diff --git a/README.md b/README.md
index 72dd6501..7f33d6eb 100644
--- a/README.md
+++ b/README.md
@@ -63,7 +63,8 @@ agent/
 ├── .core/                       Runtime workspace seed (agents.yaml + workspace.yaml)
 ├── docs/                        RFCs, onboarding, audits
 ├── go.work + external/          Dev workspace mode (see CLAUDE.md)
-└── Taskfile.yml                 Build orchestration
+├── Taskfile.yaml                Build orchestration (module-graph refresh, etc.)
+└── module-graph.json            Authoritative dappco.re/go/* dep snapshot
 ```
 
 ## Quickstart
@@ -110,6 +111,9 @@ cd go
 GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o core-agent-linux ./cmd/core-agent/
 ```
 
+`module-graph.json` at repo root is the authoritative `dappco.re/go/*` dep
+snapshot — regenerate via `task module-graph:refresh` after dep bumps.
+
 ## Configuration
 
 Runtime config lives at `.core/agents.yaml` (also extracted into
diff --git a/Taskfile.yaml b/Taskfile.yaml
new file mode 100644
index 00000000..7635b92d
--- /dev/null
+++ b/Taskfile.yaml
@@ -0,0 +1,30 @@
+version: "3"
+
+tasks:
+  module-graph:refresh:
+    desc: Regenerate module-graph.json from go/go.mod (run after dappco.re/go/* dep bumps)
+    cmds:
+      - |
+        TODAY="$(date +%Y-%m-%d)" awk '
+          BEGIN {
+            print "{"
+            print "  \"module\": \"dappco.re/go/agent\","
+            printf "  \"generated_at\": \"%s\",\n", ENVIRON["TODAY"]
+            print "  \"source\": \"go/go.mod\","
+            print "  \"dependencies\": {"
+          }
+          /^[[:space:]]+dappco\.re\// {
+            mod=$1; ver=$2
+            entries[++n]=sprintf("    \"%s\": \"%s\"", mod, ver)
+          }
+          END {
+            for (i=1; i<=n; i++) {
+              sep=(i<n)?",":""
+              print entries[i] sep
+            }
+            print "  }"
+            print "}"
+          }
+        ' go/go.mod > module-graph.json
+      - jq . module-graph.json > /dev/null
+      - echo "module-graph.json refreshed"
diff --git a/module-graph.json b/module-graph.json
new file mode 100644
index 00000000..184026d1
--- /dev/null
+++ b/module-graph.json
@@ -0,0 +1,15 @@
+{
+  "module": "dappco.re/go/agent",
+  "generated_at": "2026-05-01",
+  "source": "go/go.mod",
+  "dependencies": {
+    "dappco.re/go": "v0.9.0",
+    "dappco.re/go/mcp": "v0.10.0",
+    "dappco.re/go/process": "v0.10.0",
+    "dappco.re/go/store": "v0.9.0",
+    "dappco.re/go/ws": "v0.5.0",
+    "dappco.re/go/io": "v0.9.0",
+    "dappco.re/go/log": "v0.9.0",
+    "dappco.re/go/rag": "v0.10.0"
+  }
+}