@synapsor/runner 1.4.1 → 1.4.121

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 1.4.121 (prepared, not published)
+
+### Contract trust surface and bounded-set parser correctness
+
+- Fixes BUG-018: `SELECT WHERE risk_level = 'high' AND case_status =
+  'active'` now compiles into two ordered canonical equality terms instead of
+  silently folding the second term into the first string value.
+- Uses a quote-aware, full-clause parser. `AND` inside a quoted literal remains
+  literal content, while malformed terms, trailing tokens, `OR`, parentheses,
+  and non-equality operators fail during DSL compilation with location-aware
+  errors.
+- Preserves existing single-term contracts and literal types. The canonical
+  Spec bump in this release is limited to the additive enum and aggregate-read
+  fields described below.
+- Adds standalone DSL and bundled Runner parity coverage plus PostgreSQL/MySQL
+  live proof under source-database and Runner-ledger receipt authority. The
+  proof excludes first-term-only, second-term-only, and wrong-tenant rows and
+  verifies exact receipt/replay membership.
+- Adds a real stdio contract language server plus canonical `contract explain`
+  and deterministic text/JSON/SARIF lint for review before serving.
+- Adds adopter-owned static/live contract tests with a public manifest schema,
+  generic operator-boundary checks, and disposable PostgreSQL/MySQL coverage.
+- Adds tenant-scoped object/principal ledger reports in JSON, Markdown, and PDF
+  with redaction, canonical digests, optional operator signatures, and tamper
+  verification.
+- Adds typed DSL enums and canonical fixed aggregate reads for COUNT/SUM/AVG.
+  Aggregate tools use trusted tenant scope, fixed equality selection, mandatory
+  minimum-group suppression, one scalar result, and evidence/query audit with
+  no member rows or IDs.
+- Adds disabled-by-default graduated-trust recommendations. Evaluation uses
+  scoped human-reviewed outcomes, excludes auto-approval as independent
+  evidence, requires verified operator review, and exports a separate
+  digest-bound contract artifact without activating it.
+- Proves additive Spec/DSL/Runner/C++ aggregate and enum parity, shared Postgres
+  recommendation durability, and transient PostgreSQL/MySQL timeout
+  classification.
+- Stages `@synapsor/spec@1.4.1`, `@synapsor/dsl@1.4.2`, and
+  `@synapsor/runner@1.4.121`. Nothing is published by this change.
+
+## 1.4.12 (prepared, not published)
+
+### Runtime-store smoke-call consistency
+
+- Fixes BUG-017: `smoke call` now lets the MCP runtime resolve storage from the
+  complete config instead of injecting a local SQLite `ProposalStore`.
+- In `runtime_store` mode, proposal, evidence, query-audit, event, and replay
+  records land in the authoritative shared Postgres ledger and are visible to
+  other Runner processes and normal approve/apply commands.
+- Shared-ledger failures return a redacted, retryable availability result with
+  a nonzero CLI status and never create a local fallback proposal.
+- Keeps local SQLite and mirror modes unchanged. The source database still
+  remains untouched until external approval and guarded apply.
+- Adds focused no-fallback coverage and a disposable two-process fleet proof
+  covering ownership, approval/apply, one source receipt, replay, and safe
+  ledger unavailability.
+- Stages only `@synapsor/runner@1.4.12`; `@synapsor/dsl` remains `1.4.1` and
+  `@synapsor/spec` remains `1.4.0`. Nothing is published by this change.
+
 ## 1.4.1 (prepared, not published)
 
 ### Canonical Bounded-Set Digest Verification

package/README.md

@@ -78,36 +78,25 @@ approval, apply, or revert tools. A human or trusted operator approves outside
 MCP, then Runner performs a guarded write or routes the proposal to an
 app-owned executor.
 
-The distinction is the complete boundary, not a read-only toggle or a generic
-approve/reject prompt:
-
-- reviewed contracts constrain tools, tenant context, visible and writable
-  columns, numeric bounds, transitions, and approval requirements;
-- proposals separate model intent from commit authority, including aggregate
-  auto-approval ceilings where configured;
-- evidence, query audit, idempotency receipts, and replay preserve what was
-  inspected, requested, approved, and applied.
-
-Runner supports bounded deployments when its documented database, identity,
-ledger, backup, and operational controls are satisfied. It does not make raw
-SQL tools, host infrastructure, or prompt-injection-prone clients safe.
+Contracts constrain tools, trusted context, visible and writable columns,
+bounds, transitions, and approvals. Proposals separate model intent from commit
+authority; evidence, query audit, receipts, and replay preserve the reviewed
+lifecycle. Runner does not make raw SQL tools, hosts, or
+prompt-injection-prone clients safe.
 
 ## Why Not Just Use A Prompt And App Code?
 
-Prompt instructions can guide behavior, but prompt-only enforcement is not an
-authorization boundary. First ask who produces the SQL:
+Prompts are not an authorization boundary. First ask who produces the SQL:
 
-- **The model produces SQL:** your validator must safely understand arbitrary
-  queries, scope, and side effects. That is `execute_sql` with an extra parser.
+- **The model produces SQL:** validation must understand arbitrary queries,
+  scope, and side effects. That is `execute_sql` behind a parser.
 - **Trusted app code produces fixed, parameterized SQL:** good. You have built
   a semantic tool, and that may be enough for a small read-only application.
 
-Runner becomes useful when those tools also need one reviewed contract for
-trusted tenant scope, field controls, evidence, approval outside MCP, guarded
-and idempotent writeback, receipts, replay, and reviewed compensation. Use your
-own code when you do not need that lifecycle. Read the [full build-vs-adopt
-guide](docs/why-synapsor-vs-app-guardrails.md) for the decision table, public
-incident evidence, and regulated-data boundaries.
+Runner adds one reviewed contract for trusted scope, field controls, evidence,
+approval outside MCP, guarded writeback, receipts, replay, and compensation.
+Use your own code when you do not need that lifecycle. See the [build-vs-adopt
+guide](docs/why-synapsor-vs-app-guardrails.md).
 
 ## Connect A Staging Database
 
@@ -177,6 +166,23 @@ bounded inverse; `synapsor-runner revert <proposal_id>` creates a separately
 approved proposal. This is not rollback, time travel, or app-owned
 compensation.
 
+## Review And Prove Your Contract
+
+Before serving a contract, use `contract explain` for a reviewer-readable
+boundary, `contract lint --strict` for deterministic CI checks, and `contract
+test` for adopter-owned allow/deny/redaction cases. The built-in language
+server supplies diagnostics, completion, hover, and formatting for
+`.synapsor.sql` and legacy `.synapsor` files. See [Contract
+Review](docs/contract-review.md) and [Contract
+Testing](docs/contract-testing.md).
+
+Runner also supports reviewed [aggregate reads](docs/aggregate-reads.md),
+tenant-scoped tamper-evident [ledger reports](docs/compliance-reports.md), and
+opt-in [graduated-trust recommendations](docs/graduated-trust.md). Aggregate
+tools return one scalar and no source rows. Graduated trust is disabled by
+default, remains operator-only, and can export a reviewable artifact but never
+activate it.
+
 ## Trust And Verification
 
 Start with the **[Threat Model](THREAT_MODEL.md)**. It defines protected assets,
@@ -185,6 +191,9 @@ trust boundaries, covered threats, non-goals, and required operator controls.
 - [Conformance fixtures](docs/conformance.md) prove trusted context, scoped
   reads, kept-out fields, proposal boundaries, approval, receipts, and replay
   behavior rather than only validating JSON shape.
+- `contract test` lets adopters encode the same boundary checks for their own
+  synthetic fixtures; it never invokes an LLM and refuses remote live targets
+  by default.
 - MCP proposal, evidence, and replay handles are references rather than bearer
   authority: resource reads re-check the owning tenant and principal against
   the current trusted session.
@@ -204,26 +213,14 @@ See [Security Boundary](docs/security-boundary.md) and
 
 ## Operate The Approval Loop
 
-Reviewed policies combine per-proposal and daily ceilings; exceeding one routes
-the proposal to human review. Operators use `apply --all-approved --yes`,
-Prometheus metrics, structured logs, and optional signed reviewer/apply roles.
-Shared Postgres ledger mirror mode is available for bounded operator handoffs,
-and `storage.shared_postgres.mode = "runtime_store"` lets MCP serving use
-Postgres as the primary proposal/evidence/replay store with bounded CLI
-approval/apply/worker commands bridged through the same ledger. Local SQLite
-remains the default. See
-[Production](docs/production.md) and the
-[Runner Config Reference](docs/runner-config-reference.md).
-
-For a small multi-tenant fleet, bind every capability context to verified HTTP
-claims, use `jwt_asymmetric` session auth, and share a bounded Postgres
-`runtime_store`. Never assume a global `http_claims` setting overrides an
-environment-bound contract context; Runner rejects that contradiction before
-serving tools. Load balancers should use dependency-free `/healthz` for
-liveness and `/readyz` for source/ledger/writeback readiness. The tested
-two-Runner topology, pool/rate-limit budgets, metrics, backup/restore,
-dead-letter, and rolling-upgrade rules are in
-[Running A Small Runner Fleet](docs/running-a-runner-fleet.md).
+Policies combine per-proposal and daily ceilings; exceeding one routes to human
+review. Operators get batch apply, metrics, structured logs, and optional
+signed roles. Local SQLite is the default; bounded fleets can use verified HTTP
+claims, asymmetric JWT sessions, and a shared Postgres `runtime_store`.
+`smoke call` follows that store and never falls back to SQLite. Use `/healthz`
+for liveness and `/readyz` for dependency readiness. See
+[Production](docs/production.md), [Runner Config](docs/runner-config-reference.md),
+and [Small Runner Fleets](docs/running-a-runner-fleet.md).
 
 ## Packages
 

package/THREAT_MODEL.md

@@ -50,6 +50,12 @@ idempotency boundary for effects.
 - Model asks for arbitrary SQL: no generic SQL tool is exposed in the Synapsor path.
 - Model supplies `tenant_id`, `principal`, source id, allowed columns, row version, or approval identity: runner rejects trusted-binding overrides.
 - Prompt injection in database content asks the model to bypass policy: the runner ignores text as authority and only accepts structured capability/job state.
+- Aggregate inference through a one-record group: reviewed aggregate tools
+  require minimum-group suppression and never return member rows or IDs. This
+  reduces, but does not eliminate, statistical inference risk.
+- Policy self-expansion from favorable automated outcomes: graduated trust is
+  off by default, excludes auto-approvals from human evidence, requires a
+  verified operator decision, and exports without activation.
 - Wrong tenant or object: reads and writes include trusted primary-key and tenant predicates.
 - Disallowed field update: patch columns must be allowlisted.
 - Stale row: conflict guard mismatch returns `conflict` instead of silently writing.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAIza,OAAO,EAgBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAuD,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAElV,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAUL,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AAyUtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6D1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA0YjB;AAgmGD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H;AAs4CD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoP,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAIza,OAAO,EAiBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAuD,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAElV,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAUL,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AA8UtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgE1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2YjB;AA2/GD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H;AAs4CD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}