@synapsor/runner 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -1,6 +1,42 @@
 # Changelog
 
-## Unreleased
+## 1.1.1 (prepared, not published)
+
+### Resource Read Authorization
+
+- Reauthorizes local MCP proposal, evidence, and replay reads against the
+  owning capability's trusted tenant and principal before returning content.
+- Returns the same generic `RESOURCE_NOT_FOUND` result for missing resources,
+  cross-tenant access, cross-principal access, and incomplete legacy ownership
+  metadata so a leaked handle does not become bearer authority.
+- Adds shared-store and Streamable HTTP regressions proving owner access still
+  works while cross-session resource reads fail closed.
+- Stages only `@synapsor/runner@1.1.1`; canonical Spec and DSL remain `1.1.0`.
+
+## 1.1.0
+
+### Fleet Safety And Operations
+
+- Fails closed when claim-authenticated HTTP serving resolves an
+  environment/static contract context, and fixes object-filtered activity so
+  unrelated receipts cannot enter results.
+- Adds RS256/ES256 session and operator JWT verification with bounded JWKS or
+  public-PEM loading, plus verified operator attestations without bearer-token
+  persistence.
+- Adds dependency-aware `/readyz`, separately protected `/metrics`, reusable
+  bounded Postgres/MySQL pools, and trusted tenant/capability fixed-window rate
+  limits that are atomic in shared runtime-store mode.
+- Adds optional canonical `required_approvals` and DSL `REQUIRE n APPROVALS`,
+  distinct-reviewer enforcement, `n/N` progress, terminal rejection, and
+  policy-auto-approval deferral for multi-human quorum.
+- Hardens shared Postgres migration startup, bounds the transient bridge with
+  `max_entries`, makes CLI/UI reviewers read the shared queue, and fixes nested
+  worker/apply bridge locking.
+- Adds verified dead-letter list/show/requeue/discard, shared-ledger
+  backup/digest/restore, archive-before-retention, and a repeatable two-Runner
+  kill/recovery test over synthetic Postgres/MySQL.
+- Stages `@synapsor/spec@1.1.0`, `@synapsor/dsl@1.1.0`, and
+  `@synapsor/runner@1.1.0`. Nothing is published by this change.
 
 ## 1.0.0
 

package/README.md

@@ -25,6 +25,19 @@ even if you never adopt Runner:
 npx -y @synapsor/runner audit --example dangerous-db-mcp
 ```
 
+Then point the same static review at your own exported tool manifest, remote
+`tools/list` endpoint, or stdio MCP server:
+
+```bash
+npx -y @synapsor/runner audit ./tools-list.json
+```
+
+The audit flags raw SQL, arbitrary table/column inputs, model-controlled tenant
+or principal authority, model-facing approval/writeback tools, and missing
+conflict or idempotency signals. It does not call business tools, and it is a
+risk review rather than proof that a server is secure. See [MCP Database Risk
+Review](docs/mcp-audit.md) for remote, stdio, JSON, and Markdown workflows.
+
 Then see the proposal, approval boundary, evidence, and replay loop. It needs no
 database, Docker, config file, MCP client, or Synapsor account:
 
@@ -65,6 +78,21 @@ approval or apply tools. A human or trusted operator approves outside MCP, then
 Runner either performs one guarded row update or routes the approved proposal
 to an app-owned executor.
 
+The distinction is the complete boundary, not a read-only toggle or a generic
+approve/reject prompt:
+
+- reviewed contracts constrain tools, tenant context, visible and writable
+  columns, numeric bounds, transitions, and approval requirements;
+- proposals separate model intent from commit authority, including aggregate
+  auto-approval ceilings where configured;
+- evidence, query audit, idempotency receipts, and replay preserve what was
+  inspected, requested, approved, and applied.
+
+Runner supports bounded production deployments when its documented database,
+identity, ledger, backup, and operational controls are satisfied. It does not
+make arbitrary agent code, raw SQL tools, host infrastructure, or
+prompt-injection-prone clients safe by itself.
+
 ## Connect A Staging Database
 
 Start with a staging or disposable database and a read-only credential. Keep
@@ -133,6 +161,9 @@ trust boundaries, covered threats, non-goals, and required operator controls.
 - [Conformance fixtures](docs/conformance.md) prove trusted context, scoped
   reads, kept-out fields, proposal boundaries, approval, receipts, and replay
   behavior rather than only validating JSON shape.
+- MCP proposal, evidence, and replay handles are references rather than bearer
+  authority: resource reads re-check the owning tenant and principal against
+  the current trusted session.
 - `corepack pnpm test:live-apply` runs disposable Postgres and MySQL scenarios.
   It proves source rows stay unchanged before approval, guarded writeback
   applies once, idempotent retry does not duplicate the effect, and a stale row
@@ -162,6 +193,16 @@ remains the default. See
 [Production](docs/production.md) and the
 [Runner Config Reference](docs/runner-config-reference.md).
 
+For a small multi-tenant fleet, bind every capability context to verified HTTP
+claims, use `jwt_asymmetric` session auth, and share a bounded Postgres
+`runtime_store`. Never assume a global `http_claims` setting overrides an
+environment-bound contract context; Runner rejects that contradiction before
+serving tools. Load balancers should use dependency-free `/healthz` for
+liveness and `/readyz` for source/ledger/writeback readiness. The tested
+two-Runner topology, pool/rate-limit budgets, metrics, backup/restore,
+dead-letter, and rolling-upgrade rules are in
+[Running A Small Runner Fleet](docs/running-a-runner-fleet.md).
+
 ## Packages
 
 | Package | Purpose |
@@ -184,9 +225,10 @@ owner-only permissions, inspection commands, and retention.
 
 ## OSS And Cloud
 
-Synapsor Runner works by itself for local and single-node deployments: your
-database remains the source of truth and Runner stores review artifacts in the
-default local SQLite ledger or an opt-in shared Postgres runtime store.
+Synapsor Runner works by itself for local, single-node, and bounded small-fleet
+deployments: your database remains the source of truth and Runner stores review
+artifacts in the default local SQLite ledger or an opt-in shared Postgres
+runtime store.
 Synapsor Cloud adds a shared contract registry, immutable versions,
 downloadable Runner bundles, and team activity, evidence, and approval
 surfaces. See [OSS Runner vs Synapsor Cloud](docs/oss-vs-cloud.md) for the

package/THREAT_MODEL.md

@@ -10,7 +10,8 @@ It is not a general MCP security gateway, not a prompt-injection cure, not a rep
 - Business rows targeted by model-facing workflows.
 - Trusted tenant, principal, source, object, allowed-column, and version bindings.
 - Proposal diffs, evidence bundles, query audit, approvals, writeback jobs, receipts, and replay records.
-- Runner token and local SQLite proposal store.
+- Runner/session/operator tokens, local SQLite state, and optional shared
+  Postgres proposal/evidence/replay ledger.
 
 ## Trust Boundaries
 
@@ -38,6 +39,12 @@ MCP client/model
 
 The model-facing MCP tool call has request/proposal authority. The trusted runner has execution authority only for already-approved, scoped writeback jobs.
 
+In small-fleet mode, a TLS load balancer sends signed sessions to stateless
+Runner instances. Every effective capability context must bind tenant and
+principal from verified claims. Shared-ledger mutations serialize under a
+bounded Postgres advisory lock; source-side receipts remain the durable
+idempotency boundary for effects.
+
 ## Covered Threats
 
 - Model asks for arbitrary SQL: no generic SQL tool is exposed in the Synapsor path.
@@ -50,6 +57,20 @@ The model-facing MCP tool call has request/proposal authority. The trusted runne
 - Over-broad update: only single-row `UPDATE` is supported and success requires exactly one affected row.
 - Cloud credential leakage: database URLs and write credentials stay local and are not sent to Cloud.
 - Model-callable approval: approval/commit tools are not exposed to MCP clients by default.
+- Claims/environment confusion: an `http_claims` server fails before serving
+  if a capability resolves an environment/static contract context.
+- Leaked local resource handle: proposal, evidence, and replay reads resolve
+  the owning capability context again and require the same trusted tenant and
+  principal; missing or mismatched ownership returns the same generic
+  `RESOURCE_NOT_FOUND` response.
+- JWT algorithm/key confusion: networked sessions use an explicit RS256/ES256
+  allowlist, issuer/audience/time checks, `kid`, and bounded public-key/JWKS
+  loading.
+- Fleet races: shared proposal creation, distinct reviewer decisions, worker
+  claims, and fixed-window rate buckets are serialized/atomic in one ledger
+  schema.
+- Worker death around an effect: source receipts make retry before write safe
+  and recovery after commit return `already_applied` rather than duplicate.
 
 ## Not Covered
 
@@ -60,7 +81,12 @@ The model-facing MCP tool call has request/proposal authority. The trusted runne
 - Sensitive data already returned to a model.
 - Prompt injection itself.
 - Business invariants not represented in the capability config, proposal, application handler, or database constraints.
-- Multi-row business transactions, DDL, DELETE, INSERT, UPSERT, or cross-database atomicity in v0.1.
+- Generic multi-row business transactions, DDL, DELETE, INSERT, UPSERT, or
+  cross-database atomicity in the Runner direct-write path.
+- A compromised IdP/JWKS host, ledger database, source database, TLS
+  terminator, or administrator-approved contract.
+- Unbounded/high-throughput or multi-region ledger scale, compliance
+  certification, or production SLA.
 
 ## Required Operator Controls
 
@@ -71,6 +97,13 @@ The model-facing MCP tool call has request/proposal authority. The trusted runne
 - Prefer version/timestamp conflict guards over weak row-hash fallback.
 - Review proposal diffs and evidence before approval.
 - Monitor conflict/failed receipt rates.
+- Allowlist JWKS egress, keep `/metrics` separately authorized, budget source
+  pools across replicas, back up/verify the shared ledger, and retain the
+  configured `max_entries` safety bound.
+- Use verified `signed_key` or `jwt_oidc` reviewers for production-like shared
+  queues; `dev_env` is unverified.
+- Treat proposal/evidence/replay handles as identifiers, not authorization;
+  preserve verified per-session context on every networked resource read.
 
 ## Release Blockers
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAuBza,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAmV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AA+gFD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAwBza,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAmV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AA+gFD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}

package/dist/local-ui.d.ts

@@ -1,4 +1,5 @@
 import { type Server } from "node:http";
+import { ProposalStore } from "@synapsor-runner/proposal-store";
 export type LocalUiOptions = {
     configPath?: string;
     storePath?: string;
@@ -8,7 +9,9 @@ export type LocalUiOptions = {
     csrfToken?: string;
     allowRemoteBind?: boolean;
     tour?: boolean;
+    storeAccess?: LocalUiStoreAccess;
 };
+export type LocalUiStoreAccess = <T>(mode: "read" | "write", operation: string, callback: (store: ProposalStore) => T) => Promise<T>;
 export type LocalUiServer = {
     server: Server;
     url: string;

package/dist/local-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAQjG,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA8C7F"}
+{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,aAAa,EAAgD,MAAM,iCAAiC,CAAC;AAI9G,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C7F"}