forepath · me-marcel · Jul 22, 2026 · Jul 21, 2026
diff --git a/apps/agenstra/backend-agent-controller/Dockerfile.api b/apps/agenstra/backend-agent-controller/Dockerfile.api
@@ -59,6 +59,8 @@ RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | P
     . "${NVM_DIR}/nvm.sh" && \
     nvm install "${NODE_VERSION}" && \
     nvm alias default "${NODE_VERSION}" && \
+    npm install -g npm@11.18.0 && \
+    npm cache clean --force && \
     chown -R agenstra:agenstra /home/agenstra
 
 COPY --chown=agenstra:agenstra package*.json ./

diff --git a/apps/agenstra/backend-agent-controller/package.json b/apps/agenstra/backend-agent-controller/package.json
@@ -45,6 +45,7 @@
   "overrides": {
     "dockerode": {
       "protobufjs": "7.5.5"
-    }
+    },
+    "tar": "7.5.19"
   }
 }
diff --git a/apps/agenstra/backend-agent-manager/Dockerfile.agi b/apps/agenstra/backend-agent-manager/Dockerfile.agi
@@ -42,6 +42,8 @@ RUN apt-get update && \
 
 RUN HOME=/home/agenstra OPENCLAW_HOME=/openclaw \
     curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard && \
+    npm install -g npm@11.18.0 && \
+    npm cache clean --force && \
     chown -R agenstra:agenstra /openclaw /home/agenstra
 
 RUN printf '%s\n' \

diff --git a/apps/agenstra/backend-agent-manager/Dockerfile.api b/apps/agenstra/backend-agent-manager/Dockerfile.api
@@ -59,6 +59,8 @@ RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | P
     . "${NVM_DIR}/nvm.sh" && \
     nvm install "${NODE_VERSION}" && \
     nvm alias default "${NODE_VERSION}" && \
+    npm install -g npm@11.18.0 && \
+    npm cache clean --force && \
     chown -R agenstra:agenstra /home/agenstra
 
 COPY --chown=agenstra:agenstra package*.json ./

diff --git a/apps/agenstra/backend-agent-manager/Dockerfile.worker b/apps/agenstra/backend-agent-manager/Dockerfile.worker
@@ -42,6 +42,8 @@ RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | P
     . "${NVM_DIR}/nvm.sh" && \
     nvm install "${NODE_VERSION}" && \
     nvm alias default "${NODE_VERSION}" && \
+    npm install -g npm@11.18.0 && \
+    npm cache clean --force && \
     chown -R agenstra:agenstra /home/agenstra
 
 RUN . "${NVM_DIR}/nvm.sh" && npm install -g nx && npm cache clean --force && \

diff --git a/apps/agenstra/backend-agent-manager/package.json b/apps/agenstra/backend-agent-manager/package.json
@@ -41,6 +41,7 @@
   "overrides": {
     "dockerode": {
       "protobufjs": "7.5.5"
-    }
+    },
+    "tar": "7.5.19"
   }
 }
diff --git a/apps/agenstra/frontend-agent-console/Dockerfile.server b/apps/agenstra/frontend-agent-console/Dockerfile.server
@@ -22,6 +22,9 @@ WORKDIR /app
 
 EXPOSE ${PORT}
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY --chown=${APP_UID}:${APP_GID} package*.json ./
 
 RUN npm i --omit=dev && npm cache clean --force && chown -R "${APP_UID}:${APP_GID}" /app

diff --git a/apps/agenstra/frontend-landingpage/Dockerfile.server b/apps/agenstra/frontend-landingpage/Dockerfile.server
@@ -22,6 +22,9 @@ WORKDIR /app
 
 EXPOSE ${PORT}
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY --chown=${APP_UID}:${APP_GID} . /app
 
 USER ${APP_UID}:${APP_GID}

diff --git a/apps/decabill/backend-billing-manager/Dockerfile.api b/apps/decabill/backend-billing-manager/Dockerfile.api
@@ -47,6 +47,8 @@ RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | P
     . "${NVM_DIR}/nvm.sh" && \
     nvm install "${NODE_VERSION}" && \
     nvm alias default "${NODE_VERSION}" && \
+    npm install -g npm@11.18.0 && \
+    npm cache clean --force && \
     chown -R agenstra:agenstra /home/agenstra
 
 COPY --chown=agenstra:agenstra package*.json ./

diff --git a/apps/decabill/backend-billing-manager/package.json b/apps/decabill/backend-billing-manager/package.json
@@ -51,6 +51,7 @@
   "overrides": {
     "dockerode": {
       "protobufjs": "7.5.5"
-    }
+    },
+    "tar": "7.5.19"
   }
 }
diff --git a/...bill/backend-billing-manager/src/migrations/1774400000000_AddCustomerProfileTrustScore.ts b/...bill/backend-billing-manager/src/migrations/1774400000000_AddCustomerProfileTrustScore.ts
@@ -0,0 +1,37 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class AddCustomerProfileTrustScore1774400000000 implements MigrationInterface {
+  name = 'AddCustomerProfileTrustScore1774400000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE "billing_customer_profiles"
+      ADD COLUMN IF NOT EXISTS "trust_score" integer
+    `);
+    await queryRunner.query(`
+      ALTER TABLE "billing_customer_profiles"
+      ADD COLUMN IF NOT EXISTS "trust_level" character varying(16)
+    `);
+    await queryRunner.query(`
+      ALTER TABLE "billing_customer_profiles"
+      ADD COLUMN IF NOT EXISTS "trust_score_updated_at" TIMESTAMP
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "idx_billing_customer_profiles_trust_level"
+      ON "billing_customer_profiles" ("trust_level")
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP INDEX IF EXISTS "idx_billing_customer_profiles_trust_level"`);
+    await queryRunner.query(`
+      ALTER TABLE "billing_customer_profiles" DROP COLUMN IF EXISTS "trust_score_updated_at"
+    `);
+    await queryRunner.query(`
+      ALTER TABLE "billing_customer_profiles" DROP COLUMN IF EXISTS "trust_level"
+    `);
+    await queryRunner.query(`
+      ALTER TABLE "billing_customer_profiles" DROP COLUMN IF EXISTS "trust_score"
+    `);
+  }
+}
diff --git a/apps/decabill/frontend-billing-console/Dockerfile.server b/apps/decabill/frontend-billing-console/Dockerfile.server
@@ -22,6 +22,9 @@ WORKDIR /app
 
 EXPOSE ${PORT}
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY --chown=${APP_UID}:${APP_GID} package*.json ./
 
 RUN npm i --omit=dev && npm cache clean --force && chown -R "${APP_UID}:${APP_GID}" /app

diff --git a/apps/decabill/frontend-billing-console/src/i18n/messages.de.xlf b/apps/decabill/frontend-billing-console/src/i18n/messages.de.xlf
@@ -338,10 +338,38 @@
         <source>Edit profile</source>
         <target>Profil bearbeiten</target>
       </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustButtonTitle" datatype="html">
+        <source>View trust score</source>
+        <target>Vertrauensscore anzeigen</target>
+      </trans-unit>
       <trans-unit id="featureAdminProfiles-deleteButtonTitle" datatype="html">
         <source>Delete profile</source>
         <target>Profil löschen</target>
       </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustModalTitle" datatype="html">
+        <source>Customer trust score</source>
+        <target>Kunden-Vertrauensscore</target>
+      </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustFor" datatype="html">
+        <source>Trust score for</source>
+        <target>Vertrauensscore für</target>
+      </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustBaseScore" datatype="html">
+        <source>Base score:</source>
+        <target>Basisscore:</target>
+      </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustComputedAt" datatype="html">
+        <source>Computed:</source>
+        <target>Berechnet:</target>
+      </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustUnavailable" datatype="html">
+        <source>Trust details are currently unavailable.</source>
+        <target>Vertrauensdetails sind derzeit nicht verfügbar.</target>
+      </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustRecompute" datatype="html">
+        <source>Recompute</source>
+        <target>Neu berechnen</target>
+      </trans-unit>
       <trans-unit id="featureAdminProfiles-createTitle" datatype="html">
         <source>Create billing profile</source>
         <target>Abrechnungsprofil erstellen</target>
@@ -362,6 +390,22 @@
         <source>This action cannot be undone.</source>
         <target>Diese Aktion kann nicht rückgängig gemacht werden.</target>
       </trans-unit>
+      <trans-unit id="featureBilling-customerTrustGreen" datatype="html">
+        <source>High trust</source>
+        <target>Hohes Vertrauen</target>
+      </trans-unit>
+      <trans-unit id="featureBilling-customerTrustYellow" datatype="html">
+        <source>Needs attention</source>
+        <target>Aufmerksamkeitsbedarf</target>
+      </trans-unit>
+      <trans-unit id="featureBilling-customerTrustRed" datatype="html">
+        <source>High risk</source>
+        <target>Hohes Risiko</target>
+      </trans-unit>
+      <trans-unit id="featureBilling-customerTrustUnknown" datatype="html">
+        <source>Not scored</source>
+        <target>Nicht bewertet</target>
+      </trans-unit>
       <trans-unit id="featureAdminSubscriptions-title" datatype="html">
         <source>Contracts</source>
         <target>Verträge</target>

diff --git a/apps/decabill/frontend-billing-console/src/i18n/messages.xlf b/apps/decabill/frontend-billing-console/src/i18n/messages.xlf
@@ -233,9 +233,30 @@
       <trans-unit id="featureAdminProfiles-editButtonTitle" datatype="html">
         <source>Edit profile</source>
         </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustButtonTitle" datatype="html">
+        <source>View trust score</source>
+        </trans-unit>
       <trans-unit id="featureAdminProfiles-deleteButtonTitle" datatype="html">
         <source>Delete profile</source>
         </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustModalTitle" datatype="html">
+        <source>Customer trust score</source>
+        </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustFor" datatype="html">
+        <source>Trust score for</source>
+        </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustBaseScore" datatype="html">
+        <source>Base score:</source>
+        </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustComputedAt" datatype="html">
+        <source>Computed:</source>
+        </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustUnavailable" datatype="html">
+        <source>Trust details are currently unavailable.</source>
+        </trans-unit>
+      <trans-unit id="featureAdminProfiles-trustRecompute" datatype="html">
+        <source>Recompute</source>
+        </trans-unit>
       <trans-unit id="featureAdminProfiles-createTitle" datatype="html">
         <source>Create billing profile</source>
         </trans-unit>
@@ -260,6 +281,18 @@
       <trans-unit id="featureAdminProfiles-delete" datatype="html">
         <source> Delete </source>
         </trans-unit>
+      <trans-unit id="featureBilling-customerTrustGreen" datatype="html">
+        <source>High trust</source>
+        </trans-unit>
+      <trans-unit id="featureBilling-customerTrustYellow" datatype="html">
+        <source>Needs attention</source>
+        </trans-unit>
+      <trans-unit id="featureBilling-customerTrustRed" datatype="html">
+        <source>High risk</source>
+        </trans-unit>
+      <trans-unit id="featureBilling-customerTrustUnknown" datatype="html">
+        <source>Not scored</source>
+        </trans-unit>
       <trans-unit id="featureAdminDatevExports-title" datatype="html">
         <source>DATEV exports</source>
         </trans-unit>

diff --git a/apps/decabill/frontend-landingpage/Dockerfile.server b/apps/decabill/frontend-landingpage/Dockerfile.server
@@ -22,6 +22,9 @@ WORKDIR /app
 
 EXPOSE ${PORT}
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY --chown=${APP_UID}:${APP_GID} . /app
 
 USER ${APP_UID}:${APP_GID}

diff --git a/apps/forepath/backend-communication/Dockerfile.api b/apps/forepath/backend-communication/Dockerfile.api
@@ -42,6 +42,8 @@ RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | P
     . "${NVM_DIR}/nvm.sh" && \
     nvm install "${NODE_VERSION}" && \
     nvm alias default "${NODE_VERSION}" && \
+    npm install -g npm@11.18.0 && \
+    npm cache clean --force && \
     chown -R agenstra:agenstra /home/agenstra
 
 COPY --chown=agenstra:agenstra package*.json ./

diff --git a/apps/forepath/frontend-landingpage/Dockerfile b/apps/forepath/frontend-landingpage/Dockerfile
@@ -12,6 +12,9 @@ ENV PORT=4000
 
 WORKDIR /app
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY . /app
 
 

diff --git a/apps/forepath/frontend-landingpage/Dockerfile.server b/apps/forepath/frontend-landingpage/Dockerfile.server
@@ -20,6 +20,9 @@ WORKDIR /app
 
 EXPOSE ${PORT}
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY --chown=${APP_UID}:${APP_GID} . /app
 
 USER ${APP_UID}:${APP_GID}

diff --git a/apps/shared/frontend-docs/Dockerfile.server b/apps/shared/frontend-docs/Dockerfile.server
@@ -22,6 +22,9 @@ WORKDIR /app
 
 EXPOSE ${PORT}
 
+# CVE-2026-59873: upgrade npm so nested tar is >= 7.5.19
+RUN npm install -g npm@11.18.0 && npm cache clean --force
+
 COPY --chown=${APP_UID}:${APP_GID} . /app
 
 USER ${APP_UID}:${APP_GID}

diff --git a/docs/decabill/features/README.md b/docs/decabill/features/README.md
@@ -13,6 +13,7 @@ Decabill provides a complete set of capabilities for subscription billing, invoi
 - **Service Types and Plans** - Admin-managed catalog with provider schemas and pricing
 - **Billing Administration** - Manual invoices, customer profiles, KPIs, and bill-now
 - **Customer Profiles** - Self-service and admin billing metadata required for ordering
+- **Customer Trust Score** - Admin-only traffic-light trust ranking on billing profiles
 - **Dashboard and Server Control** - Overview of subscriptions with start, stop, and restart actions
 - **Real-time Status** - WebSocket dashboard stream for provisioned server status
 - **Backorders** - Queue and retry when provider capacity is unavailable
@@ -118,6 +119,10 @@ Billing metadata required before subscription orders and for compliant invoice i
 - Stripe customer ID stored on profile when payments are initiated
 - Completeness validation before `POST /subscriptions`
 
+### [Customer Trust Score](./customer-trust-score.md)
+
+Admin-only trust ranking for billing profiles based on Decabill subscription, invoice, payment, auto-billing, withdrawal, and backorder history.
+
 ### [Dashboard and Server Control](./dashboard-and-server-control.md)
 
 Customer overview of active subscriptions with live server status and power actions.
@@ -260,6 +265,10 @@ graph TB
     CIC --> SUB
     CP --> SUB
     CP --> INV
+    CP --> BA
+    CP --> PRJ
+    CP --> CTS[Customer Trust Score]
+    BA --> CTS
     SUB --> SP
     SUB --> BO
     SUB --> DASH
@@ -272,7 +281,6 @@ graph TB
     DP --> ST
     SUB --> INV
     BA --> PRJ
-    CP --> PRJ
     PRJ --> PB
     PRJ --> INV
 ```

diff --git a/docs/decabill/features/billing-administration.md b/docs/decabill/features/billing-administration.md
@@ -75,15 +75,18 @@ sequenceDiagram
 
 Customer billing data is stored in `billing_customer_profiles` (one profile per user).
 
-| Method | Path                                    | Purpose                                                |
-| ------ | --------------------------------------- | ------------------------------------------------------ |
-| GET    | `/admin/billing/customer-profiles`      | Paginated list                                         |
-| GET    | `/admin/billing/customer-profiles/{id}` | Full profile detail                                    |
-| POST   | `/admin/billing/customer-profiles`      | Create for user                                        |
-| POST   | `/admin/billing/customer-profiles/{id}` | Update                                                 |
-| DELETE | `/admin/billing/customer-profiles/{id}` | Delete (blocked if user has invoices or subscriptions) |
+| Method | Path                                                          | Purpose                                                |
+| ------ | ------------------------------------------------------------- | ------------------------------------------------------ |
+| GET    | `/admin/billing/customer-profiles`                            | Paginated list                                         |
+| GET    | `/admin/billing/customer-profiles/{id}`                       | Full profile detail                                    |
+| GET    | `/admin/billing/customer-profiles/{id}/trust-score`           | Recomputed trust score detail                          |
+| POST   | `/admin/billing/customer-profiles/{id}/trust-score/recompute` | Force trust recompute                                  |
+| POST   | `/admin/billing/customer-profiles`                            | Create for user                                        |
+| POST   | `/admin/billing/customer-profiles/{id}`                       | Update                                                 |
+| DELETE | `/admin/billing/customer-profiles/{id}`                       | Delete (blocked if user has invoices or subscriptions) |
 
 Self-service `GET/POST /customer-profile` remains for end users. See [Customer Profiles](./customer-profiles.md).
+Trust ranking remains admin-only. See [Customer Trust Score](./customer-trust-score.md).
 
 **Frontend:** `/administration/customer-profiles` in the billing console.
 
@@ -108,6 +111,7 @@ See **[Projects](./projects.md)** for assignment rules, KPIs, and bill-time prec
 
 - **Billing dashboard** (`/administration/billing`) - KPIs, charts, bill-now
 - **Customer profiles** (`/administration/customer-profiles`) - Admin CRUD
+- **Customer trust score** - Admin-only traffic-light ranking inside customer profiles
 - **Projects** (`/administration/projects`) - Project CRUD and bill-time
 - **Webhooks** (`/webhooks`) - Tenant-scoped outbound notification endpoints; see [Webhooks](./webhooks.md)
 - **Service types and plans** - Catalog administration in the billing console
@@ -136,6 +140,7 @@ See **[Webhooks](./webhooks.md)** for payload envelope, signing, and event types
 
 - **[Invoices](./invoices.md)** - Status model and open positions
 - **[Customer Profiles](./customer-profiles.md)** - Profile fields and validation
+- **[Customer Trust Score](./customer-trust-score.md)** - Trust ranking thresholds, factors, and webhooks
 - **[Projects](./projects.md)** - Admin project CRUD and bill-time
 - **[Multi-tenancy](./multi-tenancy.md)** - Tenant scope and DR-002
 - **[Authentication](./authentication.md)** - Admin role requirements

diff --git a/docs/decabill/features/customer-profiles.md b/docs/decabill/features/customer-profiles.md
@@ -40,6 +40,7 @@ When the user initiates payment, the billing manager creates or updates a Stripe
 ## Admin Management
 
 Admins manage profiles under `/admin/billing/customer-profiles`. See [Billing Administration](./billing-administration.md).
+The same admin surface also exposes the [Customer Trust Score](./customer-trust-score.md) for operator review.
 
 Rules:
 
@@ -82,6 +83,7 @@ The user's registration date (day of month, capped at 28) defaults as their **bi
 - **[Invoices](./invoices.md)** - Issuer and customer data on PDFs
 - **[Projects](./projects.md)** - Profile required for project bill-time
 - **[Billing Administration](./billing-administration.md)** - Admin profile CRUD
+- **[Customer Trust Score](./customer-trust-score.md)** - Admin-only trust ranking and factor breakdown
 - **[Payment Processing](./payment-processing.md)** - Stripe customer linkage
 - **[Billing Manager OpenAPI](/spec/billing-manager/openapi.yaml)** - Profile DTO schemas