@wrongstack/governance 0.317.0 → 0.318.0

package/dist/evidence-candidate.d.ts

@@ -45,6 +45,7 @@ export interface GovernanceEvidenceCandidate {
         readonly state: 'incomplete';
         readonly missing: readonly GovernanceEvidenceCandidateMissingBinding[];
     };
+    readonly trace: GovernanceEvidenceTraceSnapshot;
     readonly tool: {
         readonly callId: string | null;
         readonly name: string;

package/dist/index.js

@@ -1211,7 +1211,7 @@ async function connectGovernanceProjectClient(options) {
 
 // src/sanitize.ts
 function sanitizeGovernanceMessage(message) {
-  return message.replace(/wsg_\S{1,700}/gu, "[credential]").slice(0, 512);
+  return message.replace(/wsg_[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/gu, "[credential]").slice(0, 512);
 }
 
 // src/credential-lease-controller.ts
@@ -2143,6 +2143,7 @@ function validateTaskContractV1(contract) {
     }
   }
   for (const check of contract.requiredChecks) {
+    addRequiredStringIssue(issues, check.id, "requiredChecks[].id");
     for (const requirementId of check.requirementIds) {
       if (!requirementIds.has(requirementId)) {
         issues.push({
@@ -2153,6 +2154,14 @@ function validateTaskContractV1(contract) {
       }
     }
   }
+  for (const assumption of contract.assumptions) {
+    addRequiredStringIssue(issues, assumption.id, "assumptions[].id");
+    addRequiredStringIssue(
+      issues,
+      assumption.statement,
+      `assumptions[${assumption.id}].statement`
+    );
+  }
   if (hasMutatingOperation(contract.autonomy.allowedOperations) && contract.autonomy.allowedPaths.length === 0) {
     issues.push({
       code: "path_scope_missing",
@@ -2247,6 +2256,12 @@ function pathMatchesPattern(value, pattern) {
     const prefix = normalizedPattern.slice(0, -3);
     return path6 === prefix || path6.startsWith(`${prefix}/`);
   }
+  if (normalizedPattern.endsWith("/*")) {
+    const prefix = normalizedPattern.slice(0, -2);
+    if (!path6.startsWith(`${prefix}/`)) return false;
+    const remainder = path6.slice(prefix.length + 1);
+    return remainder.length > 0 && !remainder.includes("/");
+  }
   return path6 === normalizedPattern;
 }
 function pathIsAllowed(contract, value) {
@@ -3045,6 +3060,7 @@ function createGovernanceEvidenceCandidate(trace, outcome) {
     status: "unverified",
     candidateId: missing.length === 0 && toolCallId ? candidateIdentity(trace, { ...outcome, toolCallId }) : null,
     binding,
+    trace,
     tool: Object.freeze({ callId: toolCallId ?? null, name: outcome.toolName }),
     outcome: Object.freeze({
       status: outcome.ok ? "succeeded" : "failed",
@@ -3931,7 +3947,10 @@ var SqliteVerificationLedger = class {
       this.#db.exec("COMMIT");
       return deepFreeze2({ recorded: true, snapshot });
     } catch (error) {
-      this.#db.exec("ROLLBACK");
+      try {
+        this.#db.exec("ROLLBACK");
+      } catch {
+      }
       throw error;
     }
   }
@@ -4033,7 +4052,10 @@ var SqliteVerificationLedger = class {
         credential: { leaseId, secret }
       });
     } catch (error) {
-      this.#db.exec("ROLLBACK");
+      try {
+        this.#db.exec("ROLLBACK");
+      } catch {
+      }
       throw error;
     }
   }
@@ -4305,7 +4327,10 @@ var SqliteVerificationLedger = class {
         }
       });
     } catch (error) {
-      this.#db.exec("ROLLBACK");
+      try {
+        this.#db.exec("ROLLBACK");
+      } catch {
+      }
       throw error;
     }
   }

package/dist/project-daemon.js

@@ -489,7 +489,7 @@ async function acquireGovernanceDaemonStartupLease(options) {
 
 // src/sanitize.ts
 function sanitizeGovernanceMessage(message) {
-  return message.replace(/wsg_\S{1,700}/gu, "[credential]").slice(0, 512);
+  return message.replace(/wsg_[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/gu, "[credential]").slice(0, 512);
 }
 
 // src/attachment-broker-controller.ts
@@ -1212,6 +1212,7 @@ function validateTaskContractV1(contract) {
     }
   }
   for (const check of contract.requiredChecks) {
+    addRequiredStringIssue(issues, check.id, "requiredChecks[].id");
     for (const requirementId of check.requirementIds) {
       if (!requirementIds.has(requirementId)) {
         issues.push({
@@ -1222,6 +1223,14 @@ function validateTaskContractV1(contract) {
       }
     }
   }
+  for (const assumption of contract.assumptions) {
+    addRequiredStringIssue(issues, assumption.id, "assumptions[].id");
+    addRequiredStringIssue(
+      issues,
+      assumption.statement,
+      `assumptions[${assumption.id}].statement`
+    );
+  }
   if (hasMutatingOperation(contract.autonomy.allowedOperations) && contract.autonomy.allowedPaths.length === 0) {
     issues.push({
       code: "path_scope_missing",
@@ -1316,6 +1325,12 @@ function pathMatchesPattern(value, pattern) {
     const prefix = normalizedPattern.slice(0, -3);
     return path5 === prefix || path5.startsWith(`${prefix}/`);
   }
+  if (normalizedPattern.endsWith("/*")) {
+    const prefix = normalizedPattern.slice(0, -2);
+    if (!path5.startsWith(`${prefix}/`)) return false;
+    const remainder = path5.slice(prefix.length + 1);
+    return remainder.length > 0 && !remainder.includes("/");
+  }
   return path5 === normalizedPattern;
 }
 function pathIsAllowed(contract, value) {
@@ -2426,7 +2441,10 @@ var SqliteVerificationLedger = class {
       this.#db.exec("COMMIT");
       return deepFreeze2({ recorded: true, snapshot });
     } catch (error) {
-      this.#db.exec("ROLLBACK");
+      try {
+        this.#db.exec("ROLLBACK");
+      } catch {
+      }
       throw error;
     }
   }
@@ -2528,7 +2546,10 @@ var SqliteVerificationLedger = class {
         credential: { leaseId, secret }
       });
     } catch (error) {
-      this.#db.exec("ROLLBACK");
+      try {
+        this.#db.exec("ROLLBACK");
+      } catch {
+      }
       throw error;
     }
   }
@@ -2800,7 +2821,10 @@ var SqliteVerificationLedger = class {
         }
       });
     } catch (error) {
-      this.#db.exec("ROLLBACK");
+      try {
+        this.#db.exec("ROLLBACK");
+      } catch {
+      }
       throw error;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/governance",
-  "version": "0.317.0",
+  "version": "0.318.0",
   "license": "MIT",
   "description": "Deterministic workflow contracts and transition policy for WrongStack orchestration.",
   "repository": {
@@ -27,7 +27,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@wrongstack/persistence": "0.317.0"
+    "@wrongstack/persistence": "0.318.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",