@synapsor/runner 1.4.121 → 1.4.123

package/fixtures/protocol/MANIFEST.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "synapsor.protocol-manifest.v1",
   "protocol_set": "database-mcp-writeback",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "hash_algorithm": "sha256",
   "note": "This manifest is copied in Synapsor main protocol/MANIFEST.json and synapsor-runner fixtures/protocol/MANIFEST.json. Hashes are over the checked-in JSON artifact bytes.",
   "artifacts": [
@@ -113,22 +113,22 @@
     {
       "kind": "schema",
       "name": "change-set.v1.schema.json",
-      "sha256": "119ac84f7189e9433d4eaac4defb6ef7c459a14e55e1563aa7948b746d816af5"
+      "sha256": "18f76efd97424efab986b6fb0af87ad0eeafd4314393ed7f83f14afe09d625eb"
     },
     {
       "kind": "schema",
       "name": "change-set.v2.schema.json",
-      "sha256": "cd07204661d08eba31c0cd1f878b881a5b771702de4019f4cf410628384349f8"
+      "sha256": "bd9999361258c5554ffa2791d7c6469beffc5b875e775f5f0c80cea36132eaa4"
     },
     {
       "kind": "schema",
       "name": "change-set.v3.schema.json",
-      "sha256": "c14a5c787c2a269dfee98911fbba40aaa53fa8d5a007d694366ba8b58e20f0b3"
+      "sha256": "24a45eb4d9f29ab4cfe408bedeb0216dc29544fe39b515918d0c0f9742bba9cb"
     },
     {
       "kind": "schema",
       "name": "compensation-change-set.v1.schema.json",
-      "sha256": "24585f9c53bd89119bf7a7ea92a587d37fe7dccbf1517d6736b5ecdeff2b9ebc"
+      "sha256": "6353ddd1a030d0cd25c1663c96794d5420bc1002f46aacdef58c346238a90450"
     },
     {
       "kind": "schema",
@@ -153,7 +153,7 @@
     {
       "kind": "schema",
       "name": "inverse-descriptor.v1.schema.json",
-      "sha256": "ae3aa626896bdc114f5368fee4803994852bb5263a24c234f456e05f1d875fd0"
+      "sha256": "6f310b11946196cf8c829bcf5be39864d5e3bd85181ae2a3a277bfa6fd72a553"
     },
     {
       "kind": "schema",
@@ -163,22 +163,22 @@
     {
       "kind": "schema",
       "name": "writeback-job.v1.schema.json",
-      "sha256": "eab35194dd6b6caa7694aa8f14afbf265338d6ee8ed3d3db5d08ec83c4e7092e"
+      "sha256": "64238559297805e13c04cb8bf71be433e6fb1241594ca021415b1efb95214a01"
     },
     {
       "kind": "schema",
       "name": "writeback-job.v2.schema.json",
-      "sha256": "6f959deedffcb9193b7dffbb0e0beb681bb0b421b6c4460ca14733e3e18acd1f"
+      "sha256": "68110a5ed5b7867522cf86db8d177d2df3f96a458a4343bb77537bdcf304279b"
     },
     {
       "kind": "schema",
       "name": "writeback-job.v3.schema.json",
-      "sha256": "9ee7992ada437f5df9e1f551e0a16a00db0e98ab5dd745f78848b3e4cdb11cfa"
+      "sha256": "3bd46747e737e79bff90dc0496c270bc93d6a913db750ea00486be9a45714831"
     },
     {
       "kind": "schema",
       "name": "writeback-job.v4.schema.json",
-      "sha256": "5031e2476ddaf96042c596e76626d8ce8bce2eb51f7167c92bef44d1676a0487"
+      "sha256": "2c0d23cdf12f6a0d70c5f38fb4fcc5842f2b6c184ee1a195344ae42f58baf4ca"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synapsor/runner",
-  "version": "1.4.121",
+  "version": "1.4.123",
   "description": "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   "license": "Apache-2.0",
   "type": "module",

package/schemas/change-set.v1.schema.json

@@ -70,6 +70,7 @@
       "required": ["tenant", "allowed_columns", "expected_version"],
       "properties": {
         "tenant": { "$ref": "#/$defs/columnValue" },
+        "principal_scope": { "$ref": "#/$defs/principalScope" },
         "allowed_columns": {
           "type": "array",
           "items": { "$ref": "#/$defs/safeIdentifier" },
@@ -136,6 +137,19 @@
         "column": { "$ref": "#/$defs/safeIdentifier" },
         "value": { "$ref": "#/$defs/scalar" }
       }
+    },
+    "principalScope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"],
+      "properties": {
+        "schema_version": { "const": "synapsor.principal-scope.v1" },
+        "column": { "$ref": "#/$defs/safeIdentifier" },
+        "binding": { "$ref": "#/$defs/safeIdentifier" },
+        "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] },
+        "value_fingerprint": { "type": "string", "pattern": "^sha256:.+" },
+        "value": { "$ref": "#/$defs/scalar" }
+      }
     }
   }
 }

package/schemas/change-set.v2.schema.json

@@ -80,6 +80,7 @@
       "required": ["tenant", "allowed_columns"],
       "properties": {
         "tenant": { "$ref": "#/$defs/columnValue" },
+        "principal_scope": { "$ref": "#/$defs/principalScope" },
         "allowed_columns": {
           "type": "array",
           "items": { "$ref": "#/$defs/safeIdentifier" },
@@ -209,6 +210,19 @@
         "value": { "$ref": "#/$defs/scalar" }
       }
     },
+    "principalScope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"],
+      "properties": {
+        "schema_version": { "const": "synapsor.principal-scope.v1" },
+        "column": { "$ref": "#/$defs/safeIdentifier" },
+        "binding": { "$ref": "#/$defs/safeIdentifier" },
+        "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] },
+        "value_fingerprint": { "$ref": "#/$defs/sha256" },
+        "value": { "$ref": "#/$defs/scalar" }
+      }
+    },
     "versionAdvance": {
       "type": "object",
       "additionalProperties": false,

package/schemas/change-set.v3.schema.json

@@ -37,6 +37,7 @@
       "type": "object", "additionalProperties": false, "required": ["tenant", "allowed_columns"],
       "properties": {
         "tenant": { "$ref": "#/$defs/columnValue" },
+        "principal_scope": { "$ref": "#/$defs/principalScope" },
         "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/safeIdentifier" }, "maxItems": 256, "uniqueItems": true },
         "version_advance": { "$ref": "#/$defs/versionAdvance" }
       }
@@ -96,6 +97,7 @@
     "scalarRecord": { "type": "object", "propertyNames": { "$ref": "#/$defs/safeIdentifier" }, "additionalProperties": { "$ref": "#/$defs/scalar" }, "maxProperties": 256 },
     "setOperation": { "enum": ["set_update", "set_delete", "batch_insert"] },
     "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" }, "value": { "$ref": "#/$defs/scalar" } } },
+    "principalScope": { "type": "object", "additionalProperties": false, "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"], "properties": { "schema_version": { "const": "synapsor.principal-scope.v1" }, "column": { "$ref": "#/$defs/safeIdentifier" }, "binding": { "$ref": "#/$defs/safeIdentifier" }, "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] }, "value_fingerprint": { "$ref": "#/$defs/sha256" }, "value": { "$ref": "#/$defs/scalar" } } },
     "versionAdvance": { "type": "object", "additionalProperties": false, "required": ["column", "strategy"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" }, "strategy": { "enum": ["integer_increment", "database_generated"] } } },
     "deduplicationComponent": { "type": "object", "additionalProperties": false, "required": ["column", "value", "source"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" }, "value": { "$ref": "#/$defs/scalar" }, "source": { "enum": ["proposal_id", "trusted_tenant", "fixed"] } } },
     "deduplication": { "type": "object", "additionalProperties": false, "required": ["components"], "properties": { "components": { "type": "array", "items": { "$ref": "#/$defs/deduplicationComponent" }, "minItems": 1, "maxItems": 8 } } },

package/schemas/compensation-change-set.v1.schema.json

@@ -16,7 +16,7 @@
     "source": { "type": "object", "additionalProperties": false, "required": ["kind", "source_id", "schema", "table", "primary_key"], "properties": { "kind": { "enum": ["external_postgres", "external_mysql"] }, "source_id": { "type": "string", "minLength": 1 }, "schema": { "$ref": "#/$defs/identifier" }, "table": { "$ref": "#/$defs/identifier" }, "primary_key": { "type": "object", "additionalProperties": false, "required": ["column"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } } } },
     "before": { "$ref": "#/$defs/record" }, "patch": { "$ref": "#/$defs/record" }, "after": { "$ref": "#/$defs/record" },
     "compensation": { "type": "object", "additionalProperties": false, "required": ["descriptor", "forward_receipt_hash"], "properties": { "descriptor": { "$ref": "inverse-descriptor.v1.schema.json" }, "forward_receipt_hash": { "$ref": "#/$defs/sha256" } } },
-    "guards": { "type": "object", "additionalProperties": false, "required": ["tenant", "allowed_columns"], "properties": { "tenant": { "$ref": "#/$defs/columnValue" }, "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/identifier" }, "maxItems": 256, "uniqueItems": true } } },
+    "guards": { "type": "object", "additionalProperties": false, "required": ["tenant", "allowed_columns"], "properties": { "tenant": { "$ref": "#/$defs/columnValue" }, "principal_scope": { "$ref": "#/$defs/principalScope" }, "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/identifier" }, "maxItems": 256, "uniqueItems": true } } },
     "evidence": { "type": "object", "required": ["bundle_id", "query_fingerprint", "items"], "properties": { "bundle_id": { "type": "string", "minLength": 1 }, "query_fingerprint": { "$ref": "#/$defs/sha256" }, "items": { "type": "array", "maxItems": 100 } } },
     "approval": { "type": "object", "required": ["status", "mode"], "properties": { "status": { "enum": ["pending", "approved", "rejected", "canceled"] }, "mode": { "enum": ["human", "operator"] }, "required_role": { "type": "string", "minLength": 1 }, "required_approvals": { "type": "integer", "minimum": 1, "maximum": 10 } } },
     "writeback": { "type": "object", "additionalProperties": false, "required": ["status", "mode", "executor"], "properties": { "status": { "const": "not_applied" }, "mode": { "const": "trusted_worker_required" }, "executor": { "const": "sql_update" } } },
@@ -27,6 +27,7 @@
   "$defs": {
     "identifier": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" }, "sha256": { "type": "string", "pattern": "^sha256:.+" }, "scalar": { "type": ["string", "number", "boolean", "null"] },
     "record": { "type": "object", "propertyNames": { "$ref": "#/$defs/identifier" }, "additionalProperties": { "$ref": "#/$defs/scalar" }, "maxProperties": 256 },
-    "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } }
+    "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } },
+    "principalScope": { "type": "object", "additionalProperties": false, "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"], "properties": { "schema_version": { "const": "synapsor.principal-scope.v1" }, "column": { "$ref": "#/$defs/identifier" }, "binding": { "$ref": "#/$defs/identifier" }, "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] }, "value_fingerprint": { "$ref": "#/$defs/sha256" }, "value": { "$ref": "#/$defs/scalar" } } }
   }
 }

package/schemas/inverse-descriptor.v1.schema.json

@@ -19,6 +19,7 @@
       "properties": { "source_id": { "type": "string", "minLength": 1 }, "schema": { "$ref": "#/$defs/identifier" }, "table": { "$ref": "#/$defs/identifier" }, "primary_key_column": { "$ref": "#/$defs/identifier" } }
     },
     "tenant_guard": { "$ref": "#/$defs/columnValue" },
+    "principal_scope": { "$ref": "#/$defs/principalScope" },
     "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/identifier" }, "maxItems": 256, "uniqueItems": true },
     "members": { "type": "array", "minItems": 1, "maxItems": 100, "items": { "$ref": "#/$defs/member" } },
     "max_rows": { "type": "integer", "minimum": 1, "maximum": 100 },
@@ -38,6 +39,7 @@
     "scalar": { "type": ["string", "number", "boolean", "null"] },
     "record": { "type": "object", "propertyNames": { "$ref": "#/$defs/identifier" }, "additionalProperties": { "$ref": "#/$defs/scalar" }, "maxProperties": 256 },
     "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } },
+    "principalScope": { "type": "object", "additionalProperties": false, "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"], "properties": { "schema_version": { "const": "synapsor.principal-scope.v1" }, "column": { "$ref": "#/$defs/identifier" }, "binding": { "$ref": "#/$defs/identifier" }, "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] }, "value_fingerprint": { "type": "string", "pattern": "^sha256:.+" }, "value": { "$ref": "#/$defs/scalar" } } },
     "member": { "type": "object", "additionalProperties": false, "required": ["primary_key", "expected_state"], "properties": { "primary_key": { "$ref": "#/$defs/columnValue" }, "expected_state": { "$ref": "#/$defs/record" }, "restore_values": { "$ref": "#/$defs/record" } } },
     "versionAdvance": { "type": "object", "additionalProperties": false, "required": ["column", "strategy"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "strategy": { "enum": ["integer_increment", "database_generated"] } } },
     "aggregateBound": { "type": "object", "additionalProperties": false, "required": ["column", "measure", "maximum", "actual"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "measure": { "enum": ["before", "after", "absolute_delta"] }, "maximum": { "type": "number", "minimum": 0 }, "actual": { "type": "number", "minimum": 0 } } },

package/schemas/synapsor.contract-tests.schema.json

@@ -19,7 +19,7 @@
         "properties": {
           "id": { "type": "string", "minLength": 1 },
           "kind": {
-            "enum": ["tool_allow", "tool_deny", "hide_fields", "argument_constraint", "transition_guard", "set_cap", "source_unchanged_before_approval", "operator_boundary"]
+            "enum": ["tool_allow", "tool_deny", "cross_principal_deny", "hide_fields", "argument_constraint", "transition_guard", "set_cap", "source_unchanged_before_approval", "operator_boundary"]
           },
           "capability": { "type": "string", "minLength": 1 },
           "args": { "type": "object" },
@@ -33,6 +33,16 @@
               "provenance": { "enum": ["environment", "static_dev", "http_claims", "cloud_session"] }
             }
           },
+          "other_trusted_context": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["tenant_id", "principal"],
+            "properties": {
+              "tenant_id": { "type": "string", "minLength": 1 },
+              "principal": { "type": "string", "minLength": 1 },
+              "provenance": { "enum": ["environment", "static_dev", "http_claims", "cloud_session"] }
+            }
+          },
           "expected_code": { "type": "string", "minLength": 1 },
           "fields": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
           "argument": { "type": "string", "minLength": 1 },

package/schemas/writeback-job.v1.schema.json

@@ -49,6 +49,7 @@
       }
     },
     "tenant_guard": { "$ref": "#/$defs/columnValue" },
+    "principal_scope": { "$ref": "#/$defs/principalScope" },
     "allowed_columns": {
       "type": "array",
       "items": { "$ref": "#/$defs/safeIdentifier" },
@@ -116,6 +117,19 @@
         "column": { "$ref": "#/$defs/safeIdentifier" },
         "value": { "$ref": "#/$defs/scalar" }
       }
+    },
+    "principalScope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"],
+      "properties": {
+        "schema_version": { "const": "synapsor.principal-scope.v1" },
+        "column": { "$ref": "#/$defs/safeIdentifier" },
+        "binding": { "$ref": "#/$defs/safeIdentifier" },
+        "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] },
+        "value_fingerprint": { "type": "string", "pattern": "^sha256:.+" },
+        "value": { "$ref": "#/$defs/scalar" }
+      }
     }
   }
 }

package/schemas/writeback-job.v2.schema.json

@@ -54,6 +54,7 @@
       }
     },
     "tenant_guard": { "$ref": "#/$defs/columnValue" },
+    "principal_scope": { "$ref": "#/$defs/principalScope" },
     "allowed_columns": {
       "type": "array",
       "items": { "$ref": "#/$defs/safeIdentifier" },
@@ -173,6 +174,19 @@
         "value": { "$ref": "#/$defs/scalar" }
       }
     },
+    "principalScope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"],
+      "properties": {
+        "schema_version": { "const": "synapsor.principal-scope.v1" },
+        "column": { "$ref": "#/$defs/safeIdentifier" },
+        "binding": { "$ref": "#/$defs/safeIdentifier" },
+        "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] },
+        "value_fingerprint": { "$ref": "#/$defs/sha256" },
+        "value": { "$ref": "#/$defs/scalar" }
+      }
+    },
     "conflictGuard": {
       "oneOf": [
         {

package/schemas/writeback-job.v3.schema.json

@@ -16,6 +16,7 @@
     "operation": { "enum": ["set_update", "set_delete", "batch_insert"] },
     "target": { "type": "object", "additionalProperties": false, "required": ["schema", "table", "primary_key"], "properties": { "schema": { "$ref": "#/$defs/safeIdentifier" }, "table": { "$ref": "#/$defs/safeIdentifier" }, "primary_key": { "type": "object", "additionalProperties": false, "required": ["column"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" } } } } },
     "tenant_guard": { "$ref": "#/$defs/columnValue" },
+    "principal_scope": { "$ref": "#/$defs/principalScope" },
     "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/safeIdentifier" }, "maxItems": 256, "uniqueItems": true },
     "patch": { "$ref": "#/$defs/scalarRecord" },
     "version_advance": { "$ref": "#/$defs/versionAdvance" },
@@ -43,6 +44,7 @@
     "scalar": { "type": ["string", "number", "boolean", "null"] },
     "scalarRecord": { "type": "object", "propertyNames": { "$ref": "#/$defs/safeIdentifier" }, "additionalProperties": { "$ref": "#/$defs/scalar" }, "maxProperties": 256 },
     "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" }, "value": { "$ref": "#/$defs/scalar" } } },
+    "principalScope": { "type": "object", "additionalProperties": false, "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"], "properties": { "schema_version": { "const": "synapsor.principal-scope.v1" }, "column": { "$ref": "#/$defs/safeIdentifier" }, "binding": { "$ref": "#/$defs/safeIdentifier" }, "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] }, "value_fingerprint": { "$ref": "#/$defs/sha256" }, "value": { "$ref": "#/$defs/scalar" } } },
     "versionAdvance": { "type": "object", "additionalProperties": false, "required": ["column", "strategy"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" }, "strategy": { "enum": ["integer_increment", "database_generated"] } } },
     "deduplicationComponent": { "type": "object", "additionalProperties": false, "required": ["column", "value", "source"], "properties": { "column": { "$ref": "#/$defs/safeIdentifier" }, "value": { "$ref": "#/$defs/scalar" }, "source": { "enum": ["proposal_id", "trusted_tenant", "fixed"] } } },
     "deduplication": { "type": "object", "additionalProperties": false, "required": ["components"], "properties": { "components": { "type": "array", "items": { "$ref": "#/$defs/deduplicationComponent" }, "minItems": 1, "maxItems": 8 } } },

package/schemas/writeback-job.v4.schema.json

@@ -9,9 +9,9 @@
     "runner_scope": { "type": "object", "additionalProperties": false, "required": ["project_id", "source_id"], "properties": { "project_id": { "type": "string", "minLength": 1 }, "source_id": { "type": "string", "minLength": 1 } } },
     "engine": { "enum": ["postgres", "mysql"] }, "operation": { "enum": ["restore_update", "remove_insert", "restore_insert"] },
     "target": { "type": "object", "additionalProperties": false, "required": ["schema", "table", "primary_key"], "properties": { "schema": { "$ref": "#/$defs/identifier" }, "table": { "$ref": "#/$defs/identifier" }, "primary_key": { "type": "object", "additionalProperties": false, "required": ["column"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } } } },
-    "tenant_guard": { "$ref": "#/$defs/columnValue" }, "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/identifier" }, "maxItems": 256, "uniqueItems": true }, "patch": { "type": "object", "maxProperties": 0 },
+    "tenant_guard": { "$ref": "#/$defs/columnValue" }, "principal_scope": { "$ref": "#/$defs/principalScope" }, "allowed_columns": { "type": "array", "items": { "$ref": "#/$defs/identifier" }, "maxItems": 256, "uniqueItems": true }, "patch": { "type": "object", "maxProperties": 0 },
     "compensation": { "$ref": "inverse-descriptor.v1.schema.json" }, "forward_receipt_hash": { "$ref": "#/$defs/sha256" }, "idempotency_key": { "type": "string", "minLength": 1 },
     "lease": { "type": "object", "additionalProperties": false, "required": ["lease_id", "attempt", "expires_at"], "properties": { "lease_id": { "type": "string", "minLength": 1 }, "attempt": { "type": "integer", "minimum": 1 }, "expires_at": { "type": "string", "format": "date-time" } } }
   },
-  "$defs": { "identifier": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" }, "sha256": { "type": "string", "pattern": "^sha256:.+" }, "scalar": { "type": ["string", "number", "boolean", "null"] }, "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } } }
+  "$defs": { "identifier": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" }, "sha256": { "type": "string", "pattern": "^sha256:.+" }, "scalar": { "type": ["string", "number", "boolean", "null"] }, "columnValue": { "type": "object", "additionalProperties": false, "required": ["column", "value"], "properties": { "column": { "$ref": "#/$defs/identifier" }, "value": { "$ref": "#/$defs/scalar" } } }, "principalScope": { "type": "object", "additionalProperties": false, "required": ["schema_version", "column", "binding", "provider", "value_fingerprint"], "properties": { "schema_version": { "const": "synapsor.principal-scope.v1" }, "column": { "$ref": "#/$defs/identifier" }, "binding": { "$ref": "#/$defs/identifier" }, "provider": { "enum": ["environment", "http_claims", "cloud_session", "static_dev"] }, "value_fingerprint": { "$ref": "#/$defs/sha256" }, "value": { "$ref": "#/$defs/scalar" } } } }
 }