$ the-wire · showcase
Self-comparison deadlock, immortal TTLs, and typosquat checks on decorated names
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
1 person shipped this
Four bugs in microsoft/agent-governance-toolkit fixed in one push, three of them silent failures that let your agent's session state, compliance parsing and memory storage behave differently than you configured.
fix(agent-hypervisor): don't deadlock when a VectorClock is compared with itself microsoft/agent-governance-toolkit
VectorClock.merge(), happens_before() and __eq__ acquired the same non-re-entrant threading.Lock twice when a clock was compared with itself, blocking the calling thread forever; the comparison now short-circuits instead of deadlocking, so a hypervisor session that compares a clock to itself no longer hangs.
fix(agent-mesh): expire MemoryStorageProvider keys after their TTL microsoft/agent-governance-toolkit
MemoryStorageProvider.set() wrote a TTL into self._ttls but nothing ever read it, so a key set with ttl_seconds=1 was still present two seconds later. Keys now expire as configured, which means session values you relied on persisting will start disappearing on schedule.
fix(agent-compliance): drop extras and parentheses from parsed requirement names (#4348) microsoft/agent-governance-toolkit
The compliance parser kept PEP 508 extras and an opening parenthesis in the package name, so requests[security] and requests (>=2.28.0) were reported as missing against your lockfile and the typosquatting check ran on the decorated string rather than the real package.
fix(agent-mesh): parse marketplace dependency specifiers like agent_marketplace microsoft/agent-governance-toolkit
The marketplace fallback installers did not read dependency specifiers the way agent_marketplace does, so a plain core install (agent_marketplace is not a dependency of agent-governance-toolkit-core) resolved installs under different rules from the re-exported path.
