A module tag might make more sense than a boolean field, since it's similar to extension/utility...
Stability might make more sense, as core is one level above secure.
Maybe I need a module status taxonomy with a different set that describes things like core, needs work, etc.
Project