runward 0.18.0 → 0.18.1

package/dist/commands/rules.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { findMissionRoot } from "../lib/mission.js";
+import { GATED_DELIVERABLES } from "../lib/conformance.js";
 import { readRuleSet, ruleSetDir, parseRule, ruleBody } from "../lib/rules.js";
 import { RULE_MIGRATIONS } from "../lib/rule-migrations.js";
 import { c, createHeader, section, status } from "../lib/styles.js";
@@ -27,7 +28,9 @@ export async function rulesCommand(opts) {
         return;
     }
     console.log(createHeader(`Runward v${VERSION} — rules`, `${rules.length} rule(s) · source: ${source}${opts.phase ? ` · phase: ${opts.phase}` : ""}`));
-    const phases = ["architect", "topology", "floor", "govern"];
+    // The gated phases, from the single source (GATED_DELIVERABLES) — so a new gated phase (e.g.
+    // handover, ADR-0026) is never mislabelled "Unmapped/advisory" here by a stale hardcoded list.
+    const phases = GATED_DELIVERABLES.map((d) => d.phase);
     for (const ph of opts.phase ? [opts.phase] : [...phases, ""]) {
         const subset = ph === "" ? rules.filter((r) => r.phases.length === 0 || r.phases.every((p) => !phases.includes(p))) : rules.filter((r) => r.phases.includes(ph));
         if (subset.length === 0)

package/dist/lib/evidence.js

@@ -62,8 +62,14 @@ function clean(token) {
  * to catch every pathological regex. Signatures are simple token alternations in practice. See ADR-0020.
  */
 export function unsafeSignature(source) {
+    // Normalize character classes ([...], including [^()]) to a single token first: a quantifier INSIDE
+    // a class (e.g. `([^()]+)+`) otherwise hides the inner quantifier from the scan, because the scan's
+    // own `[^()]` stops at the `(` that lives literally inside the class. After normalization the class
+    // becomes `C`, so `([^()]+)+` reads as `(C+)+` and is caught.
+    const norm = source.replace(/\[(?:\\.|[^\]\\])*\]/g, "C");
     // group whose body holds a quantifier, immediately followed by another quantifier: (…+…)+ (…*…)* etc.
-    return /\((?![?])[^()]*[+*}][^()]*\)[+*{]/.test(source);
+    const NESTED = /\((?![?])[^()]*[+*}][^()]*\)[+*{]/;
+    return NESTED.test(norm) || NESTED.test(source);
 }
 /** The same three resolution bases as the drift pass (ADR-0004). */
 export function resolutionBases(missionDir, deliverable) {
@@ -230,8 +236,16 @@ export function verifyEvidenceLock(missionDir) {
     }
     const files = lock.files ?? {};
     const violations = [];
+    const rootAbs = resolve(root);
     for (const [rel, hash] of Object.entries(files)) {
-        const abs = join(root, rel);
+        // Contain the lock's keys to the project, exactly as the writer does: a forged lock with an
+        // absolute or `../`-escaping path must never make the verifier read/hash outside the project
+        // (an arbitrary-file read oracle, and a DoS via /dev/zero or a huge file). Same check as resolveFile.
+        const abs = resolve(rootAbs, rel);
+        if (isAbsolute(rel) || !(abs === rootAbs || abs.startsWith(rootAbs + sep))) {
+            violations.push({ rule: "(seal)", problem: `sealed path escapes the project: ${rel} — a lock entry must be a project-relative file. Re-seal with \`runward check --freeze\`` });
+            continue;
+        }
         if (!existsSync(abs) || !isRegularFile(abs)) {
             violations.push({ rule: "(seal)", problem: `sealed evidence missing: ${rel} — the file the gate crossed on is gone. Re-verify the pointer, then re-seal with \`runward check --freeze\`` });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "After the spec: ship and run. A delivery framework for agentic systems \u2014 floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": [
     "agentic",