@synapsor/runner 1.4.123 → 1.5.0

package/docs/shadow-studies.md

@@ -0,0 +1,198 @@
+# Shadow Studies
+
+Use a shadow study before granting an agent write authority. Runner serves the
+reviewed proposal capability and records what the agent would have proposed,
+but the proposal cannot be approved, queued, or applied.
+
+A study compares two explicit records:
+
+```text
+agent result or proposed effect
+versus
+authoritative outcome recorded by your application or operator
+```
+
+Runner does not infer a human rejection from an unchanged database row. A case
+without an authoritative outcome remains visibly unmatched.
+
+## Safety Boundary
+
+Set the Runner configuration to:
+
+```json
+{
+  "version": 1,
+  "mode": "shadow"
+}
+```
+
+The proposal store enforces the shadow boundary below the CLI and local UI:
+
+- a shadow proposal cannot be approved;
+- it cannot become a writeback job or worker item;
+- it cannot invoke direct database writeback or an app-owned handler;
+- no flag bypasses these checks;
+- a report suggestion is inactive and never edits or activates a contract.
+
+Shadow data remains in the configured local Runner store. Case and outcome
+imports reject obvious credentials, bearer tokens, database URLs, and
+secret-like fields.
+
+## Start A Study
+
+Create a study before serving the shadow capability. An empty capability list
+means all shadow capabilities; repeat `--capability` or use comma-separated
+names to narrow it.
+
+```bash
+synapsor-runner shadow study create \
+  --id sst_support_pilot \
+  --name "Support waiver pilot" \
+  --capability billing.propose_late_fee_waiver \
+  --store ./.synapsor/local.db
+
+synapsor-runner mcp serve \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db
+```
+
+New matching shadow proposals are attached automatically. To attach proposals
+that already exist, or to repair correlation after an interrupted process:
+
+```bash
+synapsor-runner shadow study sync sst_support_pilot \
+  --store ./.synapsor/local.db
+```
+
+## Record Non-Proposal Results
+
+A study also needs tasks where the agent was unable or not allowed to propose.
+Import one JSON object with `case record`, or a JSON array/JSONL file with
+`case import`.
+
+```json
+{
+  "request_id": "req-policy-42",
+  "tenant_id": "acme",
+  "principal": "support-agent-shadow",
+  "capability": "billing.propose_late_fee_waiver",
+  "business_object": "invoice",
+  "object_id": "INV-3042",
+  "agent_result": "policy_denied",
+  "decision_reason": "amount above reviewed bound",
+  "risk_score": 35
+}
+```
+
+Allowed `agent_result` values are:
+
+- `proposed`
+- `policy_denied`
+- `unable_to_propose`
+- `stale_conflict`
+- `invalid_unsafe_scope_attempt`
+
+For `proposed`, include normalized `before`, `after`, and `patch` objects under
+`proposed_effect`.
+
+```bash
+synapsor-runner shadow case import \
+  --study sst_support_pilot \
+  --input ./cases.jsonl \
+  --store ./.synapsor/local.db
+```
+
+Imports are limited to 2 MiB and 10,000 records per command.
+
+## Record Authoritative Outcomes
+
+Export actual outcomes from your application audit log or have a trusted
+operator create them. Each outcome must match an existing case by study,
+request, trusted tenant, business object, and object ID. A supplied proposal ID
+must match too.
+
+```json
+{
+  "request_id": "request_123",
+  "proposal_id": "wrp_123",
+  "tenant_id": "acme",
+  "business_object": "invoice",
+  "object_id": "INV-3001",
+  "actor": "support_lead_1",
+  "disposition": "applied",
+  "actual_effect": {
+    "before": { "late_fee_cents": 5500 },
+    "after": { "late_fee_cents": 0 },
+    "patch": { "late_fee_cents": 0 }
+  },
+  "occurred_at": "2026-07-19T12:00:00.000Z",
+  "source": "support-system-audit",
+  "reference": "ticket:SUP-184",
+  "reason": "customer qualified"
+}
+```
+
+Allowed dispositions are `applied`, `rejected_no_action`, and
+`stale_conflict`. An applied outcome requires an exact normalized effect.
+
+```bash
+synapsor-runner shadow outcome import \
+  --study sst_support_pilot \
+  --input ./outcomes.jsonl \
+  --store ./.synapsor/local.db
+```
+
+## Review The Report
+
+```bash
+synapsor-runner shadow report \
+  --study sst_support_pilot \
+  --output ./shadow-report.json \
+  --store ./.synapsor/local.db
+
+synapsor-runner ui \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db
+```
+
+The stable JSON report preserves total and comparable denominators and
+classifies exact, partial, disagreement, human rejection/no action, policy
+denial, unable-to-propose, stale/conflict, unmatched, and unsafe-scope cases.
+It also includes amount distributions, capability/reason breakdowns, and
+risk-ranked disagreements.
+
+Close a completed study:
+
+```bash
+synapsor-runner shadow study close sst_support_pilot \
+  --store ./.synapsor/local.db
+```
+
+## Deterministic Reference Data
+
+The packaged `examples/support-billing-agent/shadow-study/` directory contains
+six synthetic cases and two authoritative outcomes. It covers an exact $55
+waiver, human rejection, policy denial, stale state, tenant forgery, and an
+unmatched task.
+
+```bash
+synapsor-runner shadow study create \
+  --id sst_support_reference \
+  --name "Support reference study" \
+  --capability billing.propose_late_fee_waiver \
+  --store ./.synapsor/shadow-reference.db
+
+synapsor-runner shadow case import \
+  --study sst_support_reference \
+  --input ./examples/support-billing-agent/shadow-study/cases.jsonl \
+  --store ./.synapsor/shadow-reference.db
+
+synapsor-runner shadow outcome import \
+  --study sst_support_reference \
+  --input ./examples/support-billing-agent/shadow-study/outcomes.jsonl \
+  --store ./.synapsor/shadow-reference.db
+
+synapsor-runner shadow report \
+  --study sst_support_reference \
+  --store ./.synapsor/shadow-reference.db
+```

package/examples/mcp-postgres-billing-app-handler/app-handler.mjs

@@ -119,5 +119,13 @@ function writeJson(response, statusCode, body) {
 }
 
 async function loadHandlerHelper() {
-  return await import(new URL("./synapsor-handler.mjs", import.meta.url));
+  const bundledHelper = new URL("./synapsor-handler.mjs", import.meta.url);
+  try {
+    return await import(bundledHelper);
+  } catch (error) {
+    if (error?.code !== "ERR_MODULE_NOT_FOUND" || error?.url !== bundledHelper.href) {
+      throw error;
+    }
+    return await import(new URL("../../packages/handler/dist/index.js", import.meta.url));
+  }
 }

package/examples/mcp-postgres-billing-app-handler/schema.sql

@@ -50,6 +50,16 @@ CREATE TABLE IF NOT EXISTS public.synapsor_writeback_receipts (
   completed_at timestamptz
 );
 
+CREATE TABLE IF NOT EXISTS public.synapsor_handler_receipts (
+  idempotency_key text PRIMARY KEY,
+  proposal_id text NOT NULL,
+  action text NOT NULL,
+  status text NOT NULL,
+  receipt_json jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz
+);
+
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'synapsor_reader') THEN
@@ -65,5 +75,6 @@ GRANT CONNECT ON DATABASE synapsor_billing_app_handler TO synapsor_reader, synap
 GRANT USAGE ON SCHEMA public TO synapsor_reader, synapsor_writer;
 GRANT SELECT ON public.tenants, public.customers, public.invoices, public.account_credits TO synapsor_reader, synapsor_writer;
 GRANT SELECT, INSERT, UPDATE ON public.synapsor_writeback_receipts TO synapsor_writer;
+GRANT SELECT, INSERT, UPDATE ON public.synapsor_handler_receipts TO synapsor_writer;
 GRANT UPDATE (late_fee_cents, waiver_reason, credit_requested_cents, credit_reason, credited_cents, updated_at) ON public.invoices TO synapsor_writer;
 GRANT INSERT ON public.account_credits TO synapsor_writer;

package/examples/mcp-postgres-billing-app-handler/synapsor-handler.mjs

@@ -168,6 +168,9 @@ class PostgresWritebackHandlerTransaction {
         this.receiptTable = receiptTable;
     }
     async ensureReceiptTable() {
+        const existing = await this.client.query("SELECT to_regclass($1) AS receipt_table", [this.receiptTableName()]);
+        if (existing.rows[0]?.receipt_table)
+            return;
         await this.client.query(`
       CREATE TABLE IF NOT EXISTS ${this.receiptTableName()} (
         idempotency_key text PRIMARY KEY,

package/examples/raw-sql-vs-synapsor/Makefile

@@ -4,8 +4,8 @@ demo:
 	@printf '%s\n' "Unsafe shortcut:"
 	@printf '%s\n' '  agent -> execute_sql("UPDATE invoices SET late_fee_cents = 0 ...")'
 	@printf '%s\n' ""
-	@printf '%s\n' "Synapsor quick proof:"
-	npx -y @synapsor/runner demo --quick --no-interactive
+	@printf '%s\n' "Synapsor guarded-action proof:"
+	npx -y @synapsor/runner try --prove --yes --no-open
 	@printf '%s\n' ""
 	@printf '%s\n' "Risk audit example:"
 	npx -y @synapsor/runner audit --example dangerous-db-mcp --format markdown

package/examples/raw-sql-vs-synapsor/README.md

@@ -13,10 +13,12 @@ Expected output includes:
 
 ```text
 execute_sql
-Synapsor quick demo complete.
-proposal created
-source DB changed: no
-approval required outside MCP
+late_fee_cents: 5500 -> 0
+Source changed:
+  No
+Guarded commit complete.
+restart-safe retry: yes
+stale apply refused: yes
 ```
 
 The raw-SQL shortcut is:

package/examples/support-billing-agent/Makefile

@@ -1,7 +1,11 @@
-.PHONY: demo unsafe clean
+.PHONY: demo unsafe evaluate clean
 
 demo:
 	cd ../.. && examples/support-billing-agent/scripts/run-demo.sh
+	cd ../.. && examples/support-billing-agent/scripts/run-evaluation.sh
+
+evaluate:
+	cd ../.. && examples/support-billing-agent/scripts/run-evaluation.sh
 
 unsafe:
 	@printf '%s\n' "Unsafe raw-SQL shortcut this demo avoids:"

package/examples/support-billing-agent/README.md

@@ -1,16 +1,20 @@
 # Support/Billing Agent Demo
 
-This is the flagship Synapsor Runner demo.
+This is the flagship Synapsor Runner demo. It uses a disposable PostgreSQL
+database with row-level security (RLS) so the database independently checks the
+same trusted tenant and principal scope as Runner.
 
 It uses a disposable Postgres support/billing app and shows the full loop:
 
 ```text
-agent inspects scoped evidence
+agent inspects ticket SUP-184 and invoice INV-3001
 -> agent creates a proposal
+-> reviewer sees the exact $55 late-fee waiver
 -> source database is unchanged
 -> human approves outside MCP
 -> guarded writeback applies exactly one row
 -> replay shows evidence, diff, approval, receipt, and conflict behavior
+-> strict shadow and effect checks compare behavior without enabling writes
 ```
 
 ## Run It
@@ -25,6 +29,8 @@ Expected end state:
 
 ```text
 Reference support/billing app smoke passed.
+Shadow comparison passed: 6 cases, 2 human outcomes, 1 exact agreement, 1 human rejection.
+Effect regression passed: the reviewed $55 waiver effect is unchanged.
 ```
 
 The model-facing tools are exactly:
@@ -41,10 +47,27 @@ The demo proves:
 - the model does not receive `execute_sql`, approval tools, commit/apply tools,
   database URLs, write credentials, arbitrary table names, arbitrary column
   names, or tenant authority;
+- the contract-visible result excludes `card_token`, `internal_risk_note`, and
+  their seeded secret-looking values;
+- trusted tenant and principal values are bound outside model arguments, and
+  PostgreSQL RLS denies both cross-tenant and same-tenant cross-principal rows;
+- `doctor --check-rls` verifies the live database policies before the demo;
 - proposals do not mutate the source database;
 - approved writeback uses tenant, primary-key, allowed-column,
   idempotency, and `updated_at` conflict guards;
-- replay contains the evidence and writeback receipt.
+- an identical retry returns the prior receipt without another mutation;
+- stale data fails closed with `VERSION_CONFLICT`;
+- replay contains the evidence, query audit, approval, writeback event, and
+  receipt;
+- strict Shadow Mode records a proposal but cannot approve or mutate it; and
+- the shadow report compares cases with authoritative human outcomes before the
+  effect fixture checks the expected business change.
+
+RLS is defense in depth, not a claim that a fully compromised Runner process is
+contained. A process that can choose arbitrary trusted context or replace the
+database credential remains outside this guarantee. Production deployments
+must authenticate context upstream, keep the database roles least-privileged,
+and protect Runner's environment.
 
 ## Compare The Unsafe Shortcut
 
@@ -61,8 +84,13 @@ fixture; it shows the path an MCP client should not expose to the model:
 execute_sql("UPDATE invoices SET late_fee_cents = 0 ...")
 ```
 
-Use `make demo` for the real proposal, approval, writeback, idempotent retry,
-stale-row conflict, and replay proof.
+Use `make demo` for the live RLS, proposal, approval, writeback, idempotent
+retry, stale-row conflict, replay, strict-shadow, human-outcome, and effect
+proofs. Run only the deterministic comparison pass with:
+
+```bash
+make evaluate
+```
 
 ## What This Wraps
 
@@ -77,7 +105,13 @@ Relevant files:
 - `db/seed.sql`
 - `synapsor.runner.json`
 - `scripts/run-demo.sh`
+- `scripts/run-evaluation.sh`
 - `app/README.md`
+- `shadow-study/cases.jsonl` and `shadow-study/outcomes.jsonl`: deterministic
+  true-shadow reference data for agent-versus-authoritative-outcome reports.
+
+See [Shadow Studies](../../docs/shadow-studies.md) for the import and report
+commands. The reference cases do not mutate this demo database.
 
 ## Stop And Clean Up
 

package/examples/support-billing-agent/db/schema.sql

@@ -8,6 +8,7 @@ CREATE TABLE IF NOT EXISTS public.tenants (
 CREATE TABLE IF NOT EXISTS public.customers (
   id text PRIMARY KEY,
   tenant_id text NOT NULL REFERENCES public.tenants(id),
+  assigned_to text NOT NULL,
   name text NOT NULL,
   email text,
   plan text NOT NULL,
@@ -20,6 +21,7 @@ CREATE TABLE IF NOT EXISTS public.customers (
 CREATE TABLE IF NOT EXISTS public.support_tickets (
   id text PRIMARY KEY,
   tenant_id text NOT NULL REFERENCES public.tenants(id),
+  assigned_to text NOT NULL,
   customer_id text NOT NULL REFERENCES public.customers(id),
   subject text NOT NULL,
   status text NOT NULL,
@@ -30,11 +32,14 @@ CREATE TABLE IF NOT EXISTS public.support_tickets (
 CREATE TABLE IF NOT EXISTS public.invoices (
   id text PRIMARY KEY,
   tenant_id text NOT NULL REFERENCES public.tenants(id),
+  assigned_to text NOT NULL,
   customer_id text NOT NULL REFERENCES public.customers(id),
   status text NOT NULL,
   balance_cents integer NOT NULL,
   late_fee_cents integer NOT NULL,
   waiver_reason text,
+  card_token text,
+  internal_risk_note text,
   updated_at timestamptz NOT NULL DEFAULT now()
 );
 
@@ -93,9 +98,91 @@ $$;
 
 GRANT CONNECT ON DATABASE synapsor_support_billing_agent TO synapsor_reader, synapsor_writer;
 GRANT USAGE ON SCHEMA public TO synapsor_reader, synapsor_writer;
-GRANT SELECT ON public.tenants, public.customers, public.support_tickets, public.invoices, public.credits, public.agent_actions, public.orders TO synapsor_reader, synapsor_writer;
+GRANT SELECT ON public.tenants, public.credits, public.agent_actions, public.orders TO synapsor_reader, synapsor_writer;
+GRANT SELECT (id, tenant_id, assigned_to, name, plan, plan_credit_cents, credit_reason, created_at, updated_at)
+  ON public.customers TO synapsor_reader, synapsor_writer;
+GRANT SELECT (id, tenant_id, assigned_to, customer_id, subject, status, resolution_note, updated_at)
+  ON public.support_tickets TO synapsor_reader, synapsor_writer;
+GRANT SELECT (id, tenant_id, assigned_to, customer_id, status, balance_cents, late_fee_cents, waiver_reason, updated_at)
+  ON public.invoices TO synapsor_reader, synapsor_writer;
 GRANT SELECT, INSERT, UPDATE ON public.synapsor_writeback_receipts TO synapsor_writer;
 GRANT UPDATE (plan_credit_cents, credit_reason, updated_at) ON public.customers TO synapsor_writer;
 GRANT UPDATE (status, resolution_note, updated_at) ON public.support_tickets TO synapsor_writer;
 GRANT UPDATE (late_fee_cents, waiver_reason, updated_at) ON public.invoices TO synapsor_writer;
 GRANT UPDATE (status, status_change_reason, updated_at) ON public.orders TO synapsor_writer;
+
+ALTER TABLE public.customers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.customers FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.support_tickets ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.support_tickets FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.invoices ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.invoices FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY customers_reader_scope ON public.customers
+  FOR SELECT TO synapsor_reader
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+CREATE POLICY customers_writer_select_scope ON public.customers
+  FOR SELECT TO synapsor_writer
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+CREATE POLICY customers_writer_update_scope ON public.customers
+  FOR UPDATE TO synapsor_writer
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  )
+  WITH CHECK (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+
+CREATE POLICY support_tickets_reader_scope ON public.support_tickets
+  FOR SELECT TO synapsor_reader
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+CREATE POLICY support_tickets_writer_select_scope ON public.support_tickets
+  FOR SELECT TO synapsor_writer
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+CREATE POLICY support_tickets_writer_update_scope ON public.support_tickets
+  FOR UPDATE TO synapsor_writer
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  )
+  WITH CHECK (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+
+CREATE POLICY invoices_reader_scope ON public.invoices
+  FOR SELECT TO synapsor_reader
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+CREATE POLICY invoices_writer_select_scope ON public.invoices
+  FOR SELECT TO synapsor_writer
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );
+CREATE POLICY invoices_writer_update_scope ON public.invoices
+  FOR UPDATE TO synapsor_writer
+  USING (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  )
+  WITH CHECK (
+    tenant_id = current_setting('synapsor.tenant_id', true)
+    AND assigned_to = current_setting('synapsor.principal', true)
+  );

package/examples/support-billing-agent/db/seed.sql

@@ -4,26 +4,26 @@ VALUES
   ('otherco', 'OtherCo Labs', '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z')
 ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, updated_at = EXCLUDED.updated_at;
 
-INSERT INTO public.customers (id, tenant_id, name, email, plan, plan_credit_cents, credit_reason, created_at, updated_at)
+INSERT INTO public.customers (id, tenant_id, assigned_to, name, email, plan, plan_credit_cents, credit_reason, created_at, updated_at)
 VALUES
-  ('cust_acme_1', 'acme', 'Acme Robotics', 'ops@example.invalid', 'enterprise', 0, NULL, '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z'),
-  ('cust_acme_2', 'acme', 'Acme Field Ops', 'field@example.invalid', 'builder', 0, NULL, '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z'),
-  ('cust_other_1', 'otherco', 'OtherCo Labs', 'ops@otherco.invalid', 'builder', 0, NULL, '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z')
-ON CONFLICT (id) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, name = EXCLUDED.name, email = EXCLUDED.email, plan = EXCLUDED.plan, plan_credit_cents = EXCLUDED.plan_credit_cents, credit_reason = EXCLUDED.credit_reason, updated_at = EXCLUDED.updated_at;
+  ('cust_acme_1', 'acme', 'reference_operator', 'Acme Robotics', 'ops@example.invalid', 'enterprise', 0, NULL, '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z'),
+  ('cust_acme_2', 'acme', 'another_operator', 'Acme Field Ops', 'field@example.invalid', 'builder', 0, NULL, '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z'),
+  ('cust_other_1', 'otherco', 'reference_operator', 'OtherCo Labs', 'ops@otherco.invalid', 'builder', 0, NULL, '2026-06-20T10:00:00Z', '2026-06-20T10:00:00Z')
+ON CONFLICT (id) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, assigned_to = EXCLUDED.assigned_to, name = EXCLUDED.name, email = EXCLUDED.email, plan = EXCLUDED.plan, plan_credit_cents = EXCLUDED.plan_credit_cents, credit_reason = EXCLUDED.credit_reason, updated_at = EXCLUDED.updated_at;
 
-INSERT INTO public.support_tickets (id, tenant_id, customer_id, subject, status, resolution_note, updated_at)
+INSERT INTO public.support_tickets (id, tenant_id, assigned_to, customer_id, subject, status, resolution_note, updated_at)
 VALUES
-  ('T-1042', 'acme', 'cust_acme_1', 'Late fee waiver request for INV-3001', 'open', NULL, '2026-06-20T12:00:00Z'),
-  ('T-1043', 'acme', 'cust_acme_2', 'Duplicate card charge question', 'open', NULL, '2026-06-20T12:05:00Z'),
-  ('T-9001', 'otherco', 'cust_other_1', 'OtherCo private billing ticket', 'open', NULL, '2026-06-20T12:00:00Z')
-ON CONFLICT (id) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, customer_id = EXCLUDED.customer_id, subject = EXCLUDED.subject, status = EXCLUDED.status, resolution_note = EXCLUDED.resolution_note, updated_at = EXCLUDED.updated_at;
+  ('SUP-184', 'acme', 'reference_operator', 'cust_acme_1', 'Late fee waiver request for INV-3001', 'open', NULL, '2026-06-20T12:00:00Z'),
+  ('SUP-185', 'acme', 'another_operator', 'cust_acme_2', 'Duplicate card charge question', 'open', NULL, '2026-06-20T12:05:00Z'),
+  ('SUP-9001', 'otherco', 'reference_operator', 'cust_other_1', 'OtherCo private billing ticket', 'open', NULL, '2026-06-20T12:00:00Z')
+ON CONFLICT (id) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, assigned_to = EXCLUDED.assigned_to, customer_id = EXCLUDED.customer_id, subject = EXCLUDED.subject, status = EXCLUDED.status, resolution_note = EXCLUDED.resolution_note, updated_at = EXCLUDED.updated_at;
 
-INSERT INTO public.invoices (id, tenant_id, customer_id, status, balance_cents, late_fee_cents, waiver_reason, updated_at)
+INSERT INTO public.invoices (id, tenant_id, assigned_to, customer_id, status, balance_cents, late_fee_cents, waiver_reason, card_token, internal_risk_note, updated_at)
 VALUES
-  ('INV-3001', 'acme', 'cust_acme_1', 'overdue', 25500, 5500, NULL, '2026-06-20T14:31:08Z'),
-  ('INV-3002', 'acme', 'cust_acme_2', 'paid', 0, 0, NULL, '2026-06-20T14:40:00Z'),
-  ('INV-9001', 'otherco', 'cust_other_1', 'overdue', 25500, 5500, NULL, '2026-06-20T14:31:08Z')
-ON CONFLICT (id) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, customer_id = EXCLUDED.customer_id, status = EXCLUDED.status, balance_cents = EXCLUDED.balance_cents, late_fee_cents = EXCLUDED.late_fee_cents, waiver_reason = EXCLUDED.waiver_reason, updated_at = EXCLUDED.updated_at;
+  ('INV-3001', 'acme', 'reference_operator', 'cust_acme_1', 'overdue', 25500, 5500, NULL, 'tok_acme_must_stay_hidden', 'manual risk note must stay hidden', '2026-06-20T14:31:08Z'),
+  ('INV-3002', 'acme', 'another_operator', 'cust_acme_2', 'paid', 0, 0, NULL, 'tok_acme_other_principal', 'another principal note', '2026-06-20T14:40:00Z'),
+  ('INV-9001', 'otherco', 'reference_operator', 'cust_other_1', 'overdue', 25500, 5500, NULL, 'tok_other_tenant', 'other tenant note', '2026-06-20T14:31:08Z')
+ON CONFLICT (id) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, assigned_to = EXCLUDED.assigned_to, customer_id = EXCLUDED.customer_id, status = EXCLUDED.status, balance_cents = EXCLUDED.balance_cents, late_fee_cents = EXCLUDED.late_fee_cents, waiver_reason = EXCLUDED.waiver_reason, card_token = EXCLUDED.card_token, internal_risk_note = EXCLUDED.internal_risk_note, updated_at = EXCLUDED.updated_at;
 
 INSERT INTO public.credits (id, tenant_id, customer_id, invoice_id, amount_cents, reason, status, created_at, updated_at)
 VALUES

package/examples/support-billing-agent/scripts/run-demo.sh

@@ -12,4 +12,8 @@ SYNAPSOR_REFERENCE_DB="synapsor_support_billing_agent" \
 SYNAPSOR_REFERENCE_PORT="55436" \
 SYNAPSOR_REFERENCE_EXPECTED_TOOLS="support.inspect_ticket,support.propose_plan_credit,billing.inspect_invoice,billing.propose_late_fee_waiver" \
 SYNAPSOR_REFERENCE_EXACT_TOOLS="1" \
+SYNAPSOR_REFERENCE_TICKET_ID="SUP-184" \
+SYNAPSOR_REFERENCE_REQUIRE_PRINCIPAL_SCOPE="1" \
+SYNAPSOR_REFERENCE_REQUIRE_RLS="1" \
+SYNAPSOR_REFERENCE_SHADOW_PROOF="1" \
 node scripts/smoke-reference-support-billing-app.mjs

package/examples/support-billing-agent/scripts/run-evaluation.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+cd "$ROOT_DIR"
+
+OUTPUT_DIR="$ROOT_DIR/tmp/support-billing-agent/evaluation"
+STORE_PATH="$OUTPUT_DIR/shadow.db"
+REPORT_PATH="$OUTPUT_DIR/shadow-report.json"
+EFFECT_PATH="$OUTPUT_DIR/effect-report.json"
+
+rm -rf "$OUTPUT_DIR"
+mkdir -p "$OUTPUT_DIR"
+
+corepack pnpm runner shadow study create \
+  --id sst_support_reference \
+  --name "Support reference study" \
+  --capability billing.propose_late_fee_waiver \
+  --store "$STORE_PATH" >/dev/null
+
+corepack pnpm runner shadow case import \
+  --study sst_support_reference \
+  --input "$ROOT_DIR/examples/support-billing-agent/shadow-study/cases.jsonl" \
+  --store "$STORE_PATH" >/dev/null
+
+corepack pnpm runner shadow outcome import \
+  --study sst_support_reference \
+  --input "$ROOT_DIR/examples/support-billing-agent/shadow-study/outcomes.jsonl" \
+  --store "$STORE_PATH" >/dev/null
+
+corepack pnpm runner shadow report \
+  --study sst_support_reference \
+  --store "$STORE_PATH" \
+  --output "$REPORT_PATH" >/dev/null
+
+node --input-type=module - "$REPORT_PATH" <<'NODE'
+import fs from "node:fs";
+const report = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const expected = {
+  total_tasks_observed: 6,
+  tasks_with_authoritative_outcomes: 2,
+  comparable_tasks: 1,
+  exact_agreements: 1,
+  human_rejections_no_action: 1,
+  policy_denials: 1,
+  stale_conflicts: 1,
+  unmatched_cases: 1,
+  invalid_or_unsafe_scope_attempts: 1,
+};
+for (const [key, value] of Object.entries(expected)) {
+  if (report[key] !== value) throw new Error(`shadow report ${key}=${report[key]}, expected ${value}`);
+}
+NODE
+
+corepack pnpm runner effect run \
+  --dataset "$ROOT_DIR/fixtures/effects/dataset.json" \
+  --results-dir "$ROOT_DIR/fixtures/effects/results" \
+  --format json \
+  --out "$EFFECT_PATH" >/dev/null
+
+printf '%s\n' "Shadow comparison passed: 6 cases, 2 human outcomes, 1 exact agreement, 1 human rejection."
+printf '%s\n' "Effect regression passed: the reviewed \$55 waiver effect is unchanged."

package/examples/support-billing-agent/shadow-study/cases.jsonl

@@ -0,0 +1,6 @@
+{"request_id":"req-waiver-exact","tenant_id":"acme","principal":"support-agent-shadow","capability":"billing.propose_late_fee_waiver","business_object":"invoice","object_id":"INV-3001","agent_result":"proposed","proposed_effect":{"before":{"late_fee_cents":5500,"waiver_reason":null},"after":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"},"patch":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"}},"decision_reason":"customer qualifies for one courtesy waiver","risk_score":20,"amount_value":5500,"created_at":"2026-07-19T10:00:00.000Z"}
+{"request_id":"req-waiver-rejected","tenant_id":"acme","principal":"support-agent-shadow","capability":"billing.propose_late_fee_waiver","business_object":"invoice","object_id":"INV-REJECTED","agent_result":"proposed","proposed_effect":{"before":{"late_fee_cents":5500,"waiver_reason":null},"after":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"},"patch":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"}},"decision_reason":"agent found apparent eligibility","risk_score":45,"amount_value":5500,"created_at":"2026-07-19T10:01:00.000Z"}
+{"request_id":"req-waiver-policy","tenant_id":"acme","principal":"support-agent-shadow","capability":"billing.propose_late_fee_waiver","business_object":"invoice","object_id":"INV-EXCESSIVE","agent_result":"policy_denied","decision_reason":"amount above reviewed bound","risk_score":70,"amount_value":25000,"created_at":"2026-07-19T10:02:00.000Z"}
+{"request_id":"req-waiver-stale","tenant_id":"acme","principal":"support-agent-shadow","capability":"billing.propose_late_fee_waiver","business_object":"invoice","object_id":"INV-STALE","agent_result":"stale_conflict","decision_reason":"source version moved before proposal could be normalized","risk_score":60,"amount_value":5500,"created_at":"2026-07-19T10:03:00.000Z"}
+{"request_id":"req-waiver-forgery","tenant_id":"acme","principal":"support-agent-shadow","capability":"billing.propose_late_fee_waiver","business_object":"invoice","object_id":"INV-OTHER-TENANT","agent_result":"invalid_unsafe_scope_attempt","decision_reason":"model-supplied tenant override rejected","risk_score":100,"created_at":"2026-07-19T10:04:00.000Z"}
+{"request_id":"req-waiver-unmatched","tenant_id":"acme","principal":"support-agent-shadow","capability":"billing.propose_late_fee_waiver","business_object":"invoice","object_id":"INV-UNMATCHED","agent_result":"proposed","proposed_effect":{"before":{"late_fee_cents":5500,"waiver_reason":null},"after":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"},"patch":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"}},"decision_reason":"awaiting authoritative outcome","risk_score":30,"amount_value":5500,"created_at":"2026-07-19T10:05:00.000Z"}

package/examples/support-billing-agent/shadow-study/outcomes.jsonl

@@ -0,0 +1,2 @@
+{"request_id":"req-waiver-exact","tenant_id":"acme","business_object":"invoice","object_id":"INV-3001","actor":"support_lead_1","disposition":"applied","actual_effect":{"before":{"late_fee_cents":5500,"waiver_reason":null},"after":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"},"patch":{"late_fee_cents":0,"waiver_reason":"courtesy waiver"}},"occurred_at":"2026-07-19T11:00:00.000Z","source":"support-system-audit","reference":"ticket:SUP-184","reason":"customer qualified"}
+{"request_id":"req-waiver-rejected","tenant_id":"acme","business_object":"invoice","object_id":"INV-REJECTED","actor":"support_lead_2","disposition":"rejected_no_action","occurred_at":"2026-07-19T11:01:00.000Z","source":"support-system-audit","reference":"ticket:SUP-REJECTED","reason":"customer already received a courtesy waiver"}