-assess-.*\.js$/.test(f)).sort();
+
+test('the scan sees the whole assessment path', () => {
+  for (const f of ['module-assess-score.js', 'module-assess-security.js', 'module-assess-tests.js', 'module-assess-version.js']) {
+    assert.ok(assessFiles.includes(f), `${f} is on the assessment path`);
+  }
+});
+
+test('the scanner catches a price branch and ignores a comment about price', () => {
+  assert.equal(priceHits('// Nothing here reads price: free and paid are assessed identically\nconst x = 1;').length, 0);
+  assert.equal(priceHits('/* free modules\n are not excused */ const y = 2;').length, 0);
+  assert.deepEqual(priceHits('const a = 1;\nif (ver.price_cents === 0) score += 10;'), ['2: if (ver.price_cents === 0) score += 10;']);
+  assert.equal(priceHits("pool.query('SELECT * FROM store_module_prices')").length, 1);
+  assert.equal(priceHits('const bonus = isFreePrice(p) ? 0 : 5;').length, 1);
+  assert.equal(priceHits("const u = 'https://x.test/a'; if (paid) x();").length, 1, 'a URL in a string does not hide the rest of the line');
+});
+
+test('no assessment file names a price in its code', () => {
+  const found = assessFiles.flatMap((f) => priceHits(fs.readFileSync(path.join(ASSESS_DIR, f), 'utf8')).map((h) => `scripts/gds/${f}:${h}`));
+  assert.deepEqual(found, [], `price must never gate or excuse a score (ADR 0343 D6):\n${found.join('\n')}`);
+});
+
+// ---------------------------------------------------------------------------
+// 2. behaviour — paid, zero-price, no-price and core-bundled score the same
+// ---------------------------------------------------------------------------
+
+const CASES = [
+  { id: 1, module_key: 'paid-mod', version: '1.0.0', price: { price_cents: 500, price_credits: 50 } },
+  { id: 2, module_key: 'zero-mod', version: '1.0.0', price: { price_cents: 0, price_credits: 0 } },
+  { id: 3, module_key: 'unpriced-mod', version: '1.0.0', price: null },
+  { id: 4, module_key: 'economy', version: '1.0.0', price: null, core_bundled: true },
+];
+
+// core_265's append-only rows in memory, every case's price state alongside, and
+// a refusal for any query that reads price.
+function fakeDb() {
+  const signals = [];
+  const scores = [];
+  const sqlSeen = [];
+  let clock = 0;
+  const db = {
+    signals, scores, sqlSeen,
+    async query(sql, params = []) {
+      sqlSeen.push(sql);
+      if (PRICE_WORD.test(sql)) throw new Error(`the assessment read price: ${sql.slice(0, 120)}`);
+      if (/^SELECT id, module_key, version FROM store_module_versions WHERE id/.test(sql)) {
+        const v = CASES.find((c) => String(c.id) === String(params[0]));
+        return { rows: v ? [{ id: v.id, module_key: v.module_key, version: v.version }] : [] };
+      }
+      if (/SELECT DISTINCT ON \(part\)/.test(sql)) {
+        const cur = {};
+        for (const s of signals.filter((x) => String(x.version_id) === String(params[0]))) {
+          if (!cur[s.part] || s.t > cur[s.part].t || (s.t === cur[s.part].t && s.id > cur[s.part].id)) cur[s.part] = s;
+        }
+        return { rows: Object.values(cur) };
+      }
+      if (/FROM module_assessment_scores/.test(sql) && /^SELECT/.test(sql.trim())) {
+        const mine = scores.filter((x) => String(x.version_id) === String(params[0]) && x.kind === 'computed');
+        return { rows: mine.length ? [mine[mine.length - 1]] : [] };
+      }
+      if (/INSERT INTO module_assessment_scores/.test(sql)) {
+        const row = { id: scores.length + 1, version_id: params[0], kind: 'computed', overall: params[1], security_passed: params[2], is_new: params[3], formula: params[4], signal_ids: params[5].map(String) };
+        scores.push(row); return { rows: [row] };
+      }
+      if (/INSERT INTO module_assessment_signals/.test(sql) && /'pending'/.test(sql)) {
+        if (signals.some((s) => String(s.version_id) === String(params[0]) && s.part === 'tests')) return { rows: [] };
+        signals.push({ id: signals.length + 1, version_id: params[0], part: 'tests', outcome: 'pending', score: null, t: ++clock });
+        return { rows: [] };
+      }
+      throw new Error(`unexpected SQL: ${sql.slice(0, 80)}`);
+    },
+  };
+  db.add = (versionId, part, outcome, score = null) => {
+    const row = { id: signals.length + 1, version_id: versionId, part, outcome, score, t: ++clock };
+    signals.push(row); return row;
+  };
+  return db;
+}
+
+// The answer with the version id taken out, so cases can be compared.
+const shape = (s) => ({ overall: s.overall, security_passed: s.security_passed, is_new: s.is_new, formula: s.formula });
+
+test('composeScore takes no price: the same signals give the same score whatever is attached', () => {
+  const signals = {
+    security: { id: 1, part: 'security', outcome: 'passed', score: null },
+    tests: { id: 2, part: 'tests', outcome: 'scored', score: 70 },
+    install: { id: 3, part: 'install', outcome: 'scored', score: 90 },
+  };
+  const base = composeScore(signals);
+  for (const c of CASES) {
+    // Price riding along on the rows must change nothing.
+    const withPrice = Object.fromEntries(Object.entries(signals).map(([k, r]) => [k, { ...r, ...(c.price || {}), core_bundled: !!c.core_bundled }]));
+    assert.deepEqual(composeScore(withPrice), base, c.module_key);
+  }
+});
+
+for (const [label, signalsFor] of [
+  ['scored parts', (db, id) => { db.add(id, 'security', 'passed'); db.add(id, 'tests', 'scored', 64); db.add(id, 'reliability', 'scored', 88); }],
+  ['a failed gate', (db, id) => { db.add(id, 'security', 'failed'); db.add(id, 'tests', 'scored', 99); }],
+  ['no data yet', (db, id) => { db.add(id, 'tests', 'no_data'); }],
+]) {
+  test(`recompose: paid, zero-price, no-price and core-bundled score the same (${label})`, async () => {
+    const db = fakeDb();
+    const out = [];
+    for (const c of CASES) {
+      signalsFor(db, c.id);
+      const res = await recomposeScore(c.id, { db });
+      out.push([c.module_key, shape(res.score)]);
+    }
+    for (const [key, s] of out.slice(1)) assert.deepEqual(s, out[0][1], `${key} scores exactly like the paid module`);
+  });
+}
+
+test('assessVersion on publish runs the same steps for every case, and never reads price', async () => {
+  const db = fakeDb();
+  const steps = [];
+  const recordSecurity = async (id, { db: d }) => { steps.push(['security', id]); return { ok: true, signal: d.add(id, 'security', 'passed') }; };
+  const recordDocs = async (id, { db: d }) => { steps.push(['docs', id]); return { ok: true, signal: d.add(id, 'docs', 'scored', 50) }; };
+  const out = [];
+  for (const c of CASES) {
+    const res = await assessVersion(c.id, { db, recordSecurity, recordDocs });
+    assert.equal(res.ok, true, c.module_key);
+    out.push(shape(res.score));
+  }
+  for (const s of out.slice(1)) assert.deepEqual(s, out[0]);
+  const perCase = (id) => steps.filter(([, v]) => v === id).map(([k]) => k).join(',');
+  for (const c of CASES.slice(1)) assert.equal(perCase(c.id), perCase(CASES[0].id), `${c.module_key} goes through the same checks`);
+  assert.ok(db.sqlSeen.length > 0);
+  assert.ok(db.sqlSeen.every((q) => !PRICE_WORD.test(q)), 'no assessment query touched price');
+});