@siduri-x/core 1.0.0

package/dist/action-policy.d.ts

@@ -0,0 +1,45 @@
+import { RequestContext } from './context';
+import { ActionIntent, ActionPolicyDecision, ActionAuditEvent, ToolDefinition, ActionRiskLevel, ActionLifecycleState } from './action';
+import { AuthorizationCapability, ActionStore } from './capability';
+export interface ActionPolicyRule {
+    toolNamePattern: string | RegExp;
+    riskLevel?: ActionRiskLevel;
+    requiredCapabilities?: string[];
+    allowedRoles?: string[];
+    allowedChannels?: string[];
+    requiresExplicitApproval?: boolean;
+}
+export interface ActionPolicyEngineOptions {
+    rules?: ActionPolicyRule[];
+    defaultRiskLevel?: ActionRiskLevel;
+    defaultRequireApprovalForHighRisk?: boolean;
+    store?: ActionStore;
+    secretKey?: string;
+}
+export interface ApproveActionOptions {
+    executionId: string;
+    approverActorId: string;
+    reason?: string;
+}
+export declare class ActionPolicyEngine {
+    private readonly toolRegistry;
+    private readonly rules;
+    private readonly store;
+    private readonly defaultRiskLevel;
+    private readonly defaultRequireApprovalForHighRisk;
+    private readonly secretKey;
+    private readonly approvedExecutions;
+    constructor(options?: ActionPolicyEngineOptions);
+    registerToolDefinition(tool: ToolDefinition): void;
+    unregisterToolDefinition(toolName: string): boolean;
+    getRegisteredTools(): ToolDefinition[];
+    findToolDefinition(toolName: string): ToolDefinition | undefined;
+    evaluateAction(action: ActionIntent, context?: RequestContext): Promise<{
+        decision: ActionPolicyDecision;
+        capability?: AuthorizationCapability;
+    }>;
+    approveAction(options: ApproveActionOptions): boolean;
+    recordAudit(action: ActionIntent, context: RequestContext | undefined, decision: ActionPolicyDecision | undefined, lifecycle: ActionLifecycleState, result?: unknown, error?: string, durationMs?: number): Promise<ActionAuditEvent>;
+    getAuditLog(): Promise<ActionAuditEvent[]>;
+    getStore(): ActionStore;
+}

package/dist/action-policy.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionPolicyEngine = void 0;
+const capability_1 = require("./capability");
+class ActionPolicyEngine {
+    toolRegistry = new Map();
+    rules = [];
+    store;
+    defaultRiskLevel;
+    defaultRequireApprovalForHighRisk;
+    secretKey;
+    approvedExecutions = new Set();
+    constructor(options = {}) {
+        this.rules = options.rules ?? [];
+        this.defaultRiskLevel = options.defaultRiskLevel ?? 'HIGH';
+        this.defaultRequireApprovalForHighRisk = options.defaultRequireApprovalForHighRisk ?? true;
+        this.store = options.store ?? new capability_1.InMemoryActionStore();
+        const envSecret = typeof process !== 'undefined' && process.env ? process.env.ACTION_POLICY_SECRET : undefined;
+        const providedSecret = options.secretKey || envSecret;
+        if (!providedSecret && typeof process !== 'undefined' && process.env?.NODE_ENV === 'production') {
+            throw new Error('FATAL: ACTION_POLICY_SECRET is required in production environment');
+        }
+        this.secretKey = providedSecret ?? 'siduri_y_action_policy_secret';
+    }
+    registerToolDefinition(tool) {
+        const key = tool.providerId ? `${tool.providerId}/${tool.name}` : tool.name;
+        this.toolRegistry.set(key, tool);
+        // Also index by bare name if unique
+        if (!this.toolRegistry.has(tool.name)) {
+            this.toolRegistry.set(tool.name, tool);
+        }
+    }
+    unregisterToolDefinition(toolName) {
+        return this.toolRegistry.delete(toolName);
+    }
+    getRegisteredTools() {
+        const set = new Set(this.toolRegistry.values());
+        return Array.from(set);
+    }
+    findToolDefinition(toolName) {
+        return this.toolRegistry.get(toolName);
+    }
+    async evaluateAction(action, context) {
+        const effectiveContext = action.context || context;
+        const executionId = action.executionId || `exec-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        action.executionId = executionId;
+        const toolDef = this.findToolDefinition(action.toolName);
+        const paramsHash = (0, capability_1.computeParametersHash)(action.parameters);
+        // Rule: Unknown tools/actions must not be implicitly authorized
+        if (!toolDef) {
+            const decision = {
+                allowed: false,
+                reason: `Tool "${action.toolName}" is not registered or known in action policy`,
+                riskLevel: 'CRITICAL',
+                executionId,
+                decisionCode: 'REJECTED_UNKNOWN_TOOL',
+            };
+            await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+            return { decision };
+        }
+        const riskLevel = toolDef.riskLevel || this.defaultRiskLevel;
+        const requiredCaps = toolDef.requiredCapabilities || [];
+        // Check request context presence
+        if (!effectiveContext) {
+            const decision = {
+                allowed: false,
+                reason: 'Missing RequestContext: Actions cannot be authorized without request context',
+                riskLevel,
+                requiredCapabilities: requiredCaps,
+                executionId,
+                decisionCode: 'REJECTED_UNAUTHORIZED',
+            };
+            await this.recordAudit(action, undefined, decision, 'REJECTED');
+            return { decision };
+        }
+        // Role check if tool restricts roles
+        if (toolDef.allowedRoles && toolDef.allowedRoles.length > 0) {
+            const actorRole = effectiveContext.actor.authorizationRole;
+            if (!toolDef.allowedRoles.includes(actorRole)) {
+                const decision = {
+                    allowed: false,
+                    reason: `Actor role "${actorRole}" is not authorized to execute tool "${action.toolName}"`,
+                    riskLevel,
+                    requiredCapabilities: requiredCaps,
+                    executionId,
+                    decisionCode: 'REJECTED_UNAUTHORIZED',
+                };
+                await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+                return { decision };
+            }
+        }
+        // Channel check if tool restricts channels
+        if (toolDef.allowedChannels && toolDef.allowedChannels.length > 0) {
+            const channel = effectiveContext.conversation.channel;
+            if (!toolDef.allowedChannels.includes(channel)) {
+                const decision = {
+                    allowed: false,
+                    reason: `Tool "${action.toolName}" cannot be executed in channel "${channel}"`,
+                    riskLevel,
+                    requiredCapabilities: requiredCaps,
+                    executionId,
+                    decisionCode: 'REJECTED_CHANNEL_RESTRICTED',
+                };
+                await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+                return { decision };
+            }
+        }
+        // Capability check
+        const actorCaps = effectiveContext.actor.capabilities || [];
+        const missingCaps = requiredCaps.filter((cap) => !actorCaps.includes(cap));
+        if (missingCaps.length > 0) {
+            const decision = {
+                allowed: false,
+                reason: `Actor is missing required capabilities: [${missingCaps.join(', ')}]`,
+                riskLevel,
+                requiredCapabilities: requiredCaps,
+                executionId,
+                decisionCode: 'REJECTED_MISSING_CAPABILITY',
+            };
+            await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+            return { decision };
+        }
+        // Risk level approval check
+        const requiresExplicitApproval = toolDef.requiresApproval ??
+            (this.defaultRequireApprovalForHighRisk && (riskLevel === 'HIGH' || riskLevel === 'CRITICAL'));
+        if (requiresExplicitApproval && !this.approvedExecutions.has(executionId)) {
+            const decision = {
+                allowed: false,
+                reason: `Action "${action.toolName}" has risk level ${riskLevel} and requires explicit approval`,
+                riskLevel,
+                requiredCapabilities: requiredCaps,
+                executionId,
+                decisionCode: 'REJECTED_HIGH_RISK_UNAPPROVED',
+            };
+            await this.recordAudit(action, effectiveContext, decision, 'POLICY_CHECKED');
+            return { decision };
+        }
+        const decision = {
+            allowed: true,
+            reason: 'Action authorized by policy',
+            riskLevel,
+            requiredCapabilities: requiredCaps,
+            executionId,
+            decisionCode: 'ALLOWED_POLICY',
+        };
+        // Issue cryptographic/structural AuthorizationCapability
+        const issuedAt = new Date().toISOString();
+        const expiresAt = new Date(Date.now() + 60_000).toISOString();
+        const providerId = toolDef.providerId || 'builtin';
+        const capabilityPayload = {
+            executionId,
+            actionId: action.actionId,
+            toolName: action.toolName,
+            providerId,
+            parametersHash: paramsHash,
+            companionId: effectiveContext.companionId,
+            actorId: effectiveContext.actor.actorId,
+            sessionId: effectiveContext.actor.sessionId,
+            channel: effectiveContext.conversation.channel,
+            correlationId: effectiveContext.conversation.correlationId,
+            riskLevel,
+            issuedAt,
+            expiresAt,
+        };
+        const signature = (0, capability_1.signCapabilityPayload)(capabilityPayload, this.secretKey);
+        const capability = {
+            ...capabilityPayload,
+            allowed: true,
+            signature,
+        };
+        await this.recordAudit(action, effectiveContext, decision, 'APPROVED');
+        return { decision, capability };
+    }
+    approveAction(options) {
+        this.approvedExecutions.add(options.executionId);
+        return true;
+    }
+    async recordAudit(action, context, decision, lifecycle, result, error, durationMs) {
+        const event = {
+            executionId: action.executionId || decision?.executionId || 'unknown',
+            actionId: action.actionId,
+            toolName: action.toolName,
+            companionId: context?.companionId || 'unknown',
+            actorId: context?.actor.actorId,
+            sessionId: context?.actor.sessionId,
+            channel: context?.conversation.channel,
+            correlationId: context?.conversation.correlationId,
+            riskLevel: decision?.riskLevel || 'LOW',
+            lifecycle,
+            decision,
+            parametersHash: (0, capability_1.computeParametersHash)(action.parameters),
+            resultHash: result !== undefined ? (0, capability_1.computeParametersHash)(result) : undefined,
+            timestamp: new Date().toISOString(),
+            durationMs,
+            error,
+        };
+        await this.store.appendAudit(event);
+        return event;
+    }
+    async getAuditLog() {
+        return this.store.getAuditLog();
+    }
+    getStore() {
+        return this.store;
+    }
+}
+exports.ActionPolicyEngine = ActionPolicyEngine;

package/dist/action-policy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/action-policy.test.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const action_policy_1 = require("./action-policy");
+const capability_1 = require("./capability");
+describe('ActionPolicyEngine Boundary', () => {
+    let engine;
+    let sampleContext;
+    beforeEach(() => {
+        engine = new action_policy_1.ActionPolicyEngine({
+            defaultRiskLevel: 'HIGH',
+            defaultRequireApprovalForHighRisk: true,
+            secretKey: 'test_secret_key',
+        });
+        sampleContext = {
+            companionId: 'companion-1',
+            actor: {
+                actorId: 'user-1',
+                sessionId: 'sess-1',
+                authorizationRole: 'operator',
+                capabilities: ['web:search', 'calc:basic'],
+                authenticated: true,
+            },
+            conversation: {
+                channel: 'direct',
+                audienceId: 'audience-direct',
+                correlationId: 'corr-1',
+            },
+        };
+        const searchTool = {
+            name: 'search_web',
+            providerId: 'builtin',
+            description: 'Search the web',
+            inputSchema: { type: 'object', properties: { query: { type: 'string' } }, required: ['query'] },
+            riskLevel: 'LOW',
+            requiredCapabilities: ['web:search'],
+            allowedChannels: ['direct', 'public', 'private'],
+        };
+        const deleteTool = {
+            name: 'delete_database',
+            providerId: 'admin',
+            description: 'Delete entire database',
+            inputSchema: { type: 'object' },
+            riskLevel: 'CRITICAL',
+            requiredCapabilities: ['admin:delete'],
+            allowedRoles: ['administrator'],
+            requiresApproval: true,
+        };
+        engine.registerToolDefinition(searchTool);
+        engine.registerToolDefinition(deleteTool);
+    });
+    it('approves an authorized low-risk action and issues a signed AuthorizationCapability', async () => {
+        const action = {
+            actionId: 'act-1',
+            toolName: 'builtin/search_web',
+            parameters: { query: 'Antigravity' },
+            context: sampleContext,
+        };
+        const { decision, capability } = await engine.evaluateAction(action);
+        expect(decision.allowed).toBe(true);
+        expect(decision.decisionCode).toBe('ALLOWED_POLICY');
+        expect(decision.riskLevel).toBe('LOW');
+        expect(capability).toBeDefined();
+        expect(capability?.allowed).toBe(true);
+        expect(capability?.toolName).toBe('builtin/search_web');
+        expect(capability?.actionId).toBe('act-1');
+        expect(capability?.signature).toBeDefined();
+        expect((0, capability_1.verifyCapabilitySignature)(capability, 'test_secret_key')).toBe(true);
+    });
+    it('rejects an unknown tool/action by default and issues no capability', async () => {
+        const action = {
+            actionId: 'act-2',
+            toolName: 'unregistered_tool',
+            parameters: {},
+            context: sampleContext,
+        };
+        const { decision, capability } = await engine.evaluateAction(action);
+        expect(decision.allowed).toBe(false);
+        expect(decision.decisionCode).toBe('REJECTED_UNKNOWN_TOOL');
+        expect(decision.riskLevel).toBe('CRITICAL');
+        expect(capability).toBeUndefined();
+    });
+    it('rejects action if request context is missing', async () => {
+        const action = {
+            actionId: 'act-3',
+            toolName: 'builtin/search_web',
+            parameters: { query: 'test' },
+            // No context provided
+        };
+        const { decision, capability } = await engine.evaluateAction(action);
+        expect(decision.allowed).toBe(false);
+        expect(decision.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        expect(decision.reason).toContain('Missing RequestContext');
+        expect(capability).toBeUndefined();
+    });
+    it('rejects action when actor lacks required capability', async () => {
+        const action = {
+            actionId: 'act-4',
+            toolName: 'admin/delete_database',
+            parameters: {},
+            context: sampleContext, // has 'web:search' and 'calc:basic', not 'admin:delete'
+        };
+        const { decision, capability } = await engine.evaluateAction(action);
+        expect(decision.allowed).toBe(false);
+        expect(decision.decisionCode).toBe('REJECTED_UNAUTHORIZED'); // operator is not administrator
+        expect(capability).toBeUndefined();
+    });
+    it('rejects high/critical risk action requiring explicit approval before approval is granted, and allows after approval', async () => {
+        const adminContext = {
+            ...sampleContext,
+            actor: {
+                ...sampleContext.actor,
+                authorizationRole: 'administrator',
+                capabilities: ['admin:delete'],
+            },
+        };
+        const action = {
+            actionId: 'act-5',
+            toolName: 'admin/delete_database',
+            parameters: {},
+            context: adminContext,
+            executionId: 'exec-admin-delete-1',
+        };
+        // First attempt: unapproved
+        const res1 = await engine.evaluateAction(action);
+        expect(res1.decision.allowed).toBe(false);
+        expect(res1.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+        expect(res1.capability).toBeUndefined();
+        // Grant explicit approval
+        engine.approveAction({
+            executionId: 'exec-admin-delete-1',
+            approverActorId: 'admin-super-user',
+        });
+        // Second attempt: approved
+        const res2 = await engine.evaluateAction(action);
+        expect(res2.decision.allowed).toBe(true);
+        expect(res2.decision.decisionCode).toBe('ALLOWED_POLICY');
+        expect(res2.capability).toBeDefined();
+        expect((0, capability_1.verifyCapabilitySignature)(res2.capability, 'test_secret_key')).toBe(true);
+    });
+    it('records structured tamper-evident audit log entries with hash chaining', async () => {
+        const action = {
+            actionId: 'act-audit',
+            toolName: 'builtin/search_web',
+            parameters: { query: 'Audit Test' },
+            context: sampleContext,
+        };
+        await engine.evaluateAction(action);
+        const auditLogs = await engine.getAuditLog();
+        expect(auditLogs.length).toBeGreaterThan(0);
+        const log = auditLogs.find((l) => l.actionId === 'act-audit');
+        expect(log).toBeDefined();
+        expect(log?.actorId).toBe('user-1');
+        expect(log?.toolName).toBe('builtin/search_web');
+        expect(log?.parametersHash).toBeDefined();
+        expect(log?.resultHash).toBeDefined();
+    });
+});

package/dist/action.d.ts

@@ -0,0 +1,70 @@
+import { RequestContext } from './context';
+export type ActionRiskLevel = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
+export type ActionLifecycleState = 'PROPOSED' | 'VALIDATED' | 'POLICY_CHECKED' | 'APPROVED' | 'EXECUTING' | 'COMPLETED' | 'REJECTED' | 'FAILED' | 'CANCELLED' | 'TIMED_OUT';
+export interface ActionIntent {
+    actionId: string;
+    toolName: string;
+    parameters: Record<string, unknown>;
+    description?: string;
+    context?: RequestContext;
+    executionId?: string;
+}
+export interface ActionPolicyDecision {
+    allowed: boolean;
+    reason: string;
+    riskLevel: ActionRiskLevel;
+    requiredCapabilities?: string[];
+    executionId: string;
+    decisionCode: 'ALLOWED_AUTO' | 'ALLOWED_POLICY' | 'REJECTED_UNKNOWN_TOOL' | 'REJECTED_UNAUTHORIZED' | 'REJECTED_MISSING_CAPABILITY' | 'REJECTED_HIGH_RISK_UNAPPROVED' | 'REJECTED_CHANNEL_RESTRICTED' | 'REJECTED_COMPANION_MISMATCH' | 'REJECTED_POLICY';
+}
+export interface ActionAuditEvent {
+    executionId: string;
+    actionId: string;
+    toolName: string;
+    providerId?: string;
+    companionId: string;
+    actorId?: string;
+    sessionId?: string;
+    channel?: string;
+    correlationId?: string;
+    riskLevel: ActionRiskLevel;
+    lifecycle: ActionLifecycleState;
+    decision?: ActionPolicyDecision;
+    parametersHash?: string;
+    resultHash?: string;
+    timestamp: string;
+    durationMs?: number;
+    error?: string;
+}
+export interface ActionExecutionResult {
+    actionId: string;
+    executionId: string;
+    toolName: string;
+    lifecycle: ActionLifecycleState;
+    success: boolean;
+    result?: unknown;
+    error?: string;
+    decision?: ActionPolicyDecision;
+    durationMs?: number;
+}
+export interface ToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    providerId?: string;
+    riskLevel?: ActionRiskLevel;
+    requiredCapabilities?: string[];
+    allowedRoles?: string[];
+    allowedChannels?: string[];
+    timeoutMs?: number;
+    requiresApproval?: boolean;
+}
+export interface ToolExecutionOptions {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+export interface HandsOrgan {
+    listTools(): Promise<ToolDefinition[]>;
+    executeAction(action: ActionIntent, authorization: any, // AuthorizationCapability required
+    options?: ToolExecutionOptions): Promise<ActionExecutionResult>;
+}

package/dist/action.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/architecture-boundary.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/architecture-boundary.test.js

@@ -0,0 +1,116 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+describe('Architecture: Core & Organ Package Boundaries (Phase 2)', () => {
+    const rootOrgansDir = path.resolve(__dirname, '../../organs');
+    const coreSrcDir = path.resolve(__dirname);
+    const corePackageJsonPath = path.resolve(__dirname, '../package.json');
+    const EXPECTED_ORGANS = [
+        { dir: 'brain', name: '@siduri-x/brain', organType: 'brain', configKey: 'brain' },
+        { dir: 'memory', name: '@siduri-x/memory', organType: 'memory', configKey: 'memory' },
+        { dir: 'knowledge', name: '@siduri-x/knowledge', organType: 'knowledge', configKey: 'knowledge' },
+        { dir: 'behavior', name: '@siduri-x/behavior', organType: 'behavior', configKey: 'behavior' },
+        { dir: 'ear', name: '@siduri-x/ear', organType: 'ear', configKey: 'ear' },
+        { dir: 'vision', name: '@siduri-x/vision', organType: 'vision', configKey: 'vision' },
+        { dir: 'hands', name: '@siduri-x/hands', organType: 'hands', configKey: 'hands' },
+        { dir: 'body', name: '@siduri-x/body', organType: 'body', configKey: 'body' },
+        { dir: 'voice', name: '@siduri-x/voice', organType: 'voice', configKey: 'voice' },
+        { dir: 'observation', name: '@siduri-x/observation', organType: 'observation', configKey: 'observation' },
+    ];
+    it('package.json has zero dependencies on @siduri-y organ packages', () => {
+        const pkg = JSON.parse(fs.readFileSync(corePackageJsonPath, 'utf8'));
+        const allDeps = {
+            ...(pkg.dependencies || {}),
+            ...(pkg.devDependencies || {}),
+            ...(pkg.peerDependencies || {}),
+        };
+        const organDeps = Object.keys(allDeps).filter((dep) => dep.startsWith('@siduri-x/') && dep !== '@siduri-x/core');
+        expect(organDeps).toEqual([]);
+    });
+    it('source files in packages/core have zero imports referencing @siduri-y organ packages', () => {
+        const files = fs.readdirSync(coreSrcDir).filter((f) => f.endsWith('.ts') && !f.endsWith('.test.ts'));
+        const forbiddenImports = [];
+        for (const file of files) {
+            const content = fs.readFileSync(path.join(coreSrcDir, file), 'utf8');
+            const lines = content.split('\n');
+            for (const line of lines) {
+                if ((line.includes('import ') || line.includes('require(') || line.includes('export * from')) &&
+                    line.includes('@siduri-x/') &&
+                    !line.includes('@siduri-x/core')) {
+                    forbiddenImports.push({ file, match: line.trim() });
+                }
+            }
+        }
+        expect(forbiddenImports).toEqual([]);
+    });
+    it('all 10 organ packages have a valid organ-manifest.json', () => {
+        for (const organ of EXPECTED_ORGANS) {
+            const manifestPath = path.join(rootOrgansDir, organ.dir, 'organ-manifest.json');
+            expect(fs.existsSync(manifestPath)).toBe(true);
+            const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+            expect(manifest.name).toBe(organ.name);
+            expect(manifest.organType).toBe(organ.organType);
+            expect(manifest.configKey).toBe(organ.configKey);
+            expect(typeof manifest.version).toBe('string');
+            expect(typeof manifest.displayName).toBe('string');
+            expect(typeof manifest.entrypoint).toBe('string');
+            expect(typeof manifest.factory).toBe('string');
+            expect(manifest.configSchema).toBeDefined();
+            expect(Array.isArray(manifest.environment)).toBe(true);
+            expect(Array.isArray(manifest.services)).toBe(true);
+        }
+    });
+    it('no organ package contains link: or relative monorepo dependencies in package.json', () => {
+        for (const organ of EXPECTED_ORGANS) {
+            const pkgPath = path.join(rootOrgansDir, organ.dir, 'package.json');
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            const deps = { ...(pkg.dependencies || {}) };
+            for (const [depName, version] of Object.entries(deps)) {
+                if (typeof version === 'string') {
+                    expect(version.startsWith('link:')).toBe(false);
+                    expect(version.includes('../')).toBe(false);
+                }
+            }
+        }
+    });
+    it('memory organ packages SQL migrations', () => {
+        const memoryMigrationsDir = path.join(rootOrgansDir, 'memory', 'migrations');
+        expect(fs.existsSync(memoryMigrationsDir)).toBe(true);
+        const files = fs.readdirSync(memoryMigrationsDir).filter((f) => f.endsWith('.sql'));
+        expect(files.length).toBeGreaterThanOrEqual(1);
+    });
+});

package/dist/capability.d.ts

@@ -0,0 +1,52 @@
+import { ActionRiskLevel, ActionLifecycleState, ActionAuditEvent, ActionPolicyDecision } from './action';
+export interface AuthorizationCapability {
+    executionId: string;
+    actionId: string;
+    toolName: string;
+    providerId: string;
+    parametersHash: string;
+    companionId: string;
+    actorId?: string;
+    sessionId?: string;
+    channel?: string;
+    correlationId?: string;
+    riskLevel: ActionRiskLevel;
+    issuedAt: string;
+    expiresAt: string;
+    allowed: true;
+    signature: string;
+}
+export interface PersistentExecutionRecord {
+    executionId: string;
+    actionId: string;
+    toolName: string;
+    providerId: string;
+    parametersHash: string;
+    lifecycle: ActionLifecycleState;
+    decision?: ActionPolicyDecision;
+    result?: unknown;
+    error?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ActionStore {
+    reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
+    updateExecution(record: PersistentExecutionRecord): Promise<void>;
+    getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
+    appendAudit(event: ActionAuditEvent): Promise<void>;
+    getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
+}
+export declare class InMemoryActionStore implements ActionStore {
+    private readonly executions;
+    private readonly auditLog;
+    private lastAuditHash;
+    reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
+    updateExecution(record: PersistentExecutionRecord): Promise<void>;
+    getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
+    appendAudit(event: ActionAuditEvent): Promise<void>;
+    getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
+}
+export declare function canonicalizeJson(obj: unknown): string;
+export declare function computeParametersHash(params: unknown): string;
+export declare function signCapabilityPayload(payload: Record<string, unknown>, secretKey?: string): string;
+export declare function verifyCapabilitySignature(capability: AuthorizationCapability, secretKey?: string): boolean;