@synapsor/runner 0.1.16 → 1.1.0

package/CHANGELOG.md

@@ -1,6 +1,52 @@
 # Changelog
 
-## Unreleased
+## 1.1.0 (prepared, not published)
+
+### Fleet Safety And Operations
+
+- Fails closed when claim-authenticated HTTP serving resolves an
+  environment/static contract context, and fixes object-filtered activity so
+  unrelated receipts cannot enter results.
+- Adds RS256/ES256 session and operator JWT verification with bounded JWKS or
+  public-PEM loading, plus verified operator attestations without bearer-token
+  persistence.
+- Adds dependency-aware `/readyz`, separately protected `/metrics`, reusable
+  bounded Postgres/MySQL pools, and trusted tenant/capability fixed-window rate
+  limits that are atomic in shared runtime-store mode.
+- Adds optional canonical `required_approvals` and DSL `REQUIRE n APPROVALS`,
+  distinct-reviewer enforcement, `n/N` progress, terminal rejection, and
+  policy-auto-approval deferral for multi-human quorum.
+- Hardens shared Postgres migration startup, bounds the transient bridge with
+  `max_entries`, makes CLI/UI reviewers read the shared queue, and fixes nested
+  worker/apply bridge locking.
+- Adds verified dead-letter list/show/requeue/discard, shared-ledger
+  backup/digest/restore, archive-before-retention, and a repeatable two-Runner
+  kill/recovery test over synthetic Postgres/MySQL.
+- Stages `@synapsor/spec@1.1.0`, `@synapsor/dsl@1.1.0`, and
+  `@synapsor/runner@1.1.0`. Nothing is published by this change.
+
+## 1.0.0
+
+### Production Approval Loop
+
+- Adds `apply --all-approved --yes` with per-proposal results, conflict
+  isolation, idempotent reruns, and `--capability`, `--tenant`, and `--max`
+  filters.
+- Adds canonical aggregate auto-approval limits in `@synapsor/spec`, DSL
+  `LIMIT` clauses, reviewer-visible limit trip events, and doctor/tool preview
+  surfacing.
+- Adds signed operator identity checks for approve/reject/apply while keeping
+  dev env identity available for local experiments.
+- Adds structured operational logs, per-tenant/capability counters, supervised
+  writeback worker retries/dead letters, and continued owner-only local store
+  permission tests.
+- Adds Postgres shared ledger support, runtime-store mode, per-session
+  HTTP-claims trusted context, managed secret hydration, token rotation hooks,
+  and Streamable HTTP mTLS.
+- Declares the first semver contract for the documented CLI, schema, contract,
+  MCP result, writeback, approval, metrics, and replay surfaces.
+- Stages `@synapsor/spec@1.0.0`, `@synapsor/dsl@1.0.0`, and
+  `@synapsor/runner@1.0.0`.
 
 ## 0.1.16
 

package/README.md

@@ -25,6 +25,19 @@ even if you never adopt Runner:
 npx -y @synapsor/runner audit --example dangerous-db-mcp
 ```
 
+Then point the same static review at your own exported tool manifest, remote
+`tools/list` endpoint, or stdio MCP server:
+
+```bash
+npx -y @synapsor/runner audit ./tools-list.json
+```
+
+The audit flags raw SQL, arbitrary table/column inputs, model-controlled tenant
+or principal authority, model-facing approval/writeback tools, and missing
+conflict or idempotency signals. It does not call business tools, and it is a
+risk review rather than proof that a server is secure. See [MCP Database Risk
+Review](docs/mcp-audit.md) for remote, stdio, JSON, and Markdown workflows.
+
 Then see the proposal, approval boundary, evidence, and replay loop. It needs no
 database, Docker, config file, MCP client, or Synapsor account:
 
@@ -65,6 +78,21 @@ approval or apply tools. A human or trusted operator approves outside MCP, then
 Runner either performs one guarded row update or routes the approved proposal
 to an app-owned executor.
 
+The distinction is the complete boundary, not a read-only toggle or a generic
+approve/reject prompt:
+
+- reviewed contracts constrain tools, tenant context, visible and writable
+  columns, numeric bounds, transitions, and approval requirements;
+- proposals separate model intent from commit authority, including aggregate
+  auto-approval ceilings where configured;
+- evidence, query audit, idempotency receipts, and replay preserve what was
+  inspected, requested, approved, and applied.
+
+Runner supports bounded production deployments when its documented database,
+identity, ledger, backup, and operational controls are satisfied. It does not
+make arbitrary agent code, raw SQL tools, host infrastructure, or
+prompt-injection-prone clients safe by itself.
+
 ## Connect A Staging Database
 
 Start with a staging or disposable database and a read-only credential. Keep
@@ -146,6 +174,32 @@ least-privilege database access, host security, or application authorization.
 See [Security Boundary](docs/security-boundary.md) and
 [Current Limitations](docs/limitations.md).
 
+## Operate The Approval Loop
+
+Reviewed policies can combine a per-proposal threshold with daily count and
+total ceilings. Exceeding a ceiling routes that proposal to human review; it
+never auto-applies. Operators can apply the bounded approved queue independently
+with `apply --all-approved --yes`, inspect Prometheus counters with `metrics
+show`, and consume safe newline-delimited JSON outcome logs from stderr. Signed
+operator keys can enforce contract reviewer roles and separate apply roles.
+Shared Postgres ledger mirror mode is available for bounded operator handoffs,
+and `storage.shared_postgres.mode = "runtime_store"` lets MCP serving use
+Postgres as the primary proposal/evidence/replay store with bounded CLI
+approval/apply/worker commands bridged through the same ledger. Local SQLite
+remains the default. See
+[Production](docs/production.md) and the
+[Runner Config Reference](docs/runner-config-reference.md).
+
+For a small multi-tenant fleet, bind every capability context to verified HTTP
+claims, use `jwt_asymmetric` session auth, and share a bounded Postgres
+`runtime_store`. Never assume a global `http_claims` setting overrides an
+environment-bound contract context; Runner rejects that contradiction before
+serving tools. Load balancers should use dependency-free `/healthz` for
+liveness and `/readyz` for source/ledger/writeback readiness. The tested
+two-Runner topology, pool/rate-limit budgets, metrics, backup/restore,
+dead-letter, and rolling-upgrade rules are in
+[Running A Small Runner Fleet](docs/running-a-runner-fleet.md).
+
 ## Packages
 
 | Package | Purpose |
@@ -168,9 +222,11 @@ owner-only permissions, inspection commands, and retention.
 
 ## OSS And Cloud
 
-Synapsor Runner works by itself for local and single-node deployments: your
-database remains the source of truth and the local SQLite ledger stores review
-artifacts. Synapsor Cloud adds a shared contract registry, immutable versions,
+Synapsor Runner works by itself for local, single-node, and bounded small-fleet
+deployments: your database remains the source of truth and Runner stores review
+artifacts in the default local SQLite ledger or an opt-in shared Postgres
+runtime store.
+Synapsor Cloud adds a shared contract registry, immutable versions,
 downloadable Runner bundles, and team activity, evidence, and approval
 surfaces. See [OSS Runner vs Synapsor Cloud](docs/oss-vs-cloud.md) for the
 detailed boundary.

package/THREAT_MODEL.md

@@ -10,7 +10,8 @@ It is not a general MCP security gateway, not a prompt-injection cure, not a rep
 - Business rows targeted by model-facing workflows.
 - Trusted tenant, principal, source, object, allowed-column, and version bindings.
 - Proposal diffs, evidence bundles, query audit, approvals, writeback jobs, receipts, and replay records.
-- Runner token and local SQLite proposal store.
+- Runner/session/operator tokens, local SQLite state, and optional shared
+  Postgres proposal/evidence/replay ledger.
 
 ## Trust Boundaries
 
@@ -38,6 +39,12 @@ MCP client/model
 
 The model-facing MCP tool call has request/proposal authority. The trusted runner has execution authority only for already-approved, scoped writeback jobs.
 
+In small-fleet mode, a TLS load balancer sends signed sessions to stateless
+Runner instances. Every effective capability context must bind tenant and
+principal from verified claims. Shared-ledger mutations serialize under a
+bounded Postgres advisory lock; source-side receipts remain the durable
+idempotency boundary for effects.
+
 ## Covered Threats
 
 - Model asks for arbitrary SQL: no generic SQL tool is exposed in the Synapsor path.
@@ -50,6 +57,16 @@ The model-facing MCP tool call has request/proposal authority. The trusted runne
 - Over-broad update: only single-row `UPDATE` is supported and success requires exactly one affected row.
 - Cloud credential leakage: database URLs and write credentials stay local and are not sent to Cloud.
 - Model-callable approval: approval/commit tools are not exposed to MCP clients by default.
+- Claims/environment confusion: an `http_claims` server fails before serving
+  if a capability resolves an environment/static contract context.
+- JWT algorithm/key confusion: networked sessions use an explicit RS256/ES256
+  allowlist, issuer/audience/time checks, `kid`, and bounded public-key/JWKS
+  loading.
+- Fleet races: shared proposal creation, distinct reviewer decisions, worker
+  claims, and fixed-window rate buckets are serialized/atomic in one ledger
+  schema.
+- Worker death around an effect: source receipts make retry before write safe
+  and recovery after commit return `already_applied` rather than duplicate.
 
 ## Not Covered
 
@@ -60,7 +77,12 @@ The model-facing MCP tool call has request/proposal authority. The trusted runne
 - Sensitive data already returned to a model.
 - Prompt injection itself.
 - Business invariants not represented in the capability config, proposal, application handler, or database constraints.
-- Multi-row business transactions, DDL, DELETE, INSERT, UPSERT, or cross-database atomicity in v0.1.
+- Generic multi-row business transactions, DDL, DELETE, INSERT, UPSERT, or
+  cross-database atomicity in the Runner direct-write path.
+- A compromised IdP/JWKS host, ledger database, source database, TLS
+  terminator, or administrator-approved contract.
+- Unbounded/high-throughput or multi-region ledger scale, compliance
+  certification, or production SLA.
 
 ## Required Operator Controls
 
@@ -71,6 +93,11 @@ The model-facing MCP tool call has request/proposal authority. The trusted runne
 - Prefer version/timestamp conflict guards over weak row-hash fallback.
 - Review proposal diffs and evidence before approval.
 - Monitor conflict/failed receipt rates.
+- Allowlist JWKS egress, keep `/metrics` separately authorized, budget source
+  pools across replicas, back up/verify the shared ledger, and retain the
+  configured `max_entries` safety bound.
+- Use verified `signed_key` or `jwt_oidc` reviewers for production-like shared
+  queues; `dev_env` is unverified.
 
 ## Release Blockers
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA2F,MAAM,6BAA6B,CAAC;AAoB1Y,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAgV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyD1D;AAqED,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AAiwED,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAwBza,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAmV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AA+gFD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}

package/dist/local-ui.d.ts

@@ -1,4 +1,5 @@
 import { type Server } from "node:http";
+import { ProposalStore } from "@synapsor-runner/proposal-store";
 export type LocalUiOptions = {
     configPath?: string;
     storePath?: string;
@@ -8,7 +9,9 @@ export type LocalUiOptions = {
     csrfToken?: string;
     allowRemoteBind?: boolean;
     tour?: boolean;
+    storeAccess?: LocalUiStoreAccess;
 };
+export type LocalUiStoreAccess = <T>(mode: "read" | "write", operation: string, callback: (store: ProposalStore) => T) => Promise<T>;
 export type LocalUiServer = {
     server: Server;
     url: string;

package/dist/local-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAQjG,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA8C7F"}
+{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,aAAa,EAAgD,MAAM,iCAAiC,CAAC;AAI9G,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C7F"}