@synapsor/runner 0.1.16 → 1.0.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## Unreleased
 
+## 1.0.0
+
+### Production Approval Loop
+
+- Adds `apply --all-approved --yes` with per-proposal results, conflict
+  isolation, idempotent reruns, and `--capability`, `--tenant`, and `--max`
+  filters.
+- Adds canonical aggregate auto-approval limits in `@synapsor/spec`, DSL
+  `LIMIT` clauses, reviewer-visible limit trip events, and doctor/tool preview
+  surfacing.
+- Adds signed operator identity checks for approve/reject/apply while keeping
+  dev env identity available for local experiments.
+- Adds structured operational logs, per-tenant/capability counters, supervised
+  writeback worker retries/dead letters, and continued owner-only local store
+  permission tests.
+- Adds Postgres shared ledger support, runtime-store mode, per-session
+  HTTP-claims trusted context, managed secret hydration, token rotation hooks,
+  and Streamable HTTP mTLS.
+- Declares the first semver contract for the documented CLI, schema, contract,
+  MCP result, writeback, approval, metrics, and replay surfaces.
+- Stages `@synapsor/spec@1.0.0`, `@synapsor/dsl@1.0.0`, and
+  `@synapsor/runner@1.0.0`.
+
 ## 0.1.16
 
 ### Fleet-Lab Runner Hardening

package/README.md

@@ -146,6 +146,22 @@ least-privilege database access, host security, or application authorization.
 See [Security Boundary](docs/security-boundary.md) and
 [Current Limitations](docs/limitations.md).
 
+## Operate The Approval Loop
+
+Reviewed policies can combine a per-proposal threshold with daily count and
+total ceilings. Exceeding a ceiling routes that proposal to human review; it
+never auto-applies. Operators can apply the bounded approved queue independently
+with `apply --all-approved --yes`, inspect Prometheus counters with `metrics
+show`, and consume safe newline-delimited JSON outcome logs from stderr. Signed
+operator keys can enforce contract reviewer roles and separate apply roles.
+Shared Postgres ledger mirror mode is available for bounded operator handoffs,
+and `storage.shared_postgres.mode = "runtime_store"` lets MCP serving use
+Postgres as the primary proposal/evidence/replay store with bounded CLI
+approval/apply/worker commands bridged through the same ledger. Local SQLite
+remains the default. See
+[Production](docs/production.md) and the
+[Runner Config Reference](docs/runner-config-reference.md).
+
 ## Packages
 
 | Package | Purpose |
@@ -169,8 +185,9 @@ owner-only permissions, inspection commands, and retention.
 ## OSS And Cloud
 
 Synapsor Runner works by itself for local and single-node deployments: your
-database remains the source of truth and the local SQLite ledger stores review
-artifacts. Synapsor Cloud adds a shared contract registry, immutable versions,
+database remains the source of truth and Runner stores review artifacts in the
+default local SQLite ledger or an opt-in shared Postgres runtime store.
+Synapsor Cloud adds a shared contract registry, immutable versions,
 downloadable Runner bundles, and team activity, evidence, and approval
 surfaces. See [OSS Runner vs Synapsor Cloud](docs/oss-vs-cloud.md) for the
 detailed boundary.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA2F,MAAM,6BAA6B,CAAC;AAoB1Y,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAgV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyD1D;AAqED,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AAiwED,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAuBza,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAmV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AA+gFD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}