@synapsor/runner 1.4.0 → 1.4.12

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## 1.4.12 (prepared, not published)
+
+### Runtime-store smoke-call consistency
+
+- Fixes BUG-017: `smoke call` now lets the MCP runtime resolve storage from the
+  complete config instead of injecting a local SQLite `ProposalStore`.
+- In `runtime_store` mode, proposal, evidence, query-audit, event, and replay
+  records land in the authoritative shared Postgres ledger and are visible to
+  other Runner processes and normal approve/apply commands.
+- Shared-ledger failures return a redacted, retryable availability result with
+  a nonzero CLI status and never create a local fallback proposal.
+- Keeps local SQLite and mirror modes unchanged. The source database still
+  remains untouched until external approval and guarded apply.
+- Adds focused no-fallback coverage and a disposable two-process fleet proof
+  covering ownership, approval/apply, one source receipt, replay, and safe
+  ledger unavailability.
+- Stages only `@synapsor/runner@1.4.12`; `@synapsor/dsl` remains `1.4.1` and
+  `@synapsor/spec` remains `1.4.0`. Nothing is published by this change.
+
+## 1.4.1 (prepared, not published)
+
+### Canonical Bounded-Set Digest Verification
+
+- Fixes contract-authored bounded-set proposals that could fail unchanged
+  apply with `SET_DIGEST_MISMATCH` after protocol parsing reordered aggregate
+  object fields.
+- Uses recursive canonical JSON key ordering for new member and set digests,
+  while narrowly accepting the deterministic raw representations emitted by
+  `1.4.0` so valid stored proposals remain applyable.
+- Keeps every frozen member, expected version, reviewed value, aggregate,
+  tenant guard, and atomic source check intact; malformed digests and genuine
+  source drift still fail closed.
+- Adds PostgreSQL/MySQL regression coverage for the exact DSL-to-contract path
+  under source-database and Runner-ledger receipt authority, plus independent
+  version, predicate, aggregate, writable-value, missing-member, and tenant
+  drift checks.
+- Ships the bounded-set guide and other linked public docs in the Runner
+  tarball, and fails package assembly when a shipped local Markdown link cannot
+  resolve.
+- Removes obsolete `0.1 preview` wording from the DSL package without changing
+  canonical Spec `spec_version: "0.1"`.
+- Adds a build-vs-adopt guide for teams already using prompts and custom
+  parameterized tools. It distinguishes behavioral instructions from
+  structural authorization, explains where SQL authority lives, and documents
+  the approval, receipt, replay, and compensation layer without claiming
+  prompt-injection prevention or compliance certification.
+- Stages `@synapsor/runner@1.4.1` and `@synapsor/dsl@1.4.1`;
+  `@synapsor/spec` remains `1.4.0` because the public contract schema did not
+  change. Nothing is published by this change.
+
 ## 1.4.0 (prepared, not published)
 
 ### Reviewed Reversible Change Sets

package/README.md

@@ -88,10 +88,26 @@ approve/reject prompt:
 - evidence, query audit, idempotency receipts, and replay preserve what was
   inspected, requested, approved, and applied.
 
-Runner supports bounded production deployments when its documented database,
-identity, ledger, backup, and operational controls are satisfied. It does not
-make arbitrary agent code, raw SQL tools, host infrastructure, or
-prompt-injection-prone clients safe by itself.
+Runner supports bounded deployments when its documented database, identity,
+ledger, backup, and operational controls are satisfied. It does not make raw
+SQL tools, host infrastructure, or prompt-injection-prone clients safe.
+
+## Why Not Just Use A Prompt And App Code?
+
+Prompt instructions can guide behavior, but prompt-only enforcement is not an
+authorization boundary. First ask who produces the SQL:
+
+- **The model produces SQL:** your validator must safely understand arbitrary
+  queries, scope, and side effects. That is `execute_sql` with an extra parser.
+- **Trusted app code produces fixed, parameterized SQL:** good. You have built
+  a semantic tool, and that may be enough for a small read-only application.
+
+Runner becomes useful when those tools also need one reviewed contract for
+trusted tenant scope, field controls, evidence, approval outside MCP, guarded
+and idempotent writeback, receipts, replay, and reviewed compensation. Use your
+own code when you do not need that lifecycle. Read the [full build-vs-adopt
+guide](docs/why-synapsor-vs-app-guardrails.md) for the decision table, public
+incident evidence, and regulated-data boundaries.
 
 ## Connect A Staging Database
 
@@ -109,11 +125,9 @@ creates trusted context, generates reviewed capabilities, previews the MCP tool
 surface, and prints the next smoke and serve commands. It stores environment
 variable names, not connection strings.
 
-The interesting part of the generated configuration is the capability entry: a
-reviewed, tenant-scoped read with an explicit column allowlist and required
-evidence. The storage, source, and trusted-context wiring around it (including
-statement timeouts) is generated for you; the full file is in the
-[own-database guide](docs/getting-started-own-database.md).
+The generated capability is a tenant-scoped read with an explicit column
+allowlist and required evidence. See the [own-database
+guide](docs/getting-started-own-database.md) for the full configuration.
 
 ```json
 {
@@ -174,19 +188,11 @@ trust boundaries, covered threats, non-goals, and required operator controls.
 - MCP proposal, evidence, and replay handles are references rather than bearer
   authority: resource reads re-check the owning tenant and principal against
   the current trusted session.
-- `corepack pnpm test:live-apply` runs disposable Postgres and MySQL scenarios.
-  It proves source rows stay unchanged before approval, guarded writeback
-  applies once, idempotent retry does not duplicate the effect, and a stale row
-  returns a conflict.
-- `corepack pnpm test:guarded-crud` proves native single-row INSERT, UPDATE,
-  and DELETE across both databases and all receipt modes, including the
-  zero-source-schema Runner-ledger path and fail-closed reconciliation.
-- `corepack pnpm test:bounded-set` proves proposal-time cap and aggregate
-  rejection, frozen-set drift checks, all-or-nothing set UPDATE/DELETE and
-  batch INSERT, delete-side-effect refusal, exact receipts, and 1/10/100-row
-  bounds on disposable PostgreSQL and MySQL.
-- `corepack pnpm test:reversible` proves approval, conflict guards, redaction,
-  receipts, and replay on PostgreSQL and MySQL.
+- `test:live-apply`, `test:guarded-crud`, `test:bounded-set`, and
+  `test:reversible` run disposable PostgreSQL/MySQL scenarios. They prove no
+  pre-approval mutation, guarded single-row CRUD, idempotent retry,
+  fail-closed conflicts, bounded atomic sets, exact receipts, and reviewed
+  compensation.
 - The C++/Cloud round-trip verifier exports normalized contracts, validates
   them with `@synapsor/spec`, and loads them in Runner. The shared contract and
   verification commands are documented in [Conformance](docs/conformance.md).
@@ -198,12 +204,9 @@ See [Security Boundary](docs/security-boundary.md) and
 
 ## Operate The Approval Loop
 
-Reviewed policies can combine a per-proposal threshold with daily count and
-total ceilings. Exceeding a ceiling routes that proposal to human review; it
-never auto-applies. Operators can apply the bounded approved queue independently
-with `apply --all-approved --yes`, inspect Prometheus counters with `metrics
-show`, and consume safe newline-delimited JSON outcome logs from stderr. Signed
-operator keys can enforce contract reviewer roles and separate apply roles.
+Reviewed policies combine per-proposal and daily ceilings; exceeding one routes
+the proposal to human review. Operators use `apply --all-approved --yes`,
+Prometheus metrics, structured logs, and optional signed reviewer/apply roles.
 Shared Postgres ledger mirror mode is available for bounded operator handoffs,
 and `storage.shared_postgres.mode = "runtime_store"` lets MCP serving use
 Postgres as the primary proposal/evidence/replay store with bounded CLI
@@ -212,6 +215,10 @@ remains the default. See
 [Production](docs/production.md) and the
 [Runner Config Reference](docs/runner-config-reference.md).
 
+`smoke call` honors `runtime_store`: artifacts go to shared Postgres; failures
+never fall back to SQLite. `--store` is compatibility plumbing. Requires
+`1.4.12`+.
+
 For a small multi-tenant fleet, bind every capability context to verified HTTP
 claims, use `jwt_asymmetric` session auth, and share a bounded Postgres
 `runtime_store`. Never assume a global `http_claims` setting overrides an
@@ -230,11 +237,10 @@ dead-letter, and rolling-upgrade rules are in
 | `@synapsor/spec` | Canonical portable contracts for contexts, capabilities, workflows, evidence, proposals, receipts, and replay. |
 | `@synapsor/dsl` | SQL-like authoring that compiles contexts, capabilities, and workflow declarations into canonical contract JSON. |
 
-Runner executes locally. The spec is the portable contract shared by Runner
-and Cloud/C++. The DSL gives that contract a reviewable source format. Start
-with [Capability Authoring](docs/capability-authoring.md). Use `.synapsor.sql`
-for DSL source files when you want editors to provide generic SQL highlighting;
-legacy `.synapsor` files remain supported and produce the same contract JSON.
+Runner executes locally. The spec is shared by Runner and Cloud/C++; the DSL
+is its reviewable source format. Start with [Capability
+Authoring](docs/capability-authoring.md). Use `.synapsor.sql` for generic SQL
+highlighting; legacy `.synapsor` files produce the same contract JSON.
 
 Use the [DSL Reference](docs/dsl-reference.md) for exact authoring grammar and
 the [Runner Config Reference](docs/runner-config-reference.md) for every wiring

package/SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+Report security issues privately to security@synapsor.ai.
+
+Do not include production credentials, customer data, or full source rows in bug reports. Include runner version, job id, proposal id, source id, engine, safe error code, and redacted logs where possible.
+
+## Supported security scope
+
+The v0.1 runner protects the local writeback boundary for approved structured jobs. It does not make the hosted Synapsor control plane self-hosted, and it does not provide HA, compliance certification, or a general database proxy.
+
+See `docs/threat-model.md` for detailed trust boundaries, covered threats, non-goals, and release blockers.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAIza,OAAO,EAgBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAuD,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAElV,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAUL,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AAyUtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA0YjB;AAgmGD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H;AAs4CD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAIza,OAAO,EAgBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAuD,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAElV,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAUL,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AAyUtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2YjB;AAqmGD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H;AAs4CD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}