feat: move exact to a string typed equals

README.md

@@ -28,9 +28,9 @@ name: Drop checkout debug logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - log_field: LOG_FIELD_SEVERITY_TEXT
-      exact: DEBUG
+      equals: DEBUG
   keep: none
 ```
 

examples/cost-control/README.md

@@ -78,18 +78,19 @@ name: Rate limit repeated error logs to 1 per 5 minutes per request
 log:
   match:
     - log_field: severity_text
-      exact: ERROR
+      equals: ERROR
   keep: "1/5m"
   sample_key:
     log_attribute: ["request_id"]
 ```
 
 #### Typed and comparison matching
 
-The string match types (`exact`, `regex`, `contains`, ...) only see string
-values. To match numbers and booleans, use the typed `equals` matcher or the
-numeric comparators `gt` / `gte` / `lt` / `lte`. The value's type is inferred
-from the literal — `500` is an int, `0.1` is a double, `true` is a bool.
+Use `equals` for typed equality across strings, numbers, booleans, and bytes.
+The pattern matchers (`regex`, `contains`, ...) only see string values. To match
+numeric ranges, use the typed comparators `gt` / `gte` / `lt` / `lte`. The
+value's type is inferred from the literal — `500` is an int, `0.1` is a double,
+`true` is a bool.
 
 Keep only error logs by dropping the successful status-code range:
 
@@ -134,7 +135,7 @@ name: Sample order validated logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - log_field: body
       regex: "order validated"
   keep: 50%

examples/cost-control/foundation/drop-cache-hit-logs.yaml

@@ -3,7 +3,7 @@ name: Drop logs flagged as cache hits
 description: >
   Cache hits are high volume and low value. This matches the boolean attribute
   directly with equals instead of regexing a stringified flag — equals: true
-  matches a real boolean value, which the string match types cannot see.
+  matches a real boolean value, which the string pattern matchers cannot see.
 
 log:
   match:

examples/cost-control/foundation/rate-limit-batch-job-logs.yaml

@@ -4,7 +4,7 @@ name: Rate limit batch job logs to 100/s per job
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: batch-processor
+      equals: batch-processor
   keep: "100/s"
   sample_key:
     log_attribute: ["job_id"]

examples/cost-control/foundation/rate-limit-error-logs-1-per-5m.yaml

@@ -4,7 +4,7 @@ name: Rate limit repeated error logs to 1 per 5 minutes per request
 log:
   match:
     - log_field: severity_text
-      exact: ERROR
+      equals: ERROR
   keep: "1/5m"
   sample_key:
     log_attribute: ["request_id"]

examples/cost-control/foundation/sample-api-logs-by-request.yaml

@@ -4,7 +4,7 @@ name: Sample API logs at 10% by request
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: api-gateway
+      equals: api-gateway
   keep: "10%"
   sample_key:
     log_attribute: ["request_id"]

examples/cost-control/generated/checkout-api/drop-cart-item-added.yaml

@@ -4,7 +4,7 @@ name: Drop cart item added logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - log_field: body
       regex: "item added to cart"
   keep: none

examples/cost-control/generated/checkout-api/drop-request-received.yaml

@@ -4,7 +4,7 @@ name: Drop request received logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - log_field: body
       regex: "request received"
   keep: none

examples/cost-control/generated/checkout-api/sample-order-validated.yaml

@@ -4,7 +4,7 @@ name: Sample order validated logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - log_field: body
       regex: "order validated"
   keep: 50%

examples/cost-control/generated/user-service/drop-cache-hit.yaml

@@ -4,7 +4,7 @@ name: Drop cache hit logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: user-service
+      equals: user-service
     - log_field: body
       regex: "cache hit for user"
   keep: none

examples/cost-control/generated/user-service/drop-session-heartbeat.yaml

@@ -4,7 +4,7 @@ name: Drop session heartbeat logs
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: user-service
+      equals: user-service
     - log_field: body
       regex: "session heartbeat"
   keep: none

examples/pci-compliance/README.md

@@ -60,7 +60,7 @@ log:
     - resource_attribute: ["service.name"]
       regex: "^payment-"
     - log_field: severity_text
-      exact: DEBUG
+      equals: DEBUG
   keep: none
 ```
 
@@ -89,7 +89,7 @@ name: Redact transaction logged events
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: payment-api
+      equals: payment-api
     - log_field: body
       regex: "transaction logged"
   transform:

examples/pci-compliance/foundation/drop-payment-debug.yaml

@@ -6,5 +6,5 @@ log:
     - resource_attribute: ["service.name"]
       regex: "^payment-"
     - log_field: severity_text
-      exact: DEBUG
+      equals: DEBUG
   keep: none

examples/pci-compliance/generated/checkout-api/redact-order-submitted.yaml

@@ -4,7 +4,7 @@ name: Redact order submitted events
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - log_field: body
       regex: "order submitted"
   transform:

examples/pci-compliance/generated/payment-api/redact-payment-processed.yaml

@@ -4,7 +4,7 @@ name: Redact payment processed events
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: payment-api
+      equals: payment-api
     - log_field: body
       regex: "payment processed"
   transform:

examples/pci-compliance/generated/payment-api/redact-transaction-logged.yaml

@@ -4,7 +4,7 @@ name: Redact transaction logged events
 log:
   match:
     - resource_attribute: ["service.name"]
-      exact: payment-api
+      equals: payment-api
     - log_field: body
       regex: "transaction logged"
   transform:

examples/trace-sampling/foundation/keep-spans-for-trace.yaml

@@ -4,11 +4,12 @@ description: >
   Retains every span belonging to one trace id while debugging an incident.
   trace_id is a bytes field, so the hex literal is decoded to raw bytes once at
   policy-load time and compared as bytes — no per-span hex encoding required.
-  The exact matcher is case-insensitive on the hex input.
+  hex_value is case-insensitive on input.
 
 trace:
   match:
     - trace_field: TRACE_FIELD_TRACE_ID
-      exact: "4bf92f3577b34da6a3ce929d0e0e4736"
+      equals:
+        hex_value: "4bf92f3577b34da6a3ce929d0e0e4736"
   keep:
     percentage: 100.0

examples/trace-sampling/foundation/sample-by-environment.yaml

@@ -7,6 +7,6 @@ description: >
 trace:
   match:
     - resource_attribute: ["deployment.environment"]
-      exact: staging
+      equals: staging
   keep:
     percentage: 50.0

examples/trace-sampling/generated/checkout-api/keep-order-submission-spans.yaml

@@ -7,8 +7,8 @@ description: >
 trace:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - trace_field: name
-      exact: SubmitOrder
+      equals: SubmitOrder
   keep:
     percentage: 100.0

examples/trace-sampling/generated/checkout-api/sample-cart-operations.yaml

@@ -7,7 +7,7 @@ description: >
 trace:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - trace_field: name
       regex: "^(AddToCart|RemoveFromCart|UpdateCart)"
   keep:

examples/trace-sampling/generated/checkout-api/sample-inventory-checks.yaml

@@ -7,10 +7,10 @@ description: >
 trace:
   match:
     - resource_attribute: ["service.name"]
-      exact: checkout-api
+      equals: checkout-api
     - span_kind: CLIENT
     - span_attribute: ["rpc.service"]
-      exact: InventoryService
+      equals: InventoryService
   keep:
     percentage: 10.0
     mode: proportional

examples/trace-sampling/generated/payment-api/drop-heartbeat-spans.yaml

@@ -7,8 +7,8 @@ description: >
 trace:
   match:
     - resource_attribute: ["service.name"]
-      exact: payment-api
+      equals: payment-api
     - trace_field: name
-      exact: PaymentGatewayHeartbeat
+      equals: PaymentGatewayHeartbeat
   keep:
     percentage: 0.0

examples/trace-sampling/generated/payment-api/keep-payment-spans.yaml

@@ -7,7 +7,7 @@ description: >
 trace:
   match:
     - resource_attribute: ["service.name"]
-      exact: payment-api
+      equals: payment-api
     - trace_field: name
       regex: "^(ProcessPayment|AuthorizePayment|CapturePayment|RefundPayment)"
   keep:

examples/trace-sampling/generated/payment-api/sample-validation-spans.yaml

@@ -7,7 +7,7 @@ description: >
 trace:
   match:
     - resource_attribute: ["service.name"]
-      exact: payment-api
+      equals: payment-api
     - trace_field: name
       regex: "^Validate"
     - span_status: OK

proto/tero/policy/v1/log.proto

@@ -84,8 +84,8 @@ enum LogField {
   LOG_FIELD_BODY = 1;
   LOG_FIELD_SEVERITY_TEXT = 2;
   // trace_id and span_id are bytes. They are authored as lowercase hex and
-  // matched as raw bytes (exact/equals), or as their hex rendering for string
-  // match types. See the Value message and the spec's
+  // matched as raw bytes with equals.hex_value, or as their hex rendering for
+  // string pattern match types. See the Value message and the spec's
   // "Bytes and Identifier Fields" section.
   LOG_FIELD_TRACE_ID = 3;
   LOG_FIELD_SPAN_ID = 4;
@@ -129,12 +129,17 @@ message LogMatcher {
 
   // Match type. Exactly one must be set.
   //
-  // The string match types (exact, regex, starts_with, ends_with, contains)
-  // operate only on string field values. To match non-string values, use the
-  // typed equals matcher or the numeric comparison matchers (gt, gte, lt, lte).
+  // Use the typed equals matcher for equality. The exact field is deprecated and
+  // will move to reserved in a future version after wire-format users migrate to
+  // equals.string_value.
+  //
+  // The string pattern match types (regex, starts_with, ends_with, contains)
+  // operate only on string field values. Use the numeric comparison matchers
+  // (gt, gte, lt, lte) for ranges.
   oneof match {
-    // Exact string match (string field values only)
-    string exact = 10;
+    // Deprecated: use equals.string_value instead. This field will move to
+    // reserved in a future version.
+    string exact = 10 [deprecated = true];
 
     // Regular expression match (string field values only)
     string regex = 11;
@@ -151,7 +156,7 @@ message LogMatcher {
     // Literal substring match (string field values only)
     string contains = 15;
 
-    // Typed equality for non-string field values (bool, int, double, bytes)
+    // Typed equality for string, bool, int, double, or bytes field values.
     Value equals = 22;
 
     // Numeric greater-than comparison (int/double field values)
@@ -170,7 +175,8 @@ message LogMatcher {
   // If true, inverts the match result
   bool negate = 20;
 
-  // If true, applies case-insensitive matching to all match types
+  // If true, applies case-insensitive matching to equals.string_value and the
+  // string pattern match types.
   bool case_insensitive = 21;
 }
 

proto/tero/policy/v1/metric.proto

@@ -100,12 +100,17 @@ message MetricMatcher {
   // Match type. Exactly one must be set.
   // Note: For metric_type field, only exists is valid (type equality is implicit).
   //
-  // The string match types (exact, regex, starts_with, ends_with, contains)
-  // operate only on string field values. To match non-string values, use the
-  // typed equals matcher or the numeric comparison matchers (gt, gte, lt, lte).
+  // Use the typed equals matcher for equality. The exact field is deprecated and
+  // will move to reserved in a future version after wire-format users migrate to
+  // equals.string_value.
+  //
+  // The string pattern match types (regex, starts_with, ends_with, contains)
+  // operate only on string field values. Use the numeric comparison matchers
+  // (gt, gte, lt, lte) for ranges.
   oneof match {
-    // Exact string match (string field values only)
-    string exact = 10;
+    // Deprecated: use equals.string_value instead. This field will move to
+    // reserved in a future version.
+    string exact = 10 [deprecated = true];
 
     // Regular expression match (string field values only)
     string regex = 11;
@@ -122,7 +127,7 @@ message MetricMatcher {
     // Literal substring match (string field values only)
     string contains = 15;
 
-    // Typed equality for non-string field values (bool, int, double, bytes)
+    // Typed equality for string, bool, int, double, or bytes field values.
     Value equals = 22;
 
     // Numeric greater-than comparison (int/double field values)
@@ -141,6 +146,7 @@ message MetricMatcher {
   // If true, inverts the match result
   bool negate = 20;
 
-  // If true, applies case-insensitive matching to all match types
+  // If true, applies case-insensitive matching to equals.string_value and the
+  // string pattern match types.
   bool case_insensitive = 21;
 }

proto/tero/policy/v1/shared.proto

@@ -51,9 +51,7 @@ message AttributePath {
   repeated string path = 1;
 }
 
-// Value carries a typed, non-string scalar for the `equals` matcher. String
-// equality is expressed with the `exact` match type, so this message
-// intentionally has no string variant.
+// Value carries a typed scalar for the `equals` matcher.
 //
 // `equals` matches when the field value has the same type and value as the set
 // variant. Integer and floating-point values are compared in a single numeric
@@ -68,19 +66,16 @@ message AttributePath {
 //   equals: true   ->  bool_value
 //   equals: 200    ->  int_value
 //   equals: 0.5    ->  double_value
+//   equals: "foo"  ->  string_value
 //
 // Bytes are authored either as proto-native base64 (`bytes_value`) or, more
 // readably, as a lowercase-hex string (`hex_value`). The two are equivalent —
 // hex_value is decoded to bytes at policy-compile time and yields the same bytes
 // as the corresponding bytes_value — but hex_value keeps identifiers
 // (trace/span ids) readable in the canonical proto/JSON form instead of base64.
-// A bare string literal (e.g. `equals: "foo"`) MUST be rejected — use `exact`
-// for strings.
 //
-// Future direction: the `exact` match type is expected to be deprecated. Once a
-// string variant is added to this message, all equality (string and non-string)
-// will be expressed through `equals`, with `exact` kept only for backward
-// compatibility.
+// String equality SHOULD be authored with string_value. The older matcher-level
+// `exact` field is deprecated and will move to reserved in a future version.
 message Value {
   // Exactly one must be set.
   oneof value {
@@ -93,6 +88,7 @@ message Value {
     // input, canonically lowercase). Decoded to bytes at policy-compile time;
     // an invalid hex string MUST be rejected.
     string hex_value = 5;
+    string string_value = 6;
   }
 }