@siduri-x/core 2.0.0 → 2.0.2

package/dist/action-policy.d.ts

@@ -15,12 +15,42 @@ export interface ActionPolicyEngineOptions {
     defaultRequireApprovalForHighRisk?: boolean;
     store?: ActionStore;
     secretKey?: string;
+    allowedApproverRoles?: string[];
+    requiredApproverCapabilities?: string[];
+}
+export type ActionApprovalDecisionCode = 'APPROVED' | 'REJECTED_UNAUTHORIZED' | 'REJECTED_UNAUTHENTICATED' | 'REJECTED_ROLE_MISMATCH' | 'REJECTED_MISSING_APPROVER_ID' | 'REJECTED_MISSING_CAPABILITY' | 'REJECTED_UNKNOWN_EXECUTION';
+export interface ActionApprovalResult {
+    approved: boolean;
+    decisionCode: ActionApprovalDecisionCode;
+    reason: string;
+    executionId: string;
+    approverActorId: string;
 }
 export interface ApproveActionOptions {
     executionId: string;
     approverActorId: string;
     reason?: string;
+    /**
+     * Optional RequestContext of the approver establishing authenticated identity.
+     */
+    context?: RequestContext;
+    /**
+     * Optional role of the approver (e.g. 'owner', 'administrator', 'operator').
+     */
+    approverRole?: string;
+    /**
+     * Optional capabilities held by the approver.
+     */
+    approverCapabilities?: string[];
+    /**
+     * Optional explicit action binding parameters when pre-authorizing a known action
+     */
+    toolName?: string;
+    parametersHash?: string;
+    companionId?: string;
+    actorId?: string;
 }
+export declare function normalizeApproverRole(role?: string, actorId?: string): string;
 export declare class ActionPolicyEngine {
     private readonly toolRegistry;
     private readonly rules;
@@ -28,7 +58,10 @@ export declare class ActionPolicyEngine {
     private readonly defaultRiskLevel;
     private readonly defaultRequireApprovalForHighRisk;
     private readonly secretKey;
+    private readonly allowedApproverRoles;
+    private readonly requiredApproverCapabilities;
     private readonly approvedExecutions;
+    private readonly pendingActions;
     constructor(options?: ActionPolicyEngineOptions);
     registerToolDefinition(tool: ToolDefinition): void;
     unregisterToolDefinition(toolName: string): boolean;
@@ -38,7 +71,8 @@ export declare class ActionPolicyEngine {
         decision: ActionPolicyDecision;
         capability?: AuthorizationCapability;
     }>;
-    approveAction(options: ApproveActionOptions): Promise<boolean>;
+    approveAction(options: ApproveActionOptions): Promise<ActionApprovalResult>;
+    private recordApprovalAudit;
     recordAudit(action: ActionIntent, context: RequestContext | undefined, decision: ActionPolicyDecision | undefined, lifecycle: ActionLifecycleState, result?: unknown, error?: string, durationMs?: number): Promise<ActionAuditEvent>;
     getAuditLog(): Promise<ActionAuditEvent[]>;
     getStore(): ActionStore;

package/dist/action-policy.js

@@ -1,7 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ActionPolicyEngine = void 0;
+exports.normalizeApproverRole = normalizeApproverRole;
 const capability_1 = require("./capability");
+function normalizeApproverRole(role, actorId) {
+    if (role && role.trim() !== '') {
+        const lower = role.trim().toLowerCase();
+        if (lower === 'administrator' || lower === 'admin')
+            return 'administrator';
+        return lower;
+    }
+    // Principle of least privilege: Never derive privileged roles (administrator, owner, operator)
+    // from arbitrary substring matching on unverified actorId strings.
+    // When an explicit authorization role is not provided, default to 'viewer'.
+    return 'viewer';
+}
 class ActionPolicyEngine {
     toolRegistry = new Map();
     rules = [];
@@ -9,13 +22,18 @@ class ActionPolicyEngine {
     defaultRiskLevel;
     defaultRequireApprovalForHighRisk;
     secretKey;
-    approvedExecutions = new Set();
+    allowedApproverRoles;
+    requiredApproverCapabilities;
+    approvedExecutions = new Map();
+    pendingActions = new Map();
     constructor(options = {}) {
         this.rules = options.rules ?? [];
         this.defaultRiskLevel = options.defaultRiskLevel ?? 'HIGH';
         this.defaultRequireApprovalForHighRisk = options.defaultRequireApprovalForHighRisk ?? true;
         this.store = options.store ?? new capability_1.InMemoryActionStore();
         this.secretKey = (0, capability_1.getOrGenerateLocalActionPolicySecret)(options.secretKey);
+        this.allowedApproverRoles = (options.allowedApproverRoles ?? ['owner', 'administrator', 'admin', 'operator']).map((r) => r.toLowerCase());
+        this.requiredApproverCapabilities = options.requiredApproverCapabilities ?? [];
     }
     registerToolDefinition(tool) {
         const key = tool.providerId ? `${tool.providerId}/${tool.name}` : tool.name;
@@ -70,7 +88,9 @@ class ActionPolicyEngine {
         }
         // Role check if tool restricts roles (supports administrator/owner role parity)
         if (toolDef.allowedRoles && toolDef.allowedRoles.length > 0) {
-            const actorRole = effectiveContext.actor.authorizationRole || effectiveContext.actor.role || 'owner';
+            const actorRole = effectiveContext.actor.authorizationRole ||
+                effectiveContext.actor.role ||
+                (effectiveContext.actor.authenticated === false ? 'viewer' : 'owner');
             const normalizedActorRoles = new Set([actorRole.toLowerCase()]);
             if (actorRole.toLowerCase() === 'administrator' || actorRole.toLowerCase() === 'owner') {
                 normalizedActorRoles.add('administrator');
@@ -125,14 +145,79 @@ class ActionPolicyEngine {
         // Risk level approval check
         const requiresExplicitApproval = toolDef.requiresApproval ??
             (this.defaultRequireApprovalForHighRisk && (riskLevel === 'HIGH' || riskLevel === 'CRITICAL'));
-        let isApproved = this.approvedExecutions.has(executionId);
+        let approvalRecord = this.approvedExecutions.get(executionId);
+        if (!approvalRecord && typeof this.store.getApproval === 'function') {
+            approvalRecord = await this.store.getApproval(executionId);
+            if (approvalRecord) {
+                this.approvedExecutions.set(executionId, approvalRecord);
+            }
+        }
+        // Cryptographic / structural binding verification:
+        // Ensure the approval record matches the exact tool, parameters, companion, and actor
+        if (approvalRecord) {
+            const toolMatch = !approvalRecord.toolName || approvalRecord.toolName === action.toolName;
+            const paramsMatch = !approvalRecord.parametersHash || approvalRecord.parametersHash === paramsHash;
+            const companionMatch = !approvalRecord.companionId || approvalRecord.companionId === effectiveContext.companionId;
+            const actorMatch = !approvalRecord.actorId || approvalRecord.actorId === effectiveContext.actor.actorId;
+            if (!toolMatch || !paramsMatch || !companionMatch || !actorMatch) {
+                const decision = {
+                    allowed: false,
+                    reason: `Approval record for execution "${executionId}" does not match the requested tool, parameters, companion, or actor`,
+                    riskLevel,
+                    requiredCapabilities: requiredCaps,
+                    executionId,
+                    decisionCode: 'REJECTED_APPROVAL_MISMATCH',
+                };
+                await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+                return { decision };
+            }
+        }
+        let isApproved = Boolean(approvalRecord);
         if (!isApproved && typeof this.store.isActionApproved === 'function') {
             isApproved = await this.store.isActionApproved(executionId);
-            if (isApproved) {
-                this.approvedExecutions.add(executionId);
+        }
+        if (requiresExplicitApproval && isApproved && approvalRecord) {
+            const approverRole = (approvalRecord.approverRole || normalizeApproverRole(undefined, approvalRecord.approverActorId)).toLowerCase();
+            const isOwnerOrAdmin = approverRole === 'owner' || approverRole === 'administrator' || approverRole === 'admin';
+            if (toolDef.allowedRoles && toolDef.allowedRoles.length > 0 && !isOwnerOrAdmin) {
+                const allowed = toolDef.allowedRoles.map((r) => r.toLowerCase());
+                if (!allowed.includes(approverRole)) {
+                    const decision = {
+                        allowed: false,
+                        reason: `Approver "${approvalRecord.approverActorId}" with role "${approverRole}" is not authorized to approve tool "${action.toolName}"`,
+                        riskLevel,
+                        requiredCapabilities: requiredCaps,
+                        executionId,
+                        decisionCode: 'REJECTED_UNAUTHORIZED',
+                    };
+                    await this.recordAudit(action, effectiveContext, decision, 'REJECTED');
+                    return { decision };
+                }
             }
         }
         if (requiresExplicitApproval && !isApproved) {
+            this.pendingActions.set(executionId, { action, context: effectiveContext, toolDef });
+            if (typeof this.store.reserveExecution === 'function') {
+                const record = {
+                    executionId,
+                    actionId: action.actionId,
+                    toolName: action.toolName,
+                    providerId: toolDef.providerId || 'builtin',
+                    parametersHash: paramsHash,
+                    lifecycle: 'POLICY_CHECKED',
+                    decision: {
+                        allowed: false,
+                        reason: `Action "${action.toolName}" has risk level ${riskLevel} and requires explicit approval`,
+                        riskLevel,
+                        requiredCapabilities: requiredCaps,
+                        executionId,
+                        decisionCode: 'REJECTED_HIGH_RISK_UNAPPROVED',
+                    },
+                    createdAt: new Date().toISOString(),
+                    updatedAt: new Date().toISOString(),
+                };
+                await this.store.reserveExecution(record).catch(() => { });
+            }
             const decision = {
                 allowed: false,
                 reason: `Action "${action.toolName}" has risk level ${riskLevel} and requires explicit approval`,
@@ -181,11 +266,146 @@ class ActionPolicyEngine {
         return { decision, capability };
     }
     async approveAction(options) {
-        this.approvedExecutions.add(options.executionId);
+        const actorId = (options.context?.actor.actorId || options.approverActorId || '').trim();
+        if (!actorId) {
+            return {
+                approved: false,
+                decisionCode: 'REJECTED_MISSING_APPROVER_ID',
+                reason: 'approverActorId is required to approve an action execution',
+                executionId: options.executionId,
+                approverActorId: '',
+            };
+        }
+        // 1. Authenticated boundary check
+        if (options.context && options.context.actor.authenticated === false) {
+            const result = {
+                approved: false,
+                decisionCode: 'REJECTED_UNAUTHENTICATED',
+                reason: `Approver "${actorId}" is unauthenticated and cannot approve actions`,
+                executionId: options.executionId,
+                approverActorId: actorId,
+            };
+            await this.recordApprovalAudit(options.executionId, actorId, 'unauthenticated', false, result.reason);
+            return result;
+        }
+        // 2. Resolve effective approver role & capabilities
+        const rawRole = options.context?.actor.authorizationRole || options.context?.actor?.role || options.approverRole;
+        const approverRole = normalizeApproverRole(rawRole, actorId);
+        const capabilities = options.context?.actor.capabilities || options.approverCapabilities || [];
+        const isOwnerOrAdmin = approverRole === 'owner' || approverRole === 'administrator' || approverRole === 'admin';
+        const isRoleAllowed = isOwnerOrAdmin || this.allowedApproverRoles.includes(approverRole);
+        // Reject non-allowed roles or explicit viewer/guest role
+        if (!isRoleAllowed || approverRole === 'viewer') {
+            const result = {
+                approved: false,
+                decisionCode: 'REJECTED_UNAUTHORIZED',
+                reason: `Actor "${actorId}" with role "${approverRole}" is not authorized to approve actions`,
+                executionId: options.executionId,
+                approverActorId: actorId,
+            };
+            await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason);
+            return result;
+        }
+        // 3. Locate pending in-memory action or persisted execution record
+        const pending = this.pendingActions.get(options.executionId);
+        let executionRecord;
+        if (!pending && typeof this.store.getExecution === 'function') {
+            executionRecord = await this.store.getExecution(options.executionId);
+        }
+        if (!pending && !executionRecord && !options.toolName) {
+            const result = {
+                approved: false,
+                decisionCode: 'REJECTED_UNKNOWN_EXECUTION',
+                reason: `Cannot approve execution "${options.executionId}": execution is not pending or recognized`,
+                executionId: options.executionId,
+                approverActorId: actorId,
+            };
+            await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason);
+            return result;
+        }
+        const targetToolName = pending?.action.toolName || executionRecord?.toolName || options.toolName || '';
+        const targetToolDef = pending?.toolDef || (targetToolName ? this.findToolDefinition(targetToolName) : undefined);
+        const targetParamsHash = (pending ? (0, capability_1.computeParametersHash)(pending.action.parameters) : undefined) ||
+            executionRecord?.parametersHash ||
+            options.parametersHash;
+        const targetCompanionId = pending?.context?.companionId || pending?.action.context?.companionId || options.companionId;
+        const targetActorId = pending?.context?.actor.actorId || pending?.action.context?.actor.actorId || options.actorId;
+        if (targetToolDef) {
+            if (targetToolDef.allowedRoles && targetToolDef.allowedRoles.length > 0 && !isOwnerOrAdmin) {
+                const normalizedToolRoles = new Set(targetToolDef.allowedRoles.map((r) => r.toLowerCase()));
+                if (!normalizedToolRoles.has(approverRole)) {
+                    const result = {
+                        approved: false,
+                        decisionCode: 'REJECTED_ROLE_MISMATCH',
+                        reason: `Approver role "${approverRole}" is not authorized to approve tool "${targetToolDef.name}" (requires: ${targetToolDef.allowedRoles.join(', ')})`,
+                        executionId: options.executionId,
+                        approverActorId: actorId,
+                    };
+                    await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason, targetToolDef.name);
+                    return result;
+                }
+            }
+            if (this.requiredApproverCapabilities.length > 0 && !isOwnerOrAdmin) {
+                const missing = this.requiredApproverCapabilities.filter((c) => !capabilities.includes(c));
+                if (missing.length > 0) {
+                    const result = {
+                        approved: false,
+                        decisionCode: 'REJECTED_MISSING_CAPABILITY',
+                        reason: `Approver is missing required approval capabilities: [${missing.join(', ')}]`,
+                        executionId: options.executionId,
+                        approverActorId: actorId,
+                    };
+                    await this.recordApprovalAudit(options.executionId, actorId, approverRole, false, result.reason, targetToolDef.name);
+                    return result;
+                }
+            }
+        }
+        // 4. Record verified approval with exact tool, parameter, companion, and actor binding
+        const record = {
+            executionId: options.executionId,
+            approverActorId: actorId,
+            reason: options.reason,
+            approverRole,
+            approvedAt: new Date().toISOString(),
+            toolName: targetToolName,
+            parametersHash: targetParamsHash,
+            companionId: targetCompanionId,
+            actorId: targetActorId,
+        };
+        this.approvedExecutions.set(options.executionId, record);
         if (typeof this.store.saveApproval === 'function') {
-            await this.store.saveApproval(options.executionId, options.approverActorId, options.reason);
+            await this.store.saveApproval(options.executionId, actorId, options.reason, approverRole, targetToolName, targetParamsHash, targetCompanionId, targetActorId);
         }
-        return true;
+        const reason = options.reason || 'Action approved by authorized policy approver';
+        await this.recordApprovalAudit(options.executionId, actorId, approverRole, true, reason, targetToolName);
+        return {
+            approved: true,
+            decisionCode: 'APPROVED',
+            reason,
+            executionId: options.executionId,
+            approverActorId: actorId,
+        };
+    }
+    async recordApprovalAudit(executionId, approverActorId, approverRole, approved, reason, toolName) {
+        const event = {
+            executionId,
+            actionId: executionId,
+            toolName: toolName || 'action:approve',
+            companionId: 'system',
+            actorId: approverActorId,
+            riskLevel: 'HIGH',
+            lifecycle: approved ? 'APPROVED' : 'REJECTED',
+            decision: {
+                allowed: approved,
+                reason: reason || (approved ? 'Approval granted' : 'Approval rejected'),
+                riskLevel: 'HIGH',
+                executionId,
+                decisionCode: approved ? 'ALLOWED_POLICY' : 'REJECTED_UNAUTHORIZED',
+            },
+            parametersHash: (0, capability_1.computeParametersHash)({ executionId, approverActorId, approverRole, reason }),
+            timestamp: new Date().toISOString(),
+        };
+        await this.store.appendAudit(event);
     }
     async recordAudit(action, context, decision, lifecycle, result, error, durationMs) {
         const event = {

package/dist/action-policy.test.js

@@ -125,9 +125,10 @@ describe('ActionPolicyEngine Boundary', () => {
         expect(res1.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
         expect(res1.capability).toBeUndefined();
         // Grant explicit approval
-        engine.approveAction({
+        await engine.approveAction({
             executionId: 'exec-admin-delete-1',
             approverActorId: 'admin-super-user',
+            approverRole: 'administrator',
         });
         // Second attempt: approved
         const res2 = await engine.evaluateAction(action);
@@ -190,4 +191,173 @@ describe('ActionPolicyEngine Boundary', () => {
         expect(resOp.decision.allowed).toBe(false);
         expect(resOp.decision.decisionCode).toBe('REJECTED_UNAUTHORIZED');
     });
+    describe('Approval Authorization Semantics', () => {
+        const criticalAction = {
+            actionId: 'act-sec-auth-1',
+            toolName: 'admin/delete_database',
+            parameters: {},
+            context: {
+                companionId: 'companion-1',
+                actor: {
+                    actorId: 'admin-1',
+                    sessionId: 'sess-1',
+                    authorizationRole: 'administrator',
+                    capabilities: ['admin:delete'],
+                    authenticated: true,
+                },
+                conversation: { channel: 'direct', correlationId: 'corr-1' },
+            },
+            executionId: 'exec-sec-auth-1',
+        };
+        it('rejects action approval when approverActorId is empty', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: '',
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_MISSING_APPROVER_ID');
+        });
+        it('rejects action approval from unauthenticated approver context', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'fake-admin',
+                context: {
+                    companionId: 'companion-1',
+                    actor: {
+                        actorId: 'fake-admin',
+                        sessionId: 'sess-fake',
+                        authorizationRole: 'administrator',
+                        capabilities: ['admin:delete'],
+                        authenticated: false, // Unauthenticated!
+                    },
+                    conversation: { channel: 'direct', correlationId: 'corr-fake' },
+                },
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_UNAUTHENTICATED');
+        });
+        it('rejects action approval from viewer role', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'viewer-user',
+                approverRole: 'viewer',
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        });
+        it('rejects approval when approver role does not match tool requirements (operator cannot approve admin tool)', async () => {
+            // 1. Initial evaluation stages pending execution
+            const eval1 = await engine.evaluateAction(criticalAction);
+            expect(eval1.decision.allowed).toBe(false);
+            expect(eval1.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+            // 2. Operator attempts to approve an administrator-only tool
+            const approvalRes = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'operator-alice',
+                approverRole: 'operator',
+            });
+            expect(approvalRes.approved).toBe(false);
+            expect(approvalRes.decisionCode).toBe('REJECTED_ROLE_MISMATCH');
+            // 3. Action re-evaluation remains unapproved and denied
+            const eval2 = await engine.evaluateAction(criticalAction);
+            expect(eval2.decision.allowed).toBe(false);
+            expect(eval2.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+        });
+        it('authorizes approval and emits capability when approver is administrator or owner', async () => {
+            await engine.evaluateAction(criticalAction);
+            const approvalRes = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'admin-bob',
+                approverRole: 'administrator',
+                reason: 'Authorized scheduled database purge',
+            });
+            expect(approvalRes.approved).toBe(true);
+            expect(approvalRes.decisionCode).toBe('APPROVED');
+            const evalApproved = await engine.evaluateAction(criticalAction);
+            expect(evalApproved.decision.allowed).toBe(true);
+            expect(evalApproved.decision.decisionCode).toBe('ALLOWED_POLICY');
+            expect(evalApproved.capability).toBeDefined();
+        });
+        it('records structured tamper-evident audit logs for approval decisions', async () => {
+            await engine.evaluateAction(criticalAction);
+            await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'viewer-tamper',
+                approverRole: 'viewer',
+            });
+            const auditLogs = await engine.getAuditLog();
+            const rejectionEvent = auditLogs.find((l) => l.executionId === 'exec-sec-auth-1' && l.lifecycle === 'REJECTED' && l.toolName === 'action:approve');
+            expect(rejectionEvent).toBeDefined();
+            expect(rejectionEvent?.actorId).toBe('viewer-tamper');
+            expect(rejectionEvent?.decision?.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        });
+        it('rejects approval attempt for arbitrary unknown execution ID', async () => {
+            const res = await engine.approveAction({
+                executionId: 'arbitrary-unregistered-id',
+                approverActorId: 'admin-bob',
+                approverRole: 'administrator',
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_UNKNOWN_EXECUTION');
+        });
+        it('rejects privilege escalation from actorId strings (attacker-admin is not an administrator without explicit role)', async () => {
+            await engine.evaluateAction(criticalAction);
+            const res = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'attacker-admin-user',
+                // Notice no approverRole is provided!
+            });
+            expect(res.approved).toBe(false);
+            expect(res.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        });
+        it('rejects action evaluation if parameters are tampered after approval (REJECTED_APPROVAL_MISMATCH)', async () => {
+            await engine.evaluateAction(criticalAction);
+            const approval = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'admin-bob',
+                approverRole: 'administrator',
+            });
+            expect(approval.approved).toBe(true);
+            // Attacker re-evaluates the same approved executionId but with injected dangerous parameters
+            const tamperedAction = {
+                ...criticalAction,
+                parameters: { injected: 'malicious-payload' },
+            };
+            const evalTampered = await engine.evaluateAction(tamperedAction);
+            expect(evalTampered.decision.allowed).toBe(false);
+            expect(evalTampered.decision.decisionCode).toBe('REJECTED_APPROVAL_MISMATCH');
+            expect(evalTampered.capability).toBeUndefined();
+        });
+        it('rejects action evaluation if tool name is swapped after approval (REJECTED_APPROVAL_MISMATCH)', async () => {
+            await engine.evaluateAction(criticalAction);
+            const approval = await engine.approveAction({
+                executionId: 'exec-sec-auth-1',
+                approverActorId: 'admin-bob',
+                approverRole: 'administrator',
+            });
+            expect(approval.approved).toBe(true);
+            // Register another tool
+            engine.registerToolDefinition({
+                name: 'admin/format_drive',
+                providerId: 'admin',
+                description: 'Format drive',
+                inputSchema: {},
+                riskLevel: 'CRITICAL',
+                allowedRoles: ['administrator'],
+                requiresApproval: true,
+            });
+            // Attacker re-uses the executionId on a different tool
+            const swappedAction = {
+                ...criticalAction,
+                toolName: 'admin/format_drive',
+            };
+            const evalSwapped = await engine.evaluateAction(swappedAction);
+            expect(evalSwapped.decision.allowed).toBe(false);
+            expect(evalSwapped.decision.decisionCode).toBe('REJECTED_APPROVAL_MISMATCH');
+            expect(evalSwapped.capability).toBeUndefined();
+        });
+    });
 });

package/dist/action.d.ts

@@ -15,7 +15,7 @@ export interface ActionPolicyDecision {
     riskLevel: ActionRiskLevel;
     requiredCapabilities?: string[];
     executionId: string;
-    decisionCode: 'ALLOWED_AUTO' | 'ALLOWED_POLICY' | 'REJECTED_UNKNOWN_TOOL' | 'REJECTED_UNAUTHORIZED' | 'REJECTED_MISSING_CAPABILITY' | 'REJECTED_HIGH_RISK_UNAPPROVED' | 'REJECTED_CHANNEL_RESTRICTED' | 'REJECTED_COMPANION_MISMATCH' | 'REJECTED_POLICY';
+    decisionCode: 'ALLOWED_AUTO' | 'ALLOWED_POLICY' | 'REJECTED_UNKNOWN_TOOL' | 'REJECTED_UNAUTHORIZED' | 'REJECTED_MISSING_CAPABILITY' | 'REJECTED_HIGH_RISK_UNAPPROVED' | 'REJECTED_CHANNEL_RESTRICTED' | 'REJECTED_COMPANION_MISMATCH' | 'REJECTED_APPROVAL_MISMATCH' | 'REJECTED_POLICY';
 }
 export interface ActionAuditEvent {
     executionId: string;

package/dist/adversarial.test.js

@@ -356,7 +356,7 @@ describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
             const failingMemory = {
                 initialize: jest.fn().mockResolvedValue(undefined),
                 searchClaims: jest.fn().mockRejectedValue(new Error('Connection terminated unexpectedly')),
-                getDirectives: jest.fn().mockRejectedValue(new Error('PostgreSQL read timeout')),
+                getDirectives: jest.fn().mockRejectedValue(new Error('Database read timeout')),
             };
             const runtime = new index_1.SiduriRuntime('companion-adv', { name: 'AdvCompanion' }, {
                 brain: mockBrain,
@@ -454,6 +454,7 @@ describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
                 'riskLevel',
                 'lifecycle',
                 'parametersHash',
+                'resultHash',
             ];
             for (const field of criticalFields) {
                 const tamperedEvent = { ...event1, [field]: 'TAMPERED_VALUE' };
@@ -477,12 +478,13 @@ describe('Adversarial Hardening Verification Suite (Phase 3)', () => {
                         decisionCode: tamperedEvent.decision.decisionCode,
                     } : null,
                     parametersHash: tamperedEvent.parametersHash || null,
+                    resultHash: field === 'resultHash' ? 'TAMPERED_VALUE' : null,
                     error: tamperedEvent.error || null,
                     timestamp: tamperedEvent.timestamp,
                 });
                 const crypto = require('node:crypto');
                 const brokenHash1 = crypto.createHash('sha256').update(`${initialPrevHash}:${canonical}`, 'utf8').digest('hex');
-                expect(brokenHash1).not.toBe(event1.resultHash);
+                expect(brokenHash1).not.toBe(event1.eventHash);
             }
         });
     });

package/dist/capability.d.ts

@@ -37,12 +37,24 @@ export interface PersistentExecutionRecord {
     createdAt: string;
     updatedAt: string;
 }
+export interface ActionApprovalRecord {
+    executionId: string;
+    approverActorId: string;
+    reason?: string;
+    approvedAt: string;
+    approverRole?: string;
+    toolName?: string;
+    parametersHash?: string;
+    companionId?: string;
+    actorId?: string;
+}
 export interface ActionStore {
     reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
     updateExecution(record: PersistentExecutionRecord): Promise<void>;
     getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
-    saveApproval(executionId: string, approverActorId: string, reason?: string): Promise<void>;
+    saveApproval(executionId: string, approverActorId: string, reason?: string, approverRole?: string, toolName?: string, parametersHash?: string, companionId?: string, actorId?: string): Promise<void>;
     isActionApproved(executionId: string): Promise<boolean>;
+    getApproval?(executionId: string): Promise<ActionApprovalRecord | undefined>;
     appendAudit(event: ActionAuditEvent): Promise<void>;
     getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
 }
@@ -54,8 +66,9 @@ export declare class InMemoryActionStore implements ActionStore {
     reserveExecution(record: PersistentExecutionRecord): Promise<boolean>;
     updateExecution(record: PersistentExecutionRecord): Promise<void>;
     getExecution(executionId: string): Promise<PersistentExecutionRecord | undefined>;
-    saveApproval(executionId: string, approverActorId: string, reason?: string): Promise<void>;
+    saveApproval(executionId: string, approverActorId: string, reason?: string, approverRole?: string, toolName?: string, parametersHash?: string, companionId?: string, actorId?: string): Promise<void>;
     isActionApproved(executionId: string): Promise<boolean>;
+    getApproval(executionId: string): Promise<ActionApprovalRecord | undefined>;
     appendAudit(event: ActionAuditEvent): Promise<void>;
     getAuditLog(executionId?: string): Promise<ActionAuditEvent[]>;
 }

package/dist/capability.js

@@ -53,16 +53,26 @@ class InMemoryActionStore {
         const rec = this.executions.get(executionId);
         return rec ? { ...rec } : undefined;
     }
-    async saveApproval(executionId, approverActorId, reason) {
+    async saveApproval(executionId, approverActorId, reason, approverRole, toolName, parametersHash, companionId, actorId) {
         this.approvals.set(executionId, {
+            executionId,
             approverActorId,
             reason,
+            approverRole,
             approvedAt: new Date().toISOString(),
+            toolName,
+            parametersHash,
+            companionId,
+            actorId,
         });
     }
     async isActionApproved(executionId) {
         return this.approvals.has(executionId);
     }
+    async getApproval(executionId) {
+        const record = this.approvals.get(executionId);
+        return record ? { ...record } : undefined;
+    }
     async appendAudit(event) {
         const prevHash = this.lastAuditHash;
         // Tamper-evident hash chaining over all security-critical event fields
@@ -85,6 +95,7 @@ class InMemoryActionStore {
                 decisionCode: event.decision.decisionCode,
             } : null,
             parametersHash: event.parametersHash || null,
+            resultHash: event.resultHash || null,
             error: event.error || null,
             timestamp: event.timestamp,
         };