@synapsor/runner 1.6.2 → 1.6.3

package/examples/fitflow-guided-onboarding/seed/postgres.sql

@@ -0,0 +1,401 @@
+DO $$
+BEGIN
+  CREATE ROLE fitflow_analytics_reader LOGIN PASSWORD 'fitflow_analytics_reader_password';
+EXCEPTION WHEN duplicate_object THEN NULL;
+END
+$$;
+
+DO $$
+BEGIN
+  CREATE ROLE fitflow_trainer_reader LOGIN PASSWORD 'fitflow_trainer_reader_password';
+EXCEPTION WHEN duplicate_object THEN NULL;
+END
+$$;
+
+DO $$
+BEGIN
+  CREATE ROLE fitflow_writer LOGIN PASSWORD 'fitflow_writer_password';
+EXCEPTION WHEN duplicate_object THEN NULL;
+END
+$$;
+
+DO $$
+BEGIN
+  CREATE ROLE fitflow_setup LOGIN PASSWORD 'fitflow_setup_password';
+EXCEPTION WHEN duplicate_object THEN NULL;
+END
+$$;
+
+ALTER ROLE fitflow_analytics_reader SET default_transaction_read_only = on;
+ALTER ROLE fitflow_trainer_reader SET default_transaction_read_only = on;
+
+CREATE TABLE public.organizations (
+  id text PRIMARY KEY,
+  name text NOT NULL
+);
+
+CREATE TABLE public.locations (
+  id text PRIMARY KEY,
+  organization_id text NOT NULL REFERENCES public.organizations(id) ON DELETE RESTRICT,
+  name text NOT NULL,
+  region text NOT NULL CHECK (region IN ('central', 'east', 'north', 'south', 'west')),
+  UNIQUE (organization_id, name)
+);
+
+CREATE TABLE public.trainers (
+  id text PRIMARY KEY,
+  organization_id text NOT NULL REFERENCES public.organizations(id) ON DELETE RESTRICT,
+  display_name text NOT NULL
+);
+
+CREATE TABLE public.members (
+  id text PRIMARY KEY,
+  organization_id text NOT NULL REFERENCES public.organizations(id) ON DELETE RESTRICT,
+  location_id text NOT NULL REFERENCES public.locations(id) ON DELETE RESTRICT,
+  assigned_trainer_id text NOT NULL REFERENCES public.trainers(id) ON DELETE RESTRICT,
+  membership_status text NOT NULL CHECK (membership_status IN ('active', 'frozen', 'cancelled')),
+  membership_tier text NOT NULL CHECK (membership_tier IN ('basic', 'plus', 'elite')),
+  loyalty_balance integer NOT NULL CHECK (loyalty_balance BETWEEN 0 AND 10000),
+  version integer NOT NULL DEFAULT 1 CHECK (version >= 1),
+  payment_method text NOT NULL,
+  home_address text NOT NULL,
+  medical_waiver_notes text NOT NULL
+);
+
+CREATE INDEX members_trusted_scope_idx
+  ON public.members(organization_id, assigned_trainer_id);
+
+CREATE TABLE public.classes (
+  id text PRIMARY KEY,
+  organization_id text NOT NULL REFERENCES public.organizations(id) ON DELETE RESTRICT,
+  location_id text NOT NULL REFERENCES public.locations(id) ON DELETE RESTRICT,
+  trainer_id text NOT NULL REFERENCES public.trainers(id) ON DELETE RESTRICT,
+  class_type text NOT NULL CHECK (class_type IN ('cycling', 'strength', 'yoga')),
+  starts_at timestamptz NOT NULL
+);
+
+CREATE TABLE public.check_ins (
+  id text PRIMARY KEY,
+  organization_id text NOT NULL REFERENCES public.organizations(id) ON DELETE RESTRICT,
+  location_id text NOT NULL REFERENCES public.locations(id) ON DELETE RESTRICT,
+  member_id text NOT NULL REFERENCES public.members(id) ON DELETE RESTRICT,
+  class_id text NOT NULL REFERENCES public.classes(id) ON DELETE RESTRICT,
+  outcome text NOT NULL CHECK (outcome IN ('attended', 'late_cancel', 'no_show')),
+  checked_in_at timestamptz NOT NULL
+);
+
+CREATE INDEX check_ins_tenant_time_idx
+  ON public.check_ins(organization_id, checked_in_at);
+
+-- A realistic application has much more schema than the first agent pack
+-- needs. These metadata-only subsystems exercise whole-application review
+-- without adding irrelevant rows to the onboarding result.
+DO $$
+DECLARE
+  relation_name text;
+BEGIN
+  FOREACH relation_name IN ARRAY ARRAY[
+    'plans',
+    'membership_events',
+    'membership_freezes',
+    'membership_cancellations',
+    'class_bookings',
+    'class_waitlists',
+    'attendance_adjustments',
+    'trainer_certifications',
+    'trainer_schedules',
+    'staff_users',
+    'staff_roles',
+    'location_hours',
+    'rooms',
+    'equipment',
+    'equipment_maintenance',
+    'workout_programs',
+    'workout_exercises',
+    'member_goals',
+    'body_metrics',
+    'health_flags',
+    'waivers',
+    'billing_accounts',
+    'payment_methods',
+    'invoices',
+    'invoice_items',
+    'payments',
+    'refunds',
+    'promo_codes',
+    'member_promotions',
+    'leads',
+    'referrals',
+    'campaigns',
+    'notification_preferences',
+    'support_tickets'
+  ]
+  LOOP
+    EXECUTE format(
+      'CREATE TABLE public.%I (
+        id text PRIMARY KEY,
+        organization_id text NOT NULL REFERENCES public.organizations(id) ON DELETE RESTRICT,
+        status text NOT NULL,
+        created_at timestamptz NOT NULL DEFAULT clock_timestamp()
+      )',
+      relation_name
+    );
+  END LOOP;
+END
+$$;
+
+INSERT INTO public.organizations (id, name) VALUES
+  ('org-fitflow', 'FitFlow'),
+  ('org-other', 'Other Fitness');
+
+INSERT INTO public.locations (id, organization_id, name, region) VALUES
+  ('loc-downtown', 'org-fitflow', 'Downtown', 'central'),
+  ('loc-east', 'org-fitflow', 'Eastside', 'east'),
+  ('loc-north', 'org-fitflow', 'North Loop', 'north'),
+  ('loc-other', 'org-other', 'Other Downtown', 'west');
+
+INSERT INTO public.trainers (id, organization_id, display_name) VALUES
+  ('trainer-alex', 'org-fitflow', 'Alex'),
+  ('trainer-jordan', 'org-fitflow', 'Jordan'),
+  ('trainer-other', 'org-other', 'Other Trainer');
+
+WITH member_rows AS (
+  SELECT
+    item,
+    CASE
+      WHEN item <= 12 THEN 'loc-downtown'
+      WHEN item <= 22 THEN 'loc-east'
+      ELSE 'loc-north'
+    END AS location_id,
+    CASE WHEN item % 2 = 0 THEN 'trainer-alex' ELSE 'trainer-jordan' END AS trainer_id,
+    CASE WHEN item % 7 = 0 THEN 'frozen' ELSE 'active' END AS status,
+    CASE WHEN item % 3 = 0 THEN 'elite' WHEN item % 2 = 0 THEN 'plus' ELSE 'basic' END AS tier
+  FROM generate_series(1, 30) AS item
+)
+INSERT INTO public.members (
+  id,
+  organization_id,
+  location_id,
+  assigned_trainer_id,
+  membership_status,
+  membership_tier,
+  loyalty_balance,
+  version,
+  payment_method,
+  home_address,
+  medical_waiver_notes
+)
+SELECT
+  'member-' || lpad(item::text, 3, '0'),
+  'org-fitflow',
+  location_id,
+  trainer_id,
+  status,
+  tier,
+  item * 10,
+  1,
+  'synthetic-card-token-' || item,
+  item || ' Synthetic Street',
+  'synthetic private medical note ' || item
+FROM member_rows;
+
+INSERT INTO public.members (
+  id,
+  organization_id,
+  location_id,
+  assigned_trainer_id,
+  membership_status,
+  membership_tier,
+  loyalty_balance,
+  version,
+  payment_method,
+  home_address,
+  medical_waiver_notes
+) VALUES (
+  'other-member-001',
+  'org-other',
+  'loc-other',
+  'trainer-other',
+  'active',
+  'elite',
+  9999,
+  1,
+  'other-secret-payment',
+  'Other Tenant Address',
+  'other tenant private medical note'
+);
+
+INSERT INTO public.classes (id, organization_id, location_id, trainer_id, class_type, starts_at) VALUES
+  ('class-downtown-w1', 'org-fitflow', 'loc-downtown', 'trainer-alex', 'strength', '2026-07-06T17:00:00Z'),
+  ('class-downtown-w2', 'org-fitflow', 'loc-downtown', 'trainer-alex', 'cycling', '2026-07-13T17:00:00Z'),
+  ('class-east-w1', 'org-fitflow', 'loc-east', 'trainer-jordan', 'yoga', '2026-07-06T18:00:00Z'),
+  ('class-north-w2', 'org-fitflow', 'loc-north', 'trainer-jordan', 'strength', '2026-07-13T18:00:00Z'),
+  ('class-other', 'org-other', 'loc-other', 'trainer-other', 'cycling', '2026-07-13T19:00:00Z');
+
+WITH groups(prefix, organization_id, location_id, class_id, outcome, checked_in_at, first_member, group_size) AS (
+  VALUES
+    ('downtown-w1', 'org-fitflow', 'loc-downtown', 'class-downtown-w1', 'attended', '2026-07-06T17:00:00Z'::timestamptz, 1, 6),
+    ('downtown-w2', 'org-fitflow', 'loc-downtown', 'class-downtown-w2', 'attended', '2026-07-13T17:00:00Z'::timestamptz, 1, 9),
+    ('east-w1', 'org-fitflow', 'loc-east', 'class-east-w1', 'late_cancel', '2026-07-06T18:00:00Z'::timestamptz, 13, 5),
+    ('north-w2', 'org-fitflow', 'loc-north', 'class-north-w2', 'no_show', '2026-07-13T18:00:00Z'::timestamptz, 23, 2)
+)
+INSERT INTO public.check_ins (
+  id,
+  organization_id,
+  location_id,
+  member_id,
+  class_id,
+  outcome,
+  checked_in_at
+)
+SELECT
+  'checkin-' || prefix || '-' || item,
+  organization_id,
+  location_id,
+  'member-' || lpad((first_member + item - 1)::text, 3, '0'),
+  class_id,
+  outcome,
+  checked_in_at
+FROM groups
+CROSS JOIN LATERAL generate_series(1, group_size) AS item;
+
+INSERT INTO public.check_ins (
+  id,
+  organization_id,
+  location_id,
+  member_id,
+  class_id,
+  outcome,
+  checked_in_at
+)
+SELECT
+  'other-checkin-' || item,
+  'org-other',
+  'loc-other',
+  'other-member-001',
+  'class-other',
+  'attended',
+  '2026-07-13T19:00:00Z'::timestamptz
+FROM generate_series(1, 8) AS item;
+
+ALTER TABLE public.organizations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.organizations FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.locations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.locations FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.trainers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.trainers FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.members ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.members FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.classes ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.classes FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.check_ins ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.check_ins FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY organizations_org_read ON public.organizations
+  FOR SELECT TO fitflow_analytics_reader, fitflow_trainer_reader, fitflow_writer
+  USING (id = current_setting('app.tenant_id', true));
+
+CREATE POLICY locations_org_read ON public.locations
+  FOR SELECT TO fitflow_analytics_reader, fitflow_trainer_reader, fitflow_writer
+  USING (organization_id = current_setting('app.tenant_id', true));
+
+CREATE POLICY trainers_org_read ON public.trainers
+  FOR SELECT TO fitflow_analytics_reader, fitflow_trainer_reader, fitflow_writer
+  USING (organization_id = current_setting('app.tenant_id', true));
+
+CREATE POLICY members_analytics_read ON public.members
+  FOR SELECT TO fitflow_analytics_reader
+  USING (organization_id = current_setting('app.tenant_id', true));
+
+CREATE POLICY members_trainer_read ON public.members
+  FOR SELECT TO fitflow_trainer_reader, fitflow_writer
+  USING (
+    organization_id = current_setting('app.tenant_id', true)
+    AND assigned_trainer_id = current_setting('app.principal', true)
+  );
+
+CREATE POLICY members_guarded_update ON public.members
+  FOR UPDATE TO fitflow_writer
+  USING (
+    organization_id = current_setting('app.tenant_id', true)
+    AND assigned_trainer_id = current_setting('app.principal', true)
+  )
+  WITH CHECK (
+    organization_id = current_setting('app.tenant_id', true)
+    AND assigned_trainer_id = current_setting('app.principal', true)
+  );
+
+CREATE POLICY classes_org_read ON public.classes
+  FOR SELECT TO fitflow_analytics_reader, fitflow_trainer_reader, fitflow_writer
+  USING (organization_id = current_setting('app.tenant_id', true));
+
+CREATE POLICY check_ins_org_read ON public.check_ins
+  FOR SELECT TO fitflow_analytics_reader
+  USING (organization_id = current_setting('app.tenant_id', true));
+
+DO $$
+DECLARE
+  relation_name text;
+BEGIN
+  FOREACH relation_name IN ARRAY ARRAY[
+    'plans',
+    'membership_events',
+    'membership_freezes',
+    'membership_cancellations',
+    'class_bookings',
+    'class_waitlists',
+    'attendance_adjustments',
+    'trainer_certifications',
+    'trainer_schedules',
+    'staff_users',
+    'staff_roles',
+    'location_hours',
+    'rooms',
+    'equipment',
+    'equipment_maintenance',
+    'workout_programs',
+    'workout_exercises',
+    'member_goals',
+    'body_metrics',
+    'health_flags',
+    'waivers',
+    'billing_accounts',
+    'payment_methods',
+    'invoices',
+    'invoice_items',
+    'payments',
+    'refunds',
+    'promo_codes',
+    'member_promotions',
+    'leads',
+    'referrals',
+    'campaigns',
+    'notification_preferences',
+    'support_tickets'
+  ]
+  LOOP
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', relation_name);
+    EXECUTE format('ALTER TABLE public.%I FORCE ROW LEVEL SECURITY', relation_name);
+    EXECUTE format(
+      'CREATE POLICY %I ON public.%I
+       FOR SELECT TO fitflow_analytics_reader
+       USING (organization_id = current_setting(''app.tenant_id'', true))',
+      relation_name || '_org_read',
+      relation_name
+    );
+    EXECUTE format('GRANT SELECT ON public.%I TO fitflow_analytics_reader', relation_name);
+  END LOOP;
+END
+$$;
+
+GRANT CONNECT ON DATABASE fitflow TO fitflow_analytics_reader, fitflow_trainer_reader, fitflow_writer, fitflow_setup;
+GRANT USAGE ON SCHEMA public TO fitflow_analytics_reader, fitflow_trainer_reader, fitflow_writer, fitflow_setup;
+GRANT SELECT ON public.organizations, public.locations, public.trainers, public.members, public.classes, public.check_ins TO fitflow_analytics_reader;
+GRANT SELECT ON public.organizations, public.locations, public.trainers, public.members, public.classes TO fitflow_trainer_reader;
+GRANT SELECT, UPDATE (membership_status, loyalty_balance, version) ON public.members TO fitflow_writer;
+GRANT CREATE ON SCHEMA public TO fitflow_setup;
+
+CREATE TABLE public.synapsor_fixture_ready (
+  initialized_at timestamptz NOT NULL
+);
+INSERT INTO public.synapsor_fixture_ready (initialized_at) VALUES (clock_timestamp());

package/examples/operator-oidc/issuer.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import http from "node:http";
+
+const issuer = process.env.SYNAPSOR_EXAMPLE_OIDC_ISSUER
+  ?? "https://identity.example.test/oidc";
+const audience = process.env.SYNAPSOR_EXAMPLE_OIDC_AUDIENCE
+  ?? "synapsor-operators";
+const host = "127.0.0.1";
+const requestedPort = Number(process.env.SYNAPSOR_EXAMPLE_OIDC_PORT ?? "0");
+
+const primary = rsaSigner("fitflow-key-1");
+const rotated = rsaSigner("fitflow-key-2");
+const untrusted = rsaSigner("untrusted-key");
+let rotationEnabled = false;
+
+const tokenCases = {
+  reviewer: () => token(primary, {
+    sub: "reviewer@example.test",
+    groups: ["membership_reviewer"],
+  }),
+  applier: () => token(rotated, {
+    sub: "writeback@example.test",
+    groups: ["writeback_operator"],
+  }),
+  missing_role: () => token(primary, {
+    sub: "trainer@example.test",
+    groups: ["trainer"],
+  }),
+  similar_role: () => token(primary, {
+    sub: "reviewer-backup@example.test",
+    groups: ["membership_reviewer_backup"],
+  }),
+  bad_signature: () => token(untrusted, {
+    sub: "attacker@example.test",
+    groups: ["membership_reviewer"],
+  }, { kid: primary.kid }),
+  unknown_key: () => token(untrusted, {
+    sub: "unknown-key@example.test",
+    groups: ["membership_reviewer"],
+  }),
+  expired: () => token(primary, {
+    sub: "expired@example.test",
+    groups: ["membership_reviewer"],
+  }, { expiresAt: epoch() - 60 }),
+  not_yet_valid: () => token(primary, {
+    sub: "future@example.test",
+    groups: ["membership_reviewer"],
+  }, { notBefore: epoch() + 600 }),
+  wrong_issuer: () => token(primary, {
+    sub: "wrong-issuer@example.test",
+    groups: ["membership_reviewer"],
+    iss: "https://wrong.example.test/oidc",
+  }),
+  wrong_audience: () => token(primary, {
+    sub: "wrong-audience@example.test",
+    groups: ["membership_reviewer"],
+    aud: "another-service",
+  }),
+  unsafe_subject: () => token(primary, {
+    sub: "unsafe subject with spaces",
+    groups: ["membership_reviewer"],
+  }),
+  malformed_roles: () => token(primary, {
+    sub: "malformed-roles@example.test",
+    groups: { membership_reviewer: true },
+  }),
+  missing_expiry: () => token(primary, {
+    sub: "missing-expiry@example.test",
+    groups: ["membership_reviewer"],
+  }, { omitExpiry: true }),
+};
+
+const server = http.createServer((request, response) => {
+  const url = new URL(request.url ?? "/", `http://${host}`);
+  response.setHeader("cache-control", "no-store");
+
+  if (request.method === "GET" && url.pathname === "/jwks") {
+    return json(response, 200, {
+      keys: rotationEnabled ? [primary.publicJwk, rotated.publicJwk] : [primary.publicJwk],
+    });
+  }
+
+  if (request.method === "POST" && url.pathname === "/rotate") {
+    rotationEnabled = true;
+    return json(response, 200, {
+      ok: true,
+      active_kids: [primary.kid, rotated.kid],
+    });
+  }
+
+  const match = request.method === "GET"
+    ? url.pathname.match(/^\/token\/([a-z_]+)$/)
+    : undefined;
+  const mint = match ? tokenCases[match[1]] : undefined;
+  if (mint) {
+    return json(response, 200, {
+      access_token: mint(),
+      token_type: "Bearer",
+      expires_in: 300,
+    });
+  }
+
+  return json(response, 404, { error: "not_found" });
+});
+
+server.listen(requestedPort, host, () => {
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    process.stderr.write("OIDC fixture did not bind a TCP port.\n");
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(`${JSON.stringify({
+    fixture: "synapsor.operator-oidc.v1",
+    base_url: `http://${host}:${address.port}`,
+    jwks_url: `http://${host}:${address.port}/jwks`,
+    issuer,
+    audience,
+    approval_role: "membership_reviewer",
+    apply_role: "writeback_operator",
+    group_mapping: {
+      "example-membership-reviewers": "membership_reviewer",
+      "example-writeback-operators": "writeback_operator",
+    },
+  })}\n`);
+});
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => {
+    server.close(() => process.exit(0));
+  });
+}
+
+function rsaSigner(kid) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    publicExponent: 0x10001,
+  });
+  return {
+    kid,
+    privateKey,
+    publicJwk: {
+      ...publicKey.export({ format: "jwk" }),
+      kid,
+      alg: "RS256",
+      use: "sig",
+    },
+  };
+}
+
+function token(signer, claims, options = {}) {
+  const now = epoch();
+  const header = {
+    alg: "RS256",
+    kid: options.kid ?? signer.kid,
+    typ: "JWT",
+  };
+  const payload = {
+    iss: issuer,
+    aud: audience,
+    iat: now,
+    nbf: options.notBefore ?? now - 1,
+    ...(!options.omitExpiry ? { exp: options.expiresAt ?? now + 300 } : {}),
+    ...claims,
+  };
+  const signingInput = `${encodeJson(header)}.${encodeJson(payload)}`;
+  const signature = crypto.sign("RSA-SHA256", Buffer.from(signingInput), signer.privateKey);
+  return `${signingInput}.${signature.toString("base64url")}`;
+}
+
+function encodeJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+
+function epoch() {
+  return Math.floor(Date.now() / 1000);
+}
+
+function json(response, status, value) {
+  const body = JSON.stringify(value);
+  response.writeHead(status, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+  });
+  response.end(body);
+}

package/examples/support-plan-credit/README.md

@@ -298,8 +298,12 @@ To disable local policy approval without changing the contract:
 }
 ```
 
-Auto-approval never applies the write. It only records an approval row and audit
-event with actor `policy:<policy_name>`.
+In this example, auto-approval records an approval row and audit event with
+actor `policy:<policy_name>`; apply remains manual. Runner does not start
+automatic execution merely because a contract uses `AUTO APPROVE`. A separately
+trusted supervised worker can apply an eligible proposal only when the contract
+and deployment independently opt into the exact active digest. See
+[`docs/supervised-automatic-apply.md`](../../docs/supervised-automatic-apply.md).
 
 After reviewing the ceilings and running `doctor`, an operator can drain the
 approved queue without letting one stale-row conflict abort the remaining jobs:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@synapsor/runner",
-  "version": "1.6.2",
-  "description": "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
+  "version": "1.6.3",
+  "description": "Open-source MCP runtime for governed Postgres/MySQL access with reviewed capabilities, proposals, guarded writes, receipts, and replay.",
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
@@ -41,10 +41,12 @@
     "examples/dangerous-mcp-tools.json",
     "examples/app-owned-writeback/**",
     "examples/auto-boundary-churn/**",
+    "examples/fitflow-guided-onboarding/**",
     "examples/claude-desktop-postgres/**",
     "examples/cursor-postgres/**",
     "examples/mcp-postgres-billing-app-handler/**",
     "examples/mysql-refund-agent/**",
+    "examples/operator-oidc/**",
     "examples/openai-agents-http/**",
     "examples/openai-agents-stdio/**",
     "examples/raw-sql-vs-synapsor/**",
@@ -85,7 +87,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@synapsor/spec": "^1.5.0",
+    "@synapsor/spec": "^1.6.0",
     "jose": "6.2.3",
     "mysql2": "^3.11.0",
     "pdf-lib": "1.17.1",

package/schemas/schema-candidate-review.schema.json

@@ -78,6 +78,7 @@
           "potential_principal_fields",
           "potential_conflict_fields",
           "potentially_sensitive_fields",
+          "field_classifications",
           "suggested_kept_out_fields",
           "suggested_visible_fields",
           "possible_actions",
@@ -106,6 +107,47 @@
           "potentially_sensitive_fields": {
             "$ref": "#/$defs/stringArray"
           },
+          "field_classifications": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "field",
+                "state",
+                "reason_codes",
+                "reasons",
+                "evidence_source"
+              ],
+              "properties": {
+                "field": {
+                  "type": "string"
+                },
+                "state": {
+                  "enum": [
+                    "high_confidence_sensitive",
+                    "unresolved_free_text",
+                    "structurally_low_risk"
+                  ]
+                },
+                "reason_codes": {
+                  "$ref": "#/$defs/stringArray"
+                },
+                "reasons": {
+                  "$ref": "#/$defs/stringArray"
+                },
+                "evidence_source": {
+                  "enum": [
+                    "database",
+                    "prisma",
+                    "drizzle",
+                    "openapi",
+                    "synapsor"
+                  ]
+                }
+              }
+            }
+          },
           "suggested_kept_out_fields": {
             "$ref": "#/$defs/stringArray"
           },