@windyroad/risk-scorer 0.19.5 → 0.19.6-preview.1254

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -310,5 +310,5 @@
310
310
  }
311
311
  },
312
312
  "name": "wr-risk-scorer",
313
- "version": "0.19.5"
313
+ "version": "0.19.6"
314
314
  }
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "wr-risk-scorer",
3
- "version": "0.19.5",
3
+ "version": "0.19.6",
4
4
  "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
5
5
  "author": {
6
6
  "name": "Windy Road Technology",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@windyroad/risk-scorer",
3
- "version": "0.19.5",
3
+ "version": "0.19.6-preview.1254",
4
4
  "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
5
5
  "scripts": {
6
6
  "prepack": "node scripts/sync-codex-skills.mjs --pack",
@@ -42,6 +42,9 @@ not invoke the \`wr-risk-scorer:pipeline\` skill and do not spawn or delegate to
42
42
  another pipeline scorer; that wrapper exists for callers, not for this agent.
43
43
 
44
44
  The request must contain exactly one \`RISK_CWD: <absolute Git root>\` line.
45
+ Treat a single syntactically absolute path as caller-attested; do not inspect or
46
+ validate its existence, accessibility, or Git status. The completion bridge
47
+ performs the deterministic checkout validation.
45
48
  Repeat that exact line once after the structured risk output so the completion
46
49
  bridge can bind marker generation to the checkout that was assessed. Do not
47
50
  repeat the path elsewhere. If the request omits the line or provides more than