src/Arcp.Core/Lease.fs implements Lease.isSubset by accepting a child glob only when it exactly equals a parent glob or the parent glob is the catch-all **. This contradicts docs/guides/leases.md, which documents narrower child patterns such as s3://artifacts/2026/** as valid subsets of s3://artifacts/**, and it prevents legitimate delegated leases from being accepted. The current unit test named isSubset accepts narrower child does not exercise a narrower pattern because the parent and child both use /a/**.
Fix prompt: replace the exact-string check in checkNamespace with conservative glob coverage logic for the patterns this SDK supports. At minimum, support literal-prefix narrowing for parent patterns ending in /**, single-segment * narrowing, and exact matches, while rejecting cases the checker cannot prove are subsets. Update the misleading unit test to use a genuinely narrower child pattern, add tests for the documented s3://artifacts/** and render.* examples, and add negative tests showing broader children such as s3://** remain rejected.
src/Arcp.Core/Lease.fsimplementsLease.isSubsetby accepting a child glob only when it exactly equals a parent glob or the parent glob is the catch-all**. This contradictsdocs/guides/leases.md, which documents narrower child patterns such ass3://artifacts/2026/**as valid subsets ofs3://artifacts/**, and it prevents legitimate delegated leases from being accepted. The current unit test namedisSubset accepts narrower childdoes not exercise a narrower pattern because the parent and child both use/a/**.Fix prompt: replace the exact-string check in
checkNamespacewith conservative glob coverage logic for the patterns this SDK supports. At minimum, support literal-prefix narrowing for parent patterns ending in/**, single-segment*narrowing, and exact matches, while rejecting cases the checker cannot prove are subsets. Update the misleading unit test to use a genuinely narrower child pattern, add tests for the documenteds3://artifacts/**andrender.*examples, and add negative tests showing broader children such ass3://**remain rejected.