@synapsor/runner 1.1.0 → 1.4.0

package/CHANGELOG.md

@@ -1,6 +1,110 @@
 # Changelog
 
-## 1.1.0 (prepared, not published)
+## 1.4.0 (prepared, not published)
+
+### Reviewed Reversible Change Sets
+
+- Adds opt-in canonical `reversibility.mode = reviewed_inverse` and DSL
+  `REVERSIBLE` for direct SQL capabilities with human/operator approval and
+  operation-specific exact guards.
+- Captures bounded inverse descriptors only after an unambiguous successful
+  source transaction. Inverses retain trusted identity, version metadata, and
+  reviewed writable values; kept-out data is excluded.
+- Adds operator-only `revert <proposal-id>`, which creates a new proposal and
+  never writes or approves. Compensation inherits reviewer role/quorum and
+  passes normal approval, guarded apply, receipt, reconciliation, and replay.
+- Supports reviewed UPDATE, INSERT, soft-delete, and exact frozen-set
+  compensation on PostgreSQL and MySQL. Fresh-state conflicts and one stale set
+  member fail closed without partial effects.
+- Reports hard DELETE and app-owned/external effects as specifically
+  unavailable instead of claiming rollback or time travel. Successful
+  compensation captures its own bounded inverse with linear lineage capped at
+  16.
+- Adds compensation change-set and protocol-v4 job/receipt schemas,
+  conformance fixtures, owner-authorized resources, local UI/doctor/preview
+  state, bounded metrics, crash-reconciliation tests, and the disposable
+  `corepack pnpm test:reversible` gate.
+- Stages `@synapsor/spec@1.4.0`, `@synapsor/dsl@1.4.0`, and
+  `@synapsor/runner@1.4.0`. No npm package is published by this change.
+
+## 1.3.0 (prepared, not published)
+
+### Bounded Set Writeback
+
+- Adds canonical and DSL semantics for fixed-predicate set `UPDATE`/`DELETE`
+  and exact-review batch `INSERT`, with mandatory `MAX ROWS`, aggregate value
+  bounds, and a hard 100-row implementation ceiling.
+- Freezes ordered primary keys, tenant scope, reviewed before/after values,
+  exact versions, per-member digests, and a set digest before approval. Apply
+  locks only that frozen set and never reruns a broad selection predicate.
+- Applies every member in one source transaction. Cap overflow, aggregate
+  overflow, stale/missing members, anomalous affected counts, dedup conflicts,
+  triggers, or widening delete cascades fail closed without partial effects.
+- Requires human/operator approval for all bounded sets in this release;
+  policy auto-approval is rejected. Hard set delete remains exceptional and
+  soft delete is preferred.
+- Adds protocol-v3 change-set, writeback-job, result, and receipt envelopes
+  with exact member identities and bounded safe digests, plus reconciliation
+  support for Runner-ledger crash ambiguity.
+- Adds executable R1-R7 conformance coverage and a disposable PostgreSQL/MySQL
+  live gate for cap/aggregate rejection, atomic rollback, exact receipts,
+  batch deduplication, delete hazards, reconciliation, and 1/10/100-row bounds.
+- Stages `@synapsor/spec@1.3.0`, `@synapsor/dsl@1.3.0`, and
+  `@synapsor/runner@1.3.0`. No npm package is published by this change.
+
+## 1.2.0 (prepared, not published)
+
+### Guarded CRUD And Receipt Authority
+
+- Adds canonical and DSL operation semantics for native guarded single-row
+  `INSERT`, `UPDATE`, and `DELETE`, while preserving operation-less contracts
+  and v1 writeback jobs as guarded UPDATE.
+- Adds operation-aware v2 change-set, writeback-job, and execution-receipt
+  schemas with trusted tenant binding, source-enforced INSERT deduplication,
+  DELETE cascade/trigger refusal, bounded diffs, and replay-safe digests.
+- Separates receipt authority (`source_db` or `runner_ledger`) from source
+  receipt provisioning (`precreated` or `auto_migrate`). Runner-ledger mode
+  records durable intents without source receipt DDL and stops ambiguous
+  post-commit outcomes for verified operator reconciliation.
+- Extends Postgres and MySQL adapters, onboarding, doctor, tools preview, and
+  the support-plan-credit example with least-privilege guarded CRUD paths.
+- Adds disposable-engine verification for every operation and receipt mode,
+  retries, crash windows, concurrent applies, stale guards, and hidden DELETE
+  effects. No npm package is published by this change.
+- Stages `@synapsor/spec@1.2.0`, `@synapsor/dsl@1.2.0`, and
+  `@synapsor/runner@1.2.0`.
+
+## 1.1.2 (prepared, not published)
+
+### Fleet Error And Batch Apply Correctness
+
+- Classifies bounded source-pool saturation and recognized transient
+  PostgreSQL, MySQL, and network failures as `TEMPORARILY_UNAVAILABLE` with
+  `retryable: true` and a bounded `retry_after_ms`, while keeping raw driver
+  details out of MCP results and operational logs.
+- Keeps non-transient database failures fail-closed as non-retryable
+  `INTERNAL` errors.
+- Preserves the existing shared `runtime_store` bridge while
+  `apply --all-approved` applies each selected proposal, preventing stale
+  bridge state from silently skipping policy- or human-approved proposals.
+- Adds policy-approved unit coverage and a two-Runner synthetic Postgres fleet
+  check for durable batch results and receipts.
+- Stages only `@synapsor/runner@1.1.2`; canonical Spec and DSL remain `1.1.0`.
+
+## 1.1.1
+
+### Resource Read Authorization
+
+- Reauthorizes local MCP proposal, evidence, and replay reads against the
+  owning capability's trusted tenant and principal before returning content.
+- Returns the same generic `RESOURCE_NOT_FOUND` result for missing resources,
+  cross-tenant access, cross-principal access, and incomplete legacy ownership
+  metadata so a leaked handle does not become bearer authority.
+- Adds shared-store and Streamable HTTP regressions proving owner access still
+  works while cross-session resource reads fail closed.
+- Stages only `@synapsor/runner@1.1.1`; canonical Spec and DSL remain `1.1.0`.
+
+## 1.1.0
 
 ### Fleet Safety And Operations
 

package/README.md

@@ -74,9 +74,9 @@ evidence -> proposal -> approval -> receipt -> replay
 ```
 
 The model can inspect scoped data and propose an exact change. It cannot call
-approval or apply tools. A human or trusted operator approves outside MCP, then
-Runner either performs one guarded row update or routes the approved proposal
-to an app-owned executor.
+approval, apply, or revert tools. A human or trusted operator approves outside
+MCP, then Runner performs a guarded write or routes the proposal to an
+app-owned executor.
 
 The distinction is the complete boundary, not a read-only toggle or a generic
 approve/reject prompt:
@@ -148,10 +148,20 @@ synapsor-runner mcp serve --config ./synapsor.runner.json --store ./.synapsor/lo
 ```
 
 For proposal capabilities and writes, follow the
-[complete own-database guide](docs/getting-started-own-database.md). One-row
-updates can use Runner's guarded direct writeback. Inserts, multiple tables, or
-external effects go through an [app-owned executor](docs/writeback-executors.md)
-after approval.
+[complete own-database guide](docs/getting-started-own-database.md). Reviewed
+single-row INSERT, UPDATE, and DELETE can use Runner's guarded direct
+writeback. Runner also supports tightly [bounded set
+writes](docs/bounded-set-writeback.md): fixed-predicate UPDATE/DELETE and
+exact-review batch INSERT, with human approval, a hard 100-row ceiling, atomic
+apply, and exact receipts. Free-form predicates, unbounded or cross-table work,
+and external effects go through an [app-owned
+executor](docs/writeback-executors.md) after approval.
+
+Direct writes can use [reviewed
+compensation](docs/reversible-change-sets.md). Receipts capture a
+bounded inverse; `synapsor-runner revert <proposal_id>` creates a separately
+approved proposal. This is not rollback, time travel, or app-owned
+compensation.
 
 ## Trust And Verification
 
@@ -161,10 +171,22 @@ trust boundaries, covered threats, non-goals, and required operator controls.
 - [Conformance fixtures](docs/conformance.md) prove trusted context, scoped
   reads, kept-out fields, proposal boundaries, approval, receipts, and replay
   behavior rather than only validating JSON shape.
+- MCP proposal, evidence, and replay handles are references rather than bearer
+  authority: resource reads re-check the owning tenant and principal against
+  the current trusted session.
 - `corepack pnpm test:live-apply` runs disposable Postgres and MySQL scenarios.
   It proves source rows stay unchanged before approval, guarded writeback
   applies once, idempotent retry does not duplicate the effect, and a stale row
   returns a conflict.
+- `corepack pnpm test:guarded-crud` proves native single-row INSERT, UPDATE,
+  and DELETE across both databases and all receipt modes, including the
+  zero-source-schema Runner-ledger path and fail-closed reconciliation.
+- `corepack pnpm test:bounded-set` proves proposal-time cap and aggregate
+  rejection, frozen-set drift checks, all-or-nothing set UPDATE/DELETE and
+  batch INSERT, delete-side-effect refusal, exact receipts, and 1/10/100-row
+  bounds on disposable PostgreSQL and MySQL.
+- `corepack pnpm test:reversible` proves approval, conflict guards, redaction,
+  receipts, and replay on PostgreSQL and MySQL.
 - The C++/Cloud round-trip verifier exports normalized contracts, validates
   them with `@synapsor/spec`, and loads them in Runner. The shared contract and
   verification commands are documented in [Conformance](docs/conformance.md).

package/THREAT_MODEL.md

@@ -53,12 +53,19 @@ idempotency boundary for effects.
 - Wrong tenant or object: reads and writes include trusted primary-key and tenant predicates.
 - Disallowed field update: patch columns must be allowlisted.
 - Stale row: conflict guard mismatch returns `conflict` instead of silently writing.
-- Duplicate retry: receipt/idempotency state prevents applying the same job twice.
-- Over-broad update: only single-row `UPDATE` is supported and success requires exactly one affected row.
+- Duplicate retry: atomic source receipts or durable Runner intents plus
+  source-enforced version/unique guards prevent a known duplicate effect;
+  ambiguous ledger/source crash windows stop for reconciliation.
+- Over-broad write: direct INSERT/UPDATE/DELETE is single-row, tenant-bound,
+  operation-guarded, and success requires exactly one affected row.
 - Cloud credential leakage: database URLs and write credentials stay local and are not sent to Cloud.
 - Model-callable approval: approval/commit tools are not exposed to MCP clients by default.
 - Claims/environment confusion: an `http_claims` server fails before serving
   if a capability resolves an environment/static contract context.
+- Leaked local resource handle: proposal, evidence, and replay reads resolve
+  the owning capability context again and require the same trusted tenant and
+  principal; missing or mismatched ownership returns the same generic
+  `RESOURCE_NOT_FOUND` response.
 - JWT algorithm/key confusion: networked sessions use an explicit RS256/ES256
   allowlist, issuer/audience/time checks, `kid`, and bounded public-key/JWKS
   loading.
@@ -77,8 +84,8 @@ idempotency boundary for effects.
 - Sensitive data already returned to a model.
 - Prompt injection itself.
 - Business invariants not represented in the capability config, proposal, application handler, or database constraints.
-- Generic multi-row business transactions, DDL, DELETE, INSERT, UPSERT, or
-  cross-database atomicity in the Runner direct-write path.
+- Generic multi-row business transactions, DDL, UPSERT, model-generated
+  predicates, or cross-database atomicity in the Runner direct-write path.
 - A compromised IdP/JWKS host, ledger database, source database, TLS
   terminator, or administrator-approved contract.
 - Unbounded/high-throughput or multi-region ledger scale, compliance
@@ -98,6 +105,8 @@ idempotency boundary for effects.
   configured `max_entries` safety bound.
 - Use verified `signed_key` or `jwt_oidc` reviewers for production-like shared
   queues; `dev_env` is unverified.
+- Treat proposal/evidence/replay handles as identifiers, not authorization;
+  preserve verified per-session context on every networked resource read.
 
 ## Release Blockers
 

package/dist/cli.d.ts

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 import { type DbRowReader } from "@synapsor-runner/mcp-server";
-import { type WritebackJob } from "@synapsor-runner/protocol";
+import { type StoredWritebackIntent } from "@synapsor-runner/proposal-store";
+import { type ExecutionReceiptV2, type ExecutionReceiptV3, type ExecutionReceiptV4, type WritebackJob } from "@synapsor-runner/protocol";
 import { type SchemaInspection } from "@synapsor-runner/schema-inspector";
+import { type ReconciliationObservation } from "@synapsor-runner/worker-core";
 export declare function main(argv: string[]): Promise<number>;
 type WizardAsk = (question: string, defaultValue?: string) => Promise<string>;
 export declare function runInitWizard(args: string[], options?: {
@@ -12,5 +14,7 @@ export declare function runInitWizard(args: string[], options?: {
     stdout?: Pick<NodeJS.WriteStream, "write">;
 }): Promise<number>;
 export declare function resolveSqlWriteDatabaseUrl(job: WritebackJob, configPath: string, env: NodeJS.ProcessEnv): Promise<string>;
+export declare function reconciliationSupportedOutcome(observation: ReconciliationObservation): "applied" | "conflict" | "failed";
+export declare function reconciliationReceipt(intent: StoredWritebackIntent, observation: ReconciliationObservation, outcome: "applied" | "conflict" | "failed", runnerId: string, reason: string): ExecutionReceiptV2 | ExecutionReceiptV3 | ExecutionReceiptV4;
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAwBza,OAAO,EAA6G,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/L,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAmV3C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2TjB;AA+gFD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAIza,OAAO,EAgBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAuD,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAElV,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAUL,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AAyUtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA0YjB;AAgmGD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H;AAs4CD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}

package/dist/local-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,aAAa,EAAgD,MAAM,iCAAiC,CAAC;AAI9G,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C7F"}
+{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,aAAa,EAA6E,MAAM,iCAAiC,CAAC;AAK3I,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C7F"}