@synapsor/runner 1.5.4 → 1.6.1

package/docs/troubleshooting-first-run.md

@@ -12,6 +12,104 @@ Use JSON for automation:
 npx -y -p @synapsor/runner synapsor-runner doctor --first-run --json
 ```
 
+## Fresh Start Did Not Enter Auto Boundary
+
+Auto Boundary is the default only for a fresh interactive `start --from-env`
+with no existing config, selector, answers file, machine-output flag, or other
+automation input. This preserves every established 1.x route.
+
+Check the generated state:
+
+```bash
+synapsor-runner boundary status --json
+```
+
+To draft explicitly without prompts or a browser:
+
+```bash
+synapsor-runner boundary draft \
+  --from-env DATABASE_URL \
+  --schema public \
+  --project-root . \
+  --json
+```
+
+## Scoped Explore Is Not Advertised
+
+This is correct unless all authoring prerequisites pass. Explore is disabled by
+default and never appears in production, unknown-profile, shared HTTP, remote,
+or non-loopback `tools/list`.
+
+Check:
+
+```bash
+synapsor-runner boundary status --json
+synapsor-runner boundary diff --json
+synapsor-runner mcp status cursor --project
+```
+
+The exact boundary digest must be active, the profile must explicitly be
+`development` or `staging`, the generation lock and compiler/Spec versions
+must be current, and the inspected database role must still be SELECT-only,
+non-owner, non-superuser, and not `BYPASSRLS`. Runner also enforces a read-only
+transaction for every Explore call.
+
+A write-capable, owner, superuser, `BYPASSRLS`, or unverifiable credential may
+still inspect metadata with a warning. It cannot enable source-row Explore.
+Use a dedicated staging reader instead of weakening this check.
+
+## Cursor Has Production Tools Instead Of Authoring Tools
+
+Install the managed local authoring entry only after boundary activation:
+
+```bash
+synapsor-runner mcp install cursor \
+  --project \
+  --authoring \
+  --project-root . \
+  --yes
+```
+
+Authoring status reports exactly `app.describe_data` and `app.explore_data`.
+After Protect and exact-digest activation, replace that entry with the
+production config. The protected named capability remains available while
+Explore disappears:
+
+```bash
+synapsor-runner mcp install cursor \
+  --project \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db \
+  --yes
+```
+
+## Boundary Became Stale After A Schema Or Grant Change
+
+Generated authority is bound to the schema, role, grants, ownership, RLS
+posture, compiler, and canonical Spec fingerprint:
+
+```bash
+synapsor-runner boundary diff --json
+```
+
+Additive fields receive no implicit authority. Breaking or posture drift fails
+closed only for lock-bound generated authority. Regenerate, review the semantic
+diff, and activate the new exact digest. Existing manually authored projects
+without a generation lock retain their previous behavior.
+
+## Aggregate Explore Suppressed Or Refused A Result
+
+Suppression and budget failures are security behavior, not query failures.
+Workbench shows the reviewed minimum cohort, maximum groups, response limits,
+and durable extraction/differencing budgets. You cannot widen them in a model
+argument.
+
+Use a larger legitimate cohort or protect a narrower reviewed question. Do not
+work around suppression with repeated slightly different filters: Runner
+records normalized redacted plan metadata and exhausts the differencing budget.
+Returned rows/groups, trusted tenant/principal values, credentials, and raw
+sensitive literals are not stored in the query audit.
+
 ## Safe Action Draft Does Not Appear As A Tool
 
 This is expected before activation. `start --action`, agent edits, `action
@@ -266,6 +364,82 @@ Fix:
 Use a read-only credential for MCP reads and a separate writer credential only
 for trusted apply.
 
+## Freshness Check Is Stale
+
+What happened:
+
+```text
+Freshness: stale
+code: FRESHNESS_TARGET_STALE
+```
+
+or:
+
+```text
+code: FRESHNESS_DEPENDENCY_STALE
+```
+
+Why it matters:
+
+The proposal target or one explicitly declared supporting row no longer has
+the exact version captured by the immutable proposal. Runner records no
+approval and never updates the old proposal to match current data.
+
+Fix:
+
+Perform a new reviewed source read and create a new proposal. Do not retry
+approval on the stale proposal or edit its stored JSON.
+
+## Freshness Check Is Unavailable
+
+What happened:
+
+```text
+Freshness: unavailable
+code: FRESHNESS_TEMPORARILY_UNAVAILABLE
+```
+
+Why it matters:
+
+Runner could not prove current source state. Unavailability is not treated as
+fresh, and no approval was recorded.
+
+Fix:
+
+Restore the read connection or resolve the transient database/pool issue, then
+retry:
+
+```bash
+synapsor-runner proposals check-freshness latest \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db
+```
+
+## Freshness Writer Lock Probe Failed
+
+What happened:
+
+`doctor --check-writeback` reports that the writer cannot lock a declared
+supporting dependency.
+
+Why it matters:
+
+Approval-time reads alone cannot provide the final atomic guarantee. The direct
+SQL adapter must lock and compare every dependency inside the mutation
+transaction.
+
+Fix:
+
+Grant only the narrow table/column privilege required for the writer's
+`SELECT ... FOR UPDATE` locking read, then rerun:
+
+```bash
+synapsor-runner doctor --check-writeback --config ./synapsor.runner.json
+```
+
+Do not replace this with an overprivileged owner/superuser role. See
+[Proposal And Evidence Freshness](proposal-evidence-freshness.md).
+
 ## MCP Client Config Contains A Secret
 
 What happened:

package/docs/writeback-executors.md

@@ -250,3 +250,11 @@ Executor secrets are never exposed over MCP. The model never receives:
 
 `MCP tool call = request/proposal authority. Trusted runner = execution
 authority.`
+
+Optional Runner `proposal_freshness` adds pre-approval and final-transaction
+checks only to same-source direct SQL writeback. It is deliberately rejected
+for HTTP/command handlers and cross-source dependencies: Runner cannot claim an
+atomic source check around an externally owned transaction. Handler authors
+must implement equivalent scope, exact-version, locking, idempotency, and
+receipt semantics themselves. See
+[Proposal And Evidence Freshness](proposal-evidence-freshness.md).

package/examples/auto-boundary-churn/README.md

@@ -0,0 +1,23 @@
+# Auto Boundary Churn Fixture
+
+This synthetic staging fixture is the measured Runner 1.6.0 golden path:
+PostgreSQL, Next.js, Prisma, Cursor-compatible local MCP, and the local
+Workbench.
+
+The database role is SELECT-only, non-owner, non-superuser, and subject to
+forced tenant/principal RLS. The data includes reviewed churn cohorts, a
+cross-tenant denial case, kept-out fields, and cohorts below the privacy
+threshold.
+
+Run the automated acceptance path from the repository root:
+
+```bash
+corepack pnpm test:auto-boundary-explore
+corepack pnpm test:auto-boundary-explore:packed
+```
+
+The packed gate uses only packed public artifacts for the complete journey:
+disabled whole-schema draft, digest activation, two Cursor authoring tools,
+privacy-suppressed weekly churn analysis, denial and differencing tests,
+Protect This Query, production Explore removal, and the surviving named
+capability. No source row is mutated.

package/examples/auto-boundary-churn/app/page.tsx

@@ -0,0 +1,8 @@
+export default function ChurnOverview() {
+  return (
+    <main>
+      <h1>Subscription churn review</h1>
+      <p>This synthetic staging application is used by the Synapsor Auto Boundary acceptance test.</p>
+    </main>
+  );
+}

package/examples/auto-boundary-churn/docker-compose.yml

@@ -0,0 +1,16 @@
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_DB: synapsor_auto_boundary
+      POSTGRES_USER: synapsor_admin
+      POSTGRES_PASSWORD: synapsor_admin_password
+    ports:
+      - "127.0.0.1:55460:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "test \"$(psql -U synapsor_admin -d synapsor_auto_boundary -tAc \"SELECT pg_postmaster_start_time() > initialized_at FROM public.synapsor_fixture_ready LIMIT 1\" 2>/dev/null | xargs)\" = t"]
+      interval: 1s
+      timeout: 3s
+      retries: 40
+    volumes:
+      - ./seed/postgres.sql:/docker-entrypoint-initdb.d/001-schema.sql:ro

package/examples/auto-boundary-churn/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "synapsor-auto-boundary-churn",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev"
+  },
+  "dependencies": {
+    "@prisma/client": "^6.0.0",
+    "next": "^15.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "prisma": "^6.0.0",
+    "typescript": "^5.8.0"
+  }
+}

package/examples/auto-boundary-churn/prisma/schema.prisma

@@ -0,0 +1,36 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model Account {
+  id                String       @id
+  tenantId          String       @map("tenant_id")
+  ownerId           String       @map("owner_id")
+  region            String
+  segment           String
+  customerEmail     String       @map("customer_email")
+  internalRiskScore Int          @map("internal_risk_score")
+  churnEvents       ChurnEvent[]
+
+  @@map("accounts")
+}
+
+model ChurnEvent {
+  id                  String   @id
+  tenantId            String   @map("tenant_id")
+  ownerId             String   @map("owner_id")
+  accountId           String   @map("account_id")
+  reasonCategory      String   @map("reason_category")
+  monthlyRevenueCents Int      @map("monthly_revenue_cents")
+  churnedAt           DateTime @map("churned_at") @db.Timestamptz(6)
+  privateNote         String   @map("private_note")
+  account             Account  @relation(fields: [accountId], references: [id])
+
+  @@index([tenantId, churnedAt])
+  @@map("churn_events")
+}

package/examples/auto-boundary-churn/seed/postgres.sql

@@ -0,0 +1,126 @@
+CREATE TABLE public.accounts (
+  id text PRIMARY KEY,
+  tenant_id text NOT NULL,
+  owner_id text NOT NULL,
+  region text NOT NULL CHECK (region IN ('east', 'north', 'south', 'west')),
+  segment text NOT NULL CHECK (segment IN ('enterprise', 'growth', 'startup')),
+  customer_email text NOT NULL,
+  internal_risk_score integer NOT NULL
+);
+
+CREATE TABLE public.churn_events (
+  id text PRIMARY KEY,
+  tenant_id text NOT NULL,
+  owner_id text NOT NULL,
+  account_id text NOT NULL REFERENCES public.accounts(id) ON DELETE RESTRICT,
+  reason_category text NOT NULL CHECK (reason_category IN ('onboarding', 'price', 'product', 'service')),
+  monthly_revenue_cents integer NOT NULL CHECK (monthly_revenue_cents >= 0),
+  churned_at timestamptz NOT NULL,
+  private_note text NOT NULL
+);
+
+CREATE INDEX churn_events_tenant_time_idx
+  ON public.churn_events(tenant_id, churned_at);
+
+WITH groups(prefix, tenant_id, owner_id, region, segment, reason_category, churned_at, group_size, revenue) AS (
+  VALUES
+    ('p1-west-price', 'acme', 'pm-1', 'west', 'growth', 'price', '2026-06-03T12:00:00Z'::timestamptz, 5, 12000),
+    ('p1-east-service', 'acme', 'pm-1', 'east', 'enterprise', 'service', '2026-06-10T12:00:00Z'::timestamptz, 5, 22000),
+    ('p1-north-product', 'acme', 'pm-1', 'north', 'startup', 'product', '2026-06-17T12:00:00Z'::timestamptz, 2, 5000),
+    ('p2-west-price', 'acme', 'pm-1', 'west', 'growth', 'price', '2026-07-08T12:00:00Z'::timestamptz, 10, 13000),
+    ('p2-east-service', 'acme', 'pm-1', 'east', 'enterprise', 'service', '2026-07-15T12:00:00Z'::timestamptz, 7, 23000),
+    ('p2-south-onboarding', 'acme', 'pm-1', 'south', 'startup', 'onboarding', '2026-07-22T12:00:00Z'::timestamptz, 5, 7000),
+    ('p2-north-product', 'acme', 'pm-1', 'north', 'startup', 'product', '2026-07-22T12:00:00Z'::timestamptz, 1, 6000),
+    ('other-west-price', 'globex', 'pm-2', 'west', 'enterprise', 'price', '2026-07-08T12:00:00Z'::timestamptz, 8, 99000)
+)
+INSERT INTO public.accounts (
+  id,
+  tenant_id,
+  owner_id,
+  region,
+  segment,
+  customer_email,
+  internal_risk_score
+)
+SELECT
+  prefix || '-' || item,
+  tenant_id,
+  owner_id,
+  region,
+  segment,
+  prefix || '-' || item || '@example.invalid',
+  900 + item
+FROM groups
+CROSS JOIN LATERAL generate_series(1, group_size) AS item;
+
+WITH groups(prefix, tenant_id, owner_id, reason_category, churned_at, group_size, revenue) AS (
+  VALUES
+    ('p1-west-price', 'acme', 'pm-1', 'price', '2026-06-03T12:00:00Z'::timestamptz, 5, 12000),
+    ('p1-east-service', 'acme', 'pm-1', 'service', '2026-06-10T12:00:00Z'::timestamptz, 5, 22000),
+    ('p1-north-product', 'acme', 'pm-1', 'product', '2026-06-17T12:00:00Z'::timestamptz, 2, 5000),
+    ('p2-west-price', 'acme', 'pm-1', 'price', '2026-07-08T12:00:00Z'::timestamptz, 10, 13000),
+    ('p2-east-service', 'acme', 'pm-1', 'service', '2026-07-15T12:00:00Z'::timestamptz, 7, 23000),
+    ('p2-south-onboarding', 'acme', 'pm-1', 'onboarding', '2026-07-22T12:00:00Z'::timestamptz, 5, 7000),
+    ('p2-north-product', 'acme', 'pm-1', 'product', '2026-07-22T12:00:00Z'::timestamptz, 1, 6000),
+    ('other-west-price', 'globex', 'pm-2', 'price', '2026-07-08T12:00:00Z'::timestamptz, 8, 99000)
+)
+INSERT INTO public.churn_events (
+  id,
+  tenant_id,
+  owner_id,
+  account_id,
+  reason_category,
+  monthly_revenue_cents,
+  churned_at,
+  private_note
+)
+SELECT
+  'event-' || prefix || '-' || item,
+  tenant_id,
+  owner_id,
+  prefix || '-' || item,
+  reason_category,
+  revenue,
+  churned_at,
+  'synthetic kept-out note ' || prefix || '-' || item
+FROM groups
+CROSS JOIN LATERAL generate_series(1, group_size) AS item;
+
+ALTER TABLE public.accounts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.accounts FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.churn_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.churn_events FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY accounts_trusted_scope ON public.accounts
+  FOR SELECT
+  USING (
+    tenant_id = current_setting('app.tenant_id', true)
+    AND owner_id = current_setting('app.principal', true)
+  );
+
+CREATE POLICY churn_events_trusted_scope ON public.churn_events
+  FOR SELECT
+  USING (
+    tenant_id = current_setting('app.tenant_id', true)
+    AND owner_id = current_setting('app.principal', true)
+  );
+
+DO $$
+BEGIN
+  CREATE ROLE synapsor_churn_reader LOGIN PASSWORD 'synapsor_churn_reader_password';
+EXCEPTION WHEN duplicate_object THEN NULL;
+END
+$$;
+
+ALTER ROLE synapsor_churn_reader SET default_transaction_read_only = on;
+GRANT CONNECT ON DATABASE synapsor_auto_boundary TO synapsor_churn_reader;
+GRANT USAGE ON SCHEMA public TO synapsor_churn_reader;
+GRANT SELECT ON public.accounts, public.churn_events TO synapsor_churn_reader;
+
+-- The image entrypoint runs these statements under a temporary postmaster and
+-- then restarts PostgreSQL. Compose reports healthy only after that final
+-- postmaster starts, preventing first-client disconnects in CI.
+CREATE TABLE public.synapsor_fixture_ready (
+  initialized_at timestamptz NOT NULL
+);
+INSERT INTO public.synapsor_fixture_ready (initialized_at) VALUES (clock_timestamp());

package/fixtures/compatibility/published-1.5.4/manifest.json

@@ -0,0 +1,76 @@
+{
+  "schema_version": "synapsor.published-compatibility.v1",
+  "published_packages": {
+    "@synapsor/runner": {
+      "version": "1.5.4",
+      "npm_shasum": "63ef030b0360118082bc670239ad4927673b6bc7"
+    },
+    "@synapsor/dsl": {
+      "version": "1.4.4",
+      "npm_shasum": "dee671d3c3d25f5434b488f80b3041d0c5606c2f"
+    },
+    "@synapsor/spec": {
+      "version": "1.4.2",
+      "npm_shasum": "cb9aa813f481ef14d542a1896c228159aab86353"
+    }
+  },
+  "contracts": [
+    {
+      "path": "packages/spec/fixtures/valid/basic-read.contract.json",
+      "source_sha256": "5ec499965f639d784603b7942390d18a3e742d79e4d510dbea470e166a743972",
+      "canonical_sha256": "9d3addfde77eb6528aae7b9e81ae0f582b5c002aa77ebb2d7381fe663f5f5b1e"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/aggregate-read/contract.json",
+      "source_sha256": "830bc208b749bb9ed6a4b4468571d58d68bc8a2b6e1072fc45fb87d1c68697e7",
+      "canonical_sha256": "ccc6ea17f449bfc207d1cea70ef3320d575c450a3904c850dcb631132c6e5602"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/proposal-capability/contract.json",
+      "source_sha256": "d4c25fb8f79f04c13bdb3daf8c18a44d4f1c61596660a67bf35d46d0f94f4100",
+      "canonical_sha256": "d895081246d41a072892b5dde6929099302492a77a229033fbfa5052cce34b18"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/bounded-set-threats/contract.json",
+      "source_sha256": "c902d45457789a6d87504ca434c8b299f3e09be779f3bfdf7bbd8684d575a10e",
+      "canonical_sha256": "64c7078ff1687762d95c17873238759b3572dce499f903a8d6f1aaa8faae5f24"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/reversible-change-sets/contract.json",
+      "source_sha256": "7e4f8da90a4b235097f76e70a7f550153bbf62d219e7ef6f4f2194f6c36fa205",
+      "canonical_sha256": "181f2e93ad3c53b9a1345a4ed6c8b5e24ab0201c00159f38659f0c2a00c037de"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/principal-row-scope/contract.json",
+      "source_sha256": "00a05c1f4e82cc9c4e5d2d68c9c9201cd9512ac42d63292314bb7b4845026996",
+      "canonical_sha256": "fc96a5327ab0f4b311c90da9b5585348e81349ed66bd3a22e41e5f29804c32a8"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/approval-quorum/contract.json",
+      "source_sha256": "dde6b328f648ba60d837fa363494d764d7eb0d2d9a8a81ff70a9c077edde410c",
+      "canonical_sha256": "9407a7d0cc4439c773c3caf721aaed6c6e163c403fa67518632829d8c5de33e7"
+    }
+  ],
+  "dsl_sources": [
+    {
+      "path": "packages/dsl/examples/aggregate-read.synapsor.sql",
+      "source_sha256": "bccac4c2eb0ab7b2fc099c7fb3f6fdc25ee2e6e534282aa19b46f0aec8191b8d",
+      "canonical_sha256": "0cc2d892f00a31a3582d773812a26c6c45c0ce343e1d8d09da226a5bbb7c93eb"
+    },
+    {
+      "path": "packages/dsl/examples/billing-late-fee.synapsor.sql",
+      "source_sha256": "f5c462cff7aa0cd01a08543c6096ee1d225ebba449d65b7470815b1aa7ec42cd",
+      "canonical_sha256": "d495df575d64e798a730dad385e097dfc2c2f371a1505865bc45179ad3c479f2"
+    },
+    {
+      "path": "packages/dsl/examples/bounded-set-multi-term.synapsor.sql",
+      "source_sha256": "0ae199034ebba8b25146435c911576118f948b55b54636a5e68f46002cd1c6dd",
+      "canonical_sha256": "5b3e84cf8f5062a8afcd50763bde907e6a141977456e74a81d01f8b3a484e422"
+    },
+    {
+      "path": "packages/dsl/examples/principal-row-scope.synapsor.sql",
+      "source_sha256": "08ccd769d633417ea45d478383d9628991f43262223f12c78bbd776202b10253",
+      "canonical_sha256": "e29f2819c267210e54f783c40d0f550d11d0d1de844dbe1590ed8c3405af3cf7"
+    }
+  ]
+}

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/aggregate-read.synapsor.sql

@@ -0,0 +1,21 @@
+CREATE AGENT CONTEXT finance_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY billing.overdue_balance_total
+  DESCRIPTION 'Return one suppressed overdue-balance aggregate for the trusted tenant.'
+  RETURNS HINT 'Returns one scalar or a suppression result; never member rows.'
+  USING CONTEXT finance_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  AGGREGATE READ SUM balance_cents
+  SELECT WHERE status = 'overdue'
+  MIN GROUP SIZE 5
+  KEEP OUT customer_email, private_notes
+  REQUIRE EVIDENCE
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/billing-late-fee.synapsor.sql

@@ -0,0 +1,56 @@
+CREATE AGENT CONTEXT local_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY billing.inspect_invoice
+  DESCRIPTION 'Inspect one invoice in the trusted tenant before proposing a waiver.'
+  RETURNS HINT 'Returns reviewed invoice fields plus evidence/query-audit handles.'
+  USING CONTEXT local_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD updated_at
+  LOOKUP invoice_id BY id
+  ARG invoice_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Invoice id such as INV-3001.'
+  ALLOW READ id, tenant_id, customer_id, status, late_fee_cents, waiver_reason, updated_at
+  KEEP OUT card_token, internal_risk_score
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+END
+
+CREATE CAPABILITY billing.propose_late_fee_waiver
+  DESCRIPTION 'Propose waiving one invoice late fee after inspecting invoice and policy evidence.'
+  RETURNS HINT 'Returns a review-required proposal id, exact diff, evidence handle, and source_database_changed:false.'
+  USING CONTEXT local_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD updated_at
+  LOOKUP invoice_id BY id
+  ARG invoice_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Invoice id such as INV-3001.'
+  ARG waiver_reason TEXT REQUIRED MAX LENGTH 500 DESCRIPTION 'Business reason for the proposed waiver.'
+  ALLOW READ id, tenant_id, customer_id, status, late_fee_cents, waiver_reason, updated_at
+  KEEP OUT card_token, internal_risk_score
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+  PROPOSE ACTION billing.waive_late_fee
+  ALLOW WRITE late_fee_cents, waiver_reason
+  PATCH late_fee_cents = 0
+  PATCH waiver_reason = ARG waiver_reason
+  APPROVAL ROLE billing_lead
+  WRITEBACK DIRECT SQL
+END
+
+CREATE AGENT WORKFLOW billing.late_fee_review
+  USING CONTEXT local_operator
+  ALLOW CAPABILITY billing.inspect_invoice
+  ALLOW CAPABILITY billing.propose_late_fee_waiver
+  REQUIRE EVIDENCE
+  APPROVAL REQUIRED ROLE billing_lead
+  CHECKPOINT PROPOSAL ONLY
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/bounded-set-multi-term.synapsor.sql

@@ -0,0 +1,30 @@
+CREATE AGENT CONTEXT local_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY cases.close_high_risk
+  DESCRIPTION 'Close active high-risk support cases within reviewed row and value caps.'
+  RETURNS HINT 'Returns a proposal for the exact reviewed set; source rows remain unchanged.'
+  USING CONTEXT local_operator
+  SOURCE support_db
+  ON public.support_cases
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD version
+  LOOKUP reason BY id
+  ARG reason STRING REQUIRED MAX LENGTH 100
+  ALLOW READ id, tenant_id, risk_level, case_status, exposure_cents, version
+  REQUIRE EVIDENCE
+  PROPOSE ACTION close_high_risk UPDATE SET
+  SELECT WHERE risk_level = 'high' AND case_status = 'active'
+  MAX ROWS 10
+  MAX TOTAL exposure_cents BEFORE 50000
+  ALLOW WRITE case_status
+  PATCH case_status = 'closed'
+  ADVANCE VERSION version USING INTEGER INCREMENT
+  APPROVAL ROLE support_manager
+  WRITEBACK DIRECT SQL
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/principal-row-scope.synapsor.sql

@@ -0,0 +1,23 @@
+CREATE AGENT CONTEXT care_session
+  BIND hospital_id FROM HTTP_CLAIM hospital_id REQUIRED
+  BIND principal FROM HTTP_CLAIM sub REQUIRED
+  TENANT BINDING hospital_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY care.inspect_assigned_patient
+  DESCRIPTION 'Inspect one patient assigned to the authenticated case manager within the trusted hospital.'
+  RETURNS HINT 'Returns reviewed patient fields and evidence only when both tenant and assignee locks match.'
+  USING CONTEXT care_session
+  SOURCE local_postgres
+  ON public.patients
+  PRIMARY KEY id
+  TENANT KEY hospital_id
+  PRINCIPAL SCOPE KEY assigned_to
+  LOOKUP patient_id BY id
+  ARG patient_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Reviewed patient identifier.'
+  ALLOW READ id, hospital_id, display_name, care_status, updated_at
+  KEEP OUT assigned_to, diagnosis_notes, insurance_member_id
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+END