@synapsor/runner 1.4.123 → 1.5.3

package/docs/mcp-audit.md

@@ -8,7 +8,10 @@ available for users who look for the command under the MCP namespace.
 From a source checkout, use `./bin/synapsor-runner ...` if the global binary is not
 linked yet.
 
-It does not call business tools. It only inspects names, descriptions, input schemas, output schemas, annotations, and examples when those are present.
+Static mode does not launch configured MCP servers or call business tools. It
+only inspects names, descriptions, input schemas, output schemas, annotations,
+and examples when those are present. An explicitly consented live check calls
+only `initialize` and `tools/list` on one named server.
 
 Every report includes this disclaimer:
 
@@ -37,6 +40,15 @@ Human-readable output:
 npx -y -p @synapsor/runner synapsor-runner audit ./tools-list.json
 ```
 
+The default terminal report groups repeated findings into the three most
+important root causes. It shows affected tools, a short blast-radius statement,
+and one next action instead of repeating the same explanation for every tool.
+Use the complete view when triaging every finding:
+
+```bash
+npx -y -p @synapsor/runner synapsor-runner audit ./tools-list.json --verbose
+```
+
 Remote `tools/list` endpoint with a bearer token kept in the environment:
 
 ```bash
@@ -62,12 +74,51 @@ JSON output:
 npx -y -p @synapsor/runner synapsor-runner audit ./tools-list.json --format json
 ```
 
+The JSON contract remains `synapsor.mcp-audit.v1`; its published schema is
+[`schemas/mcp-audit-report.schema.json`](../schemas/mcp-audit-report.schema.json).
+
+SARIF 2.1.0 output for code-scanning ingestion:
+
+```bash
+npx -y -p @synapsor/runner synapsor-runner audit ./tools-list.json --format sarif > mcp-audit.sarif
+```
+
 Markdown output for issues, PRs, or security review notes:
 
 ```bash
 npx -y -p @synapsor/runner synapsor-runner audit --example dangerous-db-mcp --format markdown
 ```
 
+Inspect a project-scoped Cursor configuration without launching anything:
+
+```bash
+npx -y -p @synapsor/runner synapsor-runner audit \
+  --mcp-config ./.cursor/mcp.json \
+  --format markdown
+```
+
+Static client-config output marks every server without supplied tool metadata
+as `requires_operator_verification`. To query one reviewed stdio command, name
+that exact server and give explicit consent:
+
+```bash
+npx -y -p @synapsor/runner synapsor-runner audit \
+  --mcp-config ./.cursor/mcp.json \
+  --live-server synapsor \
+  --yes \
+  --format json
+```
+
+Runner does not use a shell and refuses unresolved interpolation. For Cursor's
+documented `${workspaceFolder}` token, a config under `.cursor/mcp.json`
+resolves against the project root. Live mode executes no business, approval,
+apply, commit, or revert tool. It cannot prove the selected server is secure.
+
+The bypass check matters after installing Runner: another model-visible MCP
+server may still expose `execute_sql` or a direct write. Synapsor cannot govern
+calls routed around Runner. Audit reports the server and observed tool names,
+but never removes or rewrites unrelated MCP configuration automatically.
+
 During local development, the repo-local wrapper can run the same command:
 
 ```bash
@@ -75,6 +126,55 @@ During local development, the repo-local wrapper can run the same command:
 ./bin/synapsor-runner audit ./tools-list.json --format json
 ```
 
+## Generate review candidates
+
+Audit can create a separate review directory without editing or activating the
+source configuration:
+
+```bash
+npx -y -p @synapsor/runner synapsor-runner audit generate \
+  ./tools-list.json \
+  --output ./synapsor-audit-candidates
+```
+
+Open the same blocked candidate directly in the secured local review
+workbench:
+
+```bash
+npx -y -p @synapsor/runner synapsor-runner audit generate \
+  ./tools-list.json \
+  --output ./synapsor-audit-candidates \
+  --open-ui
+```
+
+This does not activate the candidate. The generated Runner config has no source
+and every proposal writeback is `none`.
+
+The generator uses the same parser and findings as `audit`. It writes:
+
+- a canonical `@synapsor/spec` contract;
+- a strict-shadow Runner scaffold with no configured source;
+- deny, redaction, and operator-boundary test candidates;
+- before/after model tool-surface reports;
+- a `REVIEW.md` checklist.
+
+Generated candidates do not carry authority. Every proposal has
+`writeback.mode: none`, the Runner scaffold is `shadow`, and the source map is
+empty. Subject identifiers and visible/write fields are conspicuous
+`review_required_*` placeholders. Input fields that look like SQL, dynamic
+identifiers, tenant/principal scope, credentials, approval identity, or row
+version are omitted rather than copied into model arguments.
+
+The output excludes raw descriptions, defaults, examples, enum values, bearer
+tokens, and credentials. Unknown business meaning becomes a TODO. A developer
+must inspect the real schema, choose trusted tenant/principal bindings, run the
+generated tests and a Shadow study, then deliberately copy reviewed definitions
+into an active contract.
+
+Generation refuses an existing directory. `--force` only replaces a directory
+that carries Runner's `synapsor.audit-candidates.v1` ownership marker; it will
+not overwrite an arbitrary hand-edited directory.
+
 ## Supported inputs
 
 The audit accepts common exported shapes:
@@ -93,7 +193,33 @@ The audit accepts common exported shapes:
 
 It also scans nested `adapter`, `mcpServers`, and `servers` blocks when they include tool metadata.
 
-For live targets, the audit calls only JSON-RPC `tools/list`. It does not call business tools, approval tools, commit tools, or writeback tools.
+For live stdio targets, the audit performs MCP `initialize`, then calls only
+JSON-RPC `tools/list`. Remote URL mode calls `tools/list`. It does not call
+business tools, approval tools, commit tools, or writeback tools.
+
+Checked-in deterministic fixtures live under
+[`fixtures/mcp-audit`](../fixtures/mcp-audit). The repository's
+[`mcp-audit` GitHub Actions workflow](https://github.com/Synapsor/Synapsor-Runner/blob/main/.github/workflows/mcp-audit.yml)
+builds the package, proves the dangerous fixture is detected, emits SARIF for
+the reviewed proposal fixture, validates the SARIF shape, and uploads the
+artifacts. Code-scanning upload runs only outside pull requests so forks do not
+receive write authority.
+
+## Model-authority map
+
+Every text, JSON, Markdown, and SARIF report records structural evidence for:
+
+- semantic reads and semantic proposals;
+- direct writes and raw SQL/query authority;
+- arbitrary identifier and model-controlled trust inputs;
+- model-visible approval/apply/commit/revert authority;
+- structured output and observable conflict/idempotency signals;
+- controls that require an operator or sit outside static audit visibility.
+
+Statuses are `observed`, `not_observed`, `requires_operator_verification`, or
+`outside_static_audit_visibility`. These are evidence labels, not a numerical
+security score. `not_observed` means only that the supplied metadata did not
+show the authority. It is not proof of absence at runtime.
 
 ## Findings
 
@@ -110,6 +236,85 @@ The audit flags database-commit risks such as:
 - ambiguous read/write tool boundaries;
 - missing business descriptions, annotations, or fixture examples.
 
+### Finding remediation index
+
+The report carries one stable remediation URL for every finding. These anchors
+are intentionally durable for JSON, Markdown, SARIF, pull requests, and code
+scanning.
+
+<a id="finding-generic-sql-tool"></a>
+<a id="finding-write-tool-accepts-arbitrary-sql"></a>
+<a id="finding-arbitrary-identifier-input"></a>
+<a id="finding-arbitrary-predicate-input"></a>
+
+#### Raw SQL, arbitrary identifiers, and free-form predicates
+
+Replace generic SQL/query tools and model-selected schemas, tables, databases,
+columns, filters, predicates, or WHERE clauses with a reviewed semantic
+capability. Fixed identifiers and row-selection rules belong in the contract;
+model inputs carry bounded business values only.
+
+<a id="finding-model-controlled-trust-scope"></a>
+
+#### Model-controlled trust scope
+
+Bind tenant, principal, source, allowed fields, approval identity, and conflict
+authority from verified context outside model arguments. Retain database RLS,
+restricted views, and least-privilege roles underneath Runner.
+
+<a id="finding-model-callable-commit-or-approval"></a>
+<a id="finding-write-without-proposal-boundary"></a>
+<a id="finding-mcp-bypass-direct-authority"></a>
+
+#### Missing review boundary or bypass
+
+Expose an immutable proposal rather than direct mutation. Keep activation,
+approval, apply, commit, and revert outside MCP. Disable or independently
+constrain another model-visible server that bypasses Runner; Synapsor cannot
+govern calls made through that server.
+
+<a id="finding-no-idempotency-field"></a>
+<a id="finding-no-conflict-guard"></a>
+<a id="finding-ambiguous-read-write-tool"></a>
+
+#### Retry, stale-state, and mixed-authority gaps
+
+Separate reads from proposals and require stable operation identity,
+idempotency receipts, an exact conflict/version guard, and an affected-row
+bound before trusted writeback.
+
+<a id="finding-no-structured-output-schema"></a>
+
+#### Missing structured output
+
+Publish typed results that distinguish reads, pending proposals, conflicts,
+failures, receipts, evidence, replay, and retry guidance without parsing prose.
+
+<a id="finding-missing-business-description"></a>
+<a id="finding-missing-risk-annotations"></a>
+<a id="finding-missing-test-fixture"></a>
+
+#### Reviewability gaps
+
+Add a reviewer-readable business description, honest read/destructive hints,
+and a non-production fixture. Annotations are vocabulary for clients, not an
+enforcement boundary.
+
+<a id="finding-mcp-server-tool-surface-unverified"></a>
+
+#### Unverified configured server
+
+Export that server's `tools/list`, or run the exact named `--live-server` check
+after reviewing its configured command. Static client configuration does not
+reveal the actual tool catalog.
+
+<a id="finding-no-tools-found"></a>
+
+#### No tools found
+
+Provide an exported `tools/list` response, a supported manifest, a Runner
+config, or an explicitly consented live target.
+
 ## Recommended target shape
 
 A safer model-facing database MCP tool should look like a reviewed semantic proposal capability:
@@ -151,6 +356,19 @@ A safer model-facing database MCP tool should look like a reviewed semantic prop
 
 Trusted values such as tenant, principal, source, allowed columns, approval identity, row-version guard, and database credentials must come from Synapsor/runner context, not from model-facing arguments.
 
+To turn an identified business write into a disabled reviewed action, continue
+with the Safe Action Composer:
+
+```bash
+synapsor-runner start \
+  --action refund_order \
+  --description "Propose one reviewed order refund"
+```
+
+The generated TypeScript action remains disabled. A coding agent may complete
+and validate it; only a human can activate its exact digest in the secured
+localhost Workbench.
+
 ## Related Fixture Benchmark
 
 `synapsor-runner benchmark mcp-efficiency` compares a fixed generic database

package/docs/mcp-client-setup.md

@@ -11,9 +11,18 @@ or SDK. The simplest local-client contract is stdio. Standard HTTP MCP is
 available through Streamable HTTP when your agent connects to a long-running
 Runner service.
 
-Command examples use the published alpha package through `npx`. From a source
-checkout, use `./bin/synapsor-runner ...` only when you intentionally want the local
-source wrapper.
+The checked [Client And Framework Recipes](client-recipes.md) use one shared
+`support.propose_plan_credit` flow and distinguish host evidence from standard
+MCP protocol evidence.
+
+Proposal tools also advertise a standard display-only
+[MCP App](mcp-apps.md). Supporting hosts discover it from tool metadata;
+other clients keep the same text/JSON proposal result. Approval and apply
+remain outside MCP in both cases.
+
+Command examples use the stable untagged package through `npx`. From a source
+checkout, use `./bin/synapsor-runner ...` only when you intentionally want the
+local source wrapper.
 
 Checked examples live in:
 
@@ -136,6 +145,11 @@ backup before writing. Noninteractive scripts must add `--yes`.
 The command writes only the local stdio MCP command and args. It does not write
 database URLs or passwords into the client config.
 
+No separate Apps flag is required. A compatible host discovers
+`ui://synapsor/proposal-review.html` from proposal-tool metadata. The app can
+display the exact diff, but it has no approval/apply authority; use the
+standalone local UI or terminal for human review.
+
 ## Start Command
 
 From the runner repository:
@@ -144,7 +158,9 @@ From the runner repository:
 npx -y -p @synapsor/runner synapsor-runner mcp serve --config ./examples/mcp-postgres-billing/synapsor.runner.json --store ./.synapsor/local.db
 ```
 
-For the alpha package, keep the package tag explicit in client configuration.
+For reproducible deployments, pin an exact stable version in package manifests
+and MCP client configuration. The untagged examples above intentionally resolve
+the current `latest` release.
 
 For standard app/server HTTP MCP mode:
 

package/docs/mcp-clients.md

@@ -4,12 +4,22 @@ Synapsor Runner exposes reviewed semantic tools over standard MCP. The model
 receives inspect/propose capabilities; it does not receive raw SQL, database
 credentials, approval commands, or apply commands.
 
+Proposal tools advertise a display-only [MCP App](mcp-apps.md). Hosts that
+implement the Apps extension can render the exact proposal diff inline.
+Clients without it receive the same structured/text result, and human approval
+still occurs in the standalone operator UI or terminal.
+
 The complete copy-paste templates live in:
 
 - [`examples/support-plan-credit/mcp-client-examples/`](../examples/support-plan-credit/mcp-client-examples/)
 - every local `synapsor-runner contract bundle` output;
 - every downloadable Synapsor Cloud runner bundle.
 
+For one shared proposal call across Claude Code, Codex, VS Code, OpenAI Agents,
+LangChain/LangGraph, Google ADK, LlamaIndex, and generic MCP clients, see
+[Client And Framework Recipes](client-recipes.md). Each recipe states whether
+it is host-tested, configuration-tested, protocol-tested, or recipe-only.
+
 Before connecting a client, validate the local boundary:
 
 ```bash
@@ -57,15 +67,39 @@ repository file.
 
 ### Cursor
 
-For one repository, place the project template at `.cursor/mcp.json`. For a
-global setup, merge `cursor-global.mcp.json` through Cursor's MCP settings and
-replace every `<absolute-path-to-bundle>` marker. Restart the MCP server from
-Cursor settings after editing.
+Prefer Runner's owned project lifecycle for one repository:
+
+```bash
+synapsor-runner mcp install cursor --project --dry-run \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db
+synapsor-runner mcp install cursor --project --yes \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db
+synapsor-runner mcp status cursor --project --check-launch
+```
+
+Runner previews the merge, backs up an existing `.cursor/mcp.json`, preserves
+other MCP servers/settings, writes an exact-version `npx` invocation, and
+tracks only its own entry with an integrity marker. Repeating install is
+idempotent. `mcp uninstall cursor --project --yes` removes only that intact,
+Runner-owned entry and also creates a backup.
+
+For global setup, merge `cursor-global.mcp.json` through Cursor's MCP settings
+and replace every `<absolute-path-to-bundle>` marker. Restart the MCP server
+from Cursor settings after editing.
 
 The model-facing list should contain only the contract's inspect/propose tools.
 If Cursor reports a missing config or store, use absolute paths and rerun
 `tools preview` from the same working directory.
 
+Cursor can be configured to auto-run model-facing tools. Synapsor therefore
+never exposes approval, apply, revert, policy activation, trusted identity, or
+credentials as MCP tools. Inline MCP App review is not assumed for Cursor; use
+the secured localhost workbench or operator CLI. No Add to Cursor deep link is
+generated because Runner has not verified a currently documented generic
+payload for this server. See [Host Compatibility](host-compatibility.md).
+
 ### OpenAI Agents SDK
 
 Install the SDK in your agent project and run either TypeScript template:
@@ -110,6 +144,9 @@ The preview must list semantic capabilities and must not list `execute_sql`,
 approval/apply tools, database URLs, write credentials, or model-controlled
 tenant authority.
 
+MCP App discovery is automatic from the proposal tool's
+`_meta.ui.resourceUri`; it does not require credentials in the client snippet.
+
 ## Troubleshooting
 
 - `ENOENT` or missing config: use absolute config/store paths.

package/docs/oss-vs-cloud.md

@@ -22,6 +22,7 @@ runtime stay local.
 | Contract source | Local files reviewed in Git | Shared registry with immutable versions and digests |
 | Trusted context | Local environment/session bindings | Registered bindings plus deployment-specific Cloud session context |
 | Capabilities | Local semantic MCP tools | Registry, version history, and capability inspection |
+| Safe Action activation | Explicit digest-confirmed local Workbench activation after a source-unchanged staging Data PR | Governed Cloud activation and immutable registry version; local coding agents still cannot activate |
 | Evidence and replay | Local SQLite ledger by default; optional shared Postgres runtime store | Redacted shared chronology and references; full evidence payload stays local by default |
 | Approval | Local CLI or localhost UI | Human-authenticated shared approval inbox; unavailable to MCP/Runner tokens |
 | Writeback | Guarded one-row CRUD, fixed/frozen bounded sets, or app-owned executor | Durable approval/job/lease coordination; the local Runner rechecks and executes |
@@ -36,6 +37,8 @@ runtime stay local.
 - direct access to Postgres or MySQL;
 - the process that executes guarded writeback;
 - local development ledgers when Cloud linkage is not enabled.
+- local disabled Safe Action drafts, project agent instructions, and source
+  database preview/writeback execution.
 
 Cloud contract registration does not require uploading database credentials or
 business rows. A Runner bundle contains the normalized contract, placeholder

package/docs/production.md

@@ -94,6 +94,14 @@ Read credential:
 - can `SELECT` only the tables/views used by capabilities;
 - should be restricted by views/RLS where possible.
 
+Name the scope mode in production reviews. The compatibility default is
+application-level Runner predicates with a shared credential. PostgreSQL can
+add database-enforced RLS to catch omitted predicates and pooled-context
+leakage. Tenant-bound credentials or isolated processes remove
+organization-wide authority from a Runner process. See
+[Database-Enforced Tenant And Principal
+Scope](database-enforced-scope.md).
+
 Write credential for direct `sql_update`:
 
 - can use only the operation-specific business DML and reviewed columns;

package/docs/release-notes.md

@@ -10,7 +10,131 @@ npx -y -p @synapsor/runner synapsor-runner demo --quick
 The OSS runner command is `synapsor-runner`. The `synapsor` command is reserved
 for the Synapsor Cloud CLI.
 
-## 1.4.123 (prepared, not published)
+## 1.5.3 (prepared, not published)
+
+### Intent to Safe Action
+
+- `start --action <name> --description <intent>` creates one inert TypeScript
+  Safe Action scaffold from an existing reviewed read boundary. Project-scoped
+  instructions let a coding agent complete and validate only the draft.
+- `action validate` statically parses the restricted object and emits a
+  digest-addressed disabled canonical draft, explanation, and deterministic
+  allow/deny/effect tests. It does not import adopter code, activate the action,
+  or alter the active MCP tool catalog.
+- The secured Workbench runs one real source-unchanged staging Data PR before
+  activation and requires `ACTIVATE` plus the complete digest. Cloud-linked
+  projects use governed Cloud activation. Existing proposals remain bound to
+  the exact active contract digest they were created under.
+- The package includes a current-format Cursor plugin with
+  `/synapsor-protect`, diagnostics, deterministic package verification, and
+  project-safe MCP wiring. Cursor host claims remain evidence-labeled; a stable
+  UI pass and Marketplace submission are owner gates.
+- MCP audit now renders a model-authority map and opt-in bypass evidence as
+  text, JSON, Markdown, or SARIF. A checked-in GitHub Actions workflow and Safe
+  Action team CI are deterministic and non-mutating.
+- Proposal-only integration recipes cover Claude Code, Codex, VS Code, OpenAI
+  Agents, LangChain/LangGraph, Google ADK, LlamaIndex, and generic MCP clients.
+- The first two README screens, public website, article, discovery routes, and
+  36-second evidence-backed demo now lead with the own-project Data PR path.
+
+Prepared package version: `@synapsor/runner@1.5.3`. Spec, DSL, and Cloud CLI
+packages are unchanged. Nothing has been published by this repository change.
+
+## 1.5.2 (prepared, not published)
+
+### First safe action in an existing application
+
+- `start --from-env DATABASE_URL` and
+  `try --prove --from-env DATABASE_URL` now converge on one own-data
+  onboarding path. It inspects a staging database read-only, asks the developer
+  to choose trusted scope and one reviewed action, emits canonical files, and
+  never substitutes synthetic data after an own-data failure.
+- The localhost workbench presents Project, Data source, Trust scope, Action,
+  Agent, Test, and Review plus an exact proposal Data PR. Test is complete only
+  after a scoped tool call records query audit, not after config validation.
+- Project-scoped Cursor install/status/uninstall previews and owns only its MCP
+  entry, preserves other entries, and launches the exact Runner version.
+  Approval, apply, revert, credentials, and trusted identity stay outside MCP.
+- Local activation reports measure proof, onboarding, Cursor, first read, and
+  first proposal without telemetry or business identifiers. Product time
+  excludes initial package download; cold `npx` time is reported separately
+  as an observed environment-specific measurement.
+- Optional TypeScript authoring emits the same canonical Spec contract. Shadow
+  trust progression and provider-neutral effect regression remain
+  non-activating and preserve deterministic/external-model provenance.
+- MCP audit candidates can open directly in the secured workbench, and the
+  release includes the host-compatibility matrix and support/billing reference
+  workflow.
+- The package now requires Node 22.13.0 or newer, the first Node 22 release
+  where Runner's `node:sqlite` dependency is available without an experimental
+  runtime flag. Older Node versions fail immediately with an actionable error.
+
+Prepared package version: `@synapsor/runner@1.5.2`. Spec, DSL, and Cloud CLI
+packages are unchanged. Nothing has been published by this repository change.
+
+## 1.5.1 (prepared, not published)
+
+### Safe disposable state ownership
+
+- `try --state-dir` no longer treats the supplied directory as disposable.
+  The supplied path is a caller-owned container and Runner uses a marked
+  managed child beneath it.
+- Cleanup removes only known direct try-state files. Unrelated files remain in
+  place, and roots, home/cwd/repository paths, traversal, symlink escapes,
+  unmarked lookalikes, and linked managed files fail closed.
+- An atomic state lease prevents concurrent runs from corrupting each other and
+  permits recovery from a valid lease whose process is no longer alive.
+- `demo inspect --state-dir` resolves the same managed child. The default
+  `.synapsor/try` path safely adopts only the recognized legacy file layout.
+- Explicit `--force` replacement of generated schema and MCP-audit candidate
+  directories now rejects protected paths, symlinked ancestors, and linked or
+  invalid ownership markers.
+- The embedded `try` data source is consistently identified as synthetic.
+- The packaged YAML parser is updated to `2.8.3` to include the upstream fix
+  for deeply nested collection denial of service.
+
+Prepared package version: `@synapsor/runner@1.5.1`. Spec, DSL, and Cloud CLI
+packages are unchanged. Nothing has been published by this repository change.
+
+## 1.5.0 (published 2026-07-20)
+
+### Complete guarded-action developer proof
+
+- `synapsor-runner try --prove` now demonstrates the complete embedded
+  business-action boundary without an account, database, Docker daemon, MCP
+  client, or model key: scoped evidence, exact `late_fee_cents: 5500 -> 0`
+  proposal, no pre-approval mutation, guarded commit, duplicate-free retry,
+  changed-intent collision refusal, stale conflict, receipt, and replay.
+- Deployments can explicitly select application-level shared-credential scope,
+  PostgreSQL RLS defense in depth, or a tenant-bound credential resolver.
+  Diagnostics report the active assurance and remaining trust boundary;
+  hardened modes fail closed when prerequisites are missing.
+- Strict Shadow Mode now has durable studies, bounded case imports,
+  authoritative human outcomes, deterministic comparison/readiness reports,
+  and effect-level regression fixtures. No study or evaluation path grants
+  authority or writes source data.
+- Proposal tools advertise a standard display-only MCP App where the host
+  supports it. The app and standalone local UI share one reviewer-facing view;
+  approval/apply authority and privileged tokens remain outside MCP.
+- `audit` can generate disabled canonical replacement candidates, while
+  Prisma, Drizzle, and OpenAPI generators create bounded review-only candidate
+  contracts without executing adopter source.
+- The `support-billing-agent` reference now provides a live disposable
+  PostgreSQL/RLS proof for tenant/principal scope, kept-out fields, proposal,
+  approval/apply, receipt/retry, stale conflict, replay, strict shadow, and
+  effect regression.
+- The bundled app-owned handler helper now uses a pre-provisioned receipt table
+  without requiring schema `CREATE`; DDL is attempted only when the table is
+  absent. The source-workspace and packed billing-handler examples both verify
+  transactional apply and idempotent retry.
+- The public README leads with `try --prove`, keeps MCP database-risk audit
+  immediately second, and distinguishes application scope, PostgreSQL RLS, and
+  tenant-bound isolation without overstating any of them.
+
+Published package version: `@synapsor/runner@1.5.0`. Spec, DSL, and Cloud CLI
+packages were unchanged.
+
+## 1.4.123 (2026-07-17)
 
 ### Advisory capability-surface fitness lint
 
@@ -25,10 +149,10 @@ for the Synapsor Cloud CLI.
   CI policy gate with `--strict` or `--fail-on warning`; canonical validity and
   runtime enforcement are unchanged.
 
-Prepared package version: `@synapsor/runner@1.4.123`. Spec, DSL, and Cloud CLI
+Published package version: `@synapsor/runner@1.4.123`. Spec, DSL, and Cloud CLI
 packages are unchanged.
 
-## 1.4.122 (2026-07-16)
+## 1.4.122 (2026-07-17)
 
 ### Trusted principal scope and Cloud-linked authority
 
@@ -54,11 +178,11 @@ packages are unchanged.
   projects, scoped credentials, Runner connections, proposal decisions, and
   audit records. Runner keeps the `synapsor-runner` binary and local boundary.
 
-Prepared package versions: `@synapsor/spec@1.4.2`,
+Published package versions: `@synapsor/spec@1.4.2`,
 `@synapsor/dsl@1.4.3`, `@synapsor/runner@1.4.122`, and
 `@synapsor/cli@0.1.0-beta.1`.
 
-## 1.4.121 (prepared, not published)
+## 1.4.121 (2026-07-15)
 
 ### Contract trust surface and bounded-set parser correctness
 
@@ -90,10 +214,10 @@ Prepared package versions: `@synapsor/spec@1.4.2`,
 - C++/Cloud validators and exporters preserve the new additive enum/aggregate
   fields for canonical round-trip compatibility.
 
-Prepared package versions: `@synapsor/spec@1.4.1`,
+Published package versions: `@synapsor/spec@1.4.1`,
 `@synapsor/dsl@1.4.2`, and `@synapsor/runner@1.4.121`.
 
-## 1.4.12 (prepared, not published)
+## 1.4.12 (2026-07-14)
 
 ### Runtime-store smoke-call consistency
 
@@ -108,10 +232,10 @@ Prepared package versions: `@synapsor/spec@1.4.1`,
 - Local SQLite and mirror modes retain their existing behavior; no source row
   changes before the normal external approval/apply path.
 
-Prepared package version: `@synapsor/runner@1.4.12`.
+Published package version: `@synapsor/runner@1.4.12`.
 `@synapsor/dsl` remains `1.4.1`; `@synapsor/spec` remains `1.4.0`.
 
-## 1.4.1 (prepared, not published)
+## 1.4.1 (2026-07-14)
 
 ### Bounded-set digest compatibility patch
 
@@ -131,10 +255,10 @@ Prepared package version: `@synapsor/runner@1.4.12`.
   authority, hand-built semantic tools, structural enforcement, build-vs-adopt
   fit, and regulated-data boundaries.
 
-Prepared package versions: `@synapsor/dsl@1.4.1` and
+Published package versions: `@synapsor/dsl@1.4.1` and
 `@synapsor/runner@1.4.1`. `@synapsor/spec` remains `1.4.0`.
 
-## 1.4.0 (prepared, not published)
+## 1.4.0 (2026-07-14)
 
 ### Reviewed Reversible Change Sets
 
@@ -149,7 +273,7 @@ Prepared package versions: `@synapsor/dsl@1.4.1` and
 - Keeps hard DELETE restoration, app-owned handlers, payments, messages, and
   other external effects outside Runner's automatic compensation claim.
 
-Prepared package versions: `@synapsor/spec@1.4.0`,
+Published package versions: `@synapsor/spec@1.4.0`,
 `@synapsor/dsl@1.4.0`, and `@synapsor/runner@1.4.0`.
 
 ## 1.3.0 (prepared, not published)
@@ -254,7 +378,7 @@ Released package versions: `@synapsor/spec@1.1.0`,
 - Declares the first semver contract for the documented CLI, schema, contract,
   MCP result, writeback, approval, metrics, and replay surfaces.
 
-Prepared package versions: `@synapsor/spec@1.0.0`,
+Released package versions: `@synapsor/spec@1.0.0`,
 `@synapsor/dsl@1.0.0`, and `@synapsor/runner@1.0.0`.
 
 ## 0.1.16
@@ -706,7 +830,7 @@ not change and must not be republished for this release.
   CDC, managed runner fleets, compliance exports, production SLA, or C++ DBMS
   internals.
 - The local store is single-node SQLite for local/dev/staging usage.
-- Node >= 22.5.0 is required because the local ledger uses Node's
+- Node >= 22.13.0 is required because the local ledger uses Node's unflagged
   `node:sqlite` runtime. Use a supported Node runtime or the Docker-backed
   source demo path.