@bongos/core 1.18.18 → 1.18.19

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.18.18",
-  "core_contract": "1.18.18",
-  "source_commit": "f404cbe8964656605d03988362a2172921c6a192",
-  "source_ref": "f404cbe",
-  "built_at": "2026-08-03T23:55:06.878Z",
+  "core_version": "1.18.19",
+  "core_contract": "1.18.19",
+  "source_commit": "ccda86b3b4fe68b8a59dd1d70bf73bfec9682642",
+  "source_ref": "HEAD",
+  "built_at": "2026-08-08T18:02:27.307Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 275,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1437,
-  "tree_sha256": "720dc8403155a686d4a7da8050c790f784979b66a1524a8f396bdc402a3893f5",
+  "tree_sha256": "6e3052888f6a30b9440eeaefee370fa8f296a9345ab9377935c703346d150f3c",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3737,12 +3737,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "06ff1390b45223f783401dd9eeba77c6020129735324ce536e9dc907a009230a"
+      "sha256": "e8bc8b5238e6c8d6fb3c4168cc93e4fcbad6cff43364b52d7e976466de3c235d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d5a5f3f66b15c82b29a0d786fd823b913ba9f86389698a5284dc05af7fc4efcf"
+      "sha256": "04a15921eadb531ab832ada19fd934cd7ffa79ca138cb23832394511a2c8e016"
     },
     {
       "path": "public-docs/index.html",
@@ -5017,7 +5017,7 @@
     {
       "path": "scripts/migrate.sh",
       "mode": "0000644",
-      "sha256": "856aaf6ac485e60679309ccbda0d404b74e7e55655ef005583e30231f1f0bce4"
+      "sha256": "28fc9fc9450ca6147d57db0a6f3ab38a5edab5f7dee22ec0340093d854c6c50a"
     },
     {
       "path": "scripts/migrate_cost_ledger.sh",
@@ -5352,7 +5352,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e1ce10a4ed04e5bcc3430cb046150b4fc54644669ae2a7a6ea266bb0434223d6"
+      "sha256": "36c522ca8a10cf57bc03bc87987c8eacea995ab99bf8f6b21842c68ec8389943"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6467,7 +6467,7 @@
     {
       "path": "tests/migrate_root_resolution.mjs",
       "mode": "0000644",
-      "sha256": "7cfb077788e8eac8e40ba60f18a0100e76cfbc2637a9e690e4dc68ba599c2cc3"
+      "sha256": "caf6f21d69cf7ab0521deb40a10450e6f2fc7c3baadcd4602dbfc3edcd224d70"
     },
     {
       "path": "tests/migration_allocation.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.18.18",
+  "version": "1.18.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.18.18",
+      "version": "1.18.19",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.18.18",
+  "version": "1.18.19",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/migrate.sh

@@ -51,6 +51,15 @@ fi
 
 DB="${PGDATABASE:-amazonprimea}"
 
+# Test/ops seam (task 1002611): --print-migrations walks the REAL core-migration loop but reports
+# each path instead of applying it, and touches NO DB. tests/migrate_root_resolution.mjs uses it to
+# assert that a checkout whose path contains a space still yields whole, readable paths. Reporting
+# through the real loop (rather than a copy of it in the test) is the point: if the loop ever reverts
+# to an unquoted `for f in $MIGRATIONS`, this seam fragments the paths and the test fails. Also handy
+# in the field — `npm run migrate -- --print-migrations` shows exactly what migrate would apply.
+DRY_RUN=0
+if [ "${1:-}" = "--print-migrations" ]; then DRY_RUN=1; fi
+
 # --- Instance-seed policy (task 1704 / ADR 0105) --------------------------
 # OTB/product scope-truth (versions, goals, done_when_criteria) lives in seed
 # migrations under migrations/instance/ (plus a few guarded blocks embedded in the
@@ -81,22 +90,40 @@ echo "instance-seed policy: app.seed_instance_data=$SEED_INSTANCE (migrations/in
 
 # Make sure schema_migrations exists before we query it. (001 creates
 # it; other migrations rely on it.)
-psql -d "$DB" -v ON_ERROR_STOP=1 -tAc "
-  CREATE TABLE IF NOT EXISTS schema_migrations (
-    version text PRIMARY KEY,
-    applied_at timestamptz NOT NULL DEFAULT now()
-  );
-" >/dev/null
+if [ "$DRY_RUN" = 0 ]; then
+  psql -d "$DB" -v ON_ERROR_STOP=1 -tAc "
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      version text PRIMARY KEY,
+      applied_at timestamptz NOT NULL DEFAULT now()
+    );
+  " >/dev/null
 
-APPLIED=$(psql -d "$DB" -tA -c "SELECT version FROM schema_migrations ORDER BY version")
+  APPLIED=$(psql -d "$DB" -tA -c "SELECT version FROM schema_migrations ORDER BY version")
+else
+  APPLIED=""
+fi
 
 # Apply one migration file unless its filename stem is already recorded. Stem (not path) is the
 # key, so moving a file between migrations/ and migrations/game/ does NOT re-run it on prod.
+#
+# The two counters are what the no-op guard below reads: a run that LISTED core migrations but
+# neither applied nor recognized a single one is the space-in-path failure (task 1002611) and must
+# be fatal, not silent. Both loops that call this run in the CURRENT shell (herestring / plain glob,
+# never a `... | while` pipeline), so these increments are visible to the caller.
+MIGRATIONS_APPLIED=0
+MIGRATIONS_ALREADY=0
 apply_migration() {
   local f="$1" version
   version="$(basename "$f" .sql)"
+  if [ "$DRY_RUN" = 1 ]; then
+    # Counted as applied so the no-op guard below is exercised by the seam too.
+    printf 'would-apply\t%s\n' "$f"
+    MIGRATIONS_APPLIED=$((MIGRATIONS_APPLIED + 1))
+    return
+  fi
   if echo "$APPLIED" | grep -q "^${version}$"; then
     echo "skip   $version (already applied)"
+    MIGRATIONS_ALREADY=$((MIGRATIONS_ALREADY + 1))
     return
   fi
   echo "apply  $version"
@@ -108,6 +135,7 @@ apply_migration() {
   psql -d "$DB" -v ON_ERROR_STOP=1 -tAc \
     "INSERT INTO schema_migrations (version) VALUES ('${version}') ON CONFLICT DO NOTHING" \
     >/dev/null
+  MIGRATIONS_APPLIED=$((MIGRATIONS_APPLIED + 1))
 }
 
 # --- Forward-safety notice (task 1002223 / audit H10) ---------------------
@@ -116,7 +144,7 @@ apply_migration() {
 # UNACKNOWLEDGED forward-unsafe core migration so an operator knows a rollback past it would strand
 # old code on new schema. Fail-closed enforcement is the unit gate (tests/migrations_forward_safe.mjs);
 # here it is advisory (`|| true`) so a lint hiccup can NEVER break a deploy.
-if [ -f "$CORE_ROOT/scripts/gds/lint-migrations.js" ]; then
+if [ "$DRY_RUN" = 0 ] && [ -f "$CORE_ROOT/scripts/gds/lint-migrations.js" ]; then
   node "$CORE_ROOT/scripts/gds/lint-migrations.js" --warn --dir "$CORE_ROOT/migrations" || true
 fi
 
@@ -131,14 +159,66 @@ fi
 # are included only when SEED_INSTANCE=on; stem-keyed tracking means a file's directory never
 # affects whether it re-runs on OTB prod. Today CORE_ROOT == INSTANCE_ROOT (single checkout);
 # once the core installs from node_modules the two roots diverge and this still merges correctly.
+#
+# PATHS WITH SPACES (task 1002611): this list is NEWLINE-separated and must be read a line at a
+# time. The old `for f in $MIGRATIONS` word-split it on IFS — which includes space — so any checkout
+# whose absolute path contains a space ("/Users/.../Hermeslines Marketing/...") fragmented every
+# path, the `[ -e ]` guard below silently dropped all of them, and ZERO core migrations ran.
+# Reproduced on 1.18.18: 117 files listed, 234 loop iterations, 234 -e failures, schema_migrations
+# empty. The module loop further down is correctly quoted, so module migrations then ran against an
+# EMPTY schema and reported a bogus `relation "achievements" does not exist` from modules/economy —
+# `achievements` is created by CORE 006_pms_v2.sql, which never ran. Hence the guard after the loop.
+# `<<<` (bash — see the shebang) keeps the loop in the CURRENT shell, so the counters survive it; a
+# `... | while read` pipeline would both subshell the counters away and interact badly with
+# `set -euo pipefail`. `|| true` on each `ls` keeps an empty glob from tripping pipefail.
 MIGRATIONS=$( {
-  ls "$CORE_ROOT"/migrations/*.sql 2>/dev/null
-  if [ "$SEED_INSTANCE" = "on" ]; then ls "$INSTANCE_ROOT"/migrations/instance/*.sql 2>/dev/null; fi
+  ls "$CORE_ROOT"/migrations/*.sql 2>/dev/null || true
+  if [ "$SEED_INSTANCE" = "on" ]; then ls "$INSTANCE_ROOT"/migrations/instance/*.sql 2>/dev/null || true; fi
 } | awk -F/ '{ print $NF "\t" $0 }' | sort | cut -f2- )
-for f in $MIGRATIONS; do
-  [ -e "$f" ] || continue
+migrations_listed=0
+migrations_unreadable=0
+before_applied=$MIGRATIONS_APPLIED
+before_already=$MIGRATIONS_ALREADY
+while IFS= read -r f; do
+  # An empty $MIGRATIONS still yields one empty line through `<<<`, so skip blanks before -e.
+  [ -n "$f" ] || continue
+  migrations_listed=$((migrations_listed + 1))
+  if [ ! -e "$f" ]; then
+    migrations_unreadable=$((migrations_unreadable + 1))
+    echo "migrate.sh: listed migration is not a readable file, skipping: $f" >&2
+    continue
+  fi
   apply_migration "$f"
-done
+done <<< "$MIGRATIONS"
+
+# --- No-op guard (task 1002611) -------------------------------------------
+# Silence is what made the space-in-path bug expensive to diagnose: core migrations were skipped
+# without a word, and the first error the operator saw came from an unrelated MODULE migration
+# hitting the empty schema. If the glob LISTED core migrations but we neither applied nor recognized
+# a single one, the list itself is broken — stop here rather than let the module loop below produce a
+# misleading error about a table that a core migration was supposed to create.
+core_applied=$((MIGRATIONS_APPLIED - before_applied))
+core_already=$((MIGRATIONS_ALREADY - before_already))
+if [ "$migrations_listed" -gt 0 ] && [ "$core_applied" -eq 0 ] && [ "$core_already" -eq 0 ]; then
+  {
+    echo
+    echo "migrate.sh: FATAL — listed $migrations_listed core migration(s) but applied 0 and found 0 already applied."
+    echo "  $migrations_unreadable of the $migrations_listed listed path(s) were not readable files."
+    echo "  CORE_ROOT=$CORE_ROOT"
+    echo "  Refusing to continue to module migrations: they would run against an empty schema and"
+    echo "  fail with a misleading error (e.g. relation \"achievements\" does not exist) from a module,"
+    echo "  when the real cause is that no core migration ran."
+    echo "  Run 'npm run migrate -- --print-roots' to see the roots migrate resolved."
+  } >&2
+  exit 1
+fi
+
+# The --print-migrations seam stops here: the core list is what it verifies, and going further would
+# need a DB. The summary line is the machine-readable assertion target.
+if [ "$DRY_RUN" = 1 ]; then
+  printf 'listed=%d unreadable=%d\n' "$migrations_listed" "$migrations_unreadable"
+  exit 0
+fi
 [ "$SEED_INSTANCE" = "on" ] || echo "instance seeds skipped (migrations/instance/) — non-owning / vanilla instance"
 
 # Module-owned migrations (modules/<key>/migrations/*.sql) — applied only when the module is
@@ -208,7 +288,12 @@ if [ "${OTB_POST_DEPLOY_CHECK:-0}" = "1" ]; then
       BASELINE_FLAG="--baseline-only"
       echo "post-deploy: no prior score ledger — running in baseline-only mode"
     fi
-    if ! python3 modules/art-pipeline/pipeline/post_deploy_check.py $BASELINE_FLAG; then
+    # `${VAR:+"$VAR"}` expands to NOTHING when empty and to the quoted value otherwise. A bare
+    # $BASELINE_FLAG relied on word-splitting to vanish (the habit that caused task 1002611), and
+    # quoting it outright would instead pass an empty argv entry that argparse rejects. An array
+    # would need bash 4 — `set -u` + `"${arr[@]}"` on an empty array aborts under the bash 3.2 that
+    # macOS still ships, and this script's shebang takes whatever bash is on PATH.
+    if ! python3 modules/art-pipeline/pipeline/post_deploy_check.py ${BASELINE_FLAG:+"$BASELINE_FLAG"}; then
       echo "post-deploy: whole-world check FAILED — see output above" >&2
       exit 1
     fi

package/src/module-api.js

@@ -348,8 +348,20 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         precisely because nothing compared live against main. The doorway surface
 //         is byte-identical to 1.18.17 (governance is reached through the kernel
 //         port, not a new export), so despite the size this is → PATCH. (task 1002521)
+//   1.18.19 — SINGLE-FIX patch cut from the core-v1.18.18 tag, not from main: core
+//         migrations were silently skipped on any checkout whose absolute path
+//         contains a space. `for f in $MIGRATIONS` word-split the newline-separated
+//         list on IFS, fragmenting every path; the `[ -e "$f" ]` guard then dropped
+//         all of them and schema_migrations stayed empty. The module loop is quoted,
+//         so module migrations ran against an empty schema and the operator saw a
+//         misleading `relation "achievements" does not exist` from modules/economy
+//         instead of the real cause. Now read with a newline-safe herestring, and a
+//         no-op guard makes the skip FATAL rather than silent. No doorway change, no
+//         schema change, one script + its test → PATCH. Deliberately does NOT carry
+//         the unreleased 1.19 tree on main, so a blocked instance can take the fix
+//         alone. (task 1002611)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.18.18'; // go-live carrier for 171 unreleased commits + the deploy-divergence check (task 1002521); see changelog above
+const CORE_VERSION = '1.18.19'; // single-fix patch off the 1.18.18 tag: migrations skipped on a path with a space (task 1002611); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migrate_root_resolution.mjs

@@ -17,7 +17,9 @@
 
 import { strict as assert } from 'node:assert';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, realpathSync } from 'node:fs';
+import {
+  mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, symlinkSync, realpathSync,
+} from 'node:fs';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
@@ -93,5 +95,126 @@ t('CORE_ROOT is always the script-relative repo root, independent of the invocat
   assert.equal(realpathSync(printRoots({ cwd: bare }).CORE_ROOT), REPO_REAL);
 });
 
+// ==========================================================================
+// A CORE ROOT WHOSE PATH CONTAINS A SPACE (task 1002611)
+// ==========================================================================
+// `for f in $MIGRATIONS` word-split the newline-separated migration list on IFS — which includes
+// space — so a checkout at "/Users/.../Hermeslines Marketing/..." fragmented every path, the
+// `[ -e "$f" ]` guard dropped all of them, and ZERO core migrations ran. Reproduced on
+// @bongos/core@1.18.18: 117 files listed, 234 iterations, 234 -e failures, schema_migrations empty.
+//
+// These exercise migrate.sh's `--print-migrations` seam, which walks the REAL loop and reports each
+// path instead of applying it (DB-free, like --print-roots). Reporting through the real loop is the
+// point: a copy of the loop inside this test would not catch a revert of the loop in the script.
+
+// A synthetic CORE root: `scripts/migrate.sh` SYMLINKED to the real script (so the fixture can never
+// drift from it), a stub instance-config that names the fixture as both roots, and n migration files.
+// `spaced` puts a space in the fixture's own directory name — the whole point of the fixture.
+function makeCore({ spaced, files = ['001_a.sql', '002_b.sql', '006_pms_v2.sql', '019_c.sql'] } = {}) {
+  const prefix = spaced ? 'r89 spaced core-' : 'r89-plain-core-';
+  const dir = realpathSync(mkdtempSync(path.join(tmpdir(), prefix)));
+  mkdirSync(path.join(dir, 'scripts'));
+  mkdirSync(path.join(dir, 'migrations'));
+  mkdirSync(path.join(dir, 'src'));
+  symlinkSync(MIGRATE, path.join(dir, 'scripts', 'migrate.sh'));
+  // Pin both roots to the fixture explicitly, so the test does not lean on migrate.sh's
+  // node-unavailable fallback to decide what CORE_ROOT is.
+  writeFileSync(path.join(dir, 'src', 'instance-config.js'), [
+    "const path = require('node:path');",
+    "const ROOT = path.resolve(__dirname, '..');",
+    'module.exports = {',
+    '  resolveCoreRoot: () => ROOT,',
+    '  resolveInstanceRootExplicit: () => ROOT,',
+    '};',
+    '',
+  ].join('\n'));
+  for (const f of files) writeFileSync(path.join(dir, 'migrations', f), '-- probe\n');
+  return dir;
+}
+
+// Run `<core>/scripts/migrate.sh --print-migrations` and parse the seam's output.
+// Returns { applied: [paths], listed, unreadable, status, stderr }.
+function printMigrations(coreDir, { script = 'migrate.sh' } = {}) {
+  const env = { ...process.env };
+  for (const k of Object.keys(env)) if (/_INSTANCE_ROOT$/.test(k)) delete env[k];
+  delete env.INIT_CWD;
+  let stdout = '';
+  let stderr = '';
+  let status = 0;
+  try {
+    stdout = execFileSync('bash', [path.join(coreDir, 'scripts', script), '--print-migrations'],
+      { cwd: coreDir, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  } catch (e) {
+    status = e.status ?? 1;
+    stdout = e.stdout ?? '';
+    stderr = e.stderr ?? '';
+  }
+  const applied = [];
+  let listed = null;
+  let unreadable = null;
+  for (const line of stdout.split('\n')) {
+    const a = /^would-apply\t(.*)$/.exec(line);
+    if (a) { applied.push(a[1]); continue; }
+    const s = /^listed=(\d+) unreadable=(\d+)$/.exec(line);
+    if (s) { listed = Number(s[1]); unreadable = Number(s[2]); }
+  }
+  return { applied, listed, unreadable, status, stderr, stdout };
+}
+
+t('core root containing a space: every migration is listed as ONE whole, readable path', () => {
+  const core = makeCore({ spaced: true });
+  assert.ok(core.includes(' '), 'fixture path must contain a space to be meaningful');
+  const r = printMigrations(core);
+  assert.equal(r.status, 0, `migrate.sh --print-migrations must succeed; stderr:\n${r.stderr}`);
+  assert.equal(r.listed, 4, 'all four migrations must be listed');
+  assert.equal(r.unreadable, 0, 'no listed path may fail the -e test (fragmentation)');
+  assert.equal(r.applied.length, 4, 'all four must reach apply_migration');
+  for (const f of r.applied) {
+    assert.ok(existsSync(f), `listed path must exist on disk, got fragment: ${f}`);
+    assert.ok(f.startsWith(core), `listed path must be whole and under the core root: ${f}`);
+  }
+});
+
+t('core root containing a space: applies in basename order, unaffected by the space', () => {
+  const core = makeCore({ spaced: true });
+  const r = printMigrations(core);
+  assert.deepEqual(
+    r.applied.map((f) => path.basename(f)),
+    ['001_a.sql', '002_b.sql', '006_pms_v2.sql', '019_c.sql'],
+    'the merge-and-sort-by-basename order must survive a spaced path',
+  );
+});
+
+t('a space-free core root behaves identically (the fixture itself is not what passes)', () => {
+  const spaced = printMigrations(makeCore({ spaced: true }));
+  const plain = printMigrations(makeCore({ spaced: false }));
+  assert.equal(plain.status, spaced.status);
+  assert.equal(plain.listed, spaced.listed);
+  assert.equal(plain.unreadable, spaced.unreadable);
+  assert.deepEqual(plain.applied.map((f) => path.basename(f)), spaced.applied.map((f) => path.basename(f)));
+});
+
+// The no-op guard, proven against the ACTUAL pre-fix code. Re-introducing the unquoted loop into a
+// copy of the script must now FAIL LOUDLY rather than skip every core migration in silence and let
+// the module loop below report a misleading `relation "achievements" does not exist`.
+t('the pre-fix unquoted loop now fails loudly instead of silently skipping', () => {
+  const core = makeCore({ spaced: true });
+  const src = readFileSync(MIGRATE, 'utf8');
+  const mutant = src
+    .replace('while IFS= read -r f; do', 'for f in $MIGRATIONS; do')
+    .replace('done <<< "$MIGRATIONS"', 'done');
+  assert.notEqual(mutant, src, 'the mutation must apply — has the core loop been reshaped?');
+  assert.ok(mutant.includes('for f in $MIGRATIONS'), 'mutant must carry the unquoted loop');
+  writeFileSync(path.join(core, 'scripts', 'mutant.sh'), mutant);
+
+  const r = printMigrations(core, { script: 'mutant.sh' });
+  assert.notEqual(r.status, 0, 'the unquoted loop on a spaced path must NOT exit 0');
+  assert.match(r.stderr, /FATAL/, 'the failure must be loud');
+  assert.match(r.stderr, /applied 0 and found 0 already applied/, 'it must name the real cause');
+  assert.match(r.stderr, /Refusing to continue to module migrations/,
+    'it must say it stopped before the module loop — the misleading-error path');
+  assert.equal(r.applied.length, 0, 'the unquoted loop applies nothing (that was the bug)');
+});
+
 console.log(`\nmigrate_root_resolution: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);