@siduri-x/core 2.0.0 → 2.0.1

package/dist/action-policy.d.ts

@@ -15,12 +15,35 @@ export interface ActionPolicyEngineOptions {
     defaultRequireApprovalForHighRisk?: boolean;
     store?: ActionStore;
     secretKey?: string;
+    allowedApproverRoles?: string[];
+    requiredApproverCapabilities?: string[];
+}
+export type ActionApprovalDecisionCode = 'APPROVED' | 'REJECTED_UNAUTHORIZED' | 'REJECTED_UNAUTHENTICATED' | 'REJECTED_ROLE_MISMATCH' | 'REJECTED_MISSING_APPROVER_ID' | 'REJECTED_MISSING_CAPABILITY';
+export interface ActionApprovalResult {
+    approved: boolean;
+    decisionCode: ActionApprovalDecisionCode;
+    reason: string;
+    executionId: string;
+    approverActorId: string;
 }
 export interface ApproveActionOptions {
     executionId: string;
     approverActorId: string;
     reason?: string;
+    /**
+     * Optional RequestContext of the approver establishing authenticated identity.
+     */
+    context?: RequestContext;
+    /**
+     * Optional role of the approver (e.g. 'owner', 'administrator', 'operator').
+     */
+    approverRole?: string;
+    /**
+     * Optional capabilities held by the approver.
+     */
+    approverCapabilities?: string[];
 }
+export declare function normalizeApproverRole(role?: string, actorId?: string): string;
 export declare class ActionPolicyEngine {
     private readonly toolRegistry;
     private readonly rules;
@@ -28,7 +51,10 @@ export declare class ActionPolicyEngine {
     private readonly defaultRiskLevel;
     private readonly defaultRequireApprovalForHighRisk;
     private readonly secretKey;
+    private readonly allowedApproverRoles;
+    private readonly requiredApproverCapabilities;
     private readonly approvedExecutions;
+    private readonly pendingActions;
     constructor(options?: ActionPolicyEngineOptions);
     registerToolDefinition(tool: ToolDefinition): void;
     unregisterToolDefinition(toolName: string): boolean;
@@ -38,7 +64,8 @@ export declare class ActionPolicyEngine {
         decision: ActionPolicyDecision;
         capability?: AuthorizationCapability;
     }>;
-    approveAction(options: ApproveActionOptions): Promise<boolean>;
+    approveAction(options: ApproveActionOptions): Promise<ActionApprovalResult>;
+    private recordApprovalAudit;
     recordAudit(action: ActionIntent, context: RequestContext | undefined, decision: ActionPolicyDecision | undefined, lifecycle: ActionLifecycleState, result?: unknown, error?: string, durationMs?: number): Promise<ActionAuditEvent>;
     getAuditLog(): Promise<ActionAuditEvent[]>;
     getStore(): ActionStore;

package/dist/action-policy.js

@@ -1,7 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ActionPolicyEngine = void 0;
+exports.normalizeApproverRole = normalizeApproverRole;
 const capability_1 = require("./capability");
+function normalizeApproverRole(role, actorId) {
+    if (role && role.trim() !== '') {
+        const lower = role.trim().toLowerCase();
+        if (lower === 'administrator' || lower === 'admin')
+            return 'administrator';
+        return lower;
+    }
+    if (actorId) {
+        const lower = actorId.toLowerCase();
+        if (lower.includes('admin'))
+            return 'administrator';
+        if (lower.includes('owner'))
+            return 'owner';
+        if (lower.includes('operator'))
+            return 'operator';
+        if (lower.includes('viewer') || lower.includes('guest') || lower.includes('visitor'))
+            return 'viewer';
+    }
+    return 'owner'; // Default to single-owner role
+}
 class ActionPolicyEngine {
     toolRegistry = new Map();
     rules = [];
@@ -9,13 +30,18 @@ class ActionPolicyEngine {
     defaultRiskLevel;
     defaultRequireApprovalForHighRisk;
     secretKey;
-    approvedExecutions = new Set();
+    allowedApproverRoles;
+    requiredApproverCapabilities;
+    approvedExecutions = new Map();
+    pendingActions = new Map();
     constructor(options = {}) {
         this.rules = options.rules ?? [];
         this.defaultRiskLevel = options.defaultRiskLevel ?? 'HIGH';
         this.defaultRequireApprovalForHighRisk = options.defaultRequireApprovalForHighRisk ?? true;
         this.store = options.store ?? new capability_1.InMemoryActionStore();
         this.secretKey = (0, capability_1.getOrGenerateLocalActionPolicySecret)(options.secretKey);
+        this.allowedApproverRoles = (options.allowedApproverRoles ?? ['owner', 'administrator', 'admin', 'operator']).map((r) => r.toLowerCase());
+        this.requiredApproverCapabilities = options.requiredApproverCapabilities ?? [];
     }
     registerToolDefinition(tool) {
         const key = tool.providerId ? `${tool.providerId}/${tool.name}` : tool.name;
@@ -125,14 +151,38 @@ class ActionPolicyEngine {
         // Risk level approval check
         const requiresExplicitApproval = toolDef.requiresApproval ??
             (this.defaultRequireApprovalForHighRisk && (riskLevel === 'HIGH' || riskLevel === 'CRITICAL'));
-        let isApproved = this.approvedExecutions.has(executionId);
+        let approvalRecord = this.approvedExecutions.get(executionId);
+        if (!approvalRecord && typeof this.store.getApproval === 'function') {
+            approvalRecord = await this.store.getApproval(executionId);
+            if (approvalRecord) {
+                this.approvedExecutions.set(executionId, approvalRecord);
+            }
+        }
+        let isApproved = Boolean(approvalRecord);
         if (!isApproved && typeof this.store.isActionApproved === 'function') {
             isApproved = await this.store.isActionApproved(executionId);
-            if (isApproved) {
-                this.approvedExecutions.add(executionId);
+        }
+        if (requiresExplicitApproval && isApproved && approvalRecord) {
+            const approverRole = (approvalRecord.approverRole || normalizeApproverRole(undefined, approvalRecord.approverActorId)).toLowerCase();
+            const isOwnerOrAdmin = approverRole === 'owner' || approverRole === 'administrator' || approverRole === 'admin';
+            if (toolDef.allowedRoles && toolDef.allowedRoles.length > 0 && !isOwnerOrAdmin) {
+                const allowed = toolDef.allowedRoles.map((r) => r.toLowerCase());
+                if (!allowed.includes(approverRole)) {
+                    const decision = {
+                        allowed: false,
+                        reason: `Approver "${approvalRecord.approverActorId}" with role "${approverRole}" is not authorized to approve tool "${action.toolName}"`,
+                        riskLevel,
+                        requiredCapabilities: requiredCaps,
+                        executionId,
+                        decisionCode: 'REJECTED_UNAUTHORIZED',
+                    };
+                    await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+                    return { decision };
+                }
             }
         }
         if (requiresExplicitApproval && !isApproved) {
+            this.pendingActions.set(executionId, { action, context: effectiveContext, toolDef });
             const decision = {
                 allowed: false,
                 reason: `Action "${action.toolName}" has risk level ${riskLevel} and requires explicit approval`,
@@ -181,11 +231,121 @@ class ActionPolicyEngine {
         return { decision, capability };
     }
     async approveAction(options) {
-        this.approvedExecutions.add(options.executionId);
+        const actorId = (options.context?.actor.actorId || options.approverActorId || '').trim();
+        if (!actorId) {
+            return {
+                approved: false,
+                decisionCode: 'REJECTED_MISSING_APPROVER_ID',
+                reason: 'approverActorId is required to approve an action execution',
+                executionId: options.executionId,
+                approverActorId: '',
+            };
+        }
+        // 1. Authenticated boundary check
+        if (options.context && options.context.actor.authenticated === false) {
+            const result = {
+                approved: false,
+                decisionCode: 'REJECTED_UNAUTHENTICATED',
+                reason: `Approver "${actorId}" is unauthenticated and cannot approve actions`,
+                executionId: options.executionId,
+                approverActorId: actorId,
+            };
+            await this.recordApprovalAudit(options.executionId, actorId, 'unauthenticated', false, result.reason);
+            return result;
+        }
+        // 2. Resolve effective approver role & capabilities
+        const rawRole = options.context?.actor.authorizationRole || options.context?.actor?.role || options.approverRole;
+        const approverRole = normalizeApproverRole(rawRole, actorId);
+        const capabilities = options.context?.actor.capabilities || options.approverCapabilities || [];
+        const isOwnerOrAdmin = approverRole === 'owner' || approverRole === 'administrator' || approverRole === 'admin';
+        const isRoleAllowed = isOwnerOrAdmin || this.allowedApproverRoles.includes(approverRole);
+        // Reject non-allowed roles or explicit viewer/guest role
+        if (!isRoleAllowed || approverRole === 'viewer') {
+            const result = {
+                approved: false,
+                decisionCode: 'REJECTED_UNAUTHORIZED',
+                reason: `Actor "${actorId}" with role "${approverRole}" is not authorized to approve actions`,
+                executionId: options.executionId,
+                approverActorId: actorId,
+            };
+            await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason);
+            return result;
+        }
+        // 3. Tool-specific authorization check if pending action is registered
+        const pending = this.pendingActions.get(options.executionId);
+        if (pending) {
+            const { toolDef } = pending;
+            if (toolDef.allowedRoles && toolDef.allowedRoles.length > 0 && !isOwnerOrAdmin) {
+                const normalizedToolRoles = new Set(toolDef.allowedRoles.map((r) => r.toLowerCase()));
+                if (!normalizedToolRoles.has(approverRole)) {
+                    const result = {
+                        approved: false,
+                        decisionCode: 'REJECTED_ROLE_MISMATCH',
+                        reason: `Approver role "${approverRole}" is not authorized to approve tool "${toolDef.name}" (requires: ${toolDef.allowedRoles.join(', ')})`,
+                        executionId: options.executionId,
+                        approverActorId: actorId,
+                    };
+                    await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason, toolDef.name);
+                    return result;
+                }
+            }
+            if (this.requiredApproverCapabilities.length > 0 && !isOwnerOrAdmin) {
+                const missing = this.requiredApproverCapabilities.filter((c) => !capabilities.includes(c));
+                if (missing.length > 0) {
+                    const result = {
+                        approved: false,
+                        decisionCode: 'REJECTED_MISSING_CAPABILITY',
+                        reason: `Approver is missing required approval capabilities: [${missing.join(', ')}]`,
+                        executionId: options.executionId,
+                        approverActorId: actorId,
+                    };
+                    await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason, toolDef.name);
+                    return result;
+                }
+            }
+        }
+        // 4. Record verified approval
+        const record = {
+            executionId: options.executionId,
+            approverActorId: actorId,
+            reason: options.reason,
+            approverRole,
+            approvedAt: new Date().toISOString(),
+        };
+        this.approvedExecutions.set(options.executionId, record);
         if (typeof this.store.saveApproval === 'function') {
-            await this.store.saveApproval(options.executionId, options.approverActorId, options.reason);
+            await this.store.saveApproval(options.executionId, actorId, options.reason, approverRole);
         }
-        return true;
+        const reason = options.reason || 'Action approved by authorized policy approver';
+        await this.recordApprovalAudit(options.executionId, actorId, approverRole, true, reason, pending?.toolDef.name);
+        return {
+            approved: true,
+            decisionCode: 'APPROVED',
+            reason,
+            executionId: options.executionId,
+            approverActorId: actorId,
+        };
+    }
+    async recordApprovalAudit(executionId, approverActorId, approverRole, approved, reason, toolName) {
+        const event = {
+            executionId,
+            actionId: executionId,
+            toolName: toolName || 'action:approve',
+            companionId: 'system',
+            actorId: approverActorId,
+            riskLevel: 'HIGH',
+            lifecycle: approved ? 'APPROVED' : 'REJECTED',
+            decision: {
+                allowed: approved,
+                reason: reason || (approved ? 'Approval granted' : 'Approval rejected'),
+                riskLevel: 'HIGH',
+                executionId,
+                decisionCode: approved ? 'ALLOWED_POLICY' : 'REJECTED_UNAUTHORIZED',
+            },
+            parametersHash: (0, capability_1.computeParametersHash)({ executionId, approverActorId, approverRole, reason }),
+            timestamp: new Date().toISOString(),
+        };
+        await this.store.appendAudit(event);
     }
     async recordAudit(action, context, decision, lifecycle, result, error, durationMs) {
         const event = {

package/dist/action-policy.test.js

@@ -190,4 +190,108 @@ describe('ActionPolicyEngine Boundary', () => {
         expect(resOp.decision.allowed).toBe(false);
         expect(resOp.decision.decisionCode).toBe('REJECTED_UNAUTHORIZED');
     });
+    describe('Approval Authorization Semantics', () => {
+        const criticalAction = {
+            actionId: 'act-sec-auth-1',
+            toolName: 'admin/delete_database',
+            parameters: {},
+            context: {
+                companionId: 'companion-1',
+                actor: {
+                    actorId: 'admin-1',
+                    sessionId: 'sess-1',
+                    authorizationRole: 'administrator',
+                    capabilities: ['admin:delete'],
+                    authenticated: true,
+                },
+                conversation: { channel: 'direct', correlationId: 'corr-1' },
+            },
+            executionId: 'exec-sec-auth-1',
+        };
+        it('rejects action approval when approverActorId is empty', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: '',
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_MISSING_APPROVER_ID');
+        });
+        it('rejects action approval from unauthenticated approver context', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'fake-admin',
+                context: {
+                    companionId: 'companion-1',
+                    actor: {
+                        actorId: 'fake-admin',
+                        sessionId: 'sess-fake',
+                        authorizationRole: 'administrator',
+                        capabilities: ['admin:delete'],
+                        authenticated: false, // Unauthenticated!
+                    },
+                    conversation: { channel: 'direct', correlationId: 'corr-fake' },
+                },
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_UNAUTHENTICATED');
+        });
+        it('rejects action approval from viewer role', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'viewer-user',
+                approverRole: 'viewer',
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        });
+        it('rejects approval when approver role does not match tool requirements (operator cannot approve admin tool)', async () => {
+            // 1. Initial evaluation stages pending execution
+            const eval1 = await engine.evaluateAction(criticalAction);
+            expect(eval1.decision.allowed).toBe(false);
+            expect(eval1.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+            // 2. Operator attempts to approve an administrator-only tool
+            const approvalRes = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'operator-alice',
+                approverRole: 'operator',
+            });
+            expect(approvalRes.approved).toBe(false);
+            expect(approvalRes.decisionCode).toBe('REJECTED_ROLE_MISMATCH');
+            // 3. Action re-evaluation remains unapproved and denied
+            const eval2 = await engine.evaluateAction(criticalAction);
+            expect(eval2.decision.allowed).toBe(false);
+            expect(eval2.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+        });
+        it('authorizes approval and emits capability when approver is administrator or owner', async () => {
+            await engine.evaluateAction(criticalAction);
+            const approvalRes = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'admin-bob',
+                approverRole: 'administrator',
+                reason: 'Authorized scheduled database purge',
+            });
+            expect(approvalRes.approved).toBe(true);
+            expect(approvalRes.decisionCode).toBe('APPROVED');
+            const evalApproved = await engine.evaluateAction(criticalAction);
+            expect(evalApproved.decision.allowed).toBe(true);
+            expect(evalApproved.decision.decisionCode).toBe('ALLOWED_POLICY');
+            expect(evalApproved.capability).toBeDefined();
+        });
+        it('records structured tamper-evident audit logs for approval decisions', async () => {
+            await engine.evaluateAction(criticalAction);
+            await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'viewer-tamper',
+                approverRole: 'viewer',
+            });
+            const auditLogs = await engine.getAuditLog();
+            const rejectionEvent = auditLogs.find((l) => l.executionId === 'exec-sec-auth-1' && l.lifecycle === 'REJECTED' && l.toolName === 'action:approve');
+            expect(rejectionEvent).toBeDefined();
+            expect(rejectionEvent?.actorId).toBe('viewer-tamper');
+            expect(rejectionEvent?.decision?.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        });
+    });
 });

package/dist/adversarial.test.js

@@ -356,7 +356,7 @@ describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
             const failingMemory = {
                 initialize: jest.fn().mockResolvedValue(undefined),
                 searchClaims: jest.fn().mockRejectedValue(new Error('Connection terminated unexpectedly')),
-                getDirectives: jest.fn().mockRejectedValue(new Error('PostgreSQL read timeout')),
+                getDirectives: jest.fn().mockRejectedValue(new Error('Database read timeout')),
             };
             const runtime = new index_1.SiduriRuntime('companion-adv', { name: 'AdvCompanion' }, {
                 brain: mockBrain,
@@ -454,6 +454,7 @@ describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
                 'riskLevel',
                 'lifecycle',
                 'parametersHash',
+                'resultHash',
             ];
             for (const field of criticalFields) {
                 const tamperedEvent = { ...event1, [field]: 'TAMPERED_VALUE' };
@@ -477,12 +478,13 @@ describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
                         decisionCode: tamperedEvent.decision.decisionCode,
                     } : null,
                     parametersHash: tamperedEvent.parametersHash || null,
+                    resultHash: field === 'resultHash' ? 'TAMPERED_VALUE' : null,
                     error: tamperedEvent.error || null,
                     timestamp: tamperedEvent.timestamp,
                 });
                 const crypto = require('node:crypto');
                 const brokenHash1 = crypto.createHash('sha256').update(`${initialPrevHash}:${canonical}`, 'utf8').digest('hex');
-                expect(brokenHash1).not.toBe(event1.resultHash);
+                expect(brokenHash1).not.toBe(event1.eventHash);
             }
         });
     });

package/dist/capability.d.ts

@@ -37,12 +37,20 @@ export interface PersistentExecutionRecord {
     createdAt: string;
     updatedAt: string;
 }
+export interface ActionApprovalRecord {
+    executionId: string;
+    approverActorId: string;
+    reason?: string;
+    approvedAt: string;
+    approverRole?: string;
+}
 export interface ActionStore {
     reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
     updateExecution(record: PersistentExecutionRecord): Promise<void>;
     getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
-    saveApproval(executionId: string, approverActorId: string, reason?: string): Promise<void>;
+    saveApproval(executionId: string, approverActorId: string, reason?: string, approverRole?: string): Promise<void>;
     isActionApproved(executionId: string): Promise<boolean>;
+    getApproval?(executionId: string): Promise<ActionApprovalRecord | undefined>;
     appendAudit(event: ActionAuditEvent): Promise<void>;
     getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
 }
@@ -54,8 +62,9 @@ export declare class InMemoryActionStore implements ActionStore {
     reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
     updateExecution(record: PersistentExecutionRecord): Promise<void>;
     getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
-    saveApproval(executionId: string, approverActorId: string, reason?: string): Promise<void>;
+    saveApproval(executionId: string, approverActorId: string, reason?: string, approverRole?: string): Promise<void>;
     isActionApproved(executionId: string): Promise<boolean>;
+    getApproval(executionId: string): Promise<ActionApprovalRecord | undefined>;
     appendAudit(event: ActionAuditEvent): Promise<void>;
     getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
 }

package/dist/capability.js

@@ -53,16 +53,22 @@ class InMemoryActionStore {
         const rec = this.executions.get(executionId);
         return rec ? { ...rec } : undefined;
     }
-    async saveApproval(executionId, approverActorId, reason) {
+    async saveApproval(executionId, approverActorId, reason, approverRole) {
         this.approvals.set(executionId, {
+            executionId,
             approverActorId,
             reason,
+            approverRole,
             approvedAt: new Date().toISOString(),
         });
     }
     async isActionApproved(executionId) {
         return this.approvals.has(executionId);
     }
+    async getApproval(executionId) {
+        const record = this.approvals.get(executionId);
+        return record ? { ...record } : undefined;
+    }
     async appendAudit(event) {
         const prevHash = this.lastAuditHash;
         // Tamper-evident hash chaining over all security-critical event fields
@@ -85,6 +91,7 @@ class InMemoryActionStore {
                 decisionCode: event.decision.decisionCode,
             } : null,
             parametersHash: event.parametersHash || null,
+            resultHash: event.resultHash || null,
             error: event.error || null,
             timestamp: event.timestamp,
         };

package/dist/capability.test.js

@@ -165,6 +165,7 @@ describe('AuthorizationCapability Cryptographic & Tamper Review', () => {
                     decisionCode: event1.decision.decisionCode,
                 } : null,
                 parametersHash: event1.parametersHash || null,
+                resultHash: null,
                 error: event1.error || null,
                 timestamp: event1.timestamp,
             });
@@ -190,6 +191,7 @@ describe('AuthorizationCapability Cryptographic & Tamper Review', () => {
                     decisionCode: event2.decision.decisionCode,
                 } : null,
                 parametersHash: event2.parametersHash || null,
+                resultHash: null,
                 error: event2.error || null,
                 timestamp: event2.timestamp,
             });
@@ -203,7 +205,47 @@ describe('AuthorizationCapability Cryptographic & Tamper Review', () => {
             });
             const tamperedHash1 = crypto.createHash('sha256').update(`${initialPrevHash}:${tamperedCanonical1}`, 'utf8').digest('hex');
             const brokenHash2 = crypto.createHash('sha256').update(`${tamperedHash1}:${canonical2}`, 'utf8').digest('hex');
-            expect(brokenHash2).not.toBe(event2.resultHash);
+            expect(brokenHash2).not.toBe(event2.eventHash);
+        });
+        it('detects tampering with resultHash on completed action events', async () => {
+            const store = new capability_1.InMemoryActionStore();
+            const initialPrevHash = '0000000000000000000000000000000000000000000000000000000000000000';
+            const event = {
+                executionId: 'exec-1',
+                actionId: 'act-1',
+                toolName: 'comm/send_email',
+                companionId: 'comp-1',
+                riskLevel: 'LOW',
+                lifecycle: 'COMPLETED',
+                parametersHash: 'param-hash-1',
+                resultHash: 'result-hash-original',
+                timestamp: '2026-09-12T10:00:00.000Z',
+            };
+            await store.appendAudit(event);
+            const log = await store.getAuditLog();
+            const recorded = log[0];
+            // Tampering with resultHash changes canonical payload and recalculates a mismatched hash
+            const tamperedPayload = {
+                executionId: recorded.executionId,
+                actionId: recorded.actionId,
+                toolName: recorded.toolName,
+                providerId: recorded.providerId || null,
+                companionId: recorded.companionId,
+                actorId: recorded.actorId || null,
+                sessionId: recorded.sessionId || null,
+                channel: recorded.channel || null,
+                correlationId: recorded.correlationId || null,
+                riskLevel: recorded.riskLevel,
+                lifecycle: recorded.lifecycle,
+                decision: null,
+                parametersHash: recorded.parametersHash || null,
+                resultHash: 'result-hash-TAMPERED',
+                error: recorded.error || null,
+                timestamp: recorded.timestamp,
+            };
+            const tamperedCanonical = (0, capability_1.canonicalizeJson)(tamperedPayload);
+            const recomputedHash = crypto.createHash('sha256').update(`${initialPrevHash}:${tamperedCanonical}`, 'utf8').digest('hex');
+            expect(recomputedHash).not.toBe(recorded.eventHash);
         });
     });
     describe('Durable Action Approval Restart Semantics', () => {

package/dist/index.d.ts

@@ -124,13 +124,15 @@ export interface MemoryOrgan {
     markClaimSessionOnly?(id: string): Promise<void>;
     expireClaim?(id: string): Promise<void>;
     revokeClaim?(id: string, reason?: string): Promise<void>;
-    getDirectives(): Promise<BehaviorDirective[]>;
-    proposeDirective(directiveData: Omit<BehaviorDirective, 'id' | 'status' | 'companionId'>): Promise<BehaviorDirective>;
-    approveDirective(id: string): Promise<void>;
-    rejectDirective(id: string): Promise<void>;
-    revokeDirective(id: string): Promise<void>;
-    disableDirective(id: string): Promise<void>;
-    expireDirective?(id: string): Promise<void>;
+    getDirectives(companionId?: string): Promise<BehaviorDirective[]>;
+    proposeDirective(directiveData: Omit<BehaviorDirective, 'id' | 'status' | 'companionId'> & {
+        companionId?: string;
+    }): Promise<BehaviorDirective>;
+    approveDirective(id: string, companionId?: string): Promise<void>;
+    rejectDirective(id: string, companionId?: string): Promise<void>;
+    revokeDirective(id: string, companionId?: string): Promise<void>;
+    disableDirective(id: string, companionId?: string): Promise<void>;
+    expireDirective?(id: string, companionId?: string): Promise<void>;
     supersedeClaim?(id: string, replacement: Omit<Claim, 'id' | 'status' | 'companionId'>): Promise<Claim>;
     updateClaim?(id: string, updates: Partial<Pick<Claim, 'subject' | 'predicate' | 'value' | 'scope' | 'sensitivity' | 'confidence' | 'validFrom' | 'validUntil'>>): Promise<Claim>;
     resetMemory?(): Promise<void>;

package/dist/runtime.d.ts

@@ -1,4 +1,4 @@
-import { BrainOrgan, MemoryOrgan, VoiceOrgan, KnowledgeOrgan, VisionOrgan, BehaviorOrgan, BodyOrgan, HandsOrgan, EarOrgan, ObservationOrgan, ObservationResult, Observation, Message, RequestContext, ActionPolicyEngine, ActionStore, ResponseGatingEngine, StageResponseOptions, ApproveResponseOptions, RejectResponseOptions, ExperienceDispatcher, ExperienceAdapter, OrganConfig, Claim, BehaviorDirective, StagedResponsePlan, ResponseGateEvaluation, EvidenceRecord, MouthOrgan, MouthUtterance, MouthMedium, FormattedMouthOutput, MouthStreamChunk, MouthChannel, SelfRepository, EKnowledgeOrgan } from './index';
+import { BrainOrgan, MemoryOrgan, VoiceOrgan, KnowledgeOrgan, VisionOrgan, BehaviorOrgan, BodyOrgan, HandsOrgan, EarOrgan, ObservationOrgan, ObservationResult, Observation, Message, RequestContext, ActionPolicyEngine, ApproveActionOptions, ActionApprovalResult, ActionStore, ResponseGatingEngine, StageResponseOptions, ApproveResponseOptions, RejectResponseOptions, ExperienceDispatcher, ExperienceAdapter, OrganConfig, Claim, BehaviorDirective, StagedResponsePlan, ResponseGateEvaluation, EvidenceRecord, MouthOrgan, MouthUtterance, MouthMedium, FormattedMouthOutput, MouthStreamChunk, MouthChannel, SelfRepository, EKnowledgeOrgan } from './index';
 export interface SiduriRuntimeConfig {
     name: string;
     brain?: OrganConfig | Record<string, unknown>;
@@ -91,10 +91,10 @@ export declare class SiduriRuntime {
     approveClaim(id: string): Promise<void>;
     rejectClaim(id: string): Promise<void>;
     updateClaim(id: string, updates: Partial<Pick<Claim, 'subject' | 'predicate' | 'value' | 'scope' | 'sensitivity' | 'confidence' | 'validFrom' | 'validUntil'>>): Promise<Claim>;
-    approveDirective(id: string): Promise<void>;
-    rejectDirective(id: string): Promise<void>;
-    revokeDirective(id: string): Promise<void>;
-    disableDirective(id: string): Promise<void>;
+    approveDirective(id: string, companionId?: string): Promise<void>;
+    rejectDirective(id: string, companionId?: string): Promise<void>;
+    revokeDirective(id: string, companionId?: string): Promise<void>;
+    disableDirective(id: string, companionId?: string): Promise<void>;
     resetMemory(): Promise<void>;
     stageResponse(options: StageResponseOptions): StagedResponsePlan;
     evaluateGate(plan: StagedResponsePlan, evidenceRecords?: EvidenceRecord[]): ResponseGateEvaluation;
@@ -108,6 +108,7 @@ export declare class SiduriRuntime {
         reason?: string;
         plan?: StagedResponsePlan;
     };
+    approveAction(options: ApproveActionOptions): Promise<ActionApprovalResult>;
     getStagedPlan(responseId: string): StagedResponsePlan | undefined;
     findStagedPlanByCorrelation(companionId: string, correlationId: string): StagedResponsePlan | undefined;
     /**

package/dist/runtime.js

@@ -163,29 +163,37 @@ class SiduriRuntime {
         }
         return this.memory.updateClaim(id, updates);
     }
-    async approveDirective(id) {
+    async approveDirective(id, companionId) {
         if (!this.memory || typeof this.memory.approveDirective !== 'function') {
             throw new Error('Memory organ not configured');
         }
-        return this.memory.approveDirective(id);
+        return companionId !== undefined
+            ? this.memory.approveDirective(id, companionId)
+            : this.memory.approveDirective(id);
     }
-    async rejectDirective(id) {
+    async rejectDirective(id, companionId) {
         if (!this.memory || typeof this.memory.rejectDirective !== 'function') {
             throw new Error('Memory organ not configured');
         }
-        return this.memory.rejectDirective(id);
+        return companionId !== undefined
+            ? this.memory.rejectDirective(id, companionId)
+            : this.memory.rejectDirective(id);
     }
-    async revokeDirective(id) {
+    async revokeDirective(id, companionId) {
         if (!this.memory || typeof this.memory.revokeDirective !== 'function') {
             throw new Error('Memory organ not configured');
         }
-        return this.memory.revokeDirective(id);
+        return companionId !== undefined
+            ? this.memory.revokeDirective(id, companionId)
+            : this.memory.revokeDirective(id);
     }
-    async disableDirective(id) {
+    async disableDirective(id, companionId) {
         if (!this.memory || typeof this.memory.disableDirective !== 'function') {
             throw new Error('Memory organ not configured');
         }
-        return this.memory.disableDirective(id);
+        return companionId !== undefined
+            ? this.memory.disableDirective(id, companionId)
+            : this.memory.disableDirective(id);
     }
     async resetMemory() {
         if (!this.memory || typeof this.memory.resetMemory !== 'function') {
@@ -206,6 +214,9 @@ class SiduriRuntime {
     rejectResponse(options) {
         return this.gating.rejectResponse(options);
     }
+    async approveAction(options) {
+        return this.actionPolicy.approveAction(options);
+    }
     getStagedPlan(responseId) {
         return this.gating.getStagedPlan(responseId);
     }