@bongos/core 1.19.128 → 1.19.130

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.128",
-  "core_contract": "1.19.128",
-  "source_commit": "15671cf5128a6b644791170f9b76c0637bcc0c2a",
+  "core_version": "1.19.130",
+  "core_contract": "1.19.130",
+  "source_commit": "9cfc165fbc5b116976ad07e249f0ed45287f3bcf",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T01:56:43.213Z",
+  "built_at": "2026-08-15T03:15:08.211Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1570,
-  "tree_sha256": "4df41f4612e88057c6058199bd929bb309af81367a8fd7435309497c2456ac1a",
+  "tree_sha256": "9c3f424caabdd8755729a2c59370b4ea6c2c0e14f591297b3769f3f18ae3da41",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4172,12 +4172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "573c516fc294514ce5ed281eb161de21132ddbfd775c5eb63ae1636bd89fc854"
+      "sha256": "d530560bb0e2b69c73bba650529a2d45f3bb4c09728c54e012987f4340681c93"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bfe73c49720864c119018c0ce9a8889271e7f67c4708ca4dbeaf5af26d277b11"
+      "sha256": "1c4c6038789240a0e60015e8501ad5aa572b1c630d0754ee65147acb5a10bb5b"
     },
     {
       "path": "public-docs/index.html",
@@ -4992,7 +4992,7 @@
     {
       "path": "scripts/gds/mirror-lineage-check.js",
       "mode": "0000644",
-      "sha256": "ec187c4a4ad91a3758ff4635baa5ad32dcad7fbf0b61e4f8d3fbc81784254833"
+      "sha256": "31296eda794e640ce5f7191d166d08710b35290be67878826a2c7209f0216e54"
     },
     {
       "path": "scripts/gds/mirror-redact.js",
@@ -5762,7 +5762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0b338840f48746ba4ad9bccd7dd4b80c36b844c2e16ea12bdf42f22ceb2eef5"
+      "sha256": "d7733ec4964e2aff924d904ee73784843f81ea72c3e2eeb6f3c7ea816c62ceb6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7052,12 +7052,12 @@
     {
       "path": "tests/mirror_lineage_fulltree.mjs",
       "mode": "0000644",
-      "sha256": "ce44c9b95988aa587164f2bfbd002046a188be34f14d968635b5d88bb8e98c56"
+      "sha256": "0482cd900a7c45a18ece314deb977eef852060b50d56b814d58ac631bc568426"
     },
     {
       "path": "tests/mirror_lineage_proof.mjs",
       "mode": "0000644",
-      "sha256": "5c9ec605b7e34b046f6df9b1d9f6efa532d394d1134e69990542dde2e86e4ffe"
+      "sha256": "74301070c93c5cb5b4f31d32e508336c96ba199064db9fdf810f07f8d431a98d"
     },
     {
       "path": "tests/mirror_redact.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.128",
+  "version": "1.19.130",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.128",
+      "version": "1.19.130",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.128",
+  "version": "1.19.130",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/mirror-lineage-check.js

@@ -13,10 +13,11 @@
 //      export does (mirror-redact + secret-scrub, via the SHARED redactBlob) and
 //      assert ZERO residual instance literals, public IPs, or secrets survive.
 //      Same detector the export gates on — "one detector, two consumers."
-//   2. MIGRATION NUMBERING — the set of core migrations/NNN_*.sql numbers that
-//      reach the mirror is IDENTICAL to the private set (redaction never renames
-//      a file), so the claim-time next-number allocator computes the SAME next
-//      migration on both sides. A dropped/renumbered migration = divergence = fail.
+//   2. MIGRATION NUMBERING — the set of core migration numbers (bare NNN_*.sql and
+//      namespaced core_NNN_*.sql alike) that reach the mirror is IDENTICAL to the
+//      private set (redaction never renames a file), so the claim-time next-number
+//      allocator computes the SAME next migration on both sides. A dropped or
+//      renumbered migration = divergence = fail.
 //   3. ENUM VALUES — for every publishable migration, the CHECK (... IN (...))
 //      value-lists are byte-identical before and after redaction. Redaction may
 //      touch a domain in a comment; it must NEVER alter a schema enum value.
@@ -46,6 +47,7 @@ const {
 const { isBinary } = require(path.join(REPO_ROOT, 'scripts/public-mirror-export.js'));
 const { scrubSecrets, collectEnvSecrets, SECRET_PATTERNS } = require(path.join(REPO_ROOT, 'modules/security/secret-scrub.js'));
 const { nextFree } = require(path.join(REPO_ROOT, 'scripts/gds/next-number.js'));
+const { migrationNumberOf } = require(path.join(REPO_ROOT, 'scripts/gds/migration-namespace.js'));
 
 // Known secret SHAPES as NON-GLOBAL clones. We scan each file with .test(), and a
 // `/g` regex carries lastIndex state across .test() calls — reused in a loop over
@@ -55,30 +57,41 @@ const { nextFree } = require(path.join(REPO_ROOT, 'scripts/gds/next-number.js'))
 // deterministic regardless of file order.
 const KNOWN_SECRET_SHAPES = SECRET_PATTERNS.map((re) => new RegExp(re.source, re.flags.replace('g', '')));
 
-// Core migrations are migrations/NNN_slug.sql (3+ digit prefix) DIRECTLY under
-// migrations/. Module migrations live under modules/<key>/migrations/ and instance
-// SEEDS under migrations/instance/ (ADR 0105) — both numbered independently and
-// excluded from the publishable mirror; the claim-time allocator only reads the
-// top-level core dir, so only core numbering can diverge.
-const MIGRATION_BASENAME_RE = /^(\d{3,})_.*\.sql$/;
-
 // ---- pure helpers (exported for tests) ------------------------------------
 
+// The CORE migration number for a repo-relative path, or null if it is not one.
+//
+// Core migrations sit DIRECTLY under migrations/ as either the legacy bare NNN_slug.sql
+// or the namespaced core_NNN_slug.sql every NEW core migration must use (ADR 0108 §5).
+// The prefix namespaces the FILENAME (so a core stem can't collide with an instance/
+// module one across repos), NOT the number line — core_188 continues the bare 001–187
+// sequence as ONE sequence. Hence the shared migrationNumberOf, the SAME parser the
+// claim-time allocator (next-number.js) counts from: this proof and the allocator can
+// never disagree about which numbers are taken. (Task 1002527 — the bare-regex version
+// was blind to core_188+, leaving BOTH halves equally blind and the gate falsely green.)
+//
+// Module migrations (modules/<key>/migrations/) and instance SEEDS
+// (migrations/instance/, ADR 0105) are numbered independently and excluded from the
+// publishable mirror; the allocator only reads the top-level core dir, so only core
+// numbering can diverge.
+function coreMigrationNumber(repoRelPath) {
+  const s = String(repoRelPath);
+  if (!s.startsWith('migrations/')) return null; // the migrations dir …
+  // … and ONLY its top level. Counting migrations/instance/NNN_*.sql put every instance
+  // seed in the PRIVATE set but not the MIRROR set (they are unpublishable, task 2140) —
+  // a false private⇄mirror divergence that red-lined the unit gate (task 2152). A path
+  // with a further slash is a subdir, never a core migration.
+  const rest = s.slice('migrations/'.length);
+  if (rest.includes('/')) return null;
+  return migrationNumberOf(rest);
+}
+
 // The set of CORE migration numbers among a list of repo-relative paths.
 function migrationNumbersFromPaths(paths) {
   const out = new Set();
   for (const p of paths || []) {
-    const s = String(p);
-    if (!s.startsWith('migrations/')) continue; // the migrations dir …
-    // … and ONLY its top level. migrations/instance/NNN_*.sql are this instance's host
-    // seeds (ADR 0105), excluded from the publishable mirror (task 2140) — counting them
-    // here put every instance seed in the PRIVATE set but not the MIRROR set, a false
-    // private⇄mirror divergence that red-lined the unit gate (task 2152). A path with a
-    // further slash is a subdir, never a core migration.
-    const rest = s.slice('migrations/'.length);
-    if (rest.includes('/')) continue;
-    const m = MIGRATION_BASENAME_RE.exec(rest);
-    if (m) out.add(parseInt(m[1], 10));
+    const n = coreMigrationNumber(p);
+    if (n != null) out.add(n);
   }
   return out;
 }
@@ -178,10 +191,12 @@ function proveLineage({ publishableFiles, privateMigrationNumbers, ctx }) {
   for (const f of publishableFiles) {
     const { redactedText, leaks: fileLeaks } = scanFile(f.buf, ctx);
     for (const l of fileLeaks) leaks.push({ path: f.path, label: l.label, sample: l.sample });
-    if (f.path.startsWith('migrations/') && MIGRATION_BASENAME_RE.test(f.path.split('/').pop())) {
+    // Same predicate as the private half (migrationNumbersFromPaths) — the two sets are
+    // only comparable if both are built by the identical parser.
+    const migNum = coreMigrationNumber(f.path);
+    if (migNum != null) {
       migFiles.push({ path: f.path, original: f.buf.toString('utf8'), redacted: redactedText != null ? redactedText : f.buf.toString('utf8') });
-      const mm = MIGRATION_BASENAME_RE.exec(f.path.split('/').pop());
-      mirrorNums.add(parseInt(mm[1], 10));
+      mirrorNums.add(migNum);
     }
   }
 
@@ -317,7 +332,7 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
-  MIGRATION_BASENAME_RE,
+  coreMigrationNumber,
   migrationNumbersFromPaths,
   parseEnumChecks,
   numberingDivergence,

package/src/module-api.js

@@ -683,8 +683,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.126 with no explicit bump. run 31854730552. (task 1002620)
 //   1.19.128 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.127 with no explicit bump. run 31857842473. (task 1002620)
+//   1.19.129 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.128 with no explicit bump. run 31858158416. (task 1002620)
+//   1.19.130 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.129 with no explicit bump. run 31861289412. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.128'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.130'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/mirror_lineage_fulltree.mjs

@@ -12,11 +12,18 @@
 // and asserts zero residual leaks + private⇄public migration-numbering/enum stability.
 // Filesystem + git (git ls-files) are the only dependencies — no DB, no network.
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { runSimulation } = require('../scripts/gds/mirror-lineage-check.js');
+const { migrationNumberOf } = require('../scripts/gds/migration-namespace.js');
+const { nextFree } = require('../scripts/gds/next-number.js');
+
+const MIGRATIONS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'migrations');
 
 test('C9 full-tree simulation: the redacted publishable mirror leaks nothing', () => {
   const report = runSimulation();
@@ -43,3 +50,24 @@ test('C9 full-tree simulation: the redacted publishable mirror leaks nothing', (
     `redaction altered enum value-list(s) in ${report.drift.length} migration(s): ${report.drift.map((d) => d.path).join(', ')}`
   );
 });
+
+// The proof is only worth its green tick if it actually SEES every core migration.
+// Before task 1002527 it parsed the bare `NNN_` form only, so every `core_NNN_` file
+// (ADR 0108 §5) was invisible to BOTH halves — equally blind, therefore silently
+// "consistent". This asserts the simulation's coverage against the real tree so the
+// gate can't quietly stop covering new core migrations again.
+test('C9 full-tree simulation covers namespaced core_NNN_ migrations too (task 1002527)', () => {
+  const basenames = fs.readdirSync(MIGRATIONS_DIR).filter((n) => migrationNumberOf(n) != null);
+  const namespaced = basenames.filter((n) => !/^\d/.test(n));
+  assert.ok(namespaced.length > 0, 'expected at least one core_NNN_ migration on disk — update this test if the namespace discipline changed');
+
+  const report = runSimulation();
+  assert.equal(
+    report.counts.migrations,
+    basenames.length,
+    `the proof saw ${report.counts.migrations} core migrations but migrations/ holds ${basenames.length} — a naming form is not being parsed`
+  );
+  // Bare and namespaced core files share ONE number line, so the proof's next-free must
+  // match what next-number.js hands a claim; if they disagree a number gets re-used.
+  assert.equal(report.nextPrivate, nextFree(new Set(basenames.map(migrationNumberOf))));
+});

package/tests/mirror_lineage_proof.mjs

@@ -8,7 +8,9 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const {
   migrationNumbersFromPaths, parseEnumChecks, numberingDivergence, enumDrift,
+  proveLineage, buildRedactionContext,
 } = require('../scripts/gds/mirror-lineage-check.js');
+const { nextFree } = require('../scripts/gds/next-number.js');
 
 test('migrationNumbersFromPaths picks CORE migrations only (not module/ADR numbers)', () => {
   const set = migrationNumbersFromPaths([
@@ -31,9 +33,61 @@ test('migrationNumbersFromPaths excludes migrations/instance/ seeds (task 2152)'
     'migrations/080_core_thing.sql',                    // bare core → counted
     'migrations/instance/080_gds_v4_planning_seed.sql', // instance seed → NOT core
     'migrations/instance/186_governance_seed.sql',      // instance seed → NOT core
-    'migrations/core_192_namespaced.sql',               // core_ prefix ≠ bare NNN_ form → not counted either
+    'migrations/core_192_namespaced.sql',               // namespaced core (ADR 0108 §5) → counted
   ]);
-  assert.deepEqual([...set].sort((a, b) => a - b), [80]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [80, 192]);
+});
+
+// ---- namespaced core migrations (ADR 0108 §5 / task 1002527) ---------------
+// Core migrations above LEGACY_BARE_CORE_MAX are `core_NNN_`-prefixed so their stem
+// can't collide with an instance/module migration across repos. The prefix namespaces
+// the FILENAME, not the NUMBER LINE: core_188 continues the bare 001–187 sequence as
+// ONE sequence (migration-namespace.js pins the cutoff so no bare core file can ever
+// exceed it, and next-number.js unions both forms into a single max+1). The C9 proof
+// must parse both forms or it silently stops covering every new core migration.
+
+test('migrationNumbersFromPaths parses namespaced core_NNN_ names as ONE sequence with the bare ones (task 1002527)', () => {
+  const set = migrationNumbersFromPaths([
+    'migrations/003_pms.sql',              // legacy bare core
+    'migrations/187_goal_sort_order.sql',  // the last bare core number
+    'migrations/core_188_goal_visibility.sql',
+    'migrations/core_219_grade_attempts_idx.sql',
+    'modules/game/migrations/game_001_world.sql', // module migration — still excluded
+  ]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [3, 187, 188, 219]);
+  // ONE sequence, so the next free core number continues past the namespaced files —
+  // the same number next-number.js hands a claim (188 here would re-use core_188).
+  assert.equal(nextFree(set), 220);
+});
+
+test('proveLineage counts namespaced core_NNN_ migrations in the MIRROR set (task 1002527)', () => {
+  const ctx = buildRedactionContext();
+  const file = (p, sql) => ({ path: p, buf: Buffer.from(sql, 'utf8') });
+  const publishableFiles = [
+    file('migrations/003_pms.sql', "CREATE TABLE a (s TEXT CHECK (s IN ('x', 'y')));\n"),
+    file('migrations/core_188_goal_visibility.sql', "CREATE TABLE b (s TEXT CHECK (s IN ('p', 'q')));\n"),
+    file('src/bongos/db.js', 'module.exports = {};\n'), // not a migration
+  ];
+  const report = proveLineage({ publishableFiles, privateMigrationNumbers: new Set([3, 188]), ctx });
+
+  // Both halves must agree: the private set (migrationNumbersFromPaths) and the mirror
+  // set (proveLineage) parse the SAME names, so a namespaced file is never a false
+  // "missing" divergence — the failure mode that would red-line the C9 gate.
+  assert.equal(report.counts.migrations, 2);
+  assert.deepEqual(report.numbering, { missing: [], extra: [], consistent: true });
+  assert.equal(report.nextMirror, 189);
+  assert.equal(report.nextPrivate, 189);
+});
+
+test('proveLineage still CATCHES a genuinely dropped namespaced core migration (task 1002527)', () => {
+  const ctx = buildRedactionContext();
+  const publishableFiles = [
+    { path: 'migrations/003_pms.sql', buf: Buffer.from('SELECT 1;\n', 'utf8') },
+  ];
+  // core_188 exists privately but never reached the mirror → a real divergence.
+  const report = proveLineage({ publishableFiles, privateMigrationNumbers: new Set([3, 188]), ctx });
+  assert.equal(report.numbering.consistent, false);
+  assert.deepEqual(report.numbering.missing, [188]);
 });
 
 test('parseEnumChecks extracts the quoted value-lists from CHECK (... IN (...))', () => {