@bongos/core 1.21.74 → 1.21.75

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.74",
-  "core_contract": "1.21.74",
-  "source_commit": "e1a614cc89edf2e1f13bf098fe70e5d6909887f9",
+  "core_version": "1.21.75",
+  "core_contract": "1.21.75",
+  "source_commit": "fdb1b2948dda051d6bd0b5b5e79a1382a7e93f63",
   "source_ref": "HEAD",
-  "built_at": "2026-10-08T17:20:42.399Z",
+  "built_at": "2026-10-08T17:33:55.022Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 589,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2980,
+    "functional_verbatim": 2982,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3598,
-  "tree_sha256": "a36fc59cee5bf88f0f473a9967f3a2a30e9ab3d59e59ef3d5b91df49789fc855",
+  "file_count": 3600,
+  "tree_sha256": "9485028ef2ecfaf25ef937e1315cca15d5526ff1d11ed8a280e78a28177fd26e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -312,12 +312,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "92ec02892192cb3ec336b8feb68516981334c6c5e9951d6983855296b6d79dfc"
+      "sha256": "cdea685186e07a106fcd43e603d006648d5d681f68895989915f3a38a54f3073"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "16b666c57928d55b8c5b8b96f90e77e3d1702ea2b601d43a118853ae7d6f5f10"
+      "sha256": "d244bccc1ec1ced97ebdc3219dbe130d9a615d12be060e8479e46368a95862bc"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -327,17 +327,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "cac495a3acbe96e8036f79dd772cce00372bac4c3a162c7a050d572cabccb464"
+      "sha256": "17bbcc0e24a99a7e8e6cba5f04db7fc210baf2fc119863c51698f69fd04771c4"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4ecbd807e9ddbd35f4c076b6daa559fa4a6eeaab80e3f03065d61e4ca139f6dd"
+      "sha256": "88bcc5e74a08fb574b1f1a81d40355a69ffd8271a75e9fdd25038c60a67b6ff3"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "6217699f613e7839e12aee3465717863397243daf741c022d43a704993c9023d"
+      "sha256": "042c25ee1600192bdaa6c7c817ff94558a884a428a7ab5b06dbf2b665fc89101"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2172,7 +2172,7 @@
     {
       "path": "docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md",
       "mode": "0000644",
-      "sha256": "668d76cffbfaeb9662fc84b4d2c185bc7cd0109a403e6b9bf3032ebe3b569457"
+      "sha256": "db41e62093dd09e5ed3f9bb4628c98ea0255b487bb5b94191bbb4adc0651636b"
     },
     {
       "path": "docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md",
@@ -2312,12 +2312,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "7ee0c370728c049634024bb204f60667a3a975f7d42dc0a714d14a1feb24f7f5"
+      "sha256": "9d29a5b16d79cbf4da889fd3d58c7164a8f70f511fd9de75b94f321ce7e01f1c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "3e3bcaac1dbdd052ad5e7c44ec77bf057faf71c76202bb6d43bd7852b0b1999a"
+      "sha256": "2f5f417f06c5b9e99e02b830fe9309c55a901cff059be909a18078a4b3ad0dee"
     },
     {
       "path": "docs/architecture.md",
@@ -2857,12 +2857,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6028080759e4c92a71ed09f4bbe67d8bfae0152377c4f3a635d02841b29fa2c7"
+      "sha256": "244e5150f6cb37861f017cf08c10d4396d641be31e7c27836ff278045b8c7365"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "33eb2665aea5cc00feb1de80b673f6063f98b2a8bd2caeb6fa4b09e41965c1df"
+      "sha256": "55a964846d438df4265777244e046b5b86deaebda3a6081c6f10a4a5a7a0dbf3"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -10057,12 +10057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ebda74c3eebe46d4e8a441c4b63a195fc9d6aa911edfffdca7d9a5189ce29014"
+      "sha256": "b55138ff35c924085a5d9b12fa4651c403dea3a2f1c4d3ee9e2d1a5fcb931314"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5c6a09991c3531cf64543c466ed124dc5f19825906c42e176c00e5cdae44c0d5"
+      "sha256": "e99024f875cb0765bdf60139021c5bf984d616c954eec42444666a0b79395c94"
     },
     {
       "path": "public-docs/index.html",
@@ -10082,7 +10082,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "b64964b1e7abbaa7a3f508f4ae02c06928e4e59d61adf1c6402584a6e681e710"
+      "sha256": "c545e162df4719ea3f8712009774705b406674c314973d49487b2d31b71185dd"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12069,6 +12069,11 @@
       "mode": "0000644",
       "sha256": "917f364b804f25437dea7fe507abe50e9b64cac79b6cc29ac786de0e24350d33"
     },
+    {
+      "path": "src/bongos/module-listing.js",
+      "mode": "0000644",
+      "sha256": "15047b229ce7c3633d74597fb8f971db00fac2ddae5fb0038666fa0896b25574"
+    },
     {
       "path": "src/bongos/module-overrides.js",
       "mode": "0000644",
@@ -12237,7 +12242,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "fb935713e6d817c5b3ea16edd620ad50c7c0ff5992c4b70de5ccf14eac73192d"
+      "sha256": "6c20741df0b1395355abf58146ad6753197dcfde928e532b43f69ecf1ce7a325"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -12317,7 +12322,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f0769084872b98cacd871ea7e0b062dd1fcaad8c759e38acad6393f94084b418"
+      "sha256": "e2dc4fbb86019edff6c023c9b78afdd70fa04010249e28eee821da8383b2252e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15674,6 +15679,11 @@
       "mode": "0000644",
       "sha256": "43828c1a95652180d558e7676cc2053d0599a61c0edf4cd1ab100820fc7de493"
     },
+    {
+      "path": "tests/module_store_listing.mjs",
+      "mode": "0000644",
+      "sha256": "289478dfc8666527e919a28db3127807aefe87c19849001f133780bb8a8ac816"
+    },
     {
       "path": "tests/module_store_publish.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 525 operations across 75 resource groups
+- 526 operations across 75 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1149,6 +1149,8 @@ function createClient(opts = {}) {
     "store": {
       // GET /store/entitlements — rank: any-builder — GET /store/entitlements
       getStoreEntitlements: (args) => request("GET", "/store/entitlements", { hasBody: false }, args),
+      // GET /store/modules — rank: any-builder — GET /store/modules
+      getStoreModules: (args) => request("GET", "/store/modules", { hasBody: false }, args),
       // POST /store/modules/{key}/acquire — rank: any-builder — POST /store/modules/:key/acquire
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired

package/clients/bongos-client/index.cjs

@@ -1148,6 +1148,8 @@ function createClient(opts = {}) {
     "store": {
       // GET /store/entitlements — rank: any-builder — GET /store/entitlements
       getStoreEntitlements: (args) => request("GET", "/store/entitlements", { hasBody: false }, args),
+      // GET /store/modules — rank: any-builder — GET /store/modules
+      getStoreModules: (args) => request("GET", "/store/modules", { hasBody: false }, args),
       // POST /store/modules/{key}/acquire — rank: any-builder — POST /store/modules/:key/acquire
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired

package/clients/bongos-client/index.d.ts

@@ -1649,6 +1649,8 @@ export interface BongosClient {
   "store": {
     /** GET /store/entitlements — rank: any-builder */
     getStoreEntitlements(args?: RequestArgs): Promise<GetStoreEntitlementsResponse>;
+    /** GET /store/modules — rank: any-builder */
+    getStoreModules(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /store/modules/{key}/acquire — rank: any-builder */
     postStoreModulesKeyAcquire(args?: RequestArgs & { body?: PostStoreModulesKeyAcquireRequest }): Promise<PostStoreModulesKeyAcquireResponse>;
     /** POST /store/modules/{key}/acquired — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1145,6 +1145,8 @@ export function createClient(opts = {}) {
     "store": {
       // GET /store/entitlements — rank: any-builder — GET /store/entitlements
       getStoreEntitlements: (args) => request("GET", "/store/entitlements", { hasBody: false }, args),
+      // GET /store/modules — rank: any-builder — GET /store/modules
+      getStoreModules: (args) => request("GET", "/store/modules", { hasBody: false }, args),
       // POST /store/modules/{key}/acquire — rank: any-builder — POST /store/modules/:key/acquire
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired

package/docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md

@@ -66,6 +66,18 @@ couldn't have yet. The floor and the ranking decide how New modules are placed (
 Price is never an input. The Metic+ override (task 1003796) and delist (task 1003797) sit on
 top of the computed score and never replace how it is computed. Every override is recorded.
 
+## Implementation note — the floor (task 1003807, 2026-10-03)
+
+The owner set the floor on 2026-10-01: **50 out of 100**, fixed in Bongos itself
+(`QUALITY_FLOOR` in `src/bongos/module-listing.js`). It is not a live setting and no new
+permission moves it; changing it is an owner-approved, reviewed task, so no author can
+move it. `GET /store/modules` lists each listed module's newest version by its current
+score: the Security gate must have passed (failed or not yet run means not listed); a
+version still labelled New (D5) is listed under "new", never ranked, and the floor does
+not apply to it until it has a real score; any other version is listed only at or above
+the floor. Below the bar is not listed at all. Authors read the rule in
+`docs/modules-contract.md` ("Getting listed").
+
 ## Consequences
 
 - **Day one, only Tests counts toward the overall score**, behind the Security gate. The number

package/docs/api/openapi.json

@@ -21492,6 +21492,37 @@
         ]
       }
     },
+    "/store/modules": {
+      "get": {
+        "operationId": "get_store_modules",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/modules",
+        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/latest": {
       "get": {
         "operationId": "get_store_modules_latest",
@@ -33747,7 +33778,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 525,
+  "x-endpoint-count": 526,
   "x-schema-count": 567,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 376,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 525 endpoints across 93 route files.
+> **Generated from the live route files** — the route file is authoritative. 526 endpoints across 93 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -814,11 +814,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (10)
+## `store` (11)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/store/entitlements` | `any-builder` | — | GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the read side of the entitlement record (task 1003813, ADR 0338 … |
+| GET | `/api/bongos/store/modules` | `any-builder` | — | The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security … |
 | POST | `/api/bongos/store/modules/:key/acquire` | `any-builder` | `version` | ---- install: acquire → download → record (task 1003785, ADR 0338 D1) ---- The server end of `bongos module install`. |
 | POST | `/api/bongos/store/modules/:key/acquired` | `any-builder` | `version` |  |
 | POST | `/api/bongos/store/modules/:key/delist` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). |

package/docs/module-api-changelog.md

@@ -2980,5 +2980,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.72 with no explicit bump. run 37803458577. (task 1002620)
   1.21.74 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.73 with no explicit bump. run 37815719494. (task 1002620)
+  1.21.75 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.74 with no explicit bump. run 37817454172. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -362,6 +362,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - The publish denylist applies (ADR 0098), plus a refusal of credential-named files (`.env*`, `*.pem`, `*.key`, `id_rsa`, …) anywhere in the module. The store re-checks every hash and the denylist itself.
 - Gate: Metic+ (`module.submit`) for now. This is not `bongos module submit`, which proposes a module *into* core.
 - **A how-to is required** ([ADR 0347](adr/0347-every-store-module-ships-a-how-to.md)). `modules/<key>/HOWTO.md` is what a buyer reads — the store shows it as the module's page — so it is written for the person who installs the module, not for an AI working inside it (that is `CLAUDE.md`). It is plain Markdown: any AI or person can write it. Publish refuses the version unless it has these five level-2 headings, in any order and any case, each with some text under it: `## What it does`, `## Install and enable`, `## How to use it` (with one worked example), `## Configuration` ("None." is fine) and `## Limits and known issues` ("None known." is fine). HTML comments don't count as text, so the scaffold's prompts must be replaced. The refusal names each failing section. The check is one function, `checkHowto` in `scripts/gds/module-artifact.js`; the CLI runs it before uploading and the store runs it again on upload, so a hand-built upload can't skip it. `bongos module check` reports it as advice only — an upstream submit is not gated by it. Install and update don't re-check it, so a version published before the gate still installs. The file travels in the tarball, so its hash pins it to the version. An optional `howto.artifactUrl` in `module.json` (an `https://` link on `claude.ai`) is shown as an extra, never graded.
+- **Getting listed** (task 1003807, [ADR 0343](adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md)). Publishing a version does not by itself put it in the store's catalog, `GET /store/modules`. The catalog shows each module's newest version, judged by its current score. It must pass the Security gate first; a version that failed it, or has not been checked yet, is not listed. A new version with no install or reliability data yet is listed with a **New** label and is not ranked; the floor does not apply to it until it has a real score. Every other version is listed only if its overall score is **at least 50 out of 100**. Below that it is not listed at all. The floor is fixed in Bongos itself (`QUALITY_FLOOR` in `src/bongos/module-listing.js`) and returned in the catalog response; no author or instance setting moves it, and changing it is an owner-approved, reviewed task.
 
 ### 7. Install from the store
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.74",
+  "version": "1.21.75",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.74",
+      "version": "1.21.75",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.74",
+  "version": "1.21.75",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9254,5 +9254,11 @@
       "id": "1004628",
       "text": "Projects now have a Ship mode setting. Auto, the default, means the AI ships finished work on its own. Manual means it asks first. Owners can switch it on the project settings page."
     }
+  ],
+  "1.21.75": [
+    {
+      "id": "1003807",
+      "text": "The module store now only shows modules that are safe and good enough: each must pass the security check, and once it has real-world data it needs a score of at least 50 out of 100. Brand-new modules show with a 'New' label un"
+    }
   ]
 }

package/src/bongos/module-listing.js

@@ -0,0 +1,85 @@
+// src/bongos/module-listing.js — which store modules the catalog lists, under the
+// quality floor (task 1003807, criterion wa5-curated-listing, ADR 0343 D2/D5).
+//
+// One module appears once, as its NEWEST published version (semver order), judged by
+// that version's CURRENT score: the newest module_assessment_scores row for it
+// (computed_at DESC, id DESC), whether computed or a Metic+ override (core_265).
+// placeVersion is the whole rule and is pure, so tests drive it directly:
+//
+//   excluded  the Security gate has not passed (false, or not run yet), or the
+//             version has no score row at all. The gate is a hard exclusion (D2).
+//   new       passed the gate but has no real-world data yet (is_new, D5). Listed
+//             with a "New" label and never ranked: the floor does not apply until
+//             it has a real score (owner decision, 2026-10-01).
+//   listed    passed the gate and its overall score is at least the floor.
+//   excluded  otherwise: scored below the floor, or no overall to compare.
+//
+// A delisted module (ADR 0338 D2) is never in the catalog, whatever its score.
+
+const { parseVersion, cmp } = require('../module-loader/semver');
+
+// The quality floor, 0-100. It lives here and nowhere else: it is part of Bongos
+// itself, not a live setting, so no author, builder or instance can move it.
+// Changing it is an owner-approved, reviewed task (owner decision, 2026-10-01).
+// Authors read the rule in docs/modules-contract.md ("Getting listed").
+const QUALITY_FLOOR = 50;
+
+// Where one version stands. `score` is its current score row, or null.
+// Returns { placement: 'listed' | 'new' | 'excluded', reason }.
+function placeVersion(score, floor = QUALITY_FLOOR) {
+  if (!score) return { placement: 'excluded', reason: 'not_assessed' };
+  if (score.security_passed !== true) return { placement: 'excluded', reason: 'security_not_passed' };
+  if (score.is_new) return { placement: 'new', reason: 'new' };
+  if (score.overall == null) return { placement: 'excluded', reason: 'no_score' };
+  if (score.overall < floor) return { placement: 'excluded', reason: 'below_floor' };
+  return { placement: 'listed', reason: 'at_or_above_floor' };
+}
+
+// The newest version row per module key, in semver order (a version that does not
+// parse is skipped, as latestVersions does in module-store.js).
+function newestPerModule(rows) {
+  const out = new Map();
+  for (const r of rows) {
+    const next = parseVersion(r.version);
+    if (!next) continue;
+    const have = out.get(r.module_key);
+    if (have && cmp(parseVersion(have.version), next) >= 0) continue;
+    out.set(r.module_key, r);
+  }
+  return [...out.values()];
+}
+
+// The catalog: { floor, listed: [...], new: [...] }, each entry
+// { key, title, version, published_at, overall, is_new }. Excluded versions are left
+// out entirely: a module below the bar is not listed at all. Both lists are in key
+// order; ranking is a separate task (1003808) and does not happen here.
+async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: versions } = await pool.query(
+    `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
+       FROM store_modules m JOIN store_module_versions v ON v.module_key = m.module_key
+      WHERE m.status = 'listed'`);
+  const newest = newestPerModule(versions);
+  const scores = new Map();
+  if (newest.length) {
+    const { rows } = await pool.query(
+      `SELECT DISTINCT ON (version_id) version_id, overall, security_passed, is_new
+         FROM module_assessment_scores
+        WHERE version_id = ANY($1)
+        ORDER BY version_id, computed_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
+    for (const s of rows) scores.set(String(s.version_id), s);
+  }
+  const out = { floor, listed: [], new: [] };
+  for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
+    const score = scores.get(String(r.version_id)) || null;
+    const { placement } = placeVersion(score, floor);
+    if (placement === 'excluded') continue;
+    out[placement].push({
+      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
+      overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
+    });
+  }
+  return out;
+}
+
+module.exports = { QUALITY_FLOOR, placeVersion, listCatalog };

package/src/bongos/routes/modules.js

@@ -97,6 +97,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
+const { listCatalog } = require('../module-listing');
 
 // A packaged submission embeds every file's content (base64) — cap the total
 // so a runaway/misbuilt module can't bloat the review-queue table. Generous
@@ -692,6 +693,20 @@ module.exports = function buildModulesRouter() {
       res.json({ latest });
     }));
 
+  // The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each
+  // listed module's newest version, if it passed the Security gate and scores at or
+  // above the floor, or under "new" if it has no real-world data yet. Below the bar
+  // is not listed at all. The floor is fixed in module-listing.js and returned here.
+  //
+  // rank: any-builder — a read of public store metadata, like /store/modules/latest:
+  // no entitlement taken, nothing changed.
+  router.get('/store/modules', auth.requireBuilder,
+    asyncHandler('GET /store/modules', async (_req, res) => {
+      const listing = await listCatalog();
+      res.set('Cache-Control', 'no-store');
+      res.json(listing);
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.74'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.75'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_store_listing.mjs

@@ -0,0 +1,156 @@
+// tests/module_store_listing.mjs — the store catalog under the quality floor (task
+// 1003807, criterion wa5-curated-listing, ADR 0343 D2/D5). Two halves, no port and
+// no real DB:
+//   - the rule: placeVersion, pure — the Security gate excludes, "New" is listed
+//     unranked, a real score must reach the floor;
+//   - the route: the real GET /store/modules handler off the real router, with
+//     pool.js replaced in the require cache (the module_upgrade_updates.mjs harness).
+//
+// Run:  node tests/module_store_listing.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// ---- the fake registry the route reads ----
+const state = { modules: {}, versions: [], scores: [] };
+const pool = {
+  async query(sql, params = []) {
+    if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
+      return {
+        rows: state.versions
+          .filter((v) => state.modules[v.module_key] && state.modules[v.module_key].status === 'listed')
+          .map((v) => ({ ...v, version_id: v.id, title: state.modules[v.module_key].title })),
+      };
+    }
+    if (/FROM module_assessment_scores/.test(sql)) {
+      const ids = params[0].map(String);
+      const newest = new Map();
+      for (const s of state.scores) {
+        if (!ids.includes(String(s.version_id))) continue;
+        const have = newest.get(s.version_id);
+        if (!have || s.computed_at > have.computed_at || (s.computed_at === have.computed_at && s.id > have.id)) newest.set(s.version_id, s);
+      }
+      return { rows: [...newest.values()] };
+    }
+    return { rows: [] };
+  },
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
+
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const { QUALITY_FLOOR, placeVersion } = require('../src/bongos/module-listing.js');
+
+function handlerFor(router, method, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, names: stack.map((s) => s.name) };
+}
+
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined, headers: {},
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set(k, v) { this.headers[k] = v; return this; },
+    fail(code, opts) { this.statusCode = opts.status; this.body = { error: code, ...opts }; return this; },
+  };
+  let nextErr = null;
+  await handle(req, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const score = (extra = {}) => ({ overall: 70, security_passed: true, is_new: false, ...extra });
+
+// ---------------------------------------------------------------------------
+// the rule (pure)
+// ---------------------------------------------------------------------------
+
+test('the floor is 50 out of 100 (owner decision, 2026-10-01)', () => {
+  assert.equal(QUALITY_FLOOR, 50);
+});
+
+test('placeVersion: the Security gate must have PASSED — false or not run yet excludes', () => {
+  assert.equal(placeVersion(score({ security_passed: false })).placement, 'excluded');
+  assert.equal(placeVersion(score({ security_passed: null })).placement, 'excluded');
+  assert.equal(placeVersion(score({ security_passed: false, is_new: true })).placement, 'excluded');
+  assert.equal(placeVersion(score({ security_passed: false })).reason, 'security_not_passed');
+});
+
+test('placeVersion: no score row at all is excluded, not failed silently', () => {
+  assert.deepEqual(placeVersion(null), { placement: 'excluded', reason: 'not_assessed' });
+});
+
+test('placeVersion: a New version that passed the gate is listed as new, whatever its number', () => {
+  assert.equal(placeVersion(score({ is_new: true, overall: 10 })).placement, 'new');
+  assert.equal(placeVersion(score({ is_new: true, overall: null })).placement, 'new');
+});
+
+test('placeVersion: a scored version must reach the floor — at the floor is in, one below is out', () => {
+  assert.equal(placeVersion(score({ overall: 50 })).placement, 'listed');
+  assert.equal(placeVersion(score({ overall: 100 })).placement, 'listed');
+  assert.deepEqual(placeVersion(score({ overall: 49 })), { placement: 'excluded', reason: 'below_floor' });
+  assert.equal(placeVersion(score({ overall: null })).placement, 'excluded');
+});
+
+// ---------------------------------------------------------------------------
+// the route
+// ---------------------------------------------------------------------------
+
+test('GET /store/modules: any signed-in builder, no extra permission', () => {
+  const { names } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  assert.equal(names.length, 2, `expected requireBuilder + handler, got ${names.join(', ')}`);
+});
+
+test('GET /store/modules: lists by the newest version\'s current score, drops what falls short', async () => {
+  state.modules = {
+    good: { status: 'listed', title: 'Good' },
+    fresh: { status: 'listed', title: 'Fresh' },
+    low: { status: 'listed', title: 'Low' },
+    unsafe: { status: 'listed', title: 'Unsafe' },
+    unscored: { status: 'listed', title: 'Unscored' },
+    gone: { status: 'delisted', title: 'Gone' },
+    fixed: { status: 'listed', title: 'Fixed' },
+  };
+  state.versions = [
+    { id: 1, module_key: 'good', version: '1.9.0', published_at: 't1' },
+    { id: 2, module_key: 'good', version: '1.10.0', published_at: 't2' },
+    { id: 3, module_key: 'fresh', version: '0.1.0', published_at: 't3' },
+    { id: 4, module_key: 'low', version: '1.0.0', published_at: 't4' },
+    { id: 5, module_key: 'unsafe', version: '1.0.0', published_at: 't5' },
+    { id: 6, module_key: 'unscored', version: '1.0.0', published_at: 't6' },
+    { id: 7, module_key: 'gone', version: '1.0.0', published_at: 't7' },
+    { id: 8, module_key: 'fixed', version: '2.0.0', published_at: 't8' },
+  ];
+  state.scores = [
+    { id: 1, version_id: 1, computed_at: 1, ...score({ overall: 20 }) }, // an OLDER version scored low
+    { id: 2, version_id: 2, computed_at: 1, ...score({ overall: 80 }) },
+    { id: 3, version_id: 3, computed_at: 1, ...score({ is_new: true, overall: 30 }) },
+    { id: 4, version_id: 4, computed_at: 1, ...score({ overall: 49 }) },
+    { id: 5, version_id: 5, computed_at: 1, ...score({ overall: 95, security_passed: false }) },
+    { id: 6, version_id: 7, computed_at: 1, ...score({ overall: 99 }) },
+    { id: 7, version_id: 8, computed_at: 1, ...score({ overall: 40 }) }, // superseded by the newer row
+    { id: 8, version_id: 8, computed_at: 2, ...score({ overall: 60 }) },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const res = await invoke(handle, {});
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.headers['Cache-Control'], 'no-store');
+  assert.equal(res.body.floor, 50);
+  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['fixed', '2.0.0', 60], ['good', '1.10.0', 80]]);
+  assert.deepEqual(res.body.new.map((m) => [m.key, m.is_new, m.overall]), [['fresh', true, null]]);
+  const all = [...res.body.listed, ...res.body.new].map((m) => m.key);
+  for (const k of ['low', 'unsafe', 'unscored', 'gone']) assert.ok(!all.includes(k), `${k} must not be listed`);
+});
+
+test('GET /store/modules: an empty store answers empty lists and the floor', async () => {
+  state.modules = {}; state.versions = []; state.scores = [];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const res = await invoke(handle, {});
+  assert.deepEqual(res.body, { floor: 50, listed: [], new: [] });
+});