@bongos/core 1.21.152 → 1.21.154

package/modules/hall-ui/public/modules.html

@@ -73,6 +73,22 @@
             <ul class="ov-rows" id="own-grid"></ul>
             <p class="ov-foot" id="submit-lede">A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.</p>
           </div>
+
+          <!-- In the store — what GET /store/modules lists, each with what it is
+               strong and weak at (task 1003799, ADR 0343 D4), so two modules with
+               the same score can be told apart. Hidden until the store answers
+               with something to list. -->
+          <div class="ov-group" id="store-group" hidden>
+            <div class="ov-group__head">
+              <span class="ov-group__name">In the store</span>
+              <span class="ov-group__n" id="store-n"></span>
+              <!-- task 1003800: the buyer picks the part that matters to them, and
+                   the server orders by it (sortByPart). Filled from sort_parts. -->
+              <label class="ov-group__note">Sort by <select id="store-sort"><option value="">Name</option></select></label>
+            </div>
+            <ul class="ov-rows" id="store-grid"></ul>
+            <p class="ov-foot" id="store-lede">A part is strong at 80 out of 100 or more, and weak below the listing floor. A part with no data yet is not counted against a module. Sort by a part to see the modules strongest at it first; a module with no score for that part goes last, and a new module is never ranked.</p>
+          </div>
         </section>
 
         <!-- One store version's how-to (task 1004366, ADR 0347): the HOWTO.md that

package/modules/hall-ui/public/modules.js

@@ -204,6 +204,120 @@
       </li>`;
   }
 
+  // ---- the store listing (task 1003799, ADR 0343 D4) ----
+  //
+  // GET /store/modules entries carry their parts read as strengths, weaknesses and
+  // unmeasured parts (src/bongos/module-listing.js readParts). The row shows the
+  // short labels; the sentence behind each is one click away in the details, the
+  // splitCriterion idea: scannable in a list, thorough on demand.
+  let storeModules = [];
+  // The part the buyer sorts by (task 1003800): '' is name order. The server owns
+  // the order and the list of parts; this page only asks for one and shows it.
+  let storeSort = '';
+  let storeSortTitle = '';
+  let storeSortWired = false;
+
+  // The sorted-by part's own score, so the order explains itself on every row.
+  function sortedPartFact(m) {
+    if (!storeSort || m.is_new) return '';
+    const p = m.parts && m.parts[storeSort];
+    return p && p.score != null
+      ? `<span class="ov-fact">${escapeHtml(storeSortTitle)} <b>${escapeHtml(String(p.score))}</b></span>`
+      : `<span class="ov-fact">${escapeHtml(storeSortTitle)} not measured yet</span>`;
+  }
+
+  function partsList(items) {
+    return items.map((p) => `${escapeHtml(p.title)} <b>${escapeHtml(String(p.score))}</b>`).join(', ');
+  }
+
+  function storeFacts(m) {
+    const facts = [m.is_new
+      ? '<span class="fact-pill fact-pill--info" title="No real-world data yet, so it is listed but not ranked.">new</span>'
+      : `<span class="ov-fact">scores <b>${escapeHtml(String(m.overall))}</b></span>`];
+    const sorted = sortedPartFact(m);
+    if (sorted) facts.push(sorted);
+    const strong = Array.isArray(m.strengths) ? m.strengths : [];
+    const weak = Array.isArray(m.weaknesses) ? m.weaknesses : [];
+    if (strong.length) facts.push(`<span class="ov-fact">strong at ${partsList(strong)}</span>`);
+    // A weakness is the exception a buyer must not miss, so it is the warn pill.
+    if (weak.length) facts.push(`<span class="fact-pill fact-pill--warn">weak at ${partsList(weak)}</span>`);
+    return facts.join('');
+  }
+
+  function storeDetailLines(m) {
+    const lines = [...(m.strengths || []), ...(m.weaknesses || [])]
+      .map((p) => `<li><span class="ov-key ov-key--faint">${escapeHtml(p.title)}</span><span class="ov-lines__v">${escapeHtml(p.detail)}</span></li>`);
+    const missing = (m.unmeasured || []).map((p) => p.title);
+    if (missing.length) {
+      lines.push(`<li><span class="ov-key ov-key--faint">not measured yet</span><span class="ov-lines__v">${escapeHtml(missing.join(', '))}</span></li>`);
+    }
+    return lines.length ? `<ul class="ov-lines">${lines.join('')}</ul>` : '';
+  }
+
+  function storeRowHTML(m) {
+    const key = `store:${m.key}`;
+    const lines = storeDetailLines(m);
+    return `
+      <li class="ov-row mod-row" data-key="${escapeHtml(key)}">
+        <div class="ov-row__main">
+          <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
+          <div class="ov-row__facts">${storeFacts(m)}</div>
+          ${lines ? `<details class="mod-more"${openKeys.has(key) ? ' open' : ''}><summary aria-label="Strengths and weaknesses of ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
+        </div>
+        <div class="ov-row__right mod-row__right"><span class="ov-mono">${escapeHtml(String(m.version || ''))}</span></div>
+      </li>`;
+  }
+
+  function matchesStoreQuery(m, q) {
+    if (!q) return true;
+    return [m.key, m.title, ...(m.strengths || []).map((p) => p.title), ...(m.weaknesses || []).map((p) => p.title)]
+      .some((f) => f && String(f).toLowerCase().includes(q));
+  }
+
+  function renderStore() {
+    const group = $('#store-group');
+    if (!group) return;
+    group.hidden = !storeModules.length;
+    if (!storeModules.length) return;
+    const shown = storeModules.filter((m) => matchesStoreQuery(m, query));
+    const list = $('#store-grid');
+    if (list) {
+      list.innerHTML = shown.length ? shown.map(storeRowHTML).join('')
+        : `<li>${kit.emptyStateHtml('No store module matches that search.')}</li>`;
+    }
+    const n = $('#store-n');
+    if (n) n.textContent = String(shown.length);
+  }
+
+  // Best-effort and last: the store is a second read, and the modules on disk ARE
+  // this page, so a store that cannot be read costs this group and nothing else.
+  // Filled and wired once, on the first store read; a re-read only re-renders.
+  function fillStoreSort(parts) {
+    const select = $('#store-sort');
+    if (storeSortWired || !select || !Array.isArray(parts)) return;
+    storeSortWired = true;
+    for (const p of parts) select.add(new Option(p.title, p.part));
+    select.addEventListener('change', () => {
+      storeSort = select.value;
+      storeSortTitle = storeSort ? select.options[select.selectedIndex].text : '';
+      loadStore();
+    });
+  }
+
+  async function loadStore() {
+    try {
+      const q = storeSort ? `?sort=${encodeURIComponent(storeSort)}` : '';
+      const res = await api.request('GET', `${API}/store/modules${q}`);
+      if (!res.ok) return;
+      const body = res.data || {};
+      fillStoreSort(body.sort_parts);
+      storeModules = [...(body.listed || []), ...(body.new || [])];
+      renderStore();
+    } catch (err) {
+      console.error('[modules] store listing failed to load', err);
+    }
+  }
+
   // `source` splits the page: 'core' = shipped by the core package (the
   // catalog you opt into), 'instance' = lives in this repo. Older payloads
   // predate the field, so fall back to the credit axis rather than emptying
@@ -248,6 +362,7 @@
     if (coreN) coreN.textContent = String(core.length);
     const ownN = $('#own-n');
     if (ownN) ownN.textContent = String(own.length);
+    renderStore();
 
     // The count line speaks only while a filter narrows the list — the figure
     // band under it already says how many there are.
@@ -366,6 +481,7 @@
       if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
       if (!res.ok) throw new Error(`modules → ${res.status}`);
       render(res.data);
+      loadStore();
     } catch (err) {
       console.error('[modules] failed to load', err);
       const list = $('#core-grid');

package/modules/hall-ui/public/modules.states.json

@@ -13,7 +13,8 @@
     "/api/(gds|bongos)/goals",
     "/api/(gds|bongos)/inbox/",
     "/api/(gds|bongos)/versions",
-    "/api/(gds|bongos)/modules"
+    "/api/(gds|bongos)/modules",
+    "/api/(gds|bongos)/store/modules$"
   ],
   "ignoreConsole": [
     "/api/(gds|bongos)/",

package/modules/hall-ui/records/catalog.md

@@ -10,3 +10,7 @@
 Also gone, and the one rule in that list: `.ab-caption` takes the lede's `--measure`, never a fresh `90ch`. **Gotcha:** `gen-atlas.js` run from the MAIN checkout walks `.claude/worktrees/*` and emits thousands of context nodes — run it from a worktree, or copy a worktree's `atlas.json` over, before previewing the atlas there.
 
 **A store version's how-to is a view of the Modules page, not a new page (task 1004366).** `/builders/modules?howto=<key>&version=<X.Y.Z>` hides the catalog and shows that version's `HOWTO.md` in the reading room's article card: the page adds `body.room` so `room.css`'s sizes apply, and the markdown goes through `md-reader.js` (author-written, so every byte is escaped; only absolute http(s), mailto and #anchor links become links). A query, not a `#/` route — the hash namespace is frozen to the idea and blocker overlays. "Save as PDF" is `window.print()` with an `@media print` block in `modules.css` that keeps only the document and prints in the system ink (`CanvasText`), because a literal colour is the token tier's. Harness fixture: `store__modules__howto.json`.
+
+**The store's modules are a third group on the same panel, read as strengths and weaknesses (task 1003799, ADR 0343 D4).** `#store-group` ("In the store") lists what `GET /store/modules` lists, hidden until that read answers with something; it loads after the modules on disk and best-effort, so a store that cannot be read costs this group and nothing else. A row is the same `.ov-row`: the overall score as a plain fact (or the `new` info pill), `strong at Tests 96, How-to 88` as a plain fact, and `weak at …` as the warn pill, because a weakness is the exception a buyer must not miss. The sentence behind each part ("Tests scored 96 out of 100, from 40 test cases.") and the parts with no data yet sit in the row's `<details class="mod-more">`, the `splitCriterion` idea: short label in the list, the detail one click away. The reading is the server's (`readParts` in `src/bongos/module-listing.js`: strong at 80 or more, weak below the listing floor, unmeasured never weak); the page re-derives nothing. Harness fixture: `store__modules.json`.
+
+**The buyer sorts the store by the part that matters to them (task 1003800, owner decision 2026-10-22).** A "Sort by" menu sits in the store group's head (`#store-sort`, `.ov-group__note`): Name, then the parts the server lists in `sort_parts`. Picking one re-reads `GET /store/modules?sort=<part>`, and the server orders the listed modules (`sortByPart` in `src/bongos/module-listing.js`: highest for that part first, a tie to the overall score then the key, a module with no score for the part last). The page never sorts the rows itself, and New modules keep name order because they are never ranked. While a part is picked, each listed row carries that part's score as a plain fact (`Reliability 91`, or `Reliability not measured yet`), so the order explains itself. The owner chose the buyer over a per-category "key part" because nothing records what a category is for, and a hidden weighting would break the score an author can check (ADR 0343 D3).

package/modules/lifecycle/github-failure.js

@@ -0,0 +1,50 @@
+'use strict';
+
+// modules/lifecycle/github-failure.js — say WHICH GitHub call failed, and what
+// GitHub answered (task 1004766).
+//
+// WHY. GET /tasks/:id/publish-status answered every unexpected GitHub failure with
+// a bare 502 `status_failed`, and logged only the error's code. On the toast
+// instance (2026-10-20) the GitHub App was installed and the merge was on main,
+// yet every probe 502'd: the builder saw "no explanation", and the operator's log
+// said one word. The thrown errors already carry what is needed — the code says
+// which step broke (minting the App token, listing PRs, reading a branch) and
+// `status` / `detail` hold GitHub's own HTTP status and message — they were just
+// dropped on the floor.
+//
+// SAFE TO SHOW. `detail` is GitHub's response body (an error message such as
+// "Bad credentials" or "Resource not accessible by integration"), never a token:
+// tokens travel in request headers, and no caller puts one in an error. It is
+// trimmed and capped anyway. PURE.
+
+const STEPS = Object.freeze({
+  APP_TOKEN_FAILED: "the server could not get a GitHub App token (GitHub refused the App's key or its installation)",
+  STATUS_FETCH_FAILED: 'GitHub refused a read of the repository',
+  PUSH_UNCONFIGURED: 'the server has no GitHub credential',
+  BAD_BRANCH: 'the branch name is not one the server will ask GitHub about',
+});
+
+const MAX_DETAIL = 300;
+
+function describeGithubFailure(e) {
+  const code = (e && e.code) || null;
+  const status = e && Number.isInteger(e.status) ? e.status : null;
+  const detail = e && e.detail ? String(e.detail).replace(/\s+/g, ' ').trim().slice(0, MAX_DETAIL) : null;
+  const step = (code && STEPS[code]) || 'an unexpected error while asking GitHub';
+  const github = status ? ` GitHub answered HTTP ${status}${detail ? `: ${detail}` : ''}.` : '';
+  return {
+    message: `Could not read the land status: ${step}.${github}`,
+    details: { cause: code, github_status: status, github_detail: detail },
+    log: `${code || (e && e.message) || 'unknown'}${status ? ` (GitHub HTTP ${status}${detail ? `: ${detail}` : ''})` : ''}`,
+  };
+}
+
+// The publish-status route's answer, in one call so the (size-capped) route file
+// stays one line: log the step + GitHub's reply, answer 502 with the same words.
+function failGithubStatus(res, log, e) {
+  const why = describeGithubFailure(e);
+  if (log) log.error('[gds] GET /tasks/:id/publish-status', why.log);
+  return res.fail('status_failed', { status: 502, message: why.message, details: why.details });
+}
+
+module.exports = { describeGithubFailure, failGithubStatus };

package/modules/lifecycle/routes/tasks.js

@@ -55,6 +55,7 @@ const { makeAbandonHandler } = require('./abandon-handler');
 const githubPush = require('../github-push');
 const prAssign = require('../pr-assign');
 const shipAssurance = require('../ship-assurance');
+const { failGithubStatus } = require('../github-failure');
 const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
 // task 1003764: publish-status with no ?branch= and no PR titled for the task — the shape
 // getPublishStatus gives a branch with no PR, plus how to ask about one. Never a 400.
@@ -1345,8 +1346,7 @@ module.exports = function buildTasksRouter() {
     } catch (e) {
       if (e.code === 'NO_REPO_INFO') return res.fail('no_repo_info', 500);
       if (e.code === 'APP_NOT_INSTALLED') return res.fail('push_unconfigured', { status: 503, message: appNotInstalledMessage(e) });
-      log.error('[gds] GET /tasks/:id/publish-status', e.code || e.message);
-      return res.fail('status_failed', 502);
+      return failGithubStatus(res, log, e); // task 1004766: names the step + GitHub's answer
     }
   });
 

package/modules/provisioning/github-setup.js

@@ -247,7 +247,57 @@ async function githubSetupRead(db, inst, row, status, { now = Date.now(), withSt
   };
 }
 
+// The standing install nudge (task 1004763). A project made before the wizard's install
+// step existed (task 1004649), or whose founder closed the GitHub tab, has an app nobody
+// installed on its repo, and every ship then ends land-not-proven because the platform
+// cannot read the repo. The checklist above only shows inside the creation wizard, so the
+// project list and the project's own page carry this instead: the install link and the
+// repo, from the latest attempt, until the runner has SEEN the install. null when there is
+// no app of ours (nothing to install) or GitHub has confirmed it. PURE.
+function installNudge(setup) {
+  if (!setup || !setup.checklist || setup.checklist.install === 'done' || !setup.install_url) return null;
+  return { install_url: setup.install_url, repo: setup.repo || null };
+}
+
+// The nudges for a whole project list in TWO reads, never one per project: each project's
+// latest attempt, then which of those GitHub has been seen installed on since that attempt
+// began. Only the install fact matters here: with an app of ours recorded, the checklist's
+// install step is 'done' exactly when the runner saw it (githubChecklist), so the full
+// read is not needed. Returns a Map of instance id → nudge or null. A switched-off project
+// is silent; a failed read is no nudge for anyone, never a failed list.
+async function installNudgesFor(db, insts) {
+  const out = new Map();
+  const live = (insts || []).filter((i) => i && i.id != null && i.status !== 'torn_down' && i.status !== 'tearing_down');
+  for (const i of insts || []) if (i && i.id != null) out.set(String(i.id), null);
+  if (!live.length) return out;
+  try {
+    const { rows: attempts } = await db.query(
+      `SELECT DISTINCT ON (instance_id) instance_id, app_slug, created_at
+         FROM provisioning_oauth_manifests
+        WHERE instance_id = ANY($1::bigint[])
+        ORDER BY instance_id, created_at DESC`,
+      [live.map((i) => i.id)]);
+    const withApp = attempts.filter((a) => a.app_slug);
+    if (!withApp.length) return out;
+    const { rows: seen } = await db.query(
+      `SELECT DISTINCT e.instance_id
+         FROM provisioning_events e
+         JOIN unnest($1::bigint[], $2::timestamptz[]) AS s(id, since)
+           ON e.instance_id = s.id AND e.created_at >= s.since
+        WHERE e.event = $3`,
+      [withApp.map((a) => a.instance_id), withApp.map((a) => new Date(a.created_at).toISOString()), SETUP_EVENTS.installed]);
+    const installed = new Set(seen.map((r) => String(r.instance_id)));
+    const byId = new Map(live.map((i) => [String(i.id), i]));
+    for (const a of withApp) {
+      const id = String(a.instance_id);
+      if (installed.has(id) || !byId.has(id)) continue;
+      out.set(id, { install_url: installUrlFor({ appSlug: a.app_slug }), repo: targetRepo(byId.get(id)) });
+    }
+  } catch (_) { for (const k of out.keys()) out.set(k, null); }
+  return out;
+}
+
 module.exports = {
   SETUP_EVENTS, VERIFY_WINDOW_MS, installUrlFor, targetRepo, githubSetupFacts, githubChecklist, stillVerifying, githubSetupRead,
-  validGithubLogin, pickUpFor, mintGuard, requeueConversion, recordSignInSeen,
+  validGithubLogin, pickUpFor, mintGuard, requeueConversion, recordSignInSeen, installNudge, installNudgesFor,
 };

package/modules/provisioning/routes/provisioning.js

@@ -621,12 +621,15 @@ module.exports = function provisioningRoutes() {
   router.get('/provisioning/instances', auth.requireBuilder, async (req, res) => {
     try {
       const rows = await provisioning.listInstancesForOwner(pool, req.builder.id);
+      // the standing 'Install the GitHub App' nudge (task 1004763): two reads for the whole list
+      const nudges = await githubSetup.installNudgesFor(pool, rows);
       const instances = [];
       for (const row of rows) {
         const open = await provisioning.getOpenIntent(pool, row.id);
         instances.push({
           ...ownerInstance(row),
           open_intent: open ? { action: open.action, state: open.state } : null,
+          github_install: nudges.get(String(row.id)) || null,
         });
       }
       res.json({ instances });
@@ -660,13 +663,15 @@ module.exports = function provisioningRoutes() {
       // The GitHub-App leg's truth rides the same read (task 1003235), so the done
       // panel recovers it from server state after a reload — not from sessionStorage.
       const manifest = await provisioning.getLatestOAuthManifestForInstance(pool, id);
+      const githubSetupNow = await githubSetup.githubSetupRead(pool, inst, manifest, manifest ? provisioning.publicGithubApp(manifest).status : null, { withState: false });
       res.json({
-        instance: ownerInstance(inst),
+        // the standing install nudge rides the instance, as on the list read (task 1004763)
+        instance: { ...ownerInstance(inst), github_install: githubSetup.installNudge(githubSetupNow) },
         open_intent: open ? { action: open.action, state: open.state } : null,
         github_app: provisioning.publicGithubApp(manifest),
         // the four-step checklist from what the runner verified (task 1004649) — the
         // install link rides WITHOUT the state token this read never carries
-        github_setup: await githubSetup.githubSetupRead(pool, inst, manifest, manifest ? provisioning.publicGithubApp(manifest).status : null, { withState: false }),
+        github_setup: githubSetupNow,
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);

package/modules/public-landing/public/projects.html

@@ -1140,6 +1140,7 @@ summary{min-height:24px;padding:3px 0;}
              stripFor/errMarkup/canRetry/canRevive the list row reads -->
         <div id="mStrip"></div>
         <div class="projMsg err" id="mErr" hidden></div>
+        <div class="projMsg" id="mGh" hidden></div>
         <div class="projMsg" id="mMsg" role="status" aria-live="polite"></div>
         <div class="actions" id="mActs" hidden></div>
       </div>
@@ -8357,6 +8358,8 @@ summary{min-height:24px;padding:3px 0;}
        (renderCard) — a project the owner is being told about cannot sit under
        Live. The intent-vs-status contract is deliberately left alone. */
     if (inst.error_note && !inst.open_intent) return 'attention';
+    /* an app nobody installed blocks every ship until the owner acts (task 1004763) */
+    if (ghInstallRow(inst)) return 'attention';
     return STATE_GROUP[inst.status] || 'all';
   }
   function findText(inst) {
@@ -8828,6 +8831,21 @@ summary{min-height:24px;padding:3px 0;}
       '">Say what it is</a> and it goes on.';
   }
 
+  /* the standing GitHub install nudge (task 1004763). A project whose app was made but never
+     installed on its repo cannot have finished work added: the platform cannot read the
+     repo, so every ship stops short. The wizard's checklist shows only while a project is
+     being made, so the card and the project's own page say it, with GitHub's own install
+     link, until the runner has seen the install. The click also asks for a fresh look
+     (the a[data-gh-install] handler below). '' when there is nothing to install. */
+  function ghInstallRow(inst) {
+    var g = inst && inst.github_install;
+    if (!g || !/^https:\/\/github\.com\/apps\//.test(String(g.install_url || ''))) return '';
+    if (inst.status === 'torn_down' || inst.status === 'tearing_down') return '';
+    return 'Finished work can’t be added to ' + (g.repo ? '<code>' + esc(g.repo) + '</code>' : 'its repo') +
+      ' until the GitHub App is installed on it. <a class="btn small" href="' + esc(g.install_url) +
+      '" target="_blank" rel="noopener" data-gh-install="' + esc(String(inst.id)) + '">Install the GitHub App ↗</a>';
+  }
+
   function renderCard(inst) {
     /* iid is for MARKUP interpolation only (esc() = HTML escape); the DOM
        lookup goes through liFor(), which CSS-escapes — the two escapes are
@@ -8851,6 +8869,8 @@ summary{min-height:24px;padding:3px 0;}
     if (addr) body += '<div class="addr">' + addr + '</div>';
     var pub = publishRow(inst);
     if (pub) body += '<div class="projMsg">' + pub + '</div>';
+    var gh = ghInstallRow(inst);
+    if (gh) body += '<div class="projMsg">' + gh + '</div>';
     if ((inst.status === 'error' || inst.error_note) && !inst.open_intent) {
       /* once a retry is queued the strip tells the story — the stale error
          paragraph would just contradict it (owner walk, 2026-08-12). Also
@@ -9198,6 +9218,9 @@ summary{min-height:24px;padding:3px 0;}
     var snag = (inst.status === 'error' || inst.error_note) && !inst.open_intent;
     $('mErr').innerHTML = snag ? errMarkup(inst) : '';
     $('mErr').hidden = !snag;
+    var gh = ghInstallRow(inst);
+    $('mGh').innerHTML = gh;
+    $('mGh').hidden = !gh;
     var acts = [];
     if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-m-retry>Try again</button>');
@@ -11231,6 +11254,16 @@ summary{min-height:24px;padding:3px 0;}
     return e.message || 'The restart could not be queued — try again in a moment.';
   }
 
+  /* the install nudge's click (task 1004763), on the card and the project's own page alike:
+     GitHub opens in its own tab as the link says, and the platform is asked to look again.
+     GitHub's hand-back from this link carries no attempt, so without the ask nothing would
+     re-check and the nudge would never clear. Best-effort: a refused ask changes nothing. */
+  document.addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('a[data-gh-install]');
+    if (!a) return;
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(a.getAttribute('data-gh-install')) + '/github-app/pick-up', { method: 'POST', credentials: 'same-origin' }).catch(function () {});
+  });
+
   /* the list's one delegated handler. A row holds no sender since task 1003355
      — only its two doors — so the Manage link is all there is to upgrade: it is
      a real anchor, a modified click keeps its browser meaning and a plain one

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.152",
+  "version": "1.21.154",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.152",
+      "version": "1.21.154",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.152",
+  "version": "1.21.154",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9926,5 +9926,25 @@
       "id": "1003784",
       "text": "Every module now says which of the eight categories it belongs to, and the module list in the terminal and the hall's Modules tab both show it and let you search by it."
     }
+  ],
+  "1.21.153": [
+    {
+      "id": "1004763",
+      "text": "Project owners whose GitHub App was never installed now see an \"Install the GitHub App\" button on their project until GitHub confirms it."
+    },
+    {
+      "id": "1003799",
+      "text": "Two store modules with the same score no longer look identical: each now shows what it is strong at and weak at (tests, installs, reliability, testers, how-to), in the store listing and in the hall's Modules tab."
+    },
+    {
+      "id": "1004766",
+      "text": "When a project's server can't talk to GitHub, the land-status check now says which step failed and what GitHub answered, instead of a bare error."
+    }
+  ],
+  "1.21.154": [
+    {
+      "id": "1003800",
+      "text": "In the module store, a buyer can now sort by the score that matters to them, like reliability or tests, so the module strongest at that comes first."
+    }
   ]
 }

package/src/bongos/module-listing.js

@@ -35,6 +35,97 @@ function placeVersion(score, floor = QUALITY_FLOOR) {
   return { placement: 'listed', reason: 'at_or_above_floor' };
 }
 
+// ---------------------------------------------------------------------------
+// Strengths and weaknesses (task 1003799, ADR 0343 D4)
+// ---------------------------------------------------------------------------
+//
+// The overall number sorts the listing; the parts explain it. Two modules that both
+// score 74 can be good at different things, and a buyer who cares about reliability
+// should be able to see which one is. So each listed entry carries its parts and a
+// short reading of them:
+//
+//   strength    a part scored at or above STRONG_AT
+//   weakness    a part scored below the floor — the same bar the listing uses
+//   unmeasured  a part with no score yet (no installs, no testers, still running).
+//               Never a weakness: a missing part is never a zero (D3/D5).
+//
+// Security is not on the list: it is a pass/fail gate (D2), and every listed
+// version has passed it. The thresholds are fixed numbers on purpose, so an author
+// can check why a part reads as strong or weak, the same way the floor works.
+const STRONG_AT = 80;
+
+// The parts a buyer compares, in the order they are shown, with what their
+// sample size counts. `docs` is shown but never averaged (ADR 0347).
+const PARTS = [
+  { part: 'tests', title: 'Tests', counts: 'test cases' },
+  { part: 'install', title: 'Clean installs', counts: 'installs' },
+  { part: 'reliability', title: 'Reliability', counts: 'installs' },
+  { part: 'tester_feedback', title: 'Tester feedback', counts: 'testers' },
+  { part: 'docs', title: 'How-to', counts: null },
+];
+
+// One reading of one version's current part results. `signals` is the newest
+// module_assessment_signals row per part ({ part, outcome, score, sample_size });
+// a part with no row is unmeasured. Pure.
+function readParts(signals = [], { floor = QUALITY_FLOOR } = {}) {
+  const byPart = new Map(signals.map((s) => [s.part, s]));
+  const parts = {};
+  const strengths = [];
+  const weaknesses = [];
+  const unmeasured = [];
+  for (const { part, title, counts } of PARTS) {
+    const s = byPart.get(part);
+    const scored = s && s.outcome === 'scored' && Number.isFinite(Number(s.score));
+    parts[part] = s
+      ? { outcome: s.outcome, score: scored ? Number(s.score) : null, sample_size: s.sample_size == null ? null : Number(s.sample_size) }
+      : { outcome: 'no_data', score: null, sample_size: null };
+    if (!scored) { unmeasured.push({ part, title }); continue; }
+    const score = Number(s.score);
+    const n = parts[part].sample_size;
+    const from = counts && n ? `, from ${n} ${n === 1 ? counts.replace(/s$/, '') : counts}` : '';
+    const item = { part, title, score, detail: `${title} scored ${score} out of 100${from}.` };
+    if (score >= STRONG_AT) strengths.push(item);
+    else if (score < floor) weaknesses.push(item);
+  }
+  strengths.sort((a, b) => b.score - a.score);
+  weaknesses.sort((a, b) => a.score - b.score);
+  return { parts, strengths, weaknesses, unmeasured };
+}
+
+// ---------------------------------------------------------------------------
+// Sort by the part a buyer cares about (task 1003800, owner decision 2026-10-22)
+// ---------------------------------------------------------------------------
+//
+// A module strong at what a buyer needs should come first for THAT buyer. Nothing
+// records what a category is "for", and a hidden per-category weighting would break
+// the score an author can check (ADR 0343 D3), so the owner chose: the buyer picks
+// the part. The rule, in a sentence an author can check:
+//
+//   modules with a score for the part come first, highest first; a tie goes to the
+//   higher overall score, then the key. A module with no score for the part goes
+//   last, in key order: a missing part is never a zero, and never a first place.
+//
+// Only `listed` is sorted. A "New" version is never ranked (owner decision,
+// 2026-10-01), so `new` keeps key order whatever the buyer picks. Today this runs
+// over the whole store; once approved sub-categories exist (task 1004355) the same
+// rule orders each one (ADR 0342 D2).
+const SORT_PARTS = PARTS.map(({ part, title }) => ({ part, title }));
+
+// `entries` carry `parts` as readParts builds them. Returns a new array. Pure.
+function sortByPart(entries, part) {
+  const scoreOf = (e) => (e.parts && e.parts[part] ? e.parts[part].score : null);
+  return [...entries].sort((a, b) => {
+    const sa = scoreOf(a);
+    const sb = scoreOf(b);
+    if (sa == null || sb == null) {
+      if (sa != null) return -1;
+      if (sb != null) return 1;
+      return a.key.localeCompare(b.key);
+    }
+    return (sb - sa) || ((b.overall ?? -1) - (a.overall ?? -1)) || a.key.localeCompare(b.key);
+  });
+}
+
 // The newest version row per module key, in semver order (a version that does not
 // parse is skipped, as latestVersions does in module-store.js).
 function newestPerModule(rows) {
@@ -49,11 +140,13 @@ function newestPerModule(rows) {
   return [...out.values()];
 }
 
-// The catalog: { floor, listed: [...], new: [...] }, each entry
-// { key, title, version, published_at, overall, is_new }. Excluded versions are left
+// The catalog: { floor, sort, sort_parts, listed: [...], new: [...] }, each entry
+// { key, title, version, published_at, overall, is_new, parts, strengths, weaknesses,
+// unmeasured } (the last four from readParts). Excluded versions are left
 // out entirely: a module below the bar is not listed at all. Both lists are in key
-// order; ranking is a separate task (1003808) and does not happen here.
-async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
+// order unless `sort` names a part, which orders `listed` by sortByPart; ranking
+// is a separate task (1003808) and does not happen here.
+async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
   const pool = db || require('./pool').pool;
   const { rows: versions } = await pool.query(
     `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
@@ -69,7 +162,22 @@ async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
         ORDER BY version_id, computed_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
     for (const s of rows) scores.set(String(s.version_id), s);
   }
-  const out = { floor, listed: [], new: [] };
+  // Each version's current result per part: the newest row per (version, part),
+  // the read idx_module_assessment_signals_current exists for (core_265).
+  const signals = new Map();
+  if (newest.length) {
+    const { rows } = await pool.query(
+      `SELECT DISTINCT ON (version_id, part) version_id, part, outcome, score, sample_size
+         FROM module_assessment_signals
+        WHERE version_id = ANY($1)
+        ORDER BY version_id, part, measured_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
+    for (const s of rows) {
+      const k = String(s.version_id);
+      if (!signals.has(k)) signals.set(k, []);
+      signals.get(k).push(s);
+    }
+  }
+  const out = { floor, sort: sort || null, sort_parts: SORT_PARTS, listed: [], new: [] };
   for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
@@ -77,9 +185,11 @@ async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
     out[placement].push({
       key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
       overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
+      ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });
   }
+  if (sort) out.listed = sortByPart(out.listed, sort);
   return out;
 }
 
-module.exports = { QUALITY_FLOOR, placeVersion, listCatalog };
+module.exports = { QUALITY_FLOOR, STRONG_AT, SORT_PARTS, placeVersion, readParts, sortByPart, listCatalog };