@siduri-x/core 1.0.2 → 1.0.4

package/dist/action-policy.d.ts

@@ -38,7 +38,7 @@ export declare class ActionPolicyEngine {
         decision: ActionPolicyDecision;
         capability?: AuthorizationCapability;
     }>;
-    approveAction(options: ApproveActionOptions): boolean;
+    approveAction(options: ApproveActionOptions): Promise<boolean>;
     recordAudit(action: ActionIntent, context: RequestContext | undefined, decision: ActionPolicyDecision | undefined, lifecycle: ActionLifecycleState, result?: unknown, error?: string, durationMs?: number): Promise<ActionAuditEvent>;
     getAuditLog(): Promise<ActionAuditEvent[]>;
     getStore(): ActionStore;

package/dist/action-policy.js

@@ -73,10 +73,17 @@ class ActionPolicyEngine {
             await this.recordAudit(action, undefined, decision, 'REJECTED');
             return { decision };
         }
-        // Role check if tool restricts roles
+        // Role check if tool restricts roles (supports administrator/owner role parity)
         if (toolDef.allowedRoles && toolDef.allowedRoles.length > 0) {
             const actorRole = effectiveContext.actor.authorizationRole;
-            if (!toolDef.allowedRoles.includes(actorRole)) {
+            const normalizedActorRoles = new Set([actorRole.toLowerCase()]);
+            if (actorRole === 'administrator' || actorRole === 'owner') {
+                normalizedActorRoles.add('administrator');
+                normalizedActorRoles.add('owner');
+                normalizedActorRoles.add('admin');
+            }
+            const isAuthorizedRole = toolDef.allowedRoles.some((r) => normalizedActorRoles.has(r.toLowerCase()));
+            if (!isAuthorizedRole) {
                 const decision = {
                     allowed: false,
                     reason: `Actor role "${actorRole}" is not authorized to execute tool "${action.toolName}"`,
@@ -123,7 +130,14 @@ class ActionPolicyEngine {
         // Risk level approval check
         const requiresExplicitApproval = toolDef.requiresApproval ??
             (this.defaultRequireApprovalForHighRisk && (riskLevel === 'HIGH' || riskLevel === 'CRITICAL'));
-        if (requiresExplicitApproval && !this.approvedExecutions.has(executionId)) {
+        let isApproved = this.approvedExecutions.has(executionId);
+        if (!isApproved && typeof this.store.isActionApproved === 'function') {
+            isApproved = await this.store.isActionApproved(executionId);
+            if (isApproved) {
+                this.approvedExecutions.add(executionId);
+            }
+        }
+        if (requiresExplicitApproval && !isApproved) {
             const decision = {
                 allowed: false,
                 reason: `Action "${action.toolName}" has risk level ${riskLevel} and requires explicit approval`,
@@ -171,8 +185,11 @@ class ActionPolicyEngine {
         await this.recordAudit(action, effectiveContext, decision, 'APPROVED');
         return { decision, capability };
     }
-    approveAction(options) {
+    async approveAction(options) {
         this.approvedExecutions.add(options.executionId);
+        if (typeof this.store.saveApproval === 'function') {
+            await this.store.saveApproval(options.executionId, options.approverActorId, options.reason);
+        }
         return true;
     }
     async recordAudit(action, context, decision, lifecycle, result, error, durationMs) {

package/dist/action-policy.test.js

@@ -154,4 +154,41 @@ describe('ActionPolicyEngine Boundary', () => {
         expect(log?.parametersHash).toBeDefined();
         expect(log?.resultHash).toBeDefined();
     });
+    it('supports single-owner role parity between owner and administrator', async () => {
+        const ownerTool = {
+            name: 'builtin/owner_tool',
+            description: 'Owner only tool',
+            inputSchema: {},
+            riskLevel: 'LOW',
+            allowedRoles: ['owner'],
+        };
+        engine.registerToolDefinition(ownerTool);
+        // Context with authorizationRole: 'administrator'
+        const adminContext = {
+            ...sampleContext,
+            actor: {
+                ...sampleContext.actor,
+                authorizationRole: 'administrator',
+            },
+        };
+        const actionWithAdmin = {
+            actionId: 'act-owner-admin',
+            toolName: 'builtin/owner_tool',
+            parameters: {},
+            context: adminContext,
+        };
+        const res = await engine.evaluateAction(actionWithAdmin);
+        expect(res.decision.allowed).toBe(true);
+        expect(res.capability).toBeDefined();
+        // Context with authorizationRole: 'operator' (non-owner) is rejected
+        const operatorAction = {
+            actionId: 'act-owner-op',
+            toolName: 'builtin/owner_tool',
+            parameters: {},
+            context: sampleContext, // has authorizationRole: 'operator'
+        };
+        const resOp = await engine.evaluateAction(operatorAction);
+        expect(resOp.decision.allowed).toBe(false);
+        expect(resOp.decision.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+    });
 });

package/dist/action.d.ts

@@ -32,6 +32,8 @@ export interface ActionAuditEvent {
     decision?: ActionPolicyDecision;
     parametersHash?: string;
     resultHash?: string;
+    eventHash?: string;
+    previousEventHash?: string;
     timestamp: string;
     durationMs?: number;
     error?: string;

package/dist/adversarial.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/adversarial.test.js

@@ -0,0 +1,493 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("./index");
+describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
+    const secretKey = 'test_policy_secret_key_123';
+    const baseOwnerContext = {
+        companionId: 'companion-adv',
+        actor: {
+            actorId: 'owner-user',
+            sessionId: 'sess-owner',
+            authorizationRole: 'administrator',
+            capabilities: ['chat:public', 'chat:private', 'system:manage', 'tools:all'],
+            authenticated: true,
+        },
+        conversation: {
+            channel: 'private',
+            audienceId: 'audience-owner',
+            correlationId: 'corr-adv-1',
+        },
+    };
+    const baseViewerContext = {
+        companionId: 'companion-adv',
+        actor: {
+            actorId: 'anonymous-viewer',
+            sessionId: 'sess-viewer',
+            authorizationRole: 'viewer',
+            capabilities: ['chat:public'],
+            authenticated: false,
+        },
+        conversation: {
+            channel: 'public',
+            audienceId: 'audience-public',
+            correlationId: 'corr-adv-2',
+        },
+    };
+    // INVARIANT 1: Memory Truth & Scoping Boundaries
+    describe('Invariant 1: Memory Truth & Cognition Filtering', () => {
+        test('expired, future, and below-threshold claims are not injected into Brain contextPrompt', async () => {
+            const mockBrain = {
+                generatePlan: jest.fn().mockResolvedValue({ speech: 'Cognition received context', language: 'en' }),
+            };
+            const now = new Date();
+            const pastTime = new Date(now.getTime() - 100_000).toISOString();
+            const futureTime = new Date(now.getTime() + 100_000).toISOString();
+            // Memory mock simulating search output containing valid claim only after organ filtering
+            const validClaim = {
+                id: 'c-valid',
+                companionId: 'companion-adv',
+                subject: 'User',
+                predicate: 'favoriteColor',
+                value: 'Azure',
+                status: 'APPROVED',
+                scope: 'OWNER',
+                confidence: 0.95,
+                validFrom: pastTime,
+                validUntil: futureTime,
+            };
+            const mockMemory = {
+                initialize: jest.fn().mockResolvedValue(undefined),
+                searchClaims: jest.fn().mockResolvedValue([validClaim]),
+                getDirectives: jest.fn().mockResolvedValue([]),
+            };
+            const runtime = new index_1.SiduriRuntime('companion-adv', { name: 'AdvCompanion' }, {
+                brain: mockBrain,
+                memory: mockMemory,
+            });
+            await runtime.handleUserMessage('What is my favorite color?', baseOwnerContext);
+            expect(mockMemory.searchClaims).toHaveBeenCalled();
+            const brainCall = mockBrain.generatePlan.mock.calls[0][0];
+            expect(brainCall.contextPrompt).toContain('User favoriteColor Azure');
+        });
+        test('companion isolation: runtime passes only companionId matching context', async () => {
+            const mockBrain = {
+                generatePlan: jest.fn().mockResolvedValue({ speech: 'OK', language: 'en' }),
+            };
+            const mockMemory = {
+                initialize: jest.fn().mockResolvedValue(undefined),
+                searchClaims: jest.fn().mockResolvedValue([]),
+                getDirectives: jest.fn().mockResolvedValue([]),
+            };
+            const runtime = new index_1.SiduriRuntime('companion-A', { name: 'AdvA' }, {
+                brain: mockBrain,
+                memory: mockMemory,
+            });
+            await runtime.handleUserMessage('Query', {
+                ...baseOwnerContext,
+                companionId: 'companion-A',
+            });
+            expect(mockMemory.searchClaims).toHaveBeenCalledWith('Query', expect.objectContaining({ channel: 'private', audienceId: 'audience-owner' }), 5);
+        });
+    });
+    // INVARIANT 2: Authority & Request Boundary
+    describe('Invariant 2: Authority & Request Context Boundary', () => {
+        test('viewer cannot execute admin action intents even if request context is maliciously populated', async () => {
+            const store = new index_1.InMemoryActionStore();
+            const policyEngine = new index_1.ActionPolicyEngine({ store, secretKey });
+            policyEngine.registerToolDefinition({
+                name: 'database/drop_tables',
+                providerId: 'db',
+                description: 'Drop DB tables',
+                inputSchema: {},
+                riskLevel: 'CRITICAL',
+                allowedRoles: ['administrator'],
+                requiredCapabilities: ['system:manage'],
+            });
+            const intent = {
+                actionId: 'act-drop-1',
+                toolName: 'db/database/drop_tables',
+                parameters: {},
+                context: baseViewerContext, // Viewer role
+            };
+            const { decision, capability } = await policyEngine.evaluateAction(intent);
+            expect(decision.allowed).toBe(false);
+            expect(decision.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+            expect(capability).toBeUndefined();
+        });
+        test('missing request context strictly blocks authorization', async () => {
+            const store = new index_1.InMemoryActionStore();
+            const policyEngine = new index_1.ActionPolicyEngine({ store, secretKey });
+            policyEngine.registerToolDefinition({
+                name: 'test_tool',
+                providerId: 'sys',
+                description: 'Test Tool',
+                inputSchema: {},
+                riskLevel: 'LOW',
+            });
+            const intent = {
+                actionId: 'act-no-ctx',
+                toolName: 'sys/test_tool',
+                parameters: {},
+            };
+            const { decision, capability } = await policyEngine.evaluateAction(intent, undefined);
+            expect(decision.allowed).toBe(false);
+            expect(decision.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+            expect(capability).toBeUndefined();
+        });
+    });
+    // INVARIANT 4: Action Replay & Concurrency Protection
+    describe('Invariant 4: Action Idempotency, Concurrency & Signature Replay', () => {
+        let store;
+        let mockHandlerExecute;
+        class TestHandsOrgan {
+            store;
+            secretKey;
+            constructor(store, secretKey) {
+                this.store = store;
+                this.secretKey = secretKey;
+            }
+            async listTools() {
+                return [{
+                        name: 'transfer_funds',
+                        providerId: 'bank',
+                        description: 'Transfer money',
+                        inputSchema: {},
+                        riskLevel: 'CRITICAL',
+                    }];
+            }
+            async executeAction(action, authorization) {
+                const actionId = action?.actionId || 'unknown';
+                const toolName = action?.toolName || 'unknown';
+                if (!authorization || authorization.allowed !== true) {
+                    return { actionId, executionId: 'unauthorized', toolName, lifecycle: 'REJECTED', success: false, error: 'Unauthorized' };
+                }
+                if (!(0, index_1.verifyCapabilitySignature)(authorization, this.secretKey)) {
+                    return { actionId, executionId: authorization.executionId, toolName, lifecycle: 'REJECTED', success: false, error: 'Invalid or forged AuthorizationCapability signature' };
+                }
+                if (authorization.expiresAt && new Date(authorization.expiresAt).getTime() <= Date.now()) {
+                    return { actionId, executionId: authorization.executionId, toolName, lifecycle: 'REJECTED', success: false, error: 'AuthorizationCapability has expired' };
+                }
+                const currentParamsHash = (0, index_1.computeParametersHash)(action.parameters);
+                if (authorization.parametersHash !== currentParamsHash) {
+                    return { actionId, executionId: authorization.executionId, toolName, lifecycle: 'REJECTED', success: false, error: 'Parameters hash mismatch' };
+                }
+                const executionId = authorization.executionId;
+                const existing = await this.store.getExecution(executionId);
+                if (existing && existing.lifecycle === 'COMPLETED') {
+                    return { actionId, executionId, toolName, lifecycle: 'COMPLETED', success: true, result: existing.result };
+                }
+                const reserved = await this.store.reserveExecution({
+                    executionId,
+                    actionId,
+                    toolName,
+                    providerId: authorization.providerId,
+                    parametersHash: currentParamsHash,
+                    lifecycle: 'EXECUTING',
+                    createdAt: new Date().toISOString(),
+                    updatedAt: new Date().toISOString(),
+                });
+                if (!reserved) {
+                    return { actionId, executionId, toolName, lifecycle: 'FAILED', success: false, error: 'Reservation conflict' };
+                }
+                const result = await mockHandlerExecute(action.parameters);
+                await this.store.updateExecution({
+                    executionId,
+                    actionId,
+                    toolName,
+                    providerId: authorization.providerId,
+                    parametersHash: currentParamsHash,
+                    lifecycle: 'COMPLETED',
+                    result,
+                    createdAt: new Date().toISOString(),
+                    updatedAt: new Date().toISOString(),
+                });
+                return { actionId, executionId, toolName, lifecycle: 'COMPLETED', success: true, result };
+            }
+        }
+        let hands;
+        beforeEach(() => {
+            store = new index_1.InMemoryActionStore();
+            mockHandlerExecute = jest.fn().mockResolvedValue({ transactionId: 'tx-12345', status: 'CONFIRMED' });
+            hands = new TestHandsOrgan(store, secretKey);
+        });
+        test('replaying a completed capability returns cached result without re-executing handler', async () => {
+            const mockExecute = mockHandlerExecute;
+            const action = {
+                actionId: 'act-tx-1',
+                executionId: 'exec-tx-1',
+                toolName: 'bank/transfer_funds',
+                parameters: { amount: 100, to: 'Alice' },
+            };
+            const paramsHash = (0, index_1.computeParametersHash)(action.parameters);
+            const capabilityPayload = {
+                executionId: 'exec-tx-1',
+                actionId: 'act-tx-1',
+                toolName: 'bank/transfer_funds',
+                providerId: 'bank',
+                parametersHash: paramsHash,
+                companionId: 'companion-adv',
+                actorId: 'owner-user',
+                sessionId: 'sess-owner',
+                channel: 'private',
+                correlationId: 'corr-adv-1',
+                riskLevel: 'CRITICAL',
+                issuedAt: new Date().toISOString(),
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+            };
+            const signature = (0, index_1.signCapabilityPayload)(capabilityPayload, secretKey);
+            const capability = {
+                ...capabilityPayload,
+                allowed: true,
+                signature,
+            };
+            // 1. First execution succeeds
+            const res1 = await hands.executeAction(action, capability);
+            expect(res1.success).toBe(true);
+            expect(res1.lifecycle).toBe('COMPLETED');
+            expect(mockExecute).toHaveBeenCalledTimes(1);
+            // 2. Replay execution with identical capability
+            const res2 = await hands.executeAction(action, capability);
+            expect(res2.success).toBe(true);
+            expect(res2.lifecycle).toBe('COMPLETED');
+            expect(res2.result).toEqual({ transactionId: 'tx-12345', status: 'CONFIRMED' });
+            // Handler was NOT called a second time (replay defended)
+            expect(mockExecute).toHaveBeenCalledTimes(1);
+        });
+        test('tampering with action parameters invalidates cryptographic capability', async () => {
+            const action = {
+                actionId: 'act-tx-2',
+                executionId: 'exec-tx-2',
+                toolName: 'bank/transfer_funds',
+                parameters: { amount: 100, to: 'Alice' },
+            };
+            const paramsHash = (0, index_1.computeParametersHash)(action.parameters);
+            const capabilityPayload = {
+                executionId: 'exec-tx-2',
+                actionId: 'act-tx-2',
+                toolName: 'bank/transfer_funds',
+                providerId: 'bank',
+                parametersHash: paramsHash,
+                companionId: 'companion-adv',
+                actorId: 'owner-user',
+                sessionId: 'sess-owner',
+                channel: 'private',
+                correlationId: 'corr-adv-1',
+                riskLevel: 'CRITICAL',
+                issuedAt: new Date().toISOString(),
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+            };
+            const signature = (0, index_1.signCapabilityPayload)(capabilityPayload, secretKey);
+            const capability = { ...capabilityPayload, allowed: true, signature };
+            // Attacker tampers with parameters from $100 to $10,000
+            const tamperedAction = {
+                ...action,
+                parameters: { amount: 10_000, to: 'Attacker' },
+            };
+            const res = await hands.executeAction(tamperedAction, capability);
+            expect(res.success).toBe(false);
+            expect(res.lifecycle).toBe('REJECTED');
+            expect(res.error).toContain('Parameters hash mismatch');
+        });
+        test('forged signature on capability is rejected by constant-time verification', async () => {
+            const action = {
+                actionId: 'act-tx-3',
+                executionId: 'exec-tx-3',
+                toolName: 'bank/transfer_funds',
+                parameters: { amount: 100, to: 'Alice' },
+            };
+            const capability = {
+                executionId: 'exec-tx-3',
+                actionId: 'act-tx-3',
+                toolName: 'bank/transfer_funds',
+                providerId: 'bank',
+                parametersHash: (0, index_1.computeParametersHash)(action.parameters),
+                companionId: 'companion-adv',
+                actorId: 'owner-user',
+                sessionId: 'sess-owner',
+                channel: 'private',
+                correlationId: 'corr-adv-1',
+                riskLevel: 'CRITICAL',
+                issuedAt: new Date().toISOString(),
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                allowed: true,
+                signature: '0000000000000000000000000000000000000000000000000000000000000000', // Forged signature
+            };
+            const res = await hands.executeAction(action, capability);
+            expect(res.success).toBe(false);
+            expect(res.lifecycle).toBe('REJECTED');
+            expect(res.error).toContain('Invalid or forged AuthorizationCapability signature');
+        });
+        test('expired authorization capability is rejected', async () => {
+            const action = {
+                actionId: 'act-tx-4',
+                executionId: 'exec-tx-4',
+                toolName: 'bank/transfer_funds',
+                parameters: { amount: 100, to: 'Alice' },
+            };
+            const paramsHash = (0, index_1.computeParametersHash)(action.parameters);
+            const expiredTime = new Date(Date.now() - 5000).toISOString();
+            const capabilityPayload = {
+                executionId: 'exec-tx-4',
+                actionId: 'act-tx-4',
+                toolName: 'bank/transfer_funds',
+                providerId: 'bank',
+                parametersHash: paramsHash,
+                companionId: 'companion-adv',
+                actorId: 'owner-user',
+                sessionId: 'sess-owner',
+                channel: 'private',
+                correlationId: 'corr-adv-1',
+                riskLevel: 'CRITICAL',
+                issuedAt: new Date(Date.now() - 10000).toISOString(),
+                expiresAt: expiredTime,
+            };
+            const signature = (0, index_1.signCapabilityPayload)(capabilityPayload, secretKey);
+            const capability = { ...capabilityPayload, allowed: true, signature };
+            const res = await hands.executeAction(action, capability);
+            expect(res.success).toBe(false);
+            expect(res.lifecycle).toBe('REJECTED');
+            expect(res.error).toContain('AuthorizationCapability has expired');
+        });
+    });
+    // INVARIANT 6: Failure Semantics & Degradation
+    describe('Invariant 6: Subsystem Failure Diagnostics & Non-Empty Propagation', () => {
+        test('database/memory query failure surfaces diagnostic in contextPrompt and metadata', async () => {
+            const mockBrain = {
+                generatePlan: jest.fn().mockResolvedValue({ speech: 'Graceful fallback response', language: 'en' }),
+            };
+            const failingMemory = {
+                initialize: jest.fn().mockResolvedValue(undefined),
+                searchClaims: jest.fn().mockRejectedValue(new Error('Connection terminated unexpectedly')),
+                getDirectives: jest.fn().mockRejectedValue(new Error('PostgreSQL read timeout')),
+            };
+            const runtime = new index_1.SiduriRuntime('companion-adv', { name: 'AdvCompanion' }, {
+                brain: mockBrain,
+                memory: failingMemory,
+            });
+            const response = await runtime.handleUserMessage('Hello companion', baseOwnerContext);
+            expect(response.status).toBe('APPROVED');
+            expect(response.metadata.subsystem_diagnostics).toBeDefined();
+            expect(response.metadata.subsystem_diagnostics.memory_claims).toContain('UNAVAILABLE');
+            expect(response.metadata.subsystem_diagnostics.memory_directives).toContain('UNAVAILABLE');
+            const brainCall = mockBrain.generatePlan.mock.calls[0][0];
+            expect(brainCall.contextPrompt).toContain('SUBSYSTEM STATUS (DEGRADED):');
+            expect(brainCall.contextPrompt).toContain('memory_claims');
+        });
+    });
+    // INVARIANT 8: Truth Gate Admissibility vs Factuality
+    describe('Invariant 8: Response Gating Evidence Admissibility Semantics', () => {
+        test('gate strictly enforces evidence admissibility and disclosure without claiming unverified factuality', () => {
+            const gating = new index_1.ResponseGatingEngine();
+            const publicEvidence = {
+                evidenceId: 'ev-pub-1',
+                sourceId: 'src-facts',
+                origin: 'knowledge',
+                trust: 'configured',
+                sensitivity: 'public',
+                allowedAudiences: ['audience-public'],
+                companionId: 'companion-adv',
+                correlationId: 'corr-adv-1',
+                createdAt: new Date().toISOString(),
+            };
+            const privateEvidence = {
+                evidenceId: 'ev-priv-1',
+                sourceId: 'src-secrets',
+                origin: 'knowledge',
+                trust: 'configured',
+                sensitivity: 'restricted',
+                allowedAudiences: ['audience-owner'],
+                companionId: 'companion-adv',
+                correlationId: 'corr-adv-1',
+                createdAt: new Date().toISOString(),
+            };
+            // Staged for public channel with both public and restricted evidence attached
+            const staged = gating.stageResponse({
+                requestContext: baseViewerContext, // Public channel
+                candidateSpeech: 'Siduri was created in 1840 by aliens.',
+                candidateLanguage: 'en',
+                evidenceRecords: [publicEvidence, privateEvidence],
+            });
+            const evaluation = gating.evaluateGate(staged, [publicEvidence, privateEvidence]);
+            expect(evaluation.admissible).toBe(true);
+            expect(evaluation.reasonCode).toBe('APPROVED_DIRECT');
+            // Public evidence admitted, restricted private evidence excluded from public emission
+            expect(evaluation.filteredEvidenceIds).toEqual(['ev-pub-1']);
+            expect(evaluation.filteredEvidenceIds).not.toContain('ev-priv-1');
+        });
+    });
+    // INVARIANT 9: Full-Field Tamper-Evident Audit Trail
+    describe('Invariant 9: Full-Field SHA-256 Audit Trail Chaining', () => {
+        test('mutating any security-critical field breaks cryptographic hash chain', async () => {
+            const store = new index_1.InMemoryActionStore();
+            const policyEngine = new index_1.ActionPolicyEngine({ store, secretKey });
+            policyEngine.registerToolDefinition({
+                name: 'test_tool',
+                providerId: 'sys',
+                description: 'Test Tool',
+                inputSchema: {},
+                riskLevel: 'LOW',
+            });
+            // Event 1
+            await policyEngine.evaluateAction({
+                actionId: 'act-1',
+                toolName: 'sys/test_tool',
+                parameters: { step: 1 },
+                context: baseOwnerContext,
+            });
+            // Event 2
+            await policyEngine.evaluateAction({
+                actionId: 'act-2',
+                toolName: 'sys/test_tool',
+                parameters: { step: 2 },
+                context: baseOwnerContext,
+            });
+            const auditTrail = await store.getAuditLog();
+            expect(auditTrail.length).toBe(2);
+            const event1 = auditTrail[0];
+            const event2 = auditTrail[1];
+            // Mutate security-critical fields in event1 and verify chain discrepancy
+            const criticalFields = [
+                'executionId',
+                'actionId',
+                'toolName',
+                'companionId',
+                'actorId',
+                'sessionId',
+                'channel',
+                'correlationId',
+                'riskLevel',
+                'lifecycle',
+                'parametersHash',
+            ];
+            for (const field of criticalFields) {
+                const tamperedEvent = { ...event1, [field]: 'TAMPERED_VALUE' };
+                const initialPrevHash = '0000000000000000000000000000000000000000000000000000000000000000';
+                const canonical = (0, index_1.canonicalizeJson)({
+                    executionId: tamperedEvent.executionId,
+                    actionId: tamperedEvent.actionId,
+                    toolName: tamperedEvent.toolName,
+                    providerId: tamperedEvent.providerId || null,
+                    companionId: tamperedEvent.companionId,
+                    actorId: tamperedEvent.actorId || null,
+                    sessionId: tamperedEvent.sessionId || null,
+                    channel: tamperedEvent.channel || null,
+                    correlationId: tamperedEvent.correlationId || null,
+                    riskLevel: tamperedEvent.riskLevel,
+                    lifecycle: tamperedEvent.lifecycle,
+                    decision: tamperedEvent.decision ? {
+                        allowed: tamperedEvent.decision.allowed,
+                        reason: tamperedEvent.decision.reason,
+                        riskLevel: tamperedEvent.decision.riskLevel,
+                        decisionCode: tamperedEvent.decision.decisionCode,
+                    } : null,
+                    parametersHash: tamperedEvent.parametersHash || null,
+                    error: tamperedEvent.error || null,
+                    timestamp: tamperedEvent.timestamp,
+                });
+                const crypto = require('node:crypto');
+                const brokenHash1 = crypto.createHash('sha256').update(`${initialPrevHash}:${canonical}`, 'utf8').digest('hex');
+                expect(brokenHash1).not.toBe(event1.resultHash);
+            }
+        });
+    });
+});

package/dist/capability.d.ts

@@ -33,16 +33,21 @@ export interface ActionStore {
     reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
     updateExecution(record: PersistentExecutionRecord): Promise<void>;
     getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
+    saveApproval(executionId: string, approverActorId: string, reason?: string): Promise<void>;
+    isActionApproved(executionId: string): Promise<boolean>;
     appendAudit(event: ActionAuditEvent): Promise<void>;
     getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
 }
 export declare class InMemoryActionStore implements ActionStore {
     private readonly executions;
+    private readonly approvals;
     private readonly auditLog;
     private lastAuditHash;
     reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
     updateExecution(record: PersistentExecutionRecord): Promise<void>;
     getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
+    saveApproval(executionId: string, approverActorId: string, reason?: string): Promise<void>;
+    isActionApproved(executionId: string): Promise<boolean>;
     appendAudit(event: ActionAuditEvent): Promise<void>;
     getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
 }

package/dist/capability.js

@@ -11,6 +11,7 @@ exports.verifyCapabilitySignature = verifyCapabilitySignature;
 const crypto = require('crypto');
 class InMemoryActionStore {
     executions = new Map();
+    approvals = new Map();
     auditLog = [];
     lastAuditHash = '0000000000000000000000000000000000000000000000000000000000000000';
     async reserveExecution(record) {
@@ -27,24 +28,51 @@ class InMemoryActionStore {
         const rec = this.executions.get(executionId);
         return rec ? { ...rec } : undefined;
     }
+    async saveApproval(executionId, approverActorId, reason) {
+        this.approvals.set(executionId, {
+            approverActorId,
+            reason,
+            approvedAt: new Date().toISOString(),
+        });
+    }
+    async isActionApproved(executionId) {
+        return this.approvals.has(executionId);
+    }
     async appendAudit(event) {
-        // Tamper-evident hash chaining: SHA-256(prevHash + ":" + canonicalEvent)
+        const prevHash = this.lastAuditHash;
+        // Tamper-evident hash chaining over all security-critical event fields
         const eventPayload = {
             executionId: event.executionId,
             actionId: event.actionId,
             toolName: event.toolName,
+            providerId: event.providerId || null,
+            companionId: event.companionId,
+            actorId: event.actorId || null,
+            sessionId: event.sessionId || null,
+            channel: event.channel || null,
+            correlationId: event.correlationId || null,
+            riskLevel: event.riskLevel,
             lifecycle: event.lifecycle,
-            parametersHash: event.parametersHash,
+            decision: event.decision ? {
+                allowed: event.decision.allowed,
+                reason: event.decision.reason,
+                riskLevel: event.decision.riskLevel,
+                decisionCode: event.decision.decisionCode,
+            } : null,
+            parametersHash: event.parametersHash || null,
+            error: event.error || null,
             timestamp: event.timestamp,
         };
         const canonical = canonicalizeJson(eventPayload);
         const eventHash = crypto
             .createHash('sha256')
-            .update(`${this.lastAuditHash}:${canonical}`, 'utf8')
+            .update(`${prevHash}:${canonical}`, 'utf8')
             .digest('hex');
         this.lastAuditHash = eventHash;
         const recordWithHash = {
             ...event,
+            previousEventHash: prevHash,
+            eventHash,
             resultHash: event.resultHash || eventHash,
         };
         this.auditLog.push(recordWithHash);

package/dist/capability.test.js

@@ -151,22 +151,52 @@ describe('AuthorizationCapability Cryptographic & Tamper Review', () => {
                 executionId: event1.executionId,
                 actionId: event1.actionId,
                 toolName: event1.toolName,
+                providerId: event1.providerId || null,
+                companionId: event1.companionId,
+                actorId: event1.actorId || null,
+                sessionId: event1.sessionId || null,
+                channel: event1.channel || null,
+                correlationId: event1.correlationId || null,
+                riskLevel: event1.riskLevel,
                 lifecycle: event1.lifecycle,
-                parametersHash: event1.parametersHash,
+                decision: event1.decision ? {
+                    allowed: event1.decision.allowed,
+                    reason: event1.decision.reason,
+                    riskLevel: event1.decision.riskLevel,
+                    decisionCode: event1.decision.decisionCode,
+                } : null,
+                parametersHash: event1.parametersHash || null,
+                error: event1.error || null,
                 timestamp: event1.timestamp,
             });
             const expectedHash1 = crypto.createHash('sha256').update(`${initialPrevHash}:${canonical1}`, 'utf8').digest('hex');
-            expect(event1.resultHash).toBe(expectedHash1);
+            expect(event1.eventHash).toBe(expectedHash1);
+            expect(event1.previousEventHash).toBe(initialPrevHash);
             const canonical2 = (0, capability_1.canonicalizeJson)({
                 executionId: event2.executionId,
                 actionId: event2.actionId,
                 toolName: event2.toolName,
+                providerId: event2.providerId || null,
+                companionId: event2.companionId,
+                actorId: event2.actorId || null,
+                sessionId: event2.sessionId || null,
+                channel: event2.channel || null,
+                correlationId: event2.correlationId || null,
+                riskLevel: event2.riskLevel,
                 lifecycle: event2.lifecycle,
-                parametersHash: event2.parametersHash,
+                decision: event2.decision ? {
+                    allowed: event2.decision.allowed,
+                    reason: event2.decision.reason,
+                    riskLevel: event2.decision.riskLevel,
+                    decisionCode: event2.decision.decisionCode,
+                } : null,
+                parametersHash: event2.parametersHash || null,
+                error: event2.error || null,
                 timestamp: event2.timestamp,
             });
             const expectedHash2 = crypto.createHash('sha256').update(`${expectedHash1}:${canonical2}`, 'utf8').digest('hex');
-            expect(event2.resultHash).toBe(expectedHash2);
+            expect(event2.eventHash).toBe(expectedHash2);
+            expect(event2.previousEventHash).toBe(expectedHash1);
             // If an attacker altered event 1 retrospectively, the hash chain breaks for event 2
             const tamperedCanonical1 = (0, capability_1.canonicalizeJson)({
                 ...JSON.parse(canonical1),
@@ -177,4 +207,63 @@ describe('AuthorizationCapability Cryptographic & Tamper Review', () => {
             expect(brokenHash2).not.toBe(event2.resultHash);
         });
     });
+    describe('Durable Action Approval Restart Semantics', () => {
+        it('preserves approved execution authorization across ActionPolicyEngine process restart', async () => {
+            const sharedStore = new capability_1.InMemoryActionStore();
+            // Instance 1: Operator reviews and approves a HIGH risk action
+            const engine1 = new action_policy_1.ActionPolicyEngine({
+                store: sharedStore,
+                secretKey,
+                defaultRiskLevel: 'HIGH',
+                defaultRequireApprovalForHighRisk: true,
+            });
+            engine1.registerToolDefinition({
+                name: 'database/cleanup',
+                providerId: 'db',
+                description: 'Cleanup DB',
+                inputSchema: {},
+                riskLevel: 'HIGH',
+                requiresApproval: true,
+            });
+            const highRiskAction = {
+                actionId: 'act-restart-1',
+                executionId: 'exec-restart-1',
+                toolName: 'db/database/cleanup',
+                parameters: { target: 'logs' },
+                context: sampleContext,
+            };
+            // 1. Initial evaluation without approval is rejected
+            const eval1 = await engine1.evaluateAction(highRiskAction);
+            expect(eval1.decision.allowed).toBe(false);
+            expect(eval1.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+            // 2. Operator explicitly approves
+            await engine1.approveAction({
+                executionId: 'exec-restart-1',
+                approverActorId: 'operator-1',
+                reason: 'Scheduled maintenance',
+            });
+            // 3. Process restarts: new ActionPolicyEngine instance with empty in-memory set but shared durable store
+            const engine2 = new action_policy_1.ActionPolicyEngine({
+                store: sharedStore,
+                secretKey,
+                defaultRiskLevel: 'HIGH',
+                defaultRequireApprovalForHighRisk: true,
+            });
+            engine2.registerToolDefinition({
+                name: 'database/cleanup',
+                providerId: 'db',
+                description: 'Cleanup DB',
+                inputSchema: {},
+                riskLevel: 'HIGH',
+                requiresApproval: true,
+            });
+            // 4. Evaluation after restart loads durable approval and successfully authorizes capability
+            const eval2 = await engine2.evaluateAction(highRiskAction);
+            expect(eval2.decision.allowed).toBe(true);
+            expect(eval2.decision.decisionCode).toBe('ALLOWED_POLICY');
+            expect(eval2.capability).toBeDefined();
+            expect(eval2.capability?.executionId).toBe('exec-restart-1');
+            expect((0, capability_1.verifyCapabilitySignature)(eval2.capability, secretKey)).toBe(true);
+        });
+    });
 });

package/dist/chat-contract.d.ts

@@ -0,0 +1,77 @@
+import { RequestContext } from './context';
+import { Message, Claim } from './index';
+import { ActionExecutionResult } from './action';
+import { ResponseCitation } from './evidence';
+import { SiduriRuntime } from './runtime';
+export interface ChatRequest {
+    id?: string;
+    companionId?: string;
+    message: string;
+    role?: 'OWNER' | 'VIEWER' | 'OPERATOR';
+    context?: RequestContext;
+    history?: Message[];
+    [key: string]: any;
+}
+export interface ChatResponseMetadataEvent {
+    event_id: string;
+    kind: string;
+    lifecycle: string;
+    approval?: string;
+    expression?: string;
+    action?: string;
+    durationMs?: number;
+}
+export interface ChatResponsePlan {
+    speech_id?: string;
+    audio_url?: string;
+    subtitle_ja: string;
+    subtitle_en: string;
+    spoken_ja?: string;
+    evidence_ids?: string[];
+}
+export interface ChatResponseMetadata {
+    language?: string;
+    proposals?: Claim[];
+    memory_proposals?: Array<{
+        proposal_id: string;
+        subject?: string;
+        predicate?: string;
+        value?: string;
+        status: string;
+        content?: string;
+        claim_type?: string;
+    }>;
+    behavioral_proposals?: Array<{
+        directive_id: string;
+        memory_class: string;
+        domain: string;
+        subject: string;
+        predicate: string;
+        value: string;
+        status: string;
+        behavior?: any;
+        runtime_effect?: string;
+    }>;
+    action_results?: ActionExecutionResult[];
+    evidence_ids?: string[];
+    citations?: ResponseCitation[];
+    subsystem_diagnostics?: Record<string, string>;
+    events?: ChatResponseMetadataEvent[];
+    [key: string]: any;
+}
+export interface ChatResponse {
+    status: 'APPROVED' | 'REJECTED' | 'STAGED' | string;
+    response_id?: string;
+    correlation_id?: string;
+    response: ChatResponsePlan;
+    metadata?: ChatResponseMetadata;
+    reply?: string;
+    text?: string;
+    audioUrl?: string;
+    expression?: string;
+}
+/**
+ * Canonical helper to dispatch a chat request to a SiduriRuntime instance.
+ * Guarantees a 1:1 identical response structure for localweb (apps/api) and standalone CLI.
+ */
+export declare function dispatchCompanionChat(runtime: SiduriRuntime, payload: ChatRequest): Promise<ChatResponse>;

package/dist/chat-contract.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dispatchCompanionChat = dispatchCompanionChat;
+/**
+ * Canonical helper to dispatch a chat request to a SiduriRuntime instance.
+ * Guarantees a 1:1 identical response structure for localweb (apps/api) and standalone CLI.
+ */
+async function dispatchCompanionChat(runtime, payload) {
+    const userMessage = payload.message || payload.text || '';
+    const history = Array.isArray(payload.history) ? payload.history : [];
+    let roleOrContext;
+    if (payload.role) {
+        roleOrContext = payload.role;
+    }
+    else if (payload.context) {
+        // Map authorization role to legacy memory scope for backwards-compatible runtime calls
+        const authRole = payload.context.actor?.authorizationRole;
+        roleOrContext =
+            authRole === 'administrator'
+                ? 'OWNER'
+                : authRole === 'operator'
+                    ? 'OPERATOR'
+                    : (authRole === 'viewer' ? 'VIEWER' : 'OWNER');
+    }
+    else {
+        roleOrContext = 'OWNER';
+    }
+    const runtimeResult = await runtime.handleUserMessage(userMessage, roleOrContext, history);
+    // Normalize response plan
+    const speech = runtimeResult?.response?.subtitle_ja || runtimeResult?.response?.subtitle_en || '';
+    const audioUrl = runtimeResult?.response?.audio_url;
+    // Extract avatar expression if any event was generated
+    let expression = 'neutral';
+    const events = runtimeResult?.metadata?.events || [];
+    const avatarEvent = events.find((e) => e.kind === 'avatar' || e.kind === 'body');
+    if (avatarEvent && avatarEvent.expression) {
+        expression = avatarEvent.expression;
+    }
+    // Ensure both spoken_ja and subtitle_en are accessible alongside speech_id and evidence_ids
+    const responsePlan = {
+        speech_id: runtimeResult?.response?.speech_id,
+        audio_url: audioUrl,
+        subtitle_ja: runtimeResult?.response?.subtitle_ja ?? speech,
+        subtitle_en: runtimeResult?.response?.subtitle_en ?? speech,
+        spoken_ja: runtimeResult?.response?.spoken_ja ?? runtimeResult?.response?.subtitle_ja ?? speech,
+        evidence_ids: runtimeResult?.metadata?.evidence_ids ?? runtimeResult?.response?.evidence_ids ?? [],
+    };
+    const metadata = {
+        ...(runtimeResult?.metadata || {}),
+    };
+    delete metadata.internal_monologue;
+    delete metadata.internalMonologue;
+    return {
+        status: runtimeResult?.status || 'APPROVED',
+        response_id: runtimeResult?.response_id,
+        correlation_id: runtimeResult?.correlation_id,
+        response: responsePlan,
+        metadata,
+        // Convenience fields for legacy/simple consumers
+        reply: speech,
+        text: speech,
+        audioUrl,
+        expression,
+    };
+}

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export * from './ear-types';
 export * from './capability';
 export * from './teaching';
 export * from './runtime';
+export * from './chat-contract';
 import { ActionIntent } from './action';
 import { EarIngestOptions } from './ear-types';
 export interface OrganConfig {
@@ -123,6 +124,8 @@ export interface MemoryQueryOptions {
     audienceId?: string;
     sensitivity?: string;
     limit?: number;
+    minConfidence?: number;
+    now?: string | Date;
 }
 export interface MemoryOrgan {
     initialize(companionId: string): Promise<void>;
@@ -143,6 +146,8 @@ export interface MemoryOrgan {
     disableDirective(id: string): Promise<void>;
     expireDirective?(id: string): Promise<void>;
     supersedeClaim?(id: string, replacement: Omit<Claim, 'id' | 'status' | 'companionId'>): Promise<Claim>;
+    updateClaim?(id: string, updates: Partial<Pick<Claim, 'subject' | 'predicate' | 'value' | 'scope' | 'sensitivity' | 'confidence' | 'validFrom' | 'validUntil' | 'allowedAudiences'>>): Promise<Claim>;
+    resetMemory?(): Promise<void>;
     addSourceEvent?(event: SourceEvent): Promise<SourceEvent>;
     getSourceEvent?(id: string): Promise<SourceEvent | undefined>;
 }

package/dist/index.js

@@ -26,3 +26,4 @@ __exportStar(require("./ear-types"), exports);
 __exportStar(require("./capability"), exports);
 __exportStar(require("./teaching"), exports);
 __exportStar(require("./runtime"), exports);
+__exportStar(require("./chat-contract"), exports);

package/dist/runtime.js

@@ -111,17 +111,21 @@ class SiduriRuntime {
                 limit: 5,
             }
             : role;
+        const subsystemDiagnostics = {};
         const [knowledgeData, memoryData, activeDirectives] = await Promise.all([
             this.knowledge && shouldQueryKnowledge && typeof this.knowledge.search === 'function' ? this.knowledge.search(perceivedText).catch(e => {
                 console.error("[SiduriRuntime] Knowledge search failed:", e.message);
+                subsystemDiagnostics['knowledge'] = `UNAVAILABLE: ${e.message}`;
                 return [];
             }) : Promise.resolve([]),
             this.memory && typeof this.memory.searchClaims === 'function' ? this.memory.searchClaims(perceivedText, queryOptions, 5).catch(e => {
                 console.error("[SiduriRuntime] Memory search failed:", e.message);
+                subsystemDiagnostics['memory_claims'] = `UNAVAILABLE: ${e.message}`;
                 return [];
             }) : Promise.resolve([]),
             this.memory && typeof this.memory.getDirectives === 'function' ? this.memory.getDirectives().catch(e => {
                 console.error("[SiduriRuntime] Memory directives failed:", e.message);
+                subsystemDiagnostics['memory_directives'] = `UNAVAILABLE: ${e.message}`;
                 return [];
             }) : Promise.resolve([])
         ]);
@@ -154,6 +158,9 @@ class SiduriRuntime {
             }
         }
         let contextPrompt = "";
+        if (Object.keys(subsystemDiagnostics).length > 0) {
+            contextPrompt += "SUBSYSTEM STATUS (DEGRADED):\n" + Object.entries(subsystemDiagnostics).map(([k, v]) => `- [${k}] ${v}`).join("\n") + "\n";
+        }
         if (knowledgeData.length > 0) {
             contextPrompt += "KNOWLEDGE:\n" + knowledgeData.map(k => `- [revision:${k.revision} source:${k.provenance}] ${k.content}`).join("\n") + "\n";
         }
@@ -383,12 +390,12 @@ class SiduriRuntime {
             },
             metadata: {
                 language: plan.language,
-                internal_monologue: plan.internalMonologue,
                 proposals: createdMemoryProposals,
                 memory_proposals: memoryProposalReceipts,
                 action_results: actionResults,
                 evidence_ids: gateEval.filteredEvidenceIds,
                 citations: gateEval.filteredCitations,
+                subsystem_diagnostics: Object.keys(subsystemDiagnostics).length > 0 ? subsystemDiagnostics : undefined,
                 events: experienceEvents.map(e => ({
                     event_id: e.eventId,
                     kind: e.kind,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@siduri-x/core",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Core runtime types, evidence protocol, action dispatcher, capability validation, and SiduriRuntime protocol",
   "license": "Apache-2.0",
   "repository": {