@wrongstack/governance 0.299.0 → 0.301.0

package/dist/capability-grant.d.ts

@@ -112,6 +112,14 @@ export declare class GovernanceCapabilityGrantRegistry {
     sweepExpired(reason?: string): number;
     getGrant(grantId: string): GovernanceCapabilityGrant | null;
     remainingTtlMs(grantId: string): number | null;
+    /**
+     * Ordering is deliberately byte-wise rather than locale-aware. Both keys are
+     * ASCII by construction — `issuedAt` is an ISO-8601 timestamp and `grantId`
+     * matches `^[A-Za-z0-9_-]{1,128}$` — so the two orders are identical, but
+     * `localeCompare` would make the order depend on the host's default locale.
+     * This list backs the `list_capability_grants` cursor, and a cursor is only
+     * sound while the order it walks is stable across the requests that walk it.
+     */
     listGrants(): readonly GovernanceCapabilityGrant[];
     private parseToken;
     private describe;

package/dist/event-store.d.ts

@@ -4,6 +4,20 @@ import type { VerificationRunContract } from './verification-run-contract.js';
 import type { RecordWorkspaceSnapshotResult, WorkspaceSnapshotFenceDescriptor } from './workspace-snapshot-fence.js';
 export declare const GOVERNANCE_OBSERVATION_CATEGORIES: readonly ['task_created', 'status_changed', 'plan_updated', 'tool_invoked', 'evidence_candidate', 'verification_reported', 'review_reported', 'completion_claimed', 'failure_reported', 'capability_grant_issued', 'capability_grant_revoked', 'capability_grant_expired', 'capability_grant_rotated', 'daemon_attachment_broker_lifecycle', 'daemon_shutdown_requested'];
 export type GovernanceObservationCategory = (typeof GOVERNANCE_OBSERVATION_CATEGORIES)[number];
+export declare const GOVERNANCE_OBSERVATION_DEFAULT_PAGE_SIZE = 50;
+export declare const GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE = 100;
+export interface ReadGovernanceObservationsPageOptions {
+    readonly projectId: string;
+    readonly taskId?: string | undefined;
+    /**
+     * Exact set of categories to return. Callers pass the closed enum subset they
+     * are entitled to rather than filtering after the fact, so the database never
+     * hands back rows that are about to be discarded.
+     */
+    readonly categories: readonly GovernanceObservationCategory[];
+    readonly afterSequence: number;
+    readonly limit: number;
+}
 export interface GovernanceObservation {
     readonly observationId: string;
     readonly projectId: string;
@@ -51,7 +65,7 @@ export interface GovernanceEventStore {
     readEvents(taskId: string): readonly GovernanceEvent[];
     readReceipt(commandId: string): GovernanceCommandReceipt | null;
     appendObservation(observation: GovernanceObservation): AppendGovernanceObservationResult;
-    readObservations(projectId: string, taskId?: string): readonly StoredGovernanceObservation[];
+    readObservationsPage(options: ReadGovernanceObservationsPageOptions): readonly StoredGovernanceObservation[];
     readEvidenceCandidateObservations(projectId: string, taskId: string, options: {
         readonly afterSequence: number;
         readonly limit: number;
@@ -84,7 +98,19 @@ export declare class SqliteGovernanceEventStore implements GovernanceEventStore
     readEvents(taskId: string): readonly GovernanceEvent[];
     readReceipt(commandId: string): GovernanceCommandReceipt | null;
     appendObservation(observation: GovernanceObservation): AppendGovernanceObservationResult;
-    readObservations(projectId: string, taskId?: string): readonly StoredGovernanceObservation[];
+    /**
+     * Paginated, category-filtered observation read.
+     *
+     * The observations table is append-only — its UPDATE and DELETE triggers say
+     * so — and therefore grows without bound for the lifetime of a project. The
+     * previous unpaginated read loaded every row a project had ever recorded and
+     * left the caller to filter in JavaScript, which cost 148 MB and 400 ms at
+     * 100 000 rows and produced a 8.9 MB response: already past the 8 MB IPC
+     * frame cap, so the endpoint could not succeed at all past that point. Both
+     * the category filter and the page window belong in SQL, matching what
+     * `readEvidenceCandidateObservations` already does.
+     */
+    readObservationsPage(options: ReadGovernanceObservationsPageOptions): readonly StoredGovernanceObservation[];
     readEvidenceCandidateObservations(projectId: string, taskId: string, options: {
         readonly afterSequence: number;
         readonly limit: number;

package/dist/index.js

@@ -309,12 +309,22 @@ var GovernanceCapabilityGrantRegistry = class {
     const remaining = record.expiresAtMs - this.now();
     return remaining > 0 ? remaining : null;
   }
+  /**
+   * Ordering is deliberately byte-wise rather than locale-aware. Both keys are
+   * ASCII by construction — `issuedAt` is an ISO-8601 timestamp and `grantId`
+   * matches `^[A-Za-z0-9_-]{1,128}$` — so the two orders are identical, but
+   * `localeCompare` would make the order depend on the host's default locale.
+   * This list backs the `list_capability_grants` cursor, and a cursor is only
+   * sound while the order it walks is stable across the requests that walk it.
+   */
   listGrants() {
     const now = this.now();
     return Object.freeze(
-      [...this.records.values()].map((record) => this.describe(record, now)).sort(
-        (left, right) => left.issuedAt.localeCompare(right.issuedAt) || left.grantId.localeCompare(right.grantId)
-      )
+      [...this.records.values()].map((record) => this.describe(record, now)).sort((left, right) => {
+        if (left.issuedAt !== right.issuedAt) return left.issuedAt < right.issuedAt ? -1 : 1;
+        if (left.grantId === right.grantId) return 0;
+        return left.grantId < right.grantId ? -1 : 1;
+      })
     );
   }
   parseToken(token) {
@@ -1076,7 +1086,8 @@ var GovernanceProjectClient = class {
     return new Promise((resolve6, reject3) => {
       const socket = net2.createConnection(this.endpoint);
       let settled = false;
-      let buffer = Buffer.alloc(0);
+      const chunks = [];
+      let size = 0;
       const finish = (error, response) => {
         if (settled) return;
         settled = true;
@@ -1090,15 +1101,21 @@ var GovernanceProjectClient = class {
       }, this.timeoutMs);
       socket.once("connect", () => socket.write(frame));
       socket.on("data", (chunk) => {
-        buffer = Buffer.concat([buffer, chunk]);
-        if (buffer.byteLength > GOVERNANCE_IPC_MAX_FRAME_BYTES) {
+        if (settled) return;
+        const newline = chunk.indexOf(10);
+        const frameBytes = size + (newline < 0 ? chunk.byteLength : newline);
+        if (frameBytes > GOVERNANCE_IPC_MAX_FRAME_BYTES) {
           finish(new Error("Governance IPC response exceeded the frame limit."));
           return;
         }
-        const newline = buffer.indexOf(10);
-        if (newline < 0) return;
+        if (newline < 0) {
+          chunks.push(chunk);
+          size = frameBytes;
+          return;
+        }
+        chunks.push(chunk.subarray(0, newline));
         try {
-          const parsed = JSON.parse(buffer.subarray(0, newline).toString("utf8"));
+          const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
           const response = decodeGovernanceIpcResponse(parsed);
           const expectedRequestId = request && typeof request === "object" && "requestId" in request && typeof request.requestId === "string" ? request.requestId : null;
           if (expectedRequestId && response.requestId !== expectedRequestId) {
@@ -1204,7 +1221,9 @@ var GOVERNANCE_CREDENTIAL_LEASE_DEFAULT_RETRY_MS = 1e3;
 var GOVERNANCE_CREDENTIAL_LEASE_DEFAULT_MAX_ATTEMPTS = 3;
 var defaultScheduler = {
   schedule(callback, delayMs) {
-    return setTimeout(callback, delayMs);
+    const handle = setTimeout(callback, delayMs);
+    handle.unref();
+    return handle;
   },
   cancel(handle) {
     clearTimeout(handle);
@@ -1438,7 +1457,7 @@ var GovernanceCredentialLeaseController = class {
     this.timer = this.scheduler.schedule(() => {
       this.timer = void 0;
       this.nextActionAtMs = void 0;
-      void this.rotateNow();
+      void this.rotateNow().catch(() => void 0);
     }, delayMs);
   }
   clearTimer() {
@@ -2245,27 +2264,29 @@ function findCycle(steps, edges) {
   for (const edge of edges) adjacency.get(edge.fromStepId)?.push(edge.toStepId);
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
-  const stack = [];
-  const visit = (stepId) => {
-    if (visiting.has(stepId)) {
-      const cycleStart = stack.indexOf(stepId);
-      return [...stack.slice(cycleStart), stepId];
-    }
-    if (visited.has(stepId)) return null;
-    visiting.add(stepId);
-    stack.push(stepId);
-    for (const next of adjacency.get(stepId) ?? []) {
-      const cycle = visit(next);
-      if (cycle) return cycle;
-    }
-    stack.pop();
-    visiting.delete(stepId);
-    visited.add(stepId);
-    return null;
-  };
+  const path6 = [];
   for (const step of steps) {
-    const cycle = visit(step.id);
-    if (cycle) return cycle;
+    if (visited.has(step.id)) continue;
+    visiting.add(step.id);
+    path6.push(step.id);
+    const frames = [{ id: step.id, next: adjacency.get(step.id) ?? [], index: 0 }];
+    while (frames.length > 0) {
+      const frame = frames[frames.length - 1];
+      if (frame.index < frame.next.length) {
+        const next = frame.next[frame.index];
+        frame.index += 1;
+        if (visiting.has(next)) return [...path6.slice(path6.indexOf(next)), next];
+        if (visited.has(next)) continue;
+        visiting.add(next);
+        path6.push(next);
+        frames.push({ id: next, next: adjacency.get(next) ?? [], index: 0 });
+        continue;
+      }
+      frames.pop();
+      path6.pop();
+      visiting.delete(frame.id);
+      visited.add(frame.id);
+    }
   }
   return null;
 }
@@ -4393,6 +4414,8 @@ var GOVERNANCE_OBSERVATION_CATEGORIES = [
   "daemon_attachment_broker_lifecycle",
   "daemon_shutdown_requested"
 ];
+var GOVERNANCE_OBSERVATION_DEFAULT_PAGE_SIZE = 50;
+var GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE = 100;
 var GovernanceStoreCorruptionError = class extends Error {
   constructor(message) {
     super(message);
@@ -4590,21 +4613,47 @@ var SqliteGovernanceEventStore = class _SqliteGovernanceEventStore {
       throw error;
     }
   }
-  readObservations(projectId, taskId) {
+  /**
+   * Paginated, category-filtered observation read.
+   *
+   * The observations table is append-only — its UPDATE and DELETE triggers say
+   * so — and therefore grows without bound for the lifetime of a project. The
+   * previous unpaginated read loaded every row a project had ever recorded and
+   * left the caller to filter in JavaScript, which cost 148 MB and 400 ms at
+   * 100 000 rows and produced a 8.9 MB response: already past the 8 MB IPC
+   * frame cap, so the endpoint could not succeed at all past that point. Both
+   * the category filter and the page window belong in SQL, matching what
+   * `readEvidenceCandidateObservations` already does.
+   */
+  readObservationsPage(options) {
     this.assertOpen();
-    const rows = taskId === void 0 ? this.db.prepare(
-      `SELECT sequence, observation_id, project_id, task_id, source, category,
-                    observation_json, observation_hash, observed_at, recorded_at
-             FROM governance_observations
-             WHERE project_id = ?
-             ORDER BY sequence`
-    ).all(projectId) : this.db.prepare(
+    if (!Number.isSafeInteger(options.afterSequence) || options.afterSequence < 0) {
+      throw new Error("Observation cursor must be a non-negative safe integer.");
+    }
+    if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE + 1) {
+      throw new Error(
+        `Observation query limit must be between 1 and ${GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE + 1}.`
+      );
+    }
+    if (options.categories.length === 0) return Object.freeze([]);
+    const parameters = [options.projectId];
+    let where = "project_id = ?";
+    if (options.taskId !== void 0) {
+      where += " AND task_id = ?";
+      parameters.push(options.taskId);
+    }
+    where += ` AND category IN (${options.categories.map(() => "?").join(",")})`;
+    parameters.push(...options.categories);
+    where += " AND sequence > ?";
+    parameters.push(options.afterSequence, options.limit);
+    const rows = this.db.prepare(
       `SELECT sequence, observation_id, project_id, task_id, source, category,
-                    observation_json, observation_hash, observed_at, recorded_at
-             FROM governance_observations
-             WHERE project_id = ? AND task_id = ?
-             ORDER BY sequence`
-    ).all(projectId, taskId);
+                observation_json, observation_hash, observed_at, recorded_at
+         FROM governance_observations
+         WHERE ${where}
+         ORDER BY sequence
+         LIMIT ?`
+    ).all(...parameters);
     return Object.freeze(rows.map((row) => this.observationFromRow(row)));
   }
   readEvidenceCandidateObservations(projectId, taskId, options) {
@@ -4878,7 +4927,18 @@ var MAX_NESTING_DEPTH = 32;
 var MAX_ARRAY_ITEMS = 1e4;
 var MAX_OBJECT_KEYS = 1e3;
 var MAX_STRING_LENGTH = 1e6;
+var MAX_ISSUES = 100;
 function issue2(issues, code, path6, message) {
+  if (issues.length >= MAX_ISSUES) {
+    if (issues.length === MAX_ISSUES) {
+      issues.push({
+        code: "resource_limit",
+        path: "$",
+        message: `Validation stopped after ${MAX_ISSUES} issues.`
+      });
+    }
+    return;
+  }
   issues.push({ code, path: path6, message });
 }
 function plainRecord4(value, path6, issues) {
@@ -4970,23 +5030,24 @@ function enumArray(value, allowed, path6, issues) {
     (entry, entryPath, target) => enumValue(entry, allowed, entryPath, target)
   );
 }
-function capabilityArray(value, path6, issues) {
+function boundedCapabilityArray(value, allowed, noun, path6, issues) {
   if (!Array.isArray(value)) {
     issue2(issues, "expected_array", path6, `${path6} must be an array.`);
     return;
   }
-  if (value.length === 0 || value.length > GOVERNANCE_SERVICE_CAPABILITIES.length) {
+  if (value.length === 0 || value.length > allowed.length) {
     issue2(
       issues,
       "resource_limit",
       path6,
-      `${path6} must contain between 1 and ${GOVERNANCE_SERVICE_CAPABILITIES.length} capabilities.`
+      `${path6} must contain between 1 and ${allowed.length} ${noun}.`
     );
+    return;
   }
   const seen = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.length; index += 1) {
     const entryPath = `${path6}[${index}]`;
-    enumValue(value[index], GOVERNANCE_SERVICE_CAPABILITIES, entryPath, issues);
+    enumValue(value[index], allowed, entryPath, issues);
     if (typeof value[index] === "string") {
       if (seen.has(value[index])) {
         issue2(issues, "semantic_invalid", entryPath, `${entryPath} duplicates a capability.`);
@@ -4995,30 +5056,17 @@ function capabilityArray(value, path6, issues) {
     }
   }
 }
+function capabilityArray(value, path6, issues) {
+  boundedCapabilityArray(value, GOVERNANCE_SERVICE_CAPABILITIES, "capabilities", path6, issues);
+}
 function runtimeModelCapabilityArray(value, path6, issues) {
-  if (!Array.isArray(value)) {
-    issue2(issues, "expected_array", path6, `${path6} must be an array.`);
-    return;
-  }
-  if (value.length === 0 || value.length > GOVERNANCE_RUNTIME_MODEL_CAPABILITIES.length) {
-    issue2(
-      issues,
-      "resource_limit",
-      path6,
-      `${path6} must contain between 1 and ${GOVERNANCE_RUNTIME_MODEL_CAPABILITIES.length} model-safe capabilities.`
-    );
-  }
-  const seen = /* @__PURE__ */ new Set();
-  for (let index = 0; index < value.length; index += 1) {
-    const entryPath = `${path6}[${index}]`;
-    enumValue(value[index], GOVERNANCE_RUNTIME_MODEL_CAPABILITIES, entryPath, issues);
-    if (typeof value[index] === "string") {
-      if (seen.has(value[index])) {
-        issue2(issues, "semantic_invalid", entryPath, `${entryPath} duplicates a capability.`);
-      }
-      seen.add(value[index]);
-    }
-  }
+  boundedCapabilityArray(
+    value,
+    GOVERNANCE_RUNTIME_MODEL_CAPABILITIES,
+    "model-safe capabilities",
+    path6,
+    issues
+  );
 }
 function jsonValue(value, path6, issues, depth = 0) {
   if (depth > MAX_NESTING_DEPTH) {
@@ -5328,6 +5376,21 @@ function validateObservation(value, path6, issues) {
   const payload = plainRecord4(record.payload, `${path6}.payload`, issues);
   if (payload) jsonValue(payload, `${path6}.payload`, issues);
 }
+function observationPageWindow(record, issues) {
+  if (record.afterSequence !== void 0) {
+    integerValue(record.afterSequence, "$.afterSequence", issues);
+  }
+  if (record.limit === void 0) return;
+  integerValue(record.limit, "$.limit", issues, 1);
+  if (typeof record.limit === "number" && record.limit > GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE) {
+    issue2(
+      issues,
+      "resource_limit",
+      "$.limit",
+      `$.limit must not exceed ${GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE}.`
+    );
+  }
+}
 function deepFreeze4(value) {
   if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
   for (const nested of Object.values(value)) deepFreeze4(nested);
@@ -5360,8 +5423,14 @@ function decodeGovernanceServiceRequest(input) {
       stringValue(record.commandId, "$.commandId", issues);
       break;
     case "read_observations":
-      exactKeys2(record, ["protocolVersion", "requestId", "type", "taskId"], "$", issues);
+      exactKeys2(
+        record,
+        ["protocolVersion", "requestId", "type", "taskId", "afterSequence", "limit"],
+        "$",
+        issues
+      );
       if (record.taskId !== void 0) stringValue(record.taskId, "$.taskId", issues);
+      observationPageWindow(record, issues);
       break;
     case "read_evidence_candidates":
       exactKeys2(
@@ -5387,6 +5456,14 @@ function decodeGovernanceServiceRequest(input) {
       }
       break;
     case "read_audit_observations":
+      exactKeys2(
+        record,
+        ["protocolVersion", "requestId", "type", "afterSequence", "limit"],
+        "$",
+        issues
+      );
+      observationPageWindow(record, issues);
+      break;
     case "read_own_capability_grant":
     case "read_daemon_status":
       exactKeys2(record, ["protocolVersion", "requestId", "type"], "$", issues);
@@ -6577,6 +6654,12 @@ function fail(requestId, code, message, details) {
 function reservedAuditCategory(category) {
   return category.startsWith("capability_grant_") || category.startsWith("daemon_");
 }
+var AUDIT_OBSERVATION_CATEGORIES = Object.freeze(
+  GOVERNANCE_OBSERVATION_CATEGORIES.filter((category) => reservedAuditCategory(category))
+);
+var TASK_OBSERVATION_CATEGORIES = Object.freeze(
+  GOVERNANCE_OBSERVATION_CATEGORIES.filter((category) => !reservedAuditCategory(category))
+);
 var GovernanceProjectService = class {
   constructor(projectId, store, resolveDecisionContext = () => ({})) {
     this.projectId = projectId;
@@ -6704,14 +6787,13 @@ var GovernanceProjectService = class {
         };
       }
       case "read_observations":
-        return {
-          ok: true,
+        return this.observationPage(
           requestId,
-          result: {
-            type: "observations",
-            observations: this.store.readObservations(this.projectId, request.taskId).filter((observation) => !reservedAuditCategory(observation.category))
-          }
-        };
+          TASK_OBSERVATION_CATEGORIES,
+          request.taskId,
+          request.afterSequence,
+          request.limit
+        );
       case "read_evidence_candidates": {
         const limit = request.limit ?? GOVERNANCE_EVIDENCE_CANDIDATE_DEFAULT_PAGE_SIZE;
         const rows = this.store.readEvidenceCandidateObservations(this.projectId, request.taskId, {
@@ -6735,14 +6817,13 @@ var GovernanceProjectService = class {
         };
       }
       case "read_audit_observations":
-        return {
-          ok: true,
+        return this.observationPage(
           requestId,
-          result: {
-            type: "observations",
-            observations: this.store.readObservations(this.projectId).filter((observation) => reservedAuditCategory(observation.category))
-          }
-        };
+          AUDIT_OBSERVATION_CATEGORIES,
+          void 0,
+          request.afterSequence,
+          request.limit
+        );
       case "submit_command": {
         if (!this.commandBelongsToProject(request.command)) {
           return fail(
@@ -6804,6 +6885,31 @@ var GovernanceProjectService = class {
         );
     }
   }
+  /**
+   * Shared body for both observation reads. Fetches one row past the page so
+   * the presence of a further page is known without a second query — the same
+   * convention `read_evidence_candidates` uses.
+   */
+  observationPage(requestId, categories, taskId, afterSequence, limit) {
+    const pageSize = limit ?? GOVERNANCE_OBSERVATION_DEFAULT_PAGE_SIZE;
+    const rows = this.store.readObservationsPage({
+      projectId: this.projectId,
+      ...taskId === void 0 ? {} : { taskId },
+      categories,
+      afterSequence: afterSequence ?? 0,
+      limit: pageSize + 1
+    });
+    const page = rows.slice(0, pageSize);
+    return {
+      ok: true,
+      requestId,
+      result: {
+        type: "observations",
+        observations: page,
+        nextAfterSequence: rows.length > pageSize && page.length > 0 ? page.at(-1)?.sequence ?? null : null
+      }
+    };
+  }
   commandBelongsToProject(command) {
     if (command.type === "create_task") {
       return command.projectId === this.projectId && command.contract.projectId === this.projectId;
@@ -7078,12 +7184,14 @@ var GovernanceProjectServer = class {
     else socket.destroy();
   }
   accept(socket) {
-    let buffer = Buffer.alloc(0);
+    const chunks = [];
+    let size = 0;
     let handled = false;
     socket.on("data", (chunk) => {
       if (handled) return;
-      buffer = Buffer.concat([buffer, chunk]);
-      if (buffer.byteLength > GOVERNANCE_IPC_MAX_FRAME_BYTES) {
+      const newline = chunk.indexOf(10);
+      const frameBytes = size + (newline < 0 ? chunk.byteLength : newline);
+      if (frameBytes > GOVERNANCE_IPC_MAX_FRAME_BYTES) {
         handled = true;
         this.send(
           socket,
@@ -7091,10 +7199,14 @@ var GovernanceProjectServer = class {
         );
         return;
       }
-      const newline = buffer.indexOf(10);
-      if (newline < 0) return;
+      if (newline < 0) {
+        chunks.push(chunk);
+        size = frameBytes;
+        return;
+      }
       handled = true;
-      const line = buffer.subarray(0, newline).toString("utf8").replace(/\r$/, "");
+      chunks.push(chunk.subarray(0, newline));
+      const line = Buffer.concat(chunks).toString("utf8").replace(/\r$/, "");
       this.handleLine(socket, line);
     });
   }
@@ -7325,10 +7437,10 @@ var GovernanceCompatibilityRuntime = class {
     this.#closePromise = this.revokeModelGrant().then((response) => {
       if (response.ok && response.result.type === "capability_grant_revoked") {
         this.#closed = true;
-        adminSession.stop();
       }
       return response;
     }).finally(() => {
+      adminSession.stop();
       this.#closePromise = void 0;
     });
     return this.#closePromise;
@@ -8348,6 +8460,8 @@ export {
   GOVERNANCE_MANAGEMENT_RECEIPT_MAX_ENTRIES,
   GOVERNANCE_MANAGEMENT_RECEIPT_TTL_MS,
   GOVERNANCE_OBSERVATION_CATEGORIES,
+  GOVERNANCE_OBSERVATION_DEFAULT_PAGE_SIZE,
+  GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE,
   GOVERNANCE_RUNTIME_ATTACHMENT_MAX_TTL_MS,
   GOVERNANCE_SERVICE_CAPABILITIES,
   GOVERNANCE_SERVICE_PROTOCOL_VERSION,

package/dist/project-daemon.js

@@ -1333,27 +1333,29 @@ function findCycle(steps, edges) {
   for (const edge of edges) adjacency.get(edge.fromStepId)?.push(edge.toStepId);
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
-  const stack = [];
-  const visit = (stepId) => {
-    if (visiting.has(stepId)) {
-      const cycleStart = stack.indexOf(stepId);
-      return [...stack.slice(cycleStart), stepId];
-    }
-    if (visited.has(stepId)) return null;
-    visiting.add(stepId);
-    stack.push(stepId);
-    for (const next of adjacency.get(stepId) ?? []) {
-      const cycle = visit(next);
-      if (cycle) return cycle;
-    }
-    stack.pop();
-    visiting.delete(stepId);
-    visited.add(stepId);
-    return null;
-  };
+  const path5 = [];
   for (const step of steps) {
-    const cycle = visit(step.id);
-    if (cycle) return cycle;
+    if (visited.has(step.id)) continue;
+    visiting.add(step.id);
+    path5.push(step.id);
+    const frames = [{ id: step.id, next: adjacency.get(step.id) ?? [], index: 0 }];
+    while (frames.length > 0) {
+      const frame = frames[frames.length - 1];
+      if (frame.index < frame.next.length) {
+        const next = frame.next[frame.index];
+        frame.index += 1;
+        if (visiting.has(next)) return [...path5.slice(path5.indexOf(next)), next];
+        if (visited.has(next)) continue;
+        visiting.add(next);
+        path5.push(next);
+        frames.push({ id: next, next: adjacency.get(next) ?? [], index: 0 });
+        continue;
+      }
+      frames.pop();
+      path5.pop();
+      visiting.delete(frame.id);
+      visited.add(frame.id);
+    }
   }
   return null;
 }
@@ -2907,6 +2909,8 @@ var GOVERNANCE_OBSERVATION_CATEGORIES = [
   "daemon_attachment_broker_lifecycle",
   "daemon_shutdown_requested"
 ];
+var GOVERNANCE_OBSERVATION_DEFAULT_PAGE_SIZE = 50;
+var GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE = 100;
 var GovernanceStoreCorruptionError = class extends Error {
   constructor(message) {
     super(message);
@@ -3104,21 +3108,47 @@ var SqliteGovernanceEventStore = class _SqliteGovernanceEventStore {
       throw error;
     }
   }
-  readObservations(projectId, taskId) {
+  /**
+   * Paginated, category-filtered observation read.
+   *
+   * The observations table is append-only — its UPDATE and DELETE triggers say
+   * so — and therefore grows without bound for the lifetime of a project. The
+   * previous unpaginated read loaded every row a project had ever recorded and
+   * left the caller to filter in JavaScript, which cost 148 MB and 400 ms at
+   * 100 000 rows and produced a 8.9 MB response: already past the 8 MB IPC
+   * frame cap, so the endpoint could not succeed at all past that point. Both
+   * the category filter and the page window belong in SQL, matching what
+   * `readEvidenceCandidateObservations` already does.
+   */
+  readObservationsPage(options) {
     this.assertOpen();
-    const rows = taskId === void 0 ? this.db.prepare(
-      `SELECT sequence, observation_id, project_id, task_id, source, category,
-                    observation_json, observation_hash, observed_at, recorded_at
-             FROM governance_observations
-             WHERE project_id = ?
-             ORDER BY sequence`
-    ).all(projectId) : this.db.prepare(
+    if (!Number.isSafeInteger(options.afterSequence) || options.afterSequence < 0) {
+      throw new Error("Observation cursor must be a non-negative safe integer.");
+    }
+    if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE + 1) {
+      throw new Error(
+        `Observation query limit must be between 1 and ${GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE + 1}.`
+      );
+    }
+    if (options.categories.length === 0) return Object.freeze([]);
+    const parameters = [options.projectId];
+    let where = "project_id = ?";
+    if (options.taskId !== void 0) {
+      where += " AND task_id = ?";
+      parameters.push(options.taskId);
+    }
+    where += ` AND category IN (${options.categories.map(() => "?").join(",")})`;
+    parameters.push(...options.categories);
+    where += " AND sequence > ?";
+    parameters.push(options.afterSequence, options.limit);
+    const rows = this.db.prepare(
       `SELECT sequence, observation_id, project_id, task_id, source, category,
-                    observation_json, observation_hash, observed_at, recorded_at
-             FROM governance_observations
-             WHERE project_id = ? AND task_id = ?
-             ORDER BY sequence`
-    ).all(projectId, taskId);
+                observation_json, observation_hash, observed_at, recorded_at
+         FROM governance_observations
+         WHERE ${where}
+         ORDER BY sequence
+         LIMIT ?`
+    ).all(...parameters);
     return Object.freeze(rows.map((row) => this.observationFromRow(row)));
   }
   readEvidenceCandidateObservations(projectId, taskId, options) {
@@ -3379,7 +3409,18 @@ var MAX_NESTING_DEPTH = 32;
 var MAX_ARRAY_ITEMS = 1e4;
 var MAX_OBJECT_KEYS = 1e3;
 var MAX_STRING_LENGTH = 1e6;
+var MAX_ISSUES = 100;
 function issue(issues, code, path5, message) {
+  if (issues.length >= MAX_ISSUES) {
+    if (issues.length === MAX_ISSUES) {
+      issues.push({
+        code: "resource_limit",
+        path: "$",
+        message: `Validation stopped after ${MAX_ISSUES} issues.`
+      });
+    }
+    return;
+  }
   issues.push({ code, path: path5, message });
 }
 function plainRecord4(value, path5, issues) {
@@ -3471,23 +3512,24 @@ function enumArray(value, allowed, path5, issues) {
     (entry, entryPath, target) => enumValue(entry, allowed, entryPath, target)
   );
 }
-function capabilityArray(value, path5, issues) {
+function boundedCapabilityArray(value, allowed, noun, path5, issues) {
   if (!Array.isArray(value)) {
     issue(issues, "expected_array", path5, `${path5} must be an array.`);
     return;
   }
-  if (value.length === 0 || value.length > GOVERNANCE_SERVICE_CAPABILITIES.length) {
+  if (value.length === 0 || value.length > allowed.length) {
     issue(
       issues,
       "resource_limit",
       path5,
-      `${path5} must contain between 1 and ${GOVERNANCE_SERVICE_CAPABILITIES.length} capabilities.`
+      `${path5} must contain between 1 and ${allowed.length} ${noun}.`
     );
+    return;
   }
   const seen = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.length; index += 1) {
     const entryPath = `${path5}[${index}]`;
-    enumValue(value[index], GOVERNANCE_SERVICE_CAPABILITIES, entryPath, issues);
+    enumValue(value[index], allowed, entryPath, issues);
     if (typeof value[index] === "string") {
       if (seen.has(value[index])) {
         issue(issues, "semantic_invalid", entryPath, `${entryPath} duplicates a capability.`);
@@ -3496,30 +3538,17 @@ function capabilityArray(value, path5, issues) {
     }
   }
 }
+function capabilityArray(value, path5, issues) {
+  boundedCapabilityArray(value, GOVERNANCE_SERVICE_CAPABILITIES, "capabilities", path5, issues);
+}
 function runtimeModelCapabilityArray(value, path5, issues) {
-  if (!Array.isArray(value)) {
-    issue(issues, "expected_array", path5, `${path5} must be an array.`);
-    return;
-  }
-  if (value.length === 0 || value.length > GOVERNANCE_RUNTIME_MODEL_CAPABILITIES.length) {
-    issue(
-      issues,
-      "resource_limit",
-      path5,
-      `${path5} must contain between 1 and ${GOVERNANCE_RUNTIME_MODEL_CAPABILITIES.length} model-safe capabilities.`
-    );
-  }
-  const seen = /* @__PURE__ */ new Set();
-  for (let index = 0; index < value.length; index += 1) {
-    const entryPath = `${path5}[${index}]`;
-    enumValue(value[index], GOVERNANCE_RUNTIME_MODEL_CAPABILITIES, entryPath, issues);
-    if (typeof value[index] === "string") {
-      if (seen.has(value[index])) {
-        issue(issues, "semantic_invalid", entryPath, `${entryPath} duplicates a capability.`);
-      }
-      seen.add(value[index]);
-    }
-  }
+  boundedCapabilityArray(
+    value,
+    GOVERNANCE_RUNTIME_MODEL_CAPABILITIES,
+    "model-safe capabilities",
+    path5,
+    issues
+  );
 }
 function jsonValue(value, path5, issues, depth = 0) {
   if (depth > MAX_NESTING_DEPTH) {
@@ -3829,6 +3858,21 @@ function validateObservation(value, path5, issues) {
   const payload = plainRecord4(record.payload, `${path5}.payload`, issues);
   if (payload) jsonValue(payload, `${path5}.payload`, issues);
 }
+function observationPageWindow(record, issues) {
+  if (record.afterSequence !== void 0) {
+    integerValue(record.afterSequence, "$.afterSequence", issues);
+  }
+  if (record.limit === void 0) return;
+  integerValue(record.limit, "$.limit", issues, 1);
+  if (typeof record.limit === "number" && record.limit > GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE) {
+    issue(
+      issues,
+      "resource_limit",
+      "$.limit",
+      `$.limit must not exceed ${GOVERNANCE_OBSERVATION_MAX_PAGE_SIZE}.`
+    );
+  }
+}
 function deepFreeze4(value) {
   if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
   for (const nested of Object.values(value)) deepFreeze4(nested);
@@ -3861,8 +3905,14 @@ function decodeGovernanceServiceRequest(input) {
       stringValue(record.commandId, "$.commandId", issues);
       break;
     case "read_observations":
-      exactKeys2(record, ["protocolVersion", "requestId", "type", "taskId"], "$", issues);
+      exactKeys2(
+        record,
+        ["protocolVersion", "requestId", "type", "taskId", "afterSequence", "limit"],
+        "$",
+        issues
+      );
       if (record.taskId !== void 0) stringValue(record.taskId, "$.taskId", issues);
+      observationPageWindow(record, issues);
       break;
     case "read_evidence_candidates":
       exactKeys2(
@@ -3888,6 +3938,14 @@ function decodeGovernanceServiceRequest(input) {
       }
       break;
     case "read_audit_observations":
+      exactKeys2(
+        record,
+        ["protocolVersion", "requestId", "type", "afterSequence", "limit"],
+        "$",
+        issues
+      );
+      observationPageWindow(record, issues);
+      break;
     case "read_own_capability_grant":
     case "read_daemon_status":
       exactKeys2(record, ["protocolVersion", "requestId", "type"], "$", issues);
@@ -4722,12 +4780,22 @@ var GovernanceCapabilityGrantRegistry = class {
     const remaining = record.expiresAtMs - this.now();
     return remaining > 0 ? remaining : null;
   }
+  /**
+   * Ordering is deliberately byte-wise rather than locale-aware. Both keys are
+   * ASCII by construction — `issuedAt` is an ISO-8601 timestamp and `grantId`
+   * matches `^[A-Za-z0-9_-]{1,128}$` — so the two orders are identical, but
+   * `localeCompare` would make the order depend on the host's default locale.
+   * This list backs the `list_capability_grants` cursor, and a cursor is only
+   * sound while the order it walks is stable across the requests that walk it.
+   */
   listGrants() {
     const now = this.now();
     return Object.freeze(
-      [...this.records.values()].map((record) => this.describe(record, now)).sort(
-        (left, right) => left.issuedAt.localeCompare(right.issuedAt) || left.grantId.localeCompare(right.grantId)
-      )
+      [...this.records.values()].map((record) => this.describe(record, now)).sort((left, right) => {
+        if (left.issuedAt !== right.issuedAt) return left.issuedAt < right.issuedAt ? -1 : 1;
+        if (left.grantId === right.grantId) return 0;
+        return left.grantId < right.grantId ? -1 : 1;
+      })
     );
   }
   parseToken(token) {
@@ -4871,6 +4939,12 @@ function fail(requestId, code, message, details) {
 function reservedAuditCategory(category) {
   return category.startsWith("capability_grant_") || category.startsWith("daemon_");
 }
+var AUDIT_OBSERVATION_CATEGORIES = Object.freeze(
+  GOVERNANCE_OBSERVATION_CATEGORIES.filter((category) => reservedAuditCategory(category))
+);
+var TASK_OBSERVATION_CATEGORIES = Object.freeze(
+  GOVERNANCE_OBSERVATION_CATEGORIES.filter((category) => !reservedAuditCategory(category))
+);
 var GovernanceProjectService = class {
   constructor(projectId, store, resolveDecisionContext = () => ({})) {
     this.projectId = projectId;
@@ -4998,14 +5072,13 @@ var GovernanceProjectService = class {
         };
       }
       case "read_observations":
-        return {
-          ok: true,
+        return this.observationPage(
           requestId,
-          result: {
-            type: "observations",
-            observations: this.store.readObservations(this.projectId, request.taskId).filter((observation) => !reservedAuditCategory(observation.category))
-          }
-        };
+          TASK_OBSERVATION_CATEGORIES,
+          request.taskId,
+          request.afterSequence,
+          request.limit
+        );
       case "read_evidence_candidates": {
         const limit = request.limit ?? GOVERNANCE_EVIDENCE_CANDIDATE_DEFAULT_PAGE_SIZE;
         const rows = this.store.readEvidenceCandidateObservations(this.projectId, request.taskId, {
@@ -5029,14 +5102,13 @@ var GovernanceProjectService = class {
         };
       }
       case "read_audit_observations":
-        return {
-          ok: true,
+        return this.observationPage(
           requestId,
-          result: {
-            type: "observations",
-            observations: this.store.readObservations(this.projectId).filter((observation) => reservedAuditCategory(observation.category))
-          }
-        };
+          AUDIT_OBSERVATION_CATEGORIES,
+          void 0,
+          request.afterSequence,
+          request.limit
+        );
       case "submit_command": {
         if (!this.commandBelongsToProject(request.command)) {
           return fail(
@@ -5098,6 +5170,31 @@ var GovernanceProjectService = class {
         );
     }
   }
+  /**
+   * Shared body for both observation reads. Fetches one row past the page so
+   * the presence of a further page is known without a second query — the same
+   * convention `read_evidence_candidates` uses.
+   */
+  observationPage(requestId, categories, taskId, afterSequence, limit) {
+    const pageSize = limit ?? GOVERNANCE_OBSERVATION_DEFAULT_PAGE_SIZE;
+    const rows = this.store.readObservationsPage({
+      projectId: this.projectId,
+      ...taskId === void 0 ? {} : { taskId },
+      categories,
+      afterSequence: afterSequence ?? 0,
+      limit: pageSize + 1
+    });
+    const page = rows.slice(0, pageSize);
+    return {
+      ok: true,
+      requestId,
+      result: {
+        type: "observations",
+        observations: page,
+        nextAfterSequence: rows.length > pageSize && page.length > 0 ? page.at(-1)?.sequence ?? null : null
+      }
+    };
+  }
   commandBelongsToProject(command) {
     if (command.type === "create_task") {
       return command.projectId === this.projectId && command.contract.projectId === this.projectId;
@@ -5308,12 +5405,14 @@ var GovernanceProjectServer = class {
     else socket.destroy();
   }
   accept(socket) {
-    let buffer = Buffer.alloc(0);
+    const chunks = [];
+    let size = 0;
     let handled = false;
     socket.on("data", (chunk) => {
       if (handled) return;
-      buffer = Buffer.concat([buffer, chunk]);
-      if (buffer.byteLength > GOVERNANCE_IPC_MAX_FRAME_BYTES) {
+      const newline = chunk.indexOf(10);
+      const frameBytes = size + (newline < 0 ? chunk.byteLength : newline);
+      if (frameBytes > GOVERNANCE_IPC_MAX_FRAME_BYTES) {
         handled = true;
         this.send(
           socket,
@@ -5321,10 +5420,14 @@ var GovernanceProjectServer = class {
         );
         return;
       }
-      const newline = buffer.indexOf(10);
-      if (newline < 0) return;
+      if (newline < 0) {
+        chunks.push(chunk);
+        size = frameBytes;
+        return;
+      }
       handled = true;
-      const line = buffer.subarray(0, newline).toString("utf8").replace(/\r$/, "");
+      chunks.push(chunk.subarray(0, newline));
+      const line = Buffer.concat(chunks).toString("utf8").replace(/\r$/, "");
       this.handleLine(socket, line);
     });
   }

package/dist/project-service.d.ts

@@ -1,6 +1,6 @@
 import type { GovernanceAttachmentBrokerControllerSnapshot } from './attachment-broker-controller.js';
 import type { GovernanceCapabilityGrant, GovernanceServiceCredential } from './capability-grant.js';
-import type { AppendGovernanceObservationResult, GovernanceCommandExecution, GovernanceCommandReceipt, GovernanceEventStore, StoredGovernanceObservation } from './event-store.js';
+import { type AppendGovernanceObservationResult, type GovernanceCommandExecution, type GovernanceCommandReceipt, type GovernanceEventStore, type StoredGovernanceObservation } from './event-store.js';
 import { type GovernanceEvidenceCandidateLedgerEntry } from './evidence-candidate.js';
 import { GOVERNANCE_SERVICE_PROTOCOL_VERSION, type GovernanceServiceClientContext, type GovernanceServiceRequest } from './service-protocol.js';
 import type { GovernanceCommand, GovernanceDecisionContext, GovernanceEvent, TaskAggregate } from './task-aggregate.js';
@@ -24,6 +24,7 @@ export type GovernanceServiceResult = {
 } | {
     readonly type: 'observations';
     readonly observations: readonly StoredGovernanceObservation[];
+    readonly nextAfterSequence: number | null;
 } | {
     readonly type: 'evidence_candidates';
     readonly taskId: string;
@@ -116,6 +117,12 @@ export declare class GovernanceProjectService {
     handle(request: GovernanceServiceRequest, client: GovernanceServiceClientContext): GovernanceServiceResponse;
     close(): void;
     private handleAuthorized;
+    /**
+     * Shared body for both observation reads. Fetches one row past the page so
+     * the presence of a further page is known without a second query — the same
+     * convention `read_evidence_candidates` uses.
+     */
+    private observationPage;
     private commandBelongsToProject;
 }
 //# sourceMappingURL=project-service.d.ts.map

package/dist/service-protocol.d.ts

@@ -28,6 +28,8 @@ export type GovernanceServiceRequest = GovernanceServiceRequestMetadata & ({
 } | {
     readonly type: 'read_observations';
     readonly taskId?: string | undefined;
+    readonly afterSequence?: number | undefined;
+    readonly limit?: number | undefined;
 } | {
     readonly type: 'read_evidence_candidates';
     readonly taskId: string;
@@ -35,6 +37,8 @@ export type GovernanceServiceRequest = GovernanceServiceRequestMetadata & ({
     readonly limit?: number | undefined;
 } | {
     readonly type: 'read_audit_observations';
+    readonly afterSequence?: number | undefined;
+    readonly limit?: number | undefined;
 } | {
     readonly type: 'read_own_capability_grant';
 } | {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/governance",
-  "version": "0.299.0",
+  "version": "0.301.0",
   "license": "MIT",
   "description": "Deterministic workflow contracts and transition policy for WrongStack orchestration.",
   "repository": {