@wrongstack/core 0.309.1 → 0.310.1

package/dist/plugin/index.js

@@ -5159,7 +5159,11 @@ function relationKeys(event) {
   add("attempt", event.correlation.attemptId, "explicit");
   add("decision", event.attributes?.decisionId, "explicit");
   add("network_request", event.attributes?.requestId, "explicit");
-  add("prompt_manifest", event.attributes?.promptManifest?.manifestId, "explicit");
+  add(
+    "prompt_manifest",
+    event.correlation.promptManifestId ?? event.attributes?.promptManifest?.manifestId,
+    "explicit"
+  );
   add("resource_lineage", event.resource?.id, "inferred");
   if (event.eventType === "metrics.rollup" && event.attributes?.signal === "tool.resource.observed") {
     const resources = event.attributes.resources;
@@ -5181,6 +5185,7 @@ function matches(event, query) {
   if (!equal(query.agentId, event.scope.agentId) || !equal(query.taskId, event.scope.taskId)) return false;
   if (!equal(query.providerId, event.runtime?.providerId) || !equal(query.modelId, event.runtime?.modelId)) return false;
   if (!equal(query.traceId, event.correlation.traceId) || !equal(query.logicalRequestId, event.correlation.logicalRequestId)) return false;
+  if (!equal(query.promptManifestId, event.correlation.promptManifestId)) return false;
   if (!equal(query.attemptId, event.correlation.attemptId) || !equal(query.toolCallId, event.correlation.toolCallId)) return false;
   if (!equal(query.resourceKind, event.resource?.kind) || !equal(query.resourceId, event.resource?.id)) return false;
   if (query.path && normalize(event.resource?.path) !== normalize(query.path)) return false;
@@ -5321,6 +5326,7 @@ function isChronicleEvent(value) {
   ]) && typeof value.correlation.traceId === "string" && typeof value.correlation.spanId === "string" && optionalStrings(value.correlation, [
     "parentSpanId",
     "logicalRequestId",
+    "promptManifestId",
     "attemptId",
     "toolCallId"
   ]) && isRuntime(value.runtime) && isResource(value.resource) && (value.attributes === void 0 || isRecord2(value.attributes)) && (value.tags === void 0 || isStringRecord(value.tags));
@@ -5510,7 +5516,7 @@ var ChronicleQuotaManager = class {
 };
 
 // src/chronicle/sqlite-journal-schema.ts
-import { createRequire } from "node:module";
+import { loadRuntimeDatabaseSync } from "@wrongstack/persistence";
 
 // src/utils/index.ts
 init_atomic_write();
@@ -5928,20 +5934,18 @@ var CHRONICLE_SQLITE_FILE = "chronicle.sqlite";
 var LEGACY_JSONL_MIGRATION_KEY = "legacy-jsonl-v1";
 var LEGACY_JSONL_QUARANTINE_KEY = "legacy-jsonl-v1:quarantine";
 var LEGACY_JSONL_BOUNDARY_KEY = "legacy-jsonl-v1:boundary";
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 3;
 var Ctor;
 function loadDatabaseSync() {
   if (Ctor) return Ctor;
-  if (Ctor === null) throw new Error("node:sqlite is unavailable in this runtime");
+  if (Ctor === null) throw new Error("SQLite is unavailable in this runtime");
   try {
-    Ctor = withSqliteExperimentalWarningSuppressed(
-      () => createRequire(import.meta.url)("node:sqlite").DatabaseSync
-    );
+    Ctor = withSqliteExperimentalWarningSuppressed(loadRuntimeDatabaseSync);
     return Ctor;
   } catch (error) {
     Ctor = null;
     throw new Error(
-      "The Chronicle journal needs Node's built-in SQLite (node:sqlite, Node >= 22.5): " + (error instanceof Error ? error.message : String(error))
+      "The Chronicle journal needs node:sqlite (Node >= 22.5) or bun:sqlite: " + (error instanceof Error ? error.message : String(error))
     );
   }
 }
@@ -5956,6 +5960,7 @@ function projectEvent(event) {
     taskId: event.scope.taskId ?? null,
     traceId: event.correlation?.traceId ?? null,
     logicalRequestId: event.correlation?.logicalRequestId ?? null,
+    promptManifestId: event.correlation?.promptManifestId ?? null,
     resourceKind: event.resource?.kind ?? null,
     resourceId: event.resource?.id ?? null,
     resourcePath: event.resource?.path ?? null,
@@ -5980,6 +5985,7 @@ function ensureChronicleSchema(db) {
       task_id            TEXT,
       trace_id           TEXT,
       logical_request_id TEXT,
+      prompt_manifest_id TEXT,
       resource_kind      TEXT,
       resource_id        TEXT,
       resource_path      TEXT,
@@ -6007,6 +6013,10 @@ function ensureChronicleSchema(db) {
   if (version < 2) {
     db.exec("DROP INDEX IF EXISTS events_resource_path");
   }
+  if (version > 0 && version < 3) {
+    db.exec("ALTER TABLE events ADD COLUMN prompt_manifest_id TEXT");
+  }
+  db.exec("CREATE INDEX IF NOT EXISTS events_prompt_manifest ON events(prompt_manifest_id)");
   if (version !== SCHEMA_VERSION) {
     db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
   }
@@ -6043,6 +6053,7 @@ function pushDown(query) {
   eq("task_id", query.taskId);
   eq("trace_id", query.traceId);
   eq("logical_request_id", query.logicalRequestId);
+  eq("prompt_manifest_id", query.promptManifestId);
   eq("resource_kind", query.resourceKind);
   eq("resource_id", query.resourceId);
   if (query.eventTypes?.length) {
@@ -6399,6 +6410,7 @@ var ChronicleSqliteJournal = class {
           row.taskId,
           row.traceId,
           row.logicalRequestId,
+          row.promptManifestId,
           row.resourceKind,
           row.resourceId,
           row.resourcePath,
@@ -6558,9 +6570,9 @@ var ChronicleSqliteJournal = class {
     const insert = this.db.prepare(
       `INSERT INTO events (
          day, sequence, event_id, hash, previous_hash, occurred_at, event_type, outcome,
-         project_id, session_id, agent_id, task_id, trace_id, logical_request_id,
+         project_id, session_id, agent_id, task_id, trace_id, logical_request_id, prompt_manifest_id,
          resource_kind, resource_id, resource_path, duration_ns, payload
-       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
+       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
     );
     const checkpoint = this.db.prepare(
       `INSERT INTO chain_checkpoint (day, sequence, hash) VALUES (?, ?, ?)
@@ -6589,6 +6601,7 @@ var ChronicleSqliteJournal = class {
             row.taskId,
             row.traceId,
             row.logicalRequestId,
+            row.promptManifestId,
             row.resourceKind,
             row.resourceId,
             row.resourcePath,
@@ -6675,9 +6688,9 @@ var ChronicleSqliteJournal = class {
       insert: this.db.prepare(
         `INSERT INTO events (
            day, sequence, event_id, hash, previous_hash, occurred_at, event_type, outcome,
-           project_id, session_id, agent_id, task_id, trace_id, logical_request_id,
+           project_id, session_id, agent_id, task_id, trace_id, logical_request_id, prompt_manifest_id,
            resource_kind, resource_id, resource_path, duration_ns, payload
-         ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
+         ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
       ),
       trimBoundary: this.db.prepare(
         "SELECT day, sequence, hash FROM events ORDER BY day, sequence LIMIT 1 OFFSET ?"
@@ -6718,8 +6731,8 @@ var ChronicleSqliteJournal = class {
 };
 
 // src/chronicle/metrics-schema.ts
-import { createRequire as createRequire2 } from "node:module";
-var SCHEMA_VERSION2 = 3;
+import { loadRuntimeDatabaseSync as loadRuntimeDatabaseSync2 } from "@wrongstack/persistence";
+var SCHEMA_VERSION2 = 4;
 var READ_CHUNK_BYTES = 1024 * 1024;
 var SQLITE_SOURCE_PREFIX = "sqlite:";
 var SQLITE_INGEST_BATCH = 2e3;
@@ -6737,16 +6750,14 @@ var EMPTY_FAMILIES = {
 var Ctor2;
 function loadDatabaseSync2() {
   if (Ctor2) return Ctor2;
-  if (Ctor2 === null) throw new Error("node:sqlite is unavailable in this runtime");
+  if (Ctor2 === null) throw new Error("SQLite is unavailable in this runtime");
   try {
-    Ctor2 = withSqliteExperimentalWarningSuppressed(
-      () => createRequire2(import.meta.url)("node:sqlite").DatabaseSync
-    );
+    Ctor2 = withSqliteExperimentalWarningSuppressed(loadRuntimeDatabaseSync2);
     return Ctor2;
   } catch (error) {
     Ctor2 = null;
     throw new Error(
-      "Chronicle metrics need Node's built-in SQLite (node:sqlite, Node >= 22.5): " + (error instanceof Error ? error.message : String(error))
+      "Chronicle metrics need node:sqlite (Node >= 22.5) or bun:sqlite: " + (error instanceof Error ? error.message : String(error))
     );
   }
 }
@@ -6807,6 +6818,9 @@ function ensureMetricsSchema(db) {
       tool_name TEXT NOT NULL DEFAULT '',
       provider_id TEXT NOT NULL DEFAULT '',
       model_id TEXT NOT NULL DEFAULT '',
+      logical_request_id TEXT NOT NULL DEFAULT '',
+      prompt_manifest_id TEXT NOT NULL DEFAULT '',
+      provenance_confidence TEXT NOT NULL DEFAULT 'unknown',
       source TEXT NOT NULL DEFAULT ''
     );
     CREATE INDEX IF NOT EXISTS idx_file_lineage_path ON file_lineage(path_key, occurred_at);
@@ -6899,6 +6913,20 @@ var ChronicleMetricsIngester = class {
   db;
   directory;
   dbPath;
+  /**
+   * Prepared-statement cache for the per-event ingest hot paths. Preparing
+   * the same SQL on every event was the dominant ingest cost; node:sqlite
+   * statements are reusable, so each distinct SQL string is prepared once.
+   */
+  stmtCache = /* @__PURE__ */ new Map();
+  stmt(sql) {
+    let s = this.stmtCache.get(sql);
+    if (!s) {
+      s = this.db.prepare(sql);
+      this.stmtCache.set(sql, s);
+    }
+    return s;
+  }
   async refresh() {
     const result = {
       ingestedEvents: 0,
@@ -6928,7 +6956,7 @@ var ChronicleMetricsIngester = class {
             let base;
             if (!migrated) {
               base = offsets.get(key) ?? 0;
-            } else if (boundary !== null && boundary.has(key)) {
+            } else if (boundary?.has(key)) {
               base = Math.max(offsets.get(key) ?? 0, boundary.get(key));
             } else {
               base = rebuilt ? 0 : offsets.get(key) ?? 0;
@@ -7151,11 +7179,11 @@ var ChronicleMetricsIngester = class {
   }
   ingestDailyCounters(event) {
     const day = eventDay(event);
-    this.db.prepare("INSERT OR IGNORE INTO daily_counters (day) VALUES (?)").run(day);
-    const bump = (sql, ...params) => this.db.prepare(`UPDATE daily_counters SET ${sql} WHERE day = ?`).run(...params, day);
+    this.stmt("INSERT OR IGNORE INTO daily_counters (day) VALUES (?)").run(day);
+    const bump = (sql, ...params) => this.stmt(`UPDATE daily_counters SET ${sql} WHERE day = ?`).run(...params, day);
     const family = signalFamily(event);
     const failed = isTerminalFailure(event) ? 1 : 0;
-    this.db.prepare(
+    this.stmt(
       `INSERT INTO family_daily (day, family, count, failure_count) VALUES (?, ?, 1, ?)
        ON CONFLICT(day, family) DO UPDATE SET count = count + 1, failure_count = failure_count + excluded.failure_count`
     ).run(day, family, failed);
@@ -7164,12 +7192,15 @@ var ChronicleMetricsIngester = class {
       bump("cancellations = cancellations + 1");
     if (family === "agent") bump("agent_events = agent_events + 1");
     if (event.correlation.logicalRequestId) {
-      this.db.prepare(
+      this.stmt(
         "INSERT OR IGNORE INTO logical_request_daily (day, logical_request_id) VALUES (?, ?)"
       ).run(day, event.correlation.logicalRequestId);
     }
     if (event.scope.agentId) {
-      this.db.prepare("INSERT OR IGNORE INTO agent_daily (day, agent_id) VALUES (?, ?)").run(day, event.scope.agentId);
+      this.stmt("INSERT OR IGNORE INTO agent_daily (day, agent_id) VALUES (?, ?)").run(
+        day,
+        event.scope.agentId
+      );
     }
     const type = event.eventType;
     if (type === "decision.requested") bump("decisions = decisions + 1");
@@ -7191,7 +7222,10 @@ var ChronicleMetricsIngester = class {
     if (event.resource?.kind === "file" || type.startsWith("file.")) {
       bump("file_events_all = file_events_all + 1");
       if (event.resource?.path) {
-        this.db.prepare("INSERT OR IGNORE INTO file_seen_daily (day, path_key) VALUES (?, ?)").run(day, normalizePathKey(event.resource.path));
+        this.stmt("INSERT OR IGNORE INTO file_seen_daily (day, path_key) VALUES (?, ?)").run(
+          day,
+          normalizePathKey(event.resource.path)
+        );
       }
     }
   }
@@ -7200,8 +7234,10 @@ var ChronicleMetricsIngester = class {
     const providerId = event.runtime?.providerId ?? asString(readPath2(event.attributes ?? {}, "from.providerId")) ?? "";
     const modelId = event.runtime?.modelId ?? asString(readPath2(event.attributes ?? {}, "from.model")) ?? "";
     if (!providerId && !modelId) return;
-    this.db.prepare("INSERT OR IGNORE INTO provider_daily (day, provider_id, model_id) VALUES (?, ?, ?)").run(day, providerId, modelId);
-    const update = (sql, ...params) => this.db.prepare(
+    this.stmt(
+      "INSERT OR IGNORE INTO provider_daily (day, provider_id, model_id) VALUES (?, ?, ?)"
+    ).run(day, providerId, modelId);
+    const update = (sql, ...params) => this.stmt(
       `UPDATE provider_daily SET ${sql} WHERE day = ? AND provider_id = ? AND model_id = ?`
     ).run(...params, day, providerId, modelId);
     const duration = durationMs2(event);
@@ -7242,7 +7278,7 @@ var ChronicleMetricsIngester = class {
     if (typeof cost !== "number" || !Number.isFinite(cost)) return;
     const scopeKey2 = `${event.scope.projectId ?? ""}\0${event.scope.sessionId ?? ""}\0${event.scope.agentId ?? ""}`;
     const occurredAt = event.occurredAt ?? event.observedAt;
-    this.db.prepare(
+    this.stmt(
       `INSERT INTO token_cost (scope_key, day, occurred_at, sequence, cost) VALUES (?, ?, ?, ?, ?)
        ON CONFLICT(scope_key) DO UPDATE SET
          day = excluded.day, occurred_at = excluded.occurred_at,
@@ -7256,8 +7292,8 @@ var ChronicleMetricsIngester = class {
     const taskId = event.scope.taskId ?? stringAt(attributes, "taskId");
     if (!taskId) return;
     const occurredAt = event.occurredAt ?? event.observedAt;
-    this.db.prepare("INSERT OR IGNORE INTO task_outcomes (task_id) VALUES (?)").run(taskId);
-    const set = (sql, ...params) => this.db.prepare(`UPDATE task_outcomes SET ${sql} WHERE task_id = ?`).run(...params, taskId);
+    this.stmt("INSERT OR IGNORE INTO task_outcomes (task_id) VALUES (?)").run(taskId);
+    const set = (sql, ...params) => this.stmt(`UPDATE task_outcomes SET ${sql} WHERE task_id = ?`).run(...params, taskId);
     const lineage = [
       ["run_id", stringAt(attributes, "runId")],
       ["board_id", event.scope.kanbanBoardId ?? stringAt(attributes, "boardId")],
@@ -7304,11 +7340,12 @@ var ChronicleMetricsIngester = class {
     if (!operation || operation === "read") return;
     const filePath = event.resource?.path ?? stringAt(attributes, "filePath");
     if (!filePath) return;
-    this.db.prepare(
+    this.stmt(
       `INSERT OR IGNORE INTO file_lineage
         (event_id, path, path_key, operation, occurred_at, session_id, agent_id, task_id, board_id, run_id,
-         tool_name, provider_id, model_id, source)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+         tool_name, provider_id, model_id, logical_request_id, prompt_manifest_id,
+         provenance_confidence, source)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
     ).run(
       event.eventId,
       normalizeKey2(filePath),
@@ -7323,10 +7360,17 @@ var ChronicleMetricsIngester = class {
       stringAt(attributes, "toolName") ?? "",
       event.runtime?.providerId ?? stringAt(attributes, "provider") ?? "",
       event.runtime?.modelId ?? stringAt(attributes, "model") ?? "",
+      event.correlation.logicalRequestId ?? stringAt(attributes, "logicalRequestId") ?? "",
+      event.correlation.promptManifestId ?? stringAt(attributes, "promptManifestId") ?? "",
+      provenanceConfidence(attributes),
       stringAt(attributes, "source") ?? (event.eventType === "file.event" ? "tool" : "external")
     );
   }
 };
+function provenanceConfidence(attributes) {
+  const value = attributes["provenanceConfidence"];
+  return value === "explicit" || value === "correlated" || value === "inferred" ? value : "unknown";
+}
 
 // src/chronicle/metrics-store.ts
 var ChronicleMetricsStore = class _ChronicleMetricsStore {
@@ -7458,7 +7502,8 @@ var ChronicleMetricsStore = class _ChronicleMetricsStore {
     const where = clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "";
     params.push(clampLimit(options.limit, 200));
     const projection = `path, operation, occurred_at, session_id, agent_id, task_id, board_id, run_id,
-       tool_name, provider_id, model_id, source`;
+       tool_name, provider_id, model_id, logical_request_id, prompt_manifest_id,
+       provenance_confidence, source`;
     const sql = options.latestPerPath ? `SELECT ${projection} FROM (
            SELECT ${projection}, ROW_NUMBER() OVER (
              PARTITION BY path_key ORDER BY occurred_at DESC, event_id DESC
@@ -7479,6 +7524,9 @@ var ChronicleMetricsStore = class _ChronicleMetricsStore {
       toolName: row.tool_name,
       providerId: row.provider_id,
       modelId: row.model_id,
+      logicalRequestId: row.logical_request_id,
+      promptManifestId: row.prompt_manifest_id,
+      provenanceConfidence: row.provenance_confidence,
       source: row.source
     }));
   }
@@ -8128,6 +8176,7 @@ function legacyPartitionPath(location) {
 function useSqliteStore() {
   return process.env["WRONGSTACK_CHRONICLE_STORE"] !== "jsonl";
 }
+var MAX_OPEN_JOURNAL_DAYS = 2;
 var InlineChronicleProjectAccess = class {
   constructor(options) {
     this.options = options;
@@ -8236,6 +8285,26 @@ var InlineChronicleProjectAccess = class {
   get chronicleDirectory() {
     return path16.join(this.options.projectDir, "chronicle");
   }
+  /**
+   * Drop journals for days we will not write to again.
+   *
+   * Mirrors the daemon's `pruneJournals` in `project-server.ts`: without a cap
+   * an inline access object that lives across midnight kept one open
+   * `ChronicleJournal` (with its write buffer and file handle) per day, forever.
+   */
+  pruneJournals(currentDay) {
+    if (this.journals.size <= MAX_OPEN_JOURNAL_DAYS) return;
+    const keep = new Set(
+      [...this.journals.keys()].sort().reverse().slice(0, MAX_OPEN_JOURNAL_DAYS)
+    );
+    keep.add(currentDay);
+    for (const [day, journal] of this.journals) {
+      if (keep.has(day)) continue;
+      this.journals.delete(day);
+      void journal.flush().catch(() => {
+      });
+    }
+  }
   journalForToday() {
     const now = /* @__PURE__ */ new Date();
     const day = now.toISOString().slice(0, 10);
@@ -8252,6 +8321,7 @@ var InlineChronicleProjectAccess = class {
         retentionDays: this.options.retentionDays
       });
       this.journals.set(day, journal);
+      this.pruneJournals(day);
     }
     return journal;
   }

package/dist/security/index.d.ts

@@ -1,6 +1,7 @@
 export { noOpVault } from '../types/secret-vault.js';
 export { clampSubagentCapabilities, DANGEROUS_FOR_SUBAGENTS, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents, ToolCapabilities, type ToolCapability, WIDE_SUBAGENT_CAPABILITIES, } from './capabilities.js';
 export { decryptConfigSecrets, encryptConfigSecrets, isSecretField } from './config-secrets.js';
+export { kanbanGovernance, type KanbanGovernancePort, setKanbanGovernance, } from './kanban-governance-port.js';
 export { DirectoryPermissionPolicy, type DirectoryPermissionPolicyOptions, matchRule, resolveTargetPath, } from './directory-permission-policy.js';
 export { DIRECTORY_POLICY_LIMITS, DIRECTORY_POLICY_SCHEMA_VERSION, type DirectoryPolicyDiagnostic, type DirectoryPolicyDiagnosticCode, type DirectoryPolicyValidationResult, validateDirectoryPolicy, } from './directory-policy-schema.js';
 export { ERROR_DETAIL_MAX, sanitizeApiError, scrubErrorDetail, scrubErrorText, } from './error-sanitize.js';

package/dist/security/index.js

@@ -183,6 +183,20 @@ function isSecretField(name) {
   return SECRET_KEY_PATTERN.test(lc);
 }
 
+// src/security/kanban-governance-port.ts
+var notWired = () => {
+  throw new Error(
+    "KanbanGovernancePort is not wired \u2014 register the implementation at the CLI composition root (see setKanbanGovernance)."
+  );
+};
+var port = void 0;
+function setKanbanGovernance(impl) {
+  port = impl;
+}
+function kanbanGovernance() {
+  return port ?? notWired();
+}
+
 // src/security/directory-permission-policy.ts
 import * as path from "node:path";
 
@@ -1318,14 +1332,7 @@ import {
 // src/security/kanban-boundary.ts
 import { realpath } from "node:fs/promises";
 import * as path2 from "node:path";
-import {
-  evaluateContractGraphReadiness,
-  evaluateKanbanBoundaryOpaque,
-  evaluateKanbanBoundaryPath,
-  readBoard,
-  resolveKanbanBoundaryLayers
-} from "@wrongstack/kanban";
-var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo"]);
+var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo", "nextsteps"]);
 var PATH_KEYS2 = /* @__PURE__ */ new Set([
   "path",
   "paths",
@@ -1360,7 +1367,10 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
       reason: "Kanban governance is mandatory before product mutation. Create a managed card, add its required details and executable acceptance criteria, then call kanban start_task to bind it to this run."
     } : { decision: "allow" };
   }
-  const board = await readBoard(identity.policyRoot ?? ctx.projectRoot, identity.boardId);
+  const board = await kanbanGovernance().readBoard(
+    identity.policyRoot ?? ctx.projectRoot,
+    identity.boardId
+  );
   if (!board) {
     return governanceRequired ? {
       decision: "block",
@@ -1386,22 +1396,39 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
         taskId: identity.taskId
       };
     }
-    const readiness = evaluateContractGraphReadiness(board, task.id);
+    const readiness = kanbanGovernance().evaluateContractGraphReadiness(board, task.id);
     if (!readiness.ready) {
+      const issueLines = readiness.issues.map((issue, index) => `  ${index + 1}. ${issue.message}`).join("\n");
       return {
         decision: "block",
-        reason: "Active card is not implementation-ready: " + readiness.issues.map((issue) => issue.message).join(" | "),
+        reason: `Active card failed contract-readiness check (${readiness.issues.length} issue(s)):
+` + issueLines + `
+Resolve the readiness issues, then call kanban start_task to retry.`,
         boardId: board.id,
         taskId: task.id,
         readinessIssues: readiness.issues
       };
     }
-    if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {
-      const lifecycleStage = task.lifecycle?.currentStage ?? "missing";
-      const assignmentStatus = task.assignment?.status ?? "missing";
+    const lifecycleStage = task.lifecycle?.currentStage;
+    const assignmentStatus = task.assignment?.status;
+    const lifecycleOk = lifecycleStage === "running";
+    const assignmentOk = assignmentStatus === "running";
+    if (!lifecycleOk || !assignmentOk) {
+      const failed = [];
+      let reassessmentNote = "";
+      if (!lifecycleOk) {
+        failed.push(`lifecycle.currentStage (got: ${lifecycleStage ?? "missing"}; want: 'running')`);
+      }
+      if (!assignmentOk) {
+        failed.push(`assignment.status (got: ${assignmentStatus ?? "missing"}; want: 'running')`);
+        if (lifecycleOk && (assignmentStatus === "queued" || assignmentStatus === void 0 || assignmentStatus === null)) {
+          reassessmentNote = '\nNote: lifecycle is still "running" but the assignment was cleared \u2014 the automated kanban reassessment agent likely reset the binding. Re-issue kanban start_task to re-bind the leader to this card.';
+        }
+      }
       return {
         decision: "block",
-        reason: `Active card must be in Running with a live assignment before product mutation (lifecycle: ${lifecycleStage}; assignment: ${assignmentStatus}). Call kanban start_task after completing the required card details.`,
+        reason: `Active card failed ${failed.length} governance check(s) before product mutation:
+` + failed.map((line, index) => `  ${index + 1}. ${line}`).join("\n") + reassessmentNote,
         boardId: board.id,
         taskId: task.id
       };
@@ -1419,7 +1446,7 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
       };
     }
   }
-  const layers = resolveKanbanBoundaryLayers(board, task);
+  const layers = kanbanGovernance().resolveKanbanBoundaryLayers(board, task);
   if (layers.length === 0) return { decision: "allow" };
   const caps = tool.capabilities ?? [];
   const access = caps.includes("fs.write") || caps.includes("fs.write.outside-project") ? "write" : caps.includes("fs.read") ? "read" : void 0;
@@ -1427,10 +1454,10 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
   const candidates = access ? await extractCandidatePaths(tool.name, input, ctx) : [];
   let evaluation;
   if (shellLike || access && candidates.length === 0) {
-    evaluation = evaluateKanbanBoundaryOpaque(layers, tool.name);
+    evaluation = kanbanGovernance().evaluateKanbanBoundaryOpaque(layers, tool.name);
   } else if (access) {
     const results = candidates.map(
-      (candidate) => evaluateKanbanBoundaryPath(layers, candidate, access)
+      (candidate) => kanbanGovernance().evaluateKanbanBoundaryPath(layers, candidate, access)
     );
     evaluation = results.find((result) => result.decision === "block") ?? results.find((result) => result.decision === "confirm") ?? { decision: "allow" };
   } else {
@@ -4387,6 +4414,7 @@ export {
   hashRecoveryCode,
   isSecretField,
   isTrustDecisionAllowed,
+  kanbanGovernance,
   matchRule,
   migratePlaintextSecrets,
   noOpVault,
@@ -4398,6 +4426,7 @@ export {
   sanitizeApiError,
   scrubErrorDetail,
   scrubErrorText,
+  setKanbanGovernance,
   toolMutates,
   validateDirectoryPolicy,
   validateTrustPolicy,

package/dist/security/kanban-boundary.d.ts

@@ -1,4 +1,4 @@
-import { type KanbanBoundaryEvaluation, type KanbanContractReadinessIssue } from '@wrongstack/kanban';
+import type { KanbanBoundaryEvaluation, KanbanContractReadinessIssue } from '@wrongstack/kanban';
 import type { Context } from '../core/context.js';
 import type { Tool } from '../types/tool.js';
 export interface ToolKanbanBoundaryEvaluation extends KanbanBoundaryEvaluation {

package/dist/security/kanban-governance-port.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Kanban governance-evaluation port for the security area.
+ *
+ * `kanban-boundary.ts` previously imported the boundary evaluation and
+ * board-read functions directly from `@wrongstack/kanban`, keeping a
+ * core → kanban runtime edge (roadmap #11 / report §2.1). This port is
+ * the leaf contract; the CLI composition root registers the real
+ * implementation at boot alongside the storage and coordination ports.
+ *
+ * Type-only imports of kanban's data shapes remain permitted — they erase
+ * at compile time and do not create a runtime edge.
+ */
+import type { KanbanBoundaryAccess, KanbanBoundaryEvaluation, KanbanBoundaryLayer, KanbanBoard, KanbanContractReadinessIssue, KanbanTask } from '@wrongstack/kanban';
+export interface KanbanGovernancePort {
+    readBoard(projectRoot: string, boardId: string): Promise<KanbanBoard | null>;
+    resolveKanbanBoundaryLayers(board: KanbanBoard, task: Pick<KanbanTask, 'boundary'> | null | undefined): KanbanBoundaryLayer[];
+    evaluateKanbanBoundaryOpaque(layers: KanbanBoundaryLayer[], toolName: string): KanbanBoundaryEvaluation;
+    evaluateKanbanBoundaryPath(layers: KanbanBoundaryLayer[], candidate: unknown, access: KanbanBoundaryAccess): KanbanBoundaryEvaluation;
+    evaluateContractGraphReadiness(board: KanbanBoard, taskId: string): {
+        ready: boolean;
+        issues: KanbanContractReadinessIssue[];
+    };
+}
+/** Composition-root hook: register the real kanban-backed implementation. */
+export declare function setKanbanGovernance(impl: KanbanGovernancePort): void;
+/** Resolve the governance port (throws when not wired, mirroring BoardStorePort). */
+export declare function kanbanGovernance(): KanbanGovernancePort;
+//# sourceMappingURL=kanban-governance-port.d.ts.map

package/dist/session-catalog/index.js

@@ -740,7 +740,7 @@ import * as fs5 from "node:fs";
 import * as path5 from "node:path";
 
 // src/coordination/sqlite-mailbox-schema.ts
-import { createRequire } from "node:module";
+import { loadRuntimeDatabaseSync } from "@wrongstack/persistence";
 
 // src/utils/sqlite-warning.ts
 var SQLITE_EXPERIMENTAL_WARNING_RE = /sqlite is an experimental feature/i;
@@ -770,8 +770,7 @@ var DatabaseSyncCtor;
 function loadDatabaseSync() {
   if (DatabaseSyncCtor) return DatabaseSyncCtor;
   return withSqliteExperimentalWarningSuppressed(() => {
-    const require2 = createRequire(import.meta.url);
-    DatabaseSyncCtor = require2("node:sqlite").DatabaseSync;
+    DatabaseSyncCtor = loadRuntimeDatabaseSync();
     return DatabaseSyncCtor;
   });
 }

package/dist/session-catalog/project-server.js

@@ -184,7 +184,7 @@ import * as fs2 from "node:fs";
 import * as path3 from "node:path";
 
 // src/coordination/sqlite-mailbox-schema.ts
-import { createRequire } from "node:module";
+import { loadRuntimeDatabaseSync } from "@wrongstack/persistence";
 
 // src/utils/sqlite-warning.ts
 var SQLITE_EXPERIMENTAL_WARNING_RE = /sqlite is an experimental feature/i;
@@ -214,8 +214,7 @@ var DatabaseSyncCtor;
 function loadDatabaseSync() {
   if (DatabaseSyncCtor) return DatabaseSyncCtor;
   return withSqliteExperimentalWarningSuppressed(() => {
-    const require2 = createRequire(import.meta.url);
-    DatabaseSyncCtor = require2("node:sqlite").DatabaseSync;
+    DatabaseSyncCtor = loadRuntimeDatabaseSync();
     return DatabaseSyncCtor;
   });
 }

package/dist/session-catalog/protocol.d.ts

@@ -1,4 +1,4 @@
-import type { SessionRegistryEntry } from '../session-registry-types.js';
+import type { SessionRegistryEntry } from './session-registry-types.js';
 import type { SessionSummary } from '../types/session.js';
 export declare const SESSION_CATALOG_PROTOCOL_VERSION = 1;
 export declare const SESSION_CATALOG_MAX_FRAME_CHARS: number;

package/dist/session-catalog/registry.d.ts

@@ -1,4 +1,4 @@
-import type { AgentEntry, SessionRegistryEntry } from '../session-registry-types.js';
+import type { AgentEntry, SessionRegistryEntry } from './session-registry-types.js';
 import type { ResumeReservation, SessionCatalogEvent } from './protocol.js';
 export interface SessionResumeClaim {
     reservation: ResumeReservation;

package/dist/session-catalog/store-schema.d.ts

@@ -1,5 +1,5 @@
 import type { DatabaseSync } from 'node:sqlite';
-import type { SessionRegistryEntry } from '../session-registry-types.js';
+import type { SessionRegistryEntry } from './session-registry-types.js';
 export declare const SCHEMA_VERSION = 1;
 export declare const MAX_LEASE_MS = 120000;
 export declare const MAX_RESERVATION_MS = 60000;

package/dist/session-catalog/store.d.ts

@@ -1,4 +1,4 @@
-import type { SessionRegistryEntry } from '../session-registry-types.js';
+import type { SessionRegistryEntry } from './session-registry-types.js';
 import type { SessionSummary } from '../types/session.js';
 import type { CatalogSessionRecord, MaintenanceLease, ResumeReservation, SessionCatalogHealth, SessionCatalogListArgs, SessionLeaseCredential } from './protocol.js';
 export declare class SessionCatalogStore {

package/dist/storage/annotations-store.d.ts

@@ -1,4 +1,4 @@
-import type { EventBus } from '../kernel/events.js';
+import type { EventBus } from './event-bus-port.js';
 /**
  * L2-B: AnnotationsStore — sidecar storage for collaboration annotations
  * (Phase 2 of idea #13 from IDEAS.md).