@bongos/core 1.21.73 → 1.21.75

package/docs/modules-contract.md

@@ -362,6 +362,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - The publish denylist applies (ADR 0098), plus a refusal of credential-named files (`.env*`, `*.pem`, `*.key`, `id_rsa`, …) anywhere in the module. The store re-checks every hash and the denylist itself.
 - Gate: Metic+ (`module.submit`) for now. This is not `bongos module submit`, which proposes a module *into* core.
 - **A how-to is required** ([ADR 0347](adr/0347-every-store-module-ships-a-how-to.md)). `modules/<key>/HOWTO.md` is what a buyer reads — the store shows it as the module's page — so it is written for the person who installs the module, not for an AI working inside it (that is `CLAUDE.md`). It is plain Markdown: any AI or person can write it. Publish refuses the version unless it has these five level-2 headings, in any order and any case, each with some text under it: `## What it does`, `## Install and enable`, `## How to use it` (with one worked example), `## Configuration` ("None." is fine) and `## Limits and known issues` ("None known." is fine). HTML comments don't count as text, so the scaffold's prompts must be replaced. The refusal names each failing section. The check is one function, `checkHowto` in `scripts/gds/module-artifact.js`; the CLI runs it before uploading and the store runs it again on upload, so a hand-built upload can't skip it. `bongos module check` reports it as advice only — an upstream submit is not gated by it. Install and update don't re-check it, so a version published before the gate still installs. The file travels in the tarball, so its hash pins it to the version. An optional `howto.artifactUrl` in `module.json` (an `https://` link on `claude.ai`) is shown as an extra, never graded.
+- **Getting listed** (task 1003807, [ADR 0343](adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md)). Publishing a version does not by itself put it in the store's catalog, `GET /store/modules`. The catalog shows each module's newest version, judged by its current score. It must pass the Security gate first; a version that failed it, or has not been checked yet, is not listed. A new version with no install or reliability data yet is listed with a **New** label and is not ranked; the floor does not apply to it until it has a real score. Every other version is listed only if its overall score is **at least 50 out of 100**. Below that it is not listed at all. The floor is fixed in Bongos itself (`QUALITY_FLOOR` in `src/bongos/module-listing.js`) and returned in the catalog response; no author or instance setting moves it, and changing it is an owner-approved, reviewed task.
 
 ### 7. Install from the store
 

package/docs/page-readings.json

@@ -503,7 +503,7 @@
       "surface": "builders",
       "title": "Deploy",
       "states_read": ["work","out"],
-      "files_hash": "9d04d1e917f1926c",
+      "files_hash": "535c116eea07d320",
       "reading_hash": "b9fc5f83cc76b257",
       "counts": {"lines":21,"placed":5,"shared":9,"unplaced":7},
       "omitted": {"data":1},
@@ -1035,7 +1035,7 @@
       "surface": "builders",
       "title": "Fleet costs",
       "states_read": ["ledger","out"],
-      "files_hash": "d817fbfbc40b315b",
+      "files_hash": "153446369d287bc8",
       "reading_hash": "db04003c871f8317",
       "counts": {"lines":36,"placed":11,"shared":9,"unplaced":16},
       "omitted": {"data":11},
@@ -2586,8 +2586,8 @@
       "surface": "builders",
       "title": "Project settings",
       "states_read": ["default"],
-      "files_hash": "8ca315d376593099",
-      "reading_hash": "f6e04628d8e99880",
+      "files_hash": "525a8712c618456d",
+      "reading_hash": "8bbf4ff80ec8097c",
       "counts": {"lines":31,"placed":17,"shared":9,"unplaced":5},
       "omitted": {"data":1},
       "notes": [],
@@ -2601,13 +2601,13 @@
         {"key":"L0007","section":"top bar","text":"Ideating","placement":"shared"},
         {"key":"L0008","section":"top bar","text":"Governing","placement":"shared"},
         {"key":"L0009","section":"Project settings","text":"Project settings","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":15,"string_id":"e08628967f2f"},
-        {"key":"L0010","section":"Project settings","text":"Could not load","placement":"placed","file":"modules/hall-ui/public/project-settings.js","line":242,"string_id":"90691bceaf68"},
+        {"key":"L0010","section":"Project settings","text":"Could not load","placement":"placed","file":"modules/hall-ui/public/project-settings.js","line":284,"string_id":"90691bceaf68"},
         {"key":"L0011","section":"The fundamentals","text":"The fundamentals","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":40,"string_id":"cb7c7879eeba"},
-        {"key":"L0012","section":"The fundamentals","text":"Five things every project settles. Two of them are knobs you can turn here; the other three are decided in committed configuration, and each says which file decides it.","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":41,"string_id":"c6c9d3129ab2"},
+        {"key":"L0012","section":"The fundamentals","text":"Six things every project settles. Three of them are knobs you can turn here; the other three are decided in committed configuration, and each says which file decides it.","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":41,"string_id":"ce994c34804e"},
         {"key":"L0013","section":"The fundamentals","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5"},
         {"key":"L0014","section":"Danger zone","text":"Danger zone","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":57,"string_id":"13b22e48d9fb"},
-        {"key":"L0015","section":"Danger zone","text":"This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this project’s page there.","placement":"placed","file":"modules/hall-ui/public/project-settings.js","line":259,"string_id":"e97b2d549f10"},
-        {"key":"L0016","section":"Danger zone","text":"Manage this project on {…}","placement":"placed","file":"modules/hall-ui/public/project-settings.js","line":260,"string_id":"4e261fd15bd5"},
+        {"key":"L0015","section":"Danger zone","text":"This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this project’s page there.","placement":"placed","file":"modules/hall-ui/public/project-settings.js","line":301,"string_id":"e97b2d549f10"},
+        {"key":"L0016","section":"Danger zone","text":"Manage this project on {…}","placement":"placed","file":"modules/hall-ui/public/project-settings.js","line":302,"string_id":"4e261fd15bd5"},
         {"key":"L0017","section":"Danger zone","text":"Take it offline","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":60,"string_id":"da9da6e866bd"},
         {"key":"L0018","section":"Danger zone","text":"— stops the project and its nightly backups but keeps everything: its database, its backups and your repository on GitHub. You can bring it back.","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":60,"string_id":"61ebc5d684fd"},
         {"key":"L0019","section":"Danger zone","text":"Disconnect from Bongos entirely","placement":"placed","file":"modules/hall-ui/public/project-settings.html","line":61,"string_id":"d3efd513694b"},

package/modules/hall-ui/public/project-settings.css

@@ -219,3 +219,18 @@
    one sentence saying what it does. Plain list, the lede's measure. */
 .ps-danger__list { margin: 10px 0 0; padding-left: 18px; line-height: 1.6; max-width: var(--measure); }
 .ps-danger__list li + li { margin-top: 8px; }
+
+/* Ship mode (task 1004628): two radio choices, each a full-width row whose whole
+   line is the hit target, so the 24px floor holds on a phone without a bigger dot. */
+.ps-ship { margin: 10px 0 0; padding: 0; border: 0; }
+.ps-ship__legend { padding: 0; font-size: 12px; color: var(--ink-soft); }
+.ps-ship__choice {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  min-height: 24px;
+  padding: 6px 0;
+  line-height: 1.5;
+  cursor: pointer;
+}
+.ps-ship__choice input { margin-top: 4px; flex: 0 0 auto; }

package/modules/hall-ui/public/project-settings.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Project settings — {{worldName}}</title>
-  <meta name="description" content="The fundamentals of this project in one place — the stale timer, the category set, how credits are calculated, whether equity is real, and what share of upmarket revenue is paid on credits.">
+  <meta name="description" content="The fundamentals of this project in one place — how tasks ship, the stale timer, the category set, how credits are calculated, whether equity is real, and what share of upmarket revenue is paid on credits.">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -39,11 +39,11 @@
         <section class="scroll" id="ps-body" aria-labelledby="ps-body-h" hidden>
           <h2 class="scroll__h" id="ps-body-h">The fundamentals</h2>
           <p class="scroll__lede">
-            Five things every project settles. Two of them are knobs you can turn here;
+            Six things every project settles. Three of them are knobs you can turn here;
             the other three are decided in committed configuration, and each says which
             file decides it.
           </p>
-          <!-- One mount, five rows, written by project-settings.js. The rows are NOT
+          <!-- One mount, six rows, written by project-settings.js. The rows are NOT
                authored in this file: each carries a value plus the provenance the
                server resolved it through, and markup that could drift from that is the
                thing this page exists to end. -->
@@ -77,6 +77,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/project-settings.js?v=2026-09-04-ps1"></script>
+<script src="/builders/project-settings.js?v=2026-10-08-ship-mode"></script>
 </body>
 </html>

package/modules/hall-ui/public/project-settings.js

@@ -122,6 +122,30 @@
       ${sib}`;
   }
 
+  // Ship mode (task 1004628): two choices, each with the sentence the SERVER wrote,
+  // so the page never re-types what Auto or Manual means.
+  function shipBodyHtml(row) {
+    const v = row.value || {};
+    const choices = Array.isArray(row.choices) ? row.choices : [];
+    const invalid = row.invalid
+      ? `<p class="ps-invalid">A configured value could not be used: <code>${escapeHtml(String(row.invalid.raw))}</code>
+           — ${escapeHtml(String(row.invalid.reason))}. The mode above is the fallback that is actually in force.</p>`
+      : '';
+    return `
+      ${invalid}
+      <fieldset class="ps-ship">
+        <legend class="ps-ship__legend">How tasks ship</legend>
+        ${choices.map((c) => `
+          <label class="ps-ship__choice">
+            <input type="radio" name="ps-ship-mode" value="${escapeHtml(String(c.mode))}" ${c.mode === v.mode ? 'checked' : ''}>
+            <span><strong>${escapeHtml(String(c.label))}</strong> — ${escapeHtml(String(c.sentence))}</span>
+          </label>`).join('')}
+      </fieldset>
+      <div class="ps-controls">
+        <button type="button" class="btn" id="ps-ship-save">Save</button>
+      </div>`;
+  }
+
   function catsBodyHtml(row) {
     const v = row.value || {};
     const cats = Array.isArray(v.categories) ? v.categories : [];
@@ -150,6 +174,7 @@
   function render() {
     const mount = $('ps-rows');
     mount.innerHTML = `<ul class="ov-rows">${rows.map((row) => {
+      if (row.key === 'ship_mode' && row.editable) return rowHtml(row, shipBodyHtml(row));
       if (row.key === 'rot_timer' && row.editable) return rowHtml(row, rotBodyHtml(row));
       if (row.key === 'work_categories' && row.editable) return rowHtml(row, catsBodyHtml(row));
       return rowHtml(row, '');
@@ -166,6 +191,23 @@
   }
 
   function wire() {
+    const shipSave = $('ps-ship-save');
+    if (shipSave) {
+      shipSave.addEventListener('click', async () => {
+        const picked = document.querySelector('input[name="ps-ship-mode"]:checked');
+        if (!picked) { toast('Pick Auto or Manual.'); return; }
+        setBusy(true);
+        try {
+          const out = await sendJson('PATCH', '/project-settings/ship-mode', { mode: picked.value });
+          toast(out.mode === 'manual' ? 'Ship mode is now Manual.' : 'Ship mode is now Auto.');
+          await load();
+        } catch (err) {
+          toast(err.message || 'Could not save the ship mode.');
+          setBusy(false);
+        }
+      });
+    }
+
     const rotSave = $('ps-rot-save');
     if (rotSave) {
       rotSave.addEventListener('click', async () => {

package/modules/lifecycle/routes/project-settings.js

@@ -34,6 +34,29 @@ const goalCategory = require('../goal-category');
 
 const log = api.logger('lifecycle');
 
+// --- ship mode: who starts a ship (task 1004628, ADR 0369) -------------------
+//
+// One row shape, two readers: the settings page (inside GET /project-settings) and
+// any builder's CLI or AI session (GET /project-settings/ship-mode), so the sentence
+// a person reads and the one an agent obeys are the same words.
+function shipModeRow(resolved) {
+  return {
+    key: 'ship_mode',
+    title: 'Ship mode',
+    editable: true,
+    state: 'live',
+    value: { mode: resolved.mode, chosen: resolved.chosen, modes: api.projectSettings.SHIP_MODES },
+    sentence: api.projectSettings.describeShipMode(resolved),
+    choices: [
+      { mode: 'auto', label: 'Auto (recommended)', sentence: 'When the AI finishes a task it ships and lands it. Nobody has to type a command.' },
+      { mode: 'manual', label: 'Manual', sentence: 'The AI stops before each ship and asks a person to approve it.' },
+    ],
+    source: resolved.source,
+    invalid: resolved.invalid,
+    reads: { file: 'project_settings[\'ship.mode\'] (migration core_231)', adr: 'ADR 0369' },
+  };
+}
+
 // --- the three rows that are READ, never written -----------------------------
 //
 // Each names the committed artefact it resolves from, because "you cannot edit this"
@@ -214,12 +237,14 @@ module.exports = function buildProjectSettingsRouter() {
       // Inactive included: the set's SHAPE is what this page edits, and a deactivated
       // category the owner cannot see is one they cannot bring back.
       const categories = await goalCategory.listCategories({ includeInactive: true });
+      const shipMode = await api.projectSettings.resolveShipMode();
 
       // A settings read is a configuration comparison — a cached one is wrong the
       // moment somebody turns a knob (the rot.js precedent).
       res.set('Cache-Control', 'no-store');
       res.json({
         rows: [
+          shipModeRow(shipMode),
           {
             key: 'rot_timer',
             title: 'Stale timer',
@@ -316,7 +341,47 @@ module.exports = function buildProjectSettingsRouter() {
       }
     });
 
+  // GET /project-settings/ship-mode — the ship mode alone, for the CLI and the AI.
+  //
+  // rank: any signed-in builder. Unlike the full settings read this carries no
+  // reward internals or file paths an agent could not already read, and every
+  // builder's AI session must know whether to ship on its own or stop and ask —
+  // gating it Metic+ would leave a newcomer's session guessing.
+  router.get('/project-settings/ship-mode', api.requireBuilder, async (req, res) => {
+    try {
+      const resolved = await api.projectSettings.resolveShipMode();
+      res.set('Cache-Control', 'no-store');
+      const row = shipModeRow(resolved);
+      res.json({ mode: resolved.mode, chosen: resolved.chosen, source: resolved.source, sentence: row.sentence, choices: row.choices });
+    } catch (err) {
+      log.error(`GET /project-settings/ship-mode: ${err && err.message}`);
+      res.fail('project_settings_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // PATCH /project-settings/ship-mode — body { mode: 'auto' | 'manual' }.
+  //
+  // rank: project.settings.manage (metic+, government_010) — the same atom as the
+  // other writes on this page. Validated with the resolver's own parser, so the
+  // page, the CLI and the reader can never disagree about what a mode is.
+  router.patch('/project-settings/ship-mode', api.requireBuilder, api.requirePermission('project.settings.manage'), async (req, res) => {
+    if (api.validateOrRespond(req, res, { mode: { required: true, type: 'string' } })) return;
+    const parsed = api.projectSettings.parseShipMode(req.body.mode);
+    if (!parsed.mode) {
+      return res.fail('bad_ship_mode', { status: 400, message: `mode: ${parsed.reason}` });
+    }
+    try {
+      await api.projectSettings.set(api.projectSettings.KEYS.SHIP_MODE, parsed.mode, req.builder.id);
+      const resolved = await api.projectSettings.resolveShipMode();
+      res.json({ ok: true, mode: resolved.mode, chosen: resolved.chosen, source: resolved.source, sentence: api.projectSettings.describeShipMode(resolved) });
+    } catch (err) {
+      log.error(`PATCH /project-settings/ship-mode: ${err && err.message}`);
+      res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };
 
 module.exports.settingsDeskRows = settingsDeskRows;
+module.exports.shipModeRow = shipModeRow;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.73",
+  "version": "1.21.75",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.73",
+      "version": "1.21.75",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.73",
+  "version": "1.21.75",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9248,5 +9248,17 @@
       "id": "1004625",
       "text": "The governor city now has its own tab, and in Governing mode it leads the sidebar with every other governing page tucked into one dropdown under it."
     }
+  ],
+  "1.21.74": [
+    {
+      "id": "1004628",
+      "text": "Projects now have a Ship mode setting. Auto, the default, means the AI ships finished work on its own. Manual means it asks first. Owners can switch it on the project settings page."
+    }
+  ],
+  "1.21.75": [
+    {
+      "id": "1003807",
+      "text": "The module store now only shows modules that are safe and good enough: each must pass the security check, and once it has real-world data it needs a score of at least 50 out of 100. Brand-new modules show with a 'New' label un"
+    }
   ]
 }

package/scripts/gds/shipping-mode.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// scripts/gds/shipping-mode.js — read or set the project's ship mode (task 1004628, ADR 0369).
+//
+// WHY. Ship mode says WHO starts a ship: in `auto` the AI finishes a task and ships
+// it with no commands from the person; in `manual` it stops and asks first. An AI
+// session has to know which before it ships, and a person has to be able to change
+// it without opening the settings page — so the mode is one command away.
+//
+// Usage:
+//   node scripts/gds/shipping-mode.js                 print the mode (any builder)
+//   node scripts/gds/shipping-mode.js auto|manual     set it (needs project.settings.manage)
+//   node scripts/gds/shipping-mode.js --json          print the mode as JSON
+//
+// Also `bongos ship-mode [auto|manual]`.
+
+'use strict';
+
+const { apiCall, requireSession, errCode, cliExit } = require('./cli-lib');
+
+const USAGE = 'usage: node scripts/gds/shipping-mode.js [auto|manual] [--json]';
+
+// What a person sees. One sentence from the server, plus how to change it.
+function describe(data) {
+  const lines = [`Ship mode: ${data.mode}${data.chosen ? '' : ' (default — not chosen yet)'}`];
+  if (data.sentence) lines.push(data.sentence);
+  lines.push(data.mode === 'manual'
+    ? 'Change it: node scripts/gds/shipping-mode.js auto'
+    : 'Change it: node scripts/gds/shipping-mode.js manual');
+  return lines.join('\n');
+}
+
+async function main(argv) {
+  const args = argv.filter((a) => a !== '--json');
+  const json = argv.includes('--json');
+  if (args.includes('--help') || args.includes('-h')) { console.log(USAGE); return 0; }
+  if (args.length > 1) { console.error(USAGE); return 2; }
+
+  await requireSession();
+
+  if (args.length === 0) {
+    const r = await apiCall('GET', '/api/bongos/project-settings/ship-mode');
+    if (!r.ok) {
+      console.error(`Could not read the ship mode (${r.status}${errCode(r.data) ? `: ${errCode(r.data)}` : ''}).`);
+      return 1;
+    }
+    console.log(json ? JSON.stringify(r.data) : describe(r.data));
+    return 0;
+  }
+
+  const mode = String(args[0]).trim().toLowerCase();
+  if (mode !== 'auto' && mode !== 'manual') { console.error(USAGE); return 2; }
+  const r = await apiCall('PATCH', '/api/bongos/project-settings/ship-mode', { mode });
+  if (!r.ok) {
+    if (r.status === 403) {
+      console.error('Only the project owner (or someone with project settings access) can change the ship mode.');
+    } else {
+      console.error(`Could not set the ship mode (${r.status}${errCode(r.data) ? `: ${errCode(r.data)}` : ''}).`);
+    }
+    return 1;
+  }
+  console.log(json ? JSON.stringify(r.data) : `Saved. ${describe(r.data)}`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2))
+    .then((code) => cliExit(code))
+    .catch((err) => { console.error('fatal:', err && err.message ? err.message : err); cliExit(1); });
+}
+
+module.exports = { describe, main };

package/src/bongos/module-listing.js

@@ -0,0 +1,85 @@
+// src/bongos/module-listing.js — which store modules the catalog lists, under the
+// quality floor (task 1003807, criterion wa5-curated-listing, ADR 0343 D2/D5).
+//
+// One module appears once, as its NEWEST published version (semver order), judged by
+// that version's CURRENT score: the newest module_assessment_scores row for it
+// (computed_at DESC, id DESC), whether computed or a Metic+ override (core_265).
+// placeVersion is the whole rule and is pure, so tests drive it directly:
+//
+//   excluded  the Security gate has not passed (false, or not run yet), or the
+//             version has no score row at all. The gate is a hard exclusion (D2).
+//   new       passed the gate but has no real-world data yet (is_new, D5). Listed
+//             with a "New" label and never ranked: the floor does not apply until
+//             it has a real score (owner decision, 2026-10-01).
+//   listed    passed the gate and its overall score is at least the floor.
+//   excluded  otherwise: scored below the floor, or no overall to compare.
+//
+// A delisted module (ADR 0338 D2) is never in the catalog, whatever its score.
+
+const { parseVersion, cmp } = require('../module-loader/semver');
+
+// The quality floor, 0-100. It lives here and nowhere else: it is part of Bongos
+// itself, not a live setting, so no author, builder or instance can move it.
+// Changing it is an owner-approved, reviewed task (owner decision, 2026-10-01).
+// Authors read the rule in docs/modules-contract.md ("Getting listed").
+const QUALITY_FLOOR = 50;
+
+// Where one version stands. `score` is its current score row, or null.
+// Returns { placement: 'listed' | 'new' | 'excluded', reason }.
+function placeVersion(score, floor = QUALITY_FLOOR) {
+  if (!score) return { placement: 'excluded', reason: 'not_assessed' };
+  if (score.security_passed !== true) return { placement: 'excluded', reason: 'security_not_passed' };
+  if (score.is_new) return { placement: 'new', reason: 'new' };
+  if (score.overall == null) return { placement: 'excluded', reason: 'no_score' };
+  if (score.overall < floor) return { placement: 'excluded', reason: 'below_floor' };
+  return { placement: 'listed', reason: 'at_or_above_floor' };
+}
+
+// The newest version row per module key, in semver order (a version that does not
+// parse is skipped, as latestVersions does in module-store.js).
+function newestPerModule(rows) {
+  const out = new Map();
+  for (const r of rows) {
+    const next = parseVersion(r.version);
+    if (!next) continue;
+    const have = out.get(r.module_key);
+    if (have && cmp(parseVersion(have.version), next) >= 0) continue;
+    out.set(r.module_key, r);
+  }
+  return [...out.values()];
+}
+
+// The catalog: { floor, listed: [...], new: [...] }, each entry
+// { key, title, version, published_at, overall, is_new }. Excluded versions are left
+// out entirely: a module below the bar is not listed at all. Both lists are in key
+// order; ranking is a separate task (1003808) and does not happen here.
+async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: versions } = await pool.query(
+    `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
+       FROM store_modules m JOIN store_module_versions v ON v.module_key = m.module_key
+      WHERE m.status = 'listed'`);
+  const newest = newestPerModule(versions);
+  const scores = new Map();
+  if (newest.length) {
+    const { rows } = await pool.query(
+      `SELECT DISTINCT ON (version_id) version_id, overall, security_passed, is_new
+         FROM module_assessment_scores
+        WHERE version_id = ANY($1)
+        ORDER BY version_id, computed_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
+    for (const s of rows) scores.set(String(s.version_id), s);
+  }
+  const out = { floor, listed: [], new: [] };
+  for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
+    const score = scores.get(String(r.version_id)) || null;
+    const { placement } = placeVersion(score, floor);
+    if (placement === 'excluded') continue;
+    out[placement].push({
+      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
+      overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
+    });
+  }
+  return out;
+}
+
+module.exports = { QUALITY_FLOOR, placeVersion, listCatalog };

package/src/bongos/project-settings.js

@@ -49,8 +49,20 @@ const { logger } = require('./logger');
 const SETTING_KEYS = {
   ROT_DAYS: 'attention.rot_days',
   FOCUS_VERSION: 'roadmap.focus_version',
+  SHIP_MODE: 'ship.mode',
 };
 
+// SHIP MODE (task 1004628, ADR 0369) — WHO starts a ship, never HOW it lands.
+//   auto   — the AI finishes a task, then ships and lands it with no commands from
+//            the person. The default, because a new owner who is handed terminal
+//            commands at every ship reads the project as broken (owner feedback,
+//            2026-10-08).
+//   manual — the AI stops before shipping and the person approves each ship.
+// It is NOT the deploy mode (config/deploy.json, ci|laptop): that one decides the
+// mechanics of landing once a ship starts, is committed config, and is unchanged.
+const SHIP_MODES = Object.freeze(['auto', 'manual']);
+const DEFAULT_SHIP_MODE = 'auto';
+
 // The last-resort rot timer, in days. 30 because that is the shortest window in
 // which "nobody has touched this" is evidence of rot rather than evidence of a
 // normal week — a fortnight would fire on every ordinary holiday, and a quarter is
@@ -202,6 +214,56 @@ async function setFocusVersionId(versionId, builderId = null) {
   return String(versionId);
 }
 
+// parseShipMode(raw) — one candidate as a ship mode, or why it is unusable. Pure,
+// never throws, case-insensitive and trimmed so a hand-typed "Manual " still reads.
+function parseShipMode(raw) {
+  if (raw == null || String(raw).trim() === '') return { reason: 'empty' };
+  const v = String(raw).trim().toLowerCase();
+  if (!SHIP_MODES.includes(v)) return { reason: `must be one of ${SHIP_MODES.join(' | ')}` };
+  return { mode: v };
+}
+
+// resolveShipMode() — the project's ship mode and where it came from.
+// Returns { mode, source, chosen, invalid }:
+//   mode    — always 'auto' or 'manual'
+//   source  — 'project_settings' | 'default'
+//   chosen  — true only when someone actually SET a usable value. "Never chosen" is
+//             a real answer the first-ship prompt (task 1004630) asks about, so it
+//             must not be confused with "chose the default".
+//   invalid — null, or { where, raw, reason } for a stored value that is unusable.
+// A database that cannot be read answers the default rather than failing a ship —
+// the same reporting posture as resolveRotDays.
+async function resolveShipMode() {
+  let row = null;
+  try {
+    row = await getSetting(SETTING_KEYS.SHIP_MODE);
+  } catch (err) {
+    logger.error(`project_settings read failed; falling back to the default ship mode: ${err && err.message}`);
+    return { mode: DEFAULT_SHIP_MODE, source: 'default', chosen: false, invalid: null };
+  }
+  if (row && row.value != null && row.value !== '') {
+    const got = parseShipMode(row.value);
+    if (got.mode) return { mode: got.mode, source: 'project_settings', chosen: true, invalid: null };
+    return {
+      mode: DEFAULT_SHIP_MODE,
+      source: 'default',
+      chosen: false,
+      invalid: { where: `project_settings['${SETTING_KEYS.SHIP_MODE}']`, raw: String(row.value), reason: got.reason },
+    };
+  }
+  return { mode: DEFAULT_SHIP_MODE, source: 'default', chosen: false, invalid: null };
+}
+
+// describeShipMode(resolved) — one plain sentence for a person or an AI session.
+function describeShipMode(resolved) {
+  const r = resolved || {};
+  const what = r.mode === 'manual'
+    ? 'Manual: the AI stops before each ship and waits for a person to approve it.'
+    : 'Auto: when the AI finishes a task it ships and lands it with no commands from a person.';
+  const how = r.chosen ? '' : ' (the default — nobody has chosen yet)';
+  return `${what}${how}`;
+}
+
 // parseDays is exported for the tests only — the range check and the default are
 // asserted against the SAME constants the resolver reads, because a test that
 // re-typed 30 or 365 would be the second copy of the number this file exists to
@@ -218,4 +280,9 @@ module.exports = {
   describeRotTimer,
   getFocusVersionId,
   setFocusVersionId,
+  SHIP_MODES,
+  DEFAULT_SHIP_MODE,
+  parseShipMode,
+  resolveShipMode,
+  describeShipMode,
 };

package/src/bongos/routes/modules.js

@@ -97,6 +97,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
+const { listCatalog } = require('../module-listing');
 
 // A packaged submission embeds every file's content (base64) — cap the total
 // so a runaway/misbuilt module can't bloat the review-queue table. Generous
@@ -692,6 +693,20 @@ module.exports = function buildModulesRouter() {
       res.json({ latest });
     }));
 
+  // The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each
+  // listed module's newest version, if it passed the Security gate and scores at or
+  // above the floor, or under "new" if it has no real-world data yet. Below the bar
+  // is not listed at all. The floor is fixed in module-listing.js and returned here.
+  //
+  // rank: any-builder — a read of public store metadata, like /store/modules/latest:
+  // no entitlement taken, nothing changed.
+  router.get('/store/modules', auth.requireBuilder,
+    asyncHandler('GET /store/modules', async (_req, res) => {
+      const listing = await listCatalog();
+      res.set('Cache-Control', 'no-store');
+      res.json(listing);
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.73'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.75'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -462,6 +462,12 @@ module.exports = {
     // page's own anti-drift rule forbids, caught one layer up on task 1003280's grade.
     get MIN_ROT_DAYS() { return require('./bongos/project-settings').MIN_ROT_DAYS; },
     get MAX_ROT_DAYS() { return require('./bongos/project-settings').MAX_ROT_DAYS; },
+    // Ship mode (task 1004628, ADR 0369): who starts a ship — the AI (auto) or a
+    // person (manual). The settings page writes it; the CLI and the AI read it.
+    get SHIP_MODES() { return require('./bongos/project-settings').SHIP_MODES; },
+    get parseShipMode() { return require('./bongos/project-settings').parseShipMode; },
+    get resolveShipMode() { return require('./bongos/project-settings').resolveShipMode; },
+    get describeShipMode() { return require('./bongos/project-settings').describeShipMode; },
   },
   readConfigFileSync: instanceConfig.readConfigFileSync,
   configHome: instanceConfig.configHome,