The 'program' field of the input tsv is used as the metadata projectCode and middle component of the required scope a redwood access token needs to have in order to access the bundle corresponding to the input tsv. Since the different components of access token scopes are period-delimited, the program shouldn't contain periods (or if it had to they should be escaped). I think this should be added to the jsonschema.
Though escaping of spaces is already implemented, I'll mention for posterity that spaces also can't occur in the projectCode/scope because oauth2 passes sets of scopes as space-delimited strings.