@synapsor/runner 1.5.3 → 1.6.0

package/examples/runner-fleet/README.md

@@ -2,8 +2,11 @@
 
 This synthetic fixture starts Postgres, MySQL, and two stateless Streamable
 HTTP Runner services. Both Runners share one bounded Postgres runtime ledger.
-The committed passwords and HS256 key are disposable local-demo values. Never
-reuse them outside this fixture.
+Each container generates a one-day self-signed certificate at startup so the
+non-loopback Runner listener exercises direct TLS rather than insecure HTTP.
+The committed database passwords and HS256 key are disposable local-demo
+values. Never reuse them outside this fixture; production should use a trusted
+certificate and asymmetric identity-provider tokens.
 
 From the repository root:
 
@@ -16,9 +19,9 @@ docker compose --profile fleet -f examples/runner-fleet/docker-compose.yml ps
 Check both instances:
 
 ```bash
-curl --fail http://127.0.0.1:8871/healthz
-curl --fail http://127.0.0.1:8871/readyz
-curl --fail http://127.0.0.1:8872/readyz
+curl --fail --insecure https://127.0.0.1:8871/healthz
+curl --fail --insecure https://127.0.0.1:8871/readyz
+curl --fail --insecure https://127.0.0.1:8872/readyz
 ```
 
 The MCP endpoint requires a claim-bearing development JWT. Generate one for
@@ -28,8 +31,9 @@ the fixture only:
 node examples/runner-fleet/mint-dev-token.mjs acme local-agent
 ```
 
-The production path should use `jwt_asymmetric` with an explicit RS256/ES256
-allowlist and a trusted JWKS URL or public PEM. See
+`--insecure` is acceptable only for this synthetic self-signed fixture. The
+production path should use a trusted TLS chain and `jwt_asymmetric` with an
+explicit RS256/ES256 allowlist plus a trusted JWKS URL or public PEM. See
 [Running A Runner Fleet](../../docs/running-a-runner-fleet.md).
 
 Run the stronger automated verification instead of treating a green Compose

package/examples/runner-fleet/docker-compose.yml

@@ -46,11 +46,11 @@ services:
       SYNAPSOR_SESSION_JWT_SECRET: synthetic-fleet-session-secret-change-before-use-0001
       SYNAPSOR_METRICS_TOKEN: synthetic-fleet-metrics-token-change-before-use
     ports:
-      - "8871:8766"
+      - "127.0.0.1:8871:8766"
     volumes:
       - ./synapsor.runner.json:/config/synapsor.runner.json:ro
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8766/readyz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      test: ["CMD-SHELL", "NODE_TLS_REJECT_UNAUTHORIZED=0 node -e \"fetch('https://127.0.0.1:8766/readyz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
       interval: 2s
       timeout: 5s
       retries: 30
@@ -66,11 +66,11 @@ services:
         condition: service_healthy
     environment: *runner_environment
     ports:
-      - "8872:8766"
+      - "127.0.0.1:8872:8766"
     volumes:
       - ./synapsor.runner.json:/config/synapsor.runner.json:ro
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8766/readyz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      test: ["CMD-SHELL", "NODE_TLS_REJECT_UNAUTHORIZED=0 node -e \"fetch('https://127.0.0.1:8766/readyz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
       interval: 2s
       timeout: 5s
       retries: 30

package/examples/runner-fleet/mint-dev-token.mjs

@@ -9,7 +9,7 @@ const payload = {
   sub: subject,
   tenant_id: tenant,
   iss: "https://fleet.example.invalid",
-  aud: "synapsor-runner-fleet",
+  aud: "https://runner-fleet.example.invalid/mcp",
   iat: now,
   exp: now + 600,
 };

package/examples/runner-fleet/start-tls-runner.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tls_dir="${SYNAPSOR_FLEET_TLS_DIR:-/tmp/synapsor-runner-tls}"
+mkdir -p "$tls_dir"
+chmod 700 "$tls_dir"
+
+openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 1 \
+  -subj "/CN=localhost" \
+  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
+  -keyout "$tls_dir/server.key" \
+  -out "$tls_dir/server.crt" \
+  >/dev/null 2>&1
+chmod 600 "$tls_dir/server.key" "$tls_dir/server.crt"
+
+export SYNAPSOR_FLEET_TLS_CERT_PEM="$(<"$tls_dir/server.crt")"
+export SYNAPSOR_FLEET_TLS_KEY_PEM="$(<"$tls_dir/server.key")"
+
+exec node apps/runner/dist/cli.js "$@" \
+  --tls-cert-env SYNAPSOR_FLEET_TLS_CERT_PEM \
+  --tls-key-env SYNAPSOR_FLEET_TLS_KEY_PEM

package/examples/runner-fleet/synapsor.runner.json

@@ -36,11 +36,37 @@
     "provider": "jwt_hs256",
     "secret_env": "SYNAPSOR_SESSION_JWT_SECRET",
     "issuer": "https://fleet.example.invalid",
-    "audience": "synapsor-runner-fleet",
+    "audience": "https://runner-fleet.example.invalid/mcp",
     "tenant_claim": "tenant_id",
     "principal_claim": "sub",
     "clock_skew_seconds": 10
   },
+  "http_security": {
+    "deployment": "shared",
+    "oauth_resource": {
+      "resource": "https://runner-fleet.example.invalid/mcp",
+      "authorization_servers": ["https://fleet.example.invalid"],
+      "resource_name": "Synthetic Synapsor Runner fleet"
+    },
+    "allowed_hosts": [
+      "127.0.0.1:8766",
+      "127.0.0.1:8871",
+      "127.0.0.1:8872",
+      "localhost:8766",
+      "localhost:8871",
+      "localhost:8872"
+    ],
+    "limits": {
+      "max_request_bytes": 65536,
+      "max_header_bytes": 8192,
+      "max_sessions": 100,
+      "session_idle_timeout_seconds": 120,
+      "request_timeout_ms": 15000,
+      "headers_timeout_ms": 5000,
+      "keep_alive_timeout_ms": 5000,
+      "max_connections": 200
+    }
+  },
   "rate_limits": {
     "enabled": true,
     "default": { "requests": 20, "window_seconds": 60 },

package/examples/support-plan-credit/README.md

@@ -252,13 +252,16 @@ verification gate.
 For Streamable HTTP, run:
 
 ```bash
+export SYNAPSOR_RUNNER_HTTP_TOKEN="$(node -e 'process.stdout.write(require("node:crypto").randomBytes(32).toString("base64url"))')"
+
 synapsor-runner mcp serve \
   --transport streamable-http \
   --alias-mode openai \
   --host 127.0.0.1 \
   --port 8766 \
   --config examples/support-plan-credit/synapsor.runner.json \
-  --store ./tmp/support-plan-credit/local.db
+  --store ./tmp/support-plan-credit/local.db \
+  --auth-token-env SYNAPSOR_RUNNER_HTTP_TOKEN
 ```
 
 The OpenAI client receives `support__inspect_customer` and
@@ -266,6 +269,8 @@ The OpenAI client receives `support__inspect_customer` and
 tool metadata and results. For Claude, Cursor, or generic MCP clients, omit
 `--alias-mode openai` to expose `support.inspect_customer` and
 `support.propose_plan_credit`. Approval and apply remain outside MCP.
+The HTTP client reads the same opaque endpoint token from its protected
+environment; no token value belongs in the checked-in recipe.
 
 ## How The Policy Is Governed
 

package/examples/support-plan-credit/mcp-client-examples/generic-streamable-http.json

@@ -1,5 +1,8 @@
 {
   "name": "synapsor-runner",
   "transport": "streamable-http",
-  "url": "http://127.0.0.1:8766/mcp"
+  "url": "http://127.0.0.1:8766/mcp",
+  "headers_from_env": {
+    "Authorization": "Bearer $SYNAPSOR_RUNNER_HTTP_TOKEN"
+  }
 }

package/examples/support-plan-credit/mcp-client-examples/openai-agents-streamable-http.ts

@@ -1,9 +1,13 @@
 import { Agent, MCPServerStreamableHttp, run } from "@openai/agents";
 
 // Start Runner with --alias-mode openai so model-visible tool names are valid OpenAI function names.
+const token = process.env.SYNAPSOR_RUNNER_HTTP_TOKEN;
+if (!token) throw new Error("set SYNAPSOR_RUNNER_HTTP_TOKEN in the launching environment");
+
 const synapsor = new MCPServerStreamableHttp({
   name: "Synapsor Runner",
   url: "http://127.0.0.1:8766/mcp",
+  requestInit: { headers: { Authorization: `Bearer ${token}` } },
 });
 
 await synapsor.connect();

package/examples/support-plan-credit/synapsor.contract.json

@@ -182,9 +182,6 @@
           "mode": "human",
           "required_role": "support_reviewer"
         },
-        "conflict_guard": {
-          "weak_guard_ack": true
-        },
         "numeric_bounds": {
           "amount_cents": {
             "maximum": 50000,

package/fixtures/compatibility/published-1.5.4/manifest.json

@@ -0,0 +1,76 @@
+{
+  "schema_version": "synapsor.published-compatibility.v1",
+  "published_packages": {
+    "@synapsor/runner": {
+      "version": "1.5.4",
+      "npm_shasum": "63ef030b0360118082bc670239ad4927673b6bc7"
+    },
+    "@synapsor/dsl": {
+      "version": "1.4.4",
+      "npm_shasum": "dee671d3c3d25f5434b488f80b3041d0c5606c2f"
+    },
+    "@synapsor/spec": {
+      "version": "1.4.2",
+      "npm_shasum": "cb9aa813f481ef14d542a1896c228159aab86353"
+    }
+  },
+  "contracts": [
+    {
+      "path": "packages/spec/fixtures/valid/basic-read.contract.json",
+      "source_sha256": "5ec499965f639d784603b7942390d18a3e742d79e4d510dbea470e166a743972",
+      "canonical_sha256": "9d3addfde77eb6528aae7b9e81ae0f582b5c002aa77ebb2d7381fe663f5f5b1e"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/aggregate-read/contract.json",
+      "source_sha256": "830bc208b749bb9ed6a4b4468571d58d68bc8a2b6e1072fc45fb87d1c68697e7",
+      "canonical_sha256": "ccc6ea17f449bfc207d1cea70ef3320d575c450a3904c850dcb631132c6e5602"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/proposal-capability/contract.json",
+      "source_sha256": "d4c25fb8f79f04c13bdb3daf8c18a44d4f1c61596660a67bf35d46d0f94f4100",
+      "canonical_sha256": "d895081246d41a072892b5dde6929099302492a77a229033fbfa5052cce34b18"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/bounded-set-threats/contract.json",
+      "source_sha256": "c902d45457789a6d87504ca434c8b299f3e09be779f3bfdf7bbd8684d575a10e",
+      "canonical_sha256": "64c7078ff1687762d95c17873238759b3572dce499f903a8d6f1aaa8faae5f24"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/reversible-change-sets/contract.json",
+      "source_sha256": "7e4f8da90a4b235097f76e70a7f550153bbf62d219e7ef6f4f2194f6c36fa205",
+      "canonical_sha256": "181f2e93ad3c53b9a1345a4ed6c8b5e24ab0201c00159f38659f0c2a00c037de"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/principal-row-scope/contract.json",
+      "source_sha256": "00a05c1f4e82cc9c4e5d2d68c9c9201cd9512ac42d63292314bb7b4845026996",
+      "canonical_sha256": "fc96a5327ab0f4b311c90da9b5585348e81349ed66bd3a22e41e5f29804c32a8"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/approval-quorum/contract.json",
+      "source_sha256": "dde6b328f648ba60d837fa363494d764d7eb0d2d9a8a81ff70a9c077edde410c",
+      "canonical_sha256": "9407a7d0cc4439c773c3caf721aaed6c6e163c403fa67518632829d8c5de33e7"
+    }
+  ],
+  "dsl_sources": [
+    {
+      "path": "packages/dsl/examples/aggregate-read.synapsor.sql",
+      "source_sha256": "bccac4c2eb0ab7b2fc099c7fb3f6fdc25ee2e6e534282aa19b46f0aec8191b8d",
+      "canonical_sha256": "0cc2d892f00a31a3582d773812a26c6c45c0ce343e1d8d09da226a5bbb7c93eb"
+    },
+    {
+      "path": "packages/dsl/examples/billing-late-fee.synapsor.sql",
+      "source_sha256": "f5c462cff7aa0cd01a08543c6096ee1d225ebba449d65b7470815b1aa7ec42cd",
+      "canonical_sha256": "d495df575d64e798a730dad385e097dfc2c2f371a1505865bc45179ad3c479f2"
+    },
+    {
+      "path": "packages/dsl/examples/bounded-set-multi-term.synapsor.sql",
+      "source_sha256": "0ae199034ebba8b25146435c911576118f948b55b54636a5e68f46002cd1c6dd",
+      "canonical_sha256": "5b3e84cf8f5062a8afcd50763bde907e6a141977456e74a81d01f8b3a484e422"
+    },
+    {
+      "path": "packages/dsl/examples/principal-row-scope.synapsor.sql",
+      "source_sha256": "08ccd769d633417ea45d478383d9628991f43262223f12c78bbd776202b10253",
+      "canonical_sha256": "e29f2819c267210e54f783c40d0f550d11d0d1de844dbe1590ed8c3405af3cf7"
+    }
+  ]
+}

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/aggregate-read.synapsor.sql

@@ -0,0 +1,21 @@
+CREATE AGENT CONTEXT finance_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY billing.overdue_balance_total
+  DESCRIPTION 'Return one suppressed overdue-balance aggregate for the trusted tenant.'
+  RETURNS HINT 'Returns one scalar or a suppression result; never member rows.'
+  USING CONTEXT finance_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  AGGREGATE READ SUM balance_cents
+  SELECT WHERE status = 'overdue'
+  MIN GROUP SIZE 5
+  KEEP OUT customer_email, private_notes
+  REQUIRE EVIDENCE
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/billing-late-fee.synapsor.sql

@@ -0,0 +1,56 @@
+CREATE AGENT CONTEXT local_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY billing.inspect_invoice
+  DESCRIPTION 'Inspect one invoice in the trusted tenant before proposing a waiver.'
+  RETURNS HINT 'Returns reviewed invoice fields plus evidence/query-audit handles.'
+  USING CONTEXT local_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD updated_at
+  LOOKUP invoice_id BY id
+  ARG invoice_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Invoice id such as INV-3001.'
+  ALLOW READ id, tenant_id, customer_id, status, late_fee_cents, waiver_reason, updated_at
+  KEEP OUT card_token, internal_risk_score
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+END
+
+CREATE CAPABILITY billing.propose_late_fee_waiver
+  DESCRIPTION 'Propose waiving one invoice late fee after inspecting invoice and policy evidence.'
+  RETURNS HINT 'Returns a review-required proposal id, exact diff, evidence handle, and source_database_changed:false.'
+  USING CONTEXT local_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD updated_at
+  LOOKUP invoice_id BY id
+  ARG invoice_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Invoice id such as INV-3001.'
+  ARG waiver_reason TEXT REQUIRED MAX LENGTH 500 DESCRIPTION 'Business reason for the proposed waiver.'
+  ALLOW READ id, tenant_id, customer_id, status, late_fee_cents, waiver_reason, updated_at
+  KEEP OUT card_token, internal_risk_score
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+  PROPOSE ACTION billing.waive_late_fee
+  ALLOW WRITE late_fee_cents, waiver_reason
+  PATCH late_fee_cents = 0
+  PATCH waiver_reason = ARG waiver_reason
+  APPROVAL ROLE billing_lead
+  WRITEBACK DIRECT SQL
+END
+
+CREATE AGENT WORKFLOW billing.late_fee_review
+  USING CONTEXT local_operator
+  ALLOW CAPABILITY billing.inspect_invoice
+  ALLOW CAPABILITY billing.propose_late_fee_waiver
+  REQUIRE EVIDENCE
+  APPROVAL REQUIRED ROLE billing_lead
+  CHECKPOINT PROPOSAL ONLY
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/bounded-set-multi-term.synapsor.sql

@@ -0,0 +1,30 @@
+CREATE AGENT CONTEXT local_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY cases.close_high_risk
+  DESCRIPTION 'Close active high-risk support cases within reviewed row and value caps.'
+  RETURNS HINT 'Returns a proposal for the exact reviewed set; source rows remain unchanged.'
+  USING CONTEXT local_operator
+  SOURCE support_db
+  ON public.support_cases
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD version
+  LOOKUP reason BY id
+  ARG reason STRING REQUIRED MAX LENGTH 100
+  ALLOW READ id, tenant_id, risk_level, case_status, exposure_cents, version
+  REQUIRE EVIDENCE
+  PROPOSE ACTION close_high_risk UPDATE SET
+  SELECT WHERE risk_level = 'high' AND case_status = 'active'
+  MAX ROWS 10
+  MAX TOTAL exposure_cents BEFORE 50000
+  ALLOW WRITE case_status
+  PATCH case_status = 'closed'
+  ADVANCE VERSION version USING INTEGER INCREMENT
+  APPROVAL ROLE support_manager
+  WRITEBACK DIRECT SQL
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/principal-row-scope.synapsor.sql

@@ -0,0 +1,23 @@
+CREATE AGENT CONTEXT care_session
+  BIND hospital_id FROM HTTP_CLAIM hospital_id REQUIRED
+  BIND principal FROM HTTP_CLAIM sub REQUIRED
+  TENANT BINDING hospital_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY care.inspect_assigned_patient
+  DESCRIPTION 'Inspect one patient assigned to the authenticated case manager within the trusted hospital.'
+  RETURNS HINT 'Returns reviewed patient fields and evidence only when both tenant and assignee locks match.'
+  USING CONTEXT care_session
+  SOURCE local_postgres
+  ON public.patients
+  PRIMARY KEY id
+  TENANT KEY hospital_id
+  PRINCIPAL SCOPE KEY assigned_to
+  LOOKUP patient_id BY id
+  ARG patient_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Reviewed patient identifier.'
+  ALLOW READ id, hospital_id, display_name, care_status, updated_at
+  KEEP OUT assigned_to, diagnosis_notes, insurance_member_id
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/spec/fixtures/conformance/aggregate-read/contract.json

@@ -0,0 +1,119 @@
+{
+  "spec_version": "0.1",
+  "kind": "SynapsorContract",
+  "metadata": {
+    "name": "aggregate read and enum conformance",
+    "version": "1.0.0"
+  },
+  "resources": [
+    {
+      "name": "billing_invoices",
+      "engine": "postgres",
+      "schema": "public",
+      "table": "invoices",
+      "primary_key": "id",
+      "tenant_key": "tenant_id"
+    }
+  ],
+  "contexts": [
+    {
+      "name": "billing_context",
+      "bindings": [
+        {
+          "name": "tenant_id",
+          "source": "environment",
+          "key": "SYNAPSOR_TENANT_ID"
+        },
+        {
+          "name": "principal",
+          "source": "environment",
+          "key": "SYNAPSOR_PRINCIPAL"
+        }
+      ],
+      "tenant_binding": "tenant_id",
+      "principal_binding": "principal"
+    }
+  ],
+  "capabilities": [
+    {
+      "name": "billing.sum_overdue_balance",
+      "description": "Return one privacy-suppressed aggregate for the trusted tenant.",
+      "returns_hint": "Returns one scalar or a suppression result; never member rows.",
+      "kind": "aggregate_read",
+      "context": "billing_context",
+      "source": "local_postgres",
+      "subject": {
+        "resource": "billing_invoices"
+      },
+      "args": {},
+      "visible_fields": [],
+      "kept_out_fields": [
+        "customer_email",
+        "private_notes"
+      ],
+      "evidence": {
+        "required": true,
+        "query_audit": true
+      },
+      "aggregate": {
+        "function": "sum",
+        "column": "balance_cents",
+        "selection": {
+          "all": [
+            {
+              "column": "status",
+              "operator": "eq",
+              "value": "overdue"
+            }
+          ]
+        },
+        "minimum_group_size": 5
+      }
+    },
+    {
+      "name": "billing.inspect_invoice",
+      "description": "Inspect one tenant-scoped invoice using a reviewed risk enum.",
+      "kind": "read",
+      "context": "billing_context",
+      "source": "local_postgres",
+      "subject": {
+        "resource": "billing_invoices"
+      },
+      "args": {
+        "invoice_id": {
+          "type": "string",
+          "required": true,
+          "max_length": 128
+        },
+        "risk_level": {
+          "type": "string",
+          "required": true,
+          "enum": [
+            "low",
+            "medium",
+            "high"
+          ]
+        }
+      },
+      "lookup": {
+        "id_from_arg": "invoice_id"
+      },
+      "visible_fields": [
+        "id",
+        "tenant_id",
+        "status",
+        "balance_cents"
+      ],
+      "kept_out_fields": [
+        "customer_email",
+        "private_notes"
+      ],
+      "evidence": {
+        "required": true,
+        "query_audit": true
+      },
+      "max_rows": 1
+    }
+  ]
+}
+

package/fixtures/compatibility/published-1.5.4/sources/packages/spec/fixtures/conformance/approval-quorum/contract.json

@@ -0,0 +1,44 @@
+{
+  "spec_version": "0.1",
+  "kind": "SynapsorContract",
+  "contexts": [
+    {
+      "name": "local_operator",
+      "bindings": [
+        { "name": "tenant_id", "source": "environment", "key": "SYNAPSOR_TENANT_ID" },
+        { "name": "principal", "source": "environment", "key": "SYNAPSOR_PRINCIPAL" }
+      ],
+      "tenant_binding": "tenant_id",
+      "principal_binding": "principal"
+    }
+  ],
+  "capabilities": [
+    {
+      "name": "billing.propose_late_fee_waiver",
+      "kind": "proposal",
+      "context": "local_operator",
+      "subject": {
+        "schema": "public",
+        "table": "invoices",
+        "primary_key": "id",
+        "tenant_key": "tenant_id",
+        "conflict_key": "updated_at"
+      },
+      "args": { "invoice_id": { "type": "string" } },
+      "lookup": { "id_from_arg": "invoice_id" },
+      "visible_fields": ["id", "tenant_id", "late_fee_cents", "updated_at"],
+      "proposal": {
+        "action": "billing.waive_late_fee",
+        "allowed_fields": ["late_fee_cents"],
+        "patch": { "late_fee_cents": { "fixed": 0 } },
+        "conflict_guard": { "column": "updated_at" },
+        "approval": {
+          "mode": "human",
+          "required_role": "billing_lead",
+          "required_approvals": 2
+        },
+        "writeback": { "mode": "direct_sql" }
+      }
+    }
+  ]
+}