@bongos/core 1.19.769 → 1.19.770

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.769",
-  "core_contract": "1.19.769",
-  "source_commit": "5552e7252b67cc3192446a9c48ca2cd4faf10368",
+  "core_version": "1.19.770",
+  "core_contract": "1.19.770",
+  "source_commit": "6860da8b241f99c69f179a82908b848215eaf46d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T14:54:06.807Z",
+  "built_at": "2026-09-16T15:11:28.421Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2125,
+    "functional_verbatim": 2126,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2633,
-  "tree_sha256": "8c9135931a565436af92fb7fc38953f0bf6b9ca8c6b608b91e9751c88dd62fe0",
+  "file_count": 2634,
+  "tree_sha256": "d7c0492f1f78fb62ba8de96723bfc2b4caffb4083a4e98d39c23fab5de7c6270",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ffaeae011cd55895b3c16a2ee903e0593aa42a22cfceb3307c5228452c737948"
+      "sha256": "6c9191a42934b1fc862c9075812ead3451eacd71278bdcfb652c01b02ed7e083"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7577,12 +7577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "17b6a246e7e14d3949244aff29ed7e63dc5bc5d65a7aeff2a463f8283fa5b4cc"
+      "sha256": "43473b034badae11d9d613079d8ea502102bd9349a5b601c89ec4d094f0d21bf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "df0b9ff8dceb4cafd08db0a28bcbe92b1cbee04fefe4f811574257af0929901c"
+      "sha256": "ca671dc476d503ca56328e84fa7f0e3712b60657cfbfd84f1790be4bc93a5b1f"
     },
     {
       "path": "public-docs/index.html",
@@ -9407,7 +9407,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3237d6ea069eae19ed9baf41a528984e21010defcfc5a0d96d34fd8eeca2fb4a"
+      "sha256": "a4707be144d7581356575936d364de82a6b1dabd5310dc6df70de1954282deb4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11167,12 +11167,12 @@
     {
       "path": "tests/help_requests.mjs",
       "mode": "0000644",
-      "sha256": "8a4b380ebe8ad5667f20f4f0c21f8870262340e6d0f2aabca36d0737fdc81d1e"
+      "sha256": "e1e1075e2f8ba4b52acba29804e5fd62443b823cfd15d4c50f0a93fcea0d13bd"
     },
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "2c5ffa3ed447fdbbbc1b44e553f493bf05ab2848b154836defe3fe40e1909592"
+      "sha256": "2527e761e86d289bfaf1f0c5bc416762b02c0784f0307fd0f445da656d8db549"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -12784,6 +12784,11 @@
       "mode": "0000644",
       "sha256": "905b7b9147fa35f74c2c5f4118175ebf96fa36107379207a7a2c59afc5a2967d"
     },
+    {
+      "path": "tests/sql_column_lines.mjs",
+      "mode": "0000644",
+      "sha256": "c68bf3aa9cd886de435293f0a536df8153fcc99187c48097de12c5482b1ee430"
+    },
     {
       "path": "tests/sso_checkin_identity_spoof.mjs",
       "mode": "0000644",
@@ -12907,7 +12912,7 @@
     {
       "path": "tests/task_recommendations.mjs",
       "mode": "0000644",
-      "sha256": "cfce8e24b5844b1720399cc467e89ca457d74dfbf0783ef2a733d433f0443bd8"
+      "sha256": "1c5d35d58371cbde290a3e71e023febeebf350b54031d458c2ebe58f25962aa4"
     },
     {
       "path": "tests/task_visual_route_gate.mjs",

package/docs/module-api-changelog.md

@@ -2012,5 +2012,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.767 with no explicit bump. run 35110800163. (task 1002620)
   1.19.769 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.768 with no explicit bump. run 35111616379. (task 1002620)
+  1.19.770 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.769 with no explicit bump. run 35113578542. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.769",
+  "version": "1.19.770",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.769",
+      "version": "1.19.770",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.769",
+  "version": "1.19.770",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.769'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.770'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/help_requests.mjs

@@ -10,6 +10,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+import { sqlColumnLines } from './helpers.mjs';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
@@ -127,10 +128,7 @@ test('sub-speciality is deliberately NOT modelled yet', () => {
   // "speciality" anywhere outside a `--` comment and flagged the migration's own
   // COMMENT ON TABLE, which says it is deliberately not modelled. Same
   // over-broad-source-assertion reflex as learning 1000196.
-  const body = sql.slice(sql.indexOf('CREATE TABLE'), sql.indexOf(');'));
-  const columns = body.split('\n')
-    .map((l) => l.replace(/--.*$/, '').trim())
-    .filter((l) => l && !/^(CONSTRAINT|CHECK|\))/.test(l));
+  const columns = sqlColumnLines(sql);
   assert.ok(!columns.some((l) => /special/i.test(l)), `no speciality column: ${columns.filter((l) => /special/i.test(l))}`);
 });
 

package/tests/helpers.mjs

@@ -385,3 +385,39 @@ export function parseInto(host, html) {
     return null;
   });
 }
+
+// The COLUMN LINES of a CREATE TABLE, with SQL line comments removed (task 1003759).
+//
+// Two tests assert "this table has no such column" and must read the COLUMN LIST,
+// not the file: a migration routinely EXPLAINS in a comment that some column is
+// deliberately not modelled, and matching that prose as a violation of the rule it
+// states is the over-broad-source-assertion reflex of learning 1000196.
+//
+// Both had the same strip, and the same bug: `l.replace(/--.*$/, '')`. In JS `.`
+// does not match `\r`, and `$` without the `m` flag matches ONLY end-of-string —
+// so on a CRLF checkout (every Windows clone) the trailing `\r` sits between `.*`
+// and `$`, the match fails, and the comment is NOT stripped. The comment line then
+// reaches the column scan and trips the very assertion it was written to explain.
+//
+// tests/task_recommendations.mjs failed exactly that way on Windows and nowhere
+// else, so CI never saw it and it sat in the local failure baseline being read as
+// environmental noise. tests/help_requests.mjs carried the identical strip and
+// passed only by luck — no comment inside its CREATE TABLE body happened to
+// contain its scanned word.
+//
+// Dropping the `$` is the whole fix: `.*` still stops at the `\r`, the match now
+// succeeds, and the existing `.trim()` removes what is left.
+export function sqlColumnLines(sql) {
+  const text = String(sql || '');
+  const start = text.indexOf('CREATE TABLE');
+  if (start === -1) return [];
+  // End on `\n);` rather than the first `);` — a bare `);` can appear inside a
+  // comment or an earlier statement, which would cut the body short.
+  const endAt = text.indexOf('\n);', start);
+  const body = text.slice(start, endAt === -1 ? undefined : endAt);
+  return body.split('\n')
+    .map((l) => l.replace(/--.*/, '').trim())
+    // CREATE TABLE is dropped too: the slice starts at the header line, so a table
+    // whose NAME contained a scanned word would otherwise read as a column.
+    .filter((l) => l && !/^(CREATE TABLE|CONSTRAINT|CHECK|\))/.test(l));
+}

package/tests/sql_column_lines.mjs

@@ -0,0 +1,87 @@
+// tests/sql_column_lines.mjs — the CRLF-safe SQL column extractor (task 1003759).
+//
+// THE BUG IT REPLACES. Two tests assert "this table has no such column", and both
+// read the COLUMN LIST rather than the file, because a migration routinely EXPLAINS
+// in a comment that some column is deliberately not modelled — matching that prose
+// as a violation of the rule it states is the over-broad-source-assertion reflex of
+// learning 1000196.
+//
+// Both stripped comments with `l.replace(/--.*$/, '')`, and that is wrong on a CRLF
+// checkout. In JS `.` does not match `\r`, and `$` without the `m` flag matches ONLY
+// end-of-string, so the trailing `\r` sits between `.*` and `$`, the match fails,
+// and the comment survives into the column scan.
+//
+// tests/task_recommendations.mjs failed exactly that way — on Windows only, so CI
+// never saw it and it sat in the local failure baseline being read as environmental
+// noise for weeks. tests/help_requests.mjs had the identical strip and passed purely
+// by luck: no comment inside its CREATE TABLE body happened to contain its scanned
+// word. A guard that works by accident is the thing this file exists to stop.
+//
+// Run:  node --test tests/sql_column_lines.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { sqlColumnLines } from './helpers.mjs';
+
+// The shape that broke: a comment INSIDE the table body naming the very word a
+// caller scans for. Written with explicit \r\n — the whole point is the line ending.
+const CRLF = [
+  'CREATE TABLE lifecycle_task_recommendations (',
+  '  id BIGSERIAL PRIMARY KEY,',
+  "  -- There is NO 'accepted'. Accepting a recommendation is CLAIMING THE TASK,",
+  '  -- so "accepted" would be a second, weaker record of holding work.',
+  '  status TEXT NOT NULL DEFAULT \'open\',',
+  '  CONSTRAINT one_open_pair UNIQUE (from_builder_id, to_builder_id)',
+  ');',
+].join('\r\n');
+
+const LF = CRLF.replace(/\r\n/g, '\n');
+
+test('CRLF: a comment naming the scanned word is stripped, not returned as a column', () => {
+  const cols = sqlColumnLines(CRLF);
+  assert.ok(!cols.some((l) => /accepted/i.test(l)),
+    `comments must not reach the column list, got: ${JSON.stringify(cols)}`);
+});
+
+test('CRLF and LF produce identical column lists — the platform must not matter', () => {
+  assert.deepEqual(sqlColumnLines(CRLF), sqlColumnLines(LF));
+});
+
+test('the real columns survive on both line endings', () => {
+  for (const [label, sql] of [['CRLF', CRLF], ['LF', LF]]) {
+    const cols = sqlColumnLines(sql);
+    assert.ok(cols.some((l) => l.startsWith('id ')), `${label}: id column kept`);
+    assert.ok(cols.some((l) => l.startsWith('status ')), `${label}: status column kept`);
+  }
+});
+
+test('CONSTRAINT / CHECK lines and the closing paren are filtered out', () => {
+  const cols = sqlColumnLines(CRLF);
+  assert.ok(!cols.some((l) => /^CONSTRAINT/.test(l)), 'constraints are not columns');
+  assert.ok(!cols.some((l) => /^\)/.test(l)), 'the closing paren is not a column');
+});
+
+test('a trailing comment on a real column line is stripped, the column kept', () => {
+  const sql = 'CREATE TABLE t (\r\n  id BIGINT, -- accepted is not modelled here\r\n);';
+  const cols = sqlColumnLines(sql);
+  assert.deepEqual(cols, ['id BIGINT,']);
+});
+
+test('the body ends at the closing \\n); — a bare ); inside a comment does not cut it short', () => {
+  // `indexOf(');')` would stop at the comment and hide every column after it.
+  const sql = [
+    'CREATE TABLE t (',
+    '  -- see fn(a); for why',
+    '  keeper TEXT,',
+    ');',
+  ].join('\r\n');
+  assert.ok(sqlColumnLines(sql).some((l) => l.startsWith('keeper')),
+    'a column after a comment containing "};" must still be seen');
+});
+
+test('no CREATE TABLE, empty, and non-string inputs are safe', () => {
+  assert.deepEqual(sqlColumnLines('ALTER TABLE t ADD COLUMN x INT;'), []);
+  assert.deepEqual(sqlColumnLines(''), []);
+  assert.deepEqual(sqlColumnLines(null), []);
+  assert.deepEqual(sqlColumnLines(undefined), []);
+});

package/tests/task_recommendations.mjs

@@ -18,6 +18,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+import { sqlColumnLines } from './helpers.mjs';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
@@ -79,10 +80,7 @@ test('the schema has NO accepted status — accepting is claiming, which lives e
 });
 
 test('the schema carries no transfer column', () => {
-  const body = SQL.slice(SQL.indexOf('CREATE TABLE'), SQL.indexOf('\n);'));
-  const columns = body.split('\n')
-    .map((l) => l.replace(/--.*$/, '').trim())
-    .filter((l) => l && !/^(CONSTRAINT|CHECK|\))/.test(l));
+  const columns = sqlColumnLines(SQL);
   const suspect = columns.filter((l) => /transferred|claimed_by|assigned_to|accepted/i.test(l));
   assert.deepEqual(suspect, [], `no transfer-shaped column: ${suspect}`);
 });