fix: bound conditional evidence waivers

tests/test_conditional_evidence_freshness.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+from datetime import date
 from pathlib import Path
 
 from scripts import check_conditional_policy
@@ -11,6 +12,7 @@ from scripts import check_conditional_policy
 ROOT = Path(__file__).parents[1]
 SHA = "0123456789abcdef0123456789abcdef01234567"
 OLD_SHA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+TODAY = date(2026, 8, 15)
 
 
 def _write_evidence(path: Path, gate: str, *, git_sha: str = SHA, status: str = "passed") -> None:
@@ -65,6 +67,8 @@ def test_maintainer_exception_only_allows_sha_mismatch(tmp_path):
         required_gates=["external-evaluation"],
         stale_exception_reason="Gate reviewed against equivalent conditional surface.",
         stale_exception_issue="https://github.com/elder-plinius/OBLITERATUS/issues/123",
+        stale_exception_expires="2026-08-30",
+        today=TODAY,
     ) == []
 
 
@@ -80,7 +84,8 @@ def test_exception_requires_reason_and_issue_url(tmp_path):
     )
 
     assert (
-        "stale evidence exception requires a non-empty reason and an OBLITERATUS issue URL"
+        "stale evidence exception requires a reason, a canonical OBLITERATUS issue URL, "
+        "and an ISO expiry no more than 30 days away"
     ) in errors
     assert (
         "conditional evidence external-evaluation git_sha "
@@ -97,3 +102,21 @@ def test_evidence_freshness_does_not_make_hardware_lanes_mandatory(tmp_path):
         candidate_sha=SHA,
         required_gates=["cuda-runtime"],
     ) == ["hardware or credential gate is not software-only: cuda-runtime"]
+
+
+def test_exception_rejects_noncanonical_issue_and_unbounded_expiry(tmp_path):
+    _write_evidence(tmp_path / "network-services.json", "network-services", git_sha=OLD_SHA)
+
+    errors = check_conditional_policy.validate_evidence(
+        ROOT / "ci" / "conditional-test-policy.json",
+        tmp_path,
+        candidate_sha=SHA,
+        required_gates=["network-services"],
+        stale_exception_reason="reviewed",
+        stale_exception_issue="https://github.com/elder-plinius/OBLITERATUS/issues/not-a-number",
+        stale_exception_expires="2027-01-01",
+        today=TODAY,
+    )
+
+    assert errors[0].startswith("stale evidence exception requires a reason")
+    assert "does not match candidate" in errors[1]