@wrongstack/governance 0.316.2 → 0.317.2

package/dist/evidence-candidate.d.ts

@@ -45,6 +45,7 @@ export interface GovernanceEvidenceCandidate {
         readonly state: 'incomplete';
         readonly missing: readonly GovernanceEvidenceCandidateMissingBinding[];
     };
+    readonly trace: GovernanceEvidenceTraceSnapshot;
     readonly tool: {
         readonly callId: string | null;
         readonly name: string;

package/dist/index.js

@@ -1211,7 +1211,7 @@ async function connectGovernanceProjectClient(options) {
 
 // src/sanitize.ts
 function sanitizeGovernanceMessage(message) {
-  return message.replace(/wsg_\S{1,700}/gu, "[credential]").slice(0, 512);
+  return message.replace(/wsg_[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/gu, "[credential]").slice(0, 512);
 }
 
 // src/credential-lease-controller.ts
@@ -1449,7 +1449,8 @@ var GovernanceCredentialLeaseController = class {
     }
     this.state = "scheduled";
     this.stopReason = void 0;
-    this.schedule(Math.max(0, this.expiresAtMs - this.renewBeforeMs - now));
+    const delay2 = Math.min(2147483647, Math.max(0, this.expiresAtMs - this.renewBeforeMs - now));
+    this.schedule(delay2);
   }
   schedule(delayMs) {
     this.clearTimer();
@@ -2142,6 +2143,7 @@ function validateTaskContractV1(contract) {
     }
   }
   for (const check of contract.requiredChecks) {
+    addRequiredStringIssue(issues, check.id, "requiredChecks[].id");
     for (const requirementId of check.requirementIds) {
       if (!requirementIds.has(requirementId)) {
         issues.push({
@@ -2152,6 +2154,14 @@ function validateTaskContractV1(contract) {
       }
     }
   }
+  for (const assumption of contract.assumptions) {
+    addRequiredStringIssue(issues, assumption.id, "assumptions[].id");
+    addRequiredStringIssue(
+      issues,
+      assumption.statement,
+      `assumptions[${assumption.id}].statement`
+    );
+  }
   if (hasMutatingOperation(contract.autonomy.allowedOperations) && contract.autonomy.allowedPaths.length === 0) {
     issues.push({
       code: "path_scope_missing",
@@ -2246,6 +2256,12 @@ function pathMatchesPattern(value, pattern) {
     const prefix = normalizedPattern.slice(0, -3);
     return path6 === prefix || path6.startsWith(`${prefix}/`);
   }
+  if (normalizedPattern.endsWith("/*")) {
+    const prefix = normalizedPattern.slice(0, -2);
+    if (!path6.startsWith(`${prefix}/`)) return false;
+    const remainder = path6.slice(prefix.length + 1);
+    return remainder.length > 0 && !remainder.includes("/");
+  }
   return path6 === normalizedPattern;
 }
 function pathIsAllowed(contract, value) {
@@ -3044,6 +3060,7 @@ function createGovernanceEvidenceCandidate(trace, outcome) {
     status: "unverified",
     candidateId: missing.length === 0 && toolCallId ? candidateIdentity(trace, { ...outcome, toolCallId }) : null,
     binding,
+    trace,
     tool: Object.freeze({ callId: toolCallId ?? null, name: outcome.toolName }),
     outcome: Object.freeze({
       status: outcome.ok ? "succeeded" : "failed",

package/dist/project-daemon.js

@@ -489,7 +489,7 @@ async function acquireGovernanceDaemonStartupLease(options) {
 
 // src/sanitize.ts
 function sanitizeGovernanceMessage(message) {
-  return message.replace(/wsg_\S{1,700}/gu, "[credential]").slice(0, 512);
+  return message.replace(/wsg_[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/gu, "[credential]").slice(0, 512);
 }
 
 // src/attachment-broker-controller.ts
@@ -1212,6 +1212,7 @@ function validateTaskContractV1(contract) {
     }
   }
   for (const check of contract.requiredChecks) {
+    addRequiredStringIssue(issues, check.id, "requiredChecks[].id");
     for (const requirementId of check.requirementIds) {
       if (!requirementIds.has(requirementId)) {
         issues.push({
@@ -1222,6 +1223,14 @@ function validateTaskContractV1(contract) {
       }
     }
   }
+  for (const assumption of contract.assumptions) {
+    addRequiredStringIssue(issues, assumption.id, "assumptions[].id");
+    addRequiredStringIssue(
+      issues,
+      assumption.statement,
+      `assumptions[${assumption.id}].statement`
+    );
+  }
   if (hasMutatingOperation(contract.autonomy.allowedOperations) && contract.autonomy.allowedPaths.length === 0) {
     issues.push({
       code: "path_scope_missing",
@@ -1316,6 +1325,12 @@ function pathMatchesPattern(value, pattern) {
     const prefix = normalizedPattern.slice(0, -3);
     return path5 === prefix || path5.startsWith(`${prefix}/`);
   }
+  if (normalizedPattern.endsWith("/*")) {
+    const prefix = normalizedPattern.slice(0, -2);
+    if (!path5.startsWith(`${prefix}/`)) return false;
+    const remainder = path5.slice(prefix.length + 1);
+    return remainder.length > 0 && !remainder.includes("/");
+  }
   return path5 === normalizedPattern;
 }
 function pathIsAllowed(contract, value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/governance",
-  "version": "0.316.2",
+  "version": "0.317.2",
   "license": "MIT",
   "description": "Deterministic workflow contracts and transition policy for WrongStack orchestration.",
   "repository": {
@@ -27,7 +27,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@wrongstack/persistence": "0.316.2"
+    "@wrongstack/persistence": "0.317.2"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",