@synapsor/runner 1.6.2 → 1.6.4

package/AGENTS.md

@@ -10,8 +10,8 @@ writeback, and local evidence/replay.
 Use the stable package for public/user-facing examples:
 
 ```bash
-npx -y -p @synapsor/runner synapsor-runner demo --quick
-npx -y -p @synapsor/runner synapsor-runner audit --example dangerous-db-mcp
+npx -y @synapsor/runner demo --quick
+npx -y @synapsor/runner audit --example dangerous-db-mcp
 ```
 
 Use the local checkout while editing this repo:

package/CHANGELOG.md

@@ -1,6 +1,145 @@
 # Changelog
 
-## 1.6.2 (prepared, not published)
+## 1.6.4 (prepared, not published)
+
+### Review-correct onboarding and reviewed relationship paths
+
+- Repairs generated-boundary review state so edits invalidate only dependent
+  confirmations, stale browser revisions fail compare-and-swap checks, and
+  unrelated reviewed decisions survive. Secure headless activation now uses the
+  same exact-digest/operator boundary as Workbench.
+- Reworks the first Workbench experience around a small starter resource pack,
+  clearer plain-language authority and source-change status, stable
+  progressive disclosure, managed identity/scope decisions, and one primary
+  next action. Nested-project config discovery and resume behavior no longer
+  force a developer to rediscover paths or restart review.
+- Adds a no-argument first-run path that accepts the database URL through a
+  hidden terminal prompt or explicitly confirmed, key-specific environment-file
+  discovery. A conservative local-development fast lane reaches a real safe
+  read with at most two plain questions and one recorded exact-digest human
+  gesture, without exporting the URL or editing generated files.
+- Tightens deterministic sensitive-field classification across unfamiliar
+  schemas and combines database, Prisma, Drizzle, OpenAPI, and existing
+  Synapsor evidence without an LLM. Ambiguous identity/scope and high-risk
+  fields stay blocked or kept out for human review.
+- Adds public, additive reviewed relationship paths for protected aggregate
+  reads: up to three activated paths, each containing one or two
+  catalog-proven many-to-one links with fan-out one. The model may reference an
+  active path by name but cannot supply identifiers, join semantics, or
+  activation.
+- Adds demand-driven relationship review. A plan requiring an inactive proven
+  path fails closed, Workbench stages that exact proof for an operator, nullable
+  links require an explicit `EXCLUDE` or `KEEP NULL` choice, and a new digest is
+  required before retry.
+- Enforces trusted tenant/principal scope on every participating relation,
+  suppression after final grouping, generation-lock/catalog-proof drift, and
+  permanent rejection of one-to-many, many-to-many, ambiguous-cardinality,
+  over-depth, and model-improvised joins. Complex formulas and relationship
+  graphs remain on reviewed database views.
+- Adds clean-room Community Solar and Retail onboarding/PM-analysis journeys,
+  plus live PostgreSQL/MySQL star/depth-two, nullable-link, drift, privacy, and
+  deliberately wrong fan-out tests. Published `1.6.3` contracts, digests,
+  startup routes, and tool surfaces remain byte-compatible unless the new
+  feature is explicitly adopted.
+- Adds optional local Workbench Ask over the exact reviewed MCP/runtime tool
+  surface. OpenAI, Anthropic, and custom OpenAI-compatible adapters use
+  digest-bound direct-egress consent, in-memory credentials/history, fixed
+  size/time/tool/token bounds, escaped model output, and proposal-only writes;
+  the no-model composer remains complete and enabled by default.
+- Hardens provider endpoints with fixed official origins, remote HTTPS,
+  loopback-only plaintext, redirect refusal, per-connection DNS validation and
+  address pinning, private/special destination refusal, and redacted failures.
+  The pinned lookup supports Node 22's multi-address callback shape.
+- Extends both packed clean-room labs through the actual Ask UI. Retail visibly
+  refuses a kept-out customer-note aggregate, and Community Solar proves a
+  proposal cannot commit. An owner-authorized live OpenAI `gpt-5-mini` run
+  matched official MCP results and passed exact-key artifact/browser scans;
+  Anthropic and generic compatible claims remain protocol-scoped.
+- Uses direct `npx` only for first acquisition and the installed
+  `synapsor-runner` binary afterward. The optional unscoped command package is a
+  version-locked delegate with no independent runtime or authority logic;
+  explicit pinned and automation invocations remain compatible.
+- Adds one local, escaped, copy-exact DSL syntax highlighter for every
+  Workbench DSL preview, with no CDN or unsafe HTML path, and gives activity,
+  review, and apply detail the full available width on desktop and mobile.
+- Prepares `@synapsor/runner@1.6.4`, `@synapsor/spec@1.7.0`,
+  `@synapsor/dsl@1.7.0`, and the optional `synapsor-runner@1.6.4` command
+  alias. No package is published by this change.
+
+## 1.6.3 (published 2026-07-24)
+
+### Guided adoption without weaker authority
+
+- Turns a fresh interactive
+  `npx -y @synapsor/runner@latest start --from-env DATABASE_URL` into one
+  resumable journey: metadata-only inspection, conservative classification,
+  disabled project generation, review-by-exception in the loopback Workbench,
+  exact-digest activation, a real bounded read, and host-neutral MCP setup.
+- Generates the complete local project without requiring hand-edited DSL, JSON,
+  config, store paths, DDL, or grants for the reference development journey.
+  Existing selectors, automation, headless startup, hand-authored projects,
+  active contracts, and tool lists retain their prior behavior.
+- Adds no-ID, project-aware CLI paths for trying active named tools, bounded
+  row/aggregate exploration, protecting a successful analysis, guided action
+  authoring, proposal review, apply, receipt, replay, and compensation.
+- Reworks Workbench onboarding around one plain-language boundary summary,
+  conservative defaults, unresolved exceptions, one primary next action, and
+  progressive disclosure of DSL, canonical JSON, digests, role posture, and
+  generated tests.
+- Adds a guided write-action flow that drafts public DSL, canonical JSON,
+  tests, policy limits, conflict guards, receipt mode, and optional reviewed
+  compensation. It never derives business write authority from schema and
+  never activates, approves, or applies for the human.
+- Adds the FitFlow 30-50-table packed-artifact acceptance journey, including
+  first read, PM-style aggregate Explore, Protect, proposal, bounded policy
+  approval, guarded writeback, receipts/replay, compensation, host parity,
+  privacy gates, and source-unchanged assertions before commit.
+- Documents the full `APPROVAL ROLE` lifecycle from contract requirement
+  through external IdP claims and a verified immutable decision. A separate
+  local OIDC/JWKS issuer proves accepted reviewer/applier roles, role
+  separation, key rotation, and rejection of missing/similar roles, bad or
+  unknown signatures, expired/not-yet-valid tokens, wrong issuer/audience,
+  malformed claims, proof tampering, and cross-proposal replay.
+- Adds default-off operator-supervised automatic apply as a separate execution
+  axis. Contract permission plus an independent deployment allowlist must match
+  one exact digest; old `AUTO APPROVE` remains manual-apply. Eligible
+  single-row INSERT/UPDATE work reuses guarded apply and repeats policy, limit,
+  scope, target/supporting-evidence freshness, writer-posture, receipt, and
+  lease checks before every execution.
+- Adds durable redacted human-attention events and a coalesced Workbench inbox
+  for proposal, worker, boundary, schema, credential, policy, and sensitive
+  override lifecycle. A separately operated dispatcher supports quiet
+  per-sink routing, budgets, cooldowns, digests, JSONL development output, and
+  signed HTTPS webhooks. Notifications are disabled by default and never
+  authorize approval or mutation.
+- Binds dead-letter notification replay to a fresh verified signed-key or OIDC
+  operator decision over the exact delivery revision and reason. Replay
+  requeues only the immutable redacted event, records `notification.replayed`,
+  and cannot replay approval or source mutation. The packed gate exercises two
+  competing dispatchers, zero default success noise, duplicate suppression,
+  metadata-endpoint SSRF refusal, and event-only replay with an unchanged
+  source snapshot.
+- Adds pause/drain, exact-digest enable/disable/revoke, queue cancellation,
+  dead-letter, UNKNOWN/reconciliation, writer-posture, and optional required
+  attention-sink controls outside MCP. Fenced leases, limit reservations,
+  duplicate-consumption, process-death, known-commit, and ambiguous-outcome
+  paths retain the established fail-closed behavior.
+- Makes CLI failure output recovery-oriented and keeps supported `--json`
+  failure paths to one parseable document with redacted diagnostics on stderr,
+  preserved-state information, source-change status, and one next action.
+- Allows an explicit empty canonical `capabilities` array to represent a
+  validated zero-authority review draft and adds the optional canonical
+  `execution.supervised_worker` permission plus its public DSL clause. This
+  additive behavior is staged as `@synapsor/spec@1.6.0` and
+  `@synapsor/dsl@1.6.0`; legacy contracts retain their exact normalization and
+  digests.
+- Published `@synapsor/runner@1.6.3`, `@synapsor/spec@1.6.0`, and
+  `@synapsor/dsl@1.6.0`.
+- The clean Runner tarball gate used the locally packed public Spec before the
+  coordinated release, then returned to the stronger registry-only
+  dependency-resolution proof once npm had that exact Spec.
+
+## 1.6.2 (published 2026-07-23)
 
 ### Registry-installable packaging hotfix
 
@@ -16,7 +155,7 @@
   masking it with a simultaneously packed local Spec.
 - Contains the same proposal/evidence freshness runtime behavior prepared in
   `1.6.1`; this patch changes packaging and version surfaces only.
-- Prepares only `@synapsor/runner@1.6.2`. `@synapsor/spec@1.5.0` and
+- Published only `@synapsor/runner@1.6.2`. `@synapsor/spec@1.5.0` and
   `@synapsor/dsl@1.5.0` remain unchanged.
 
 ## 1.6.1 (published 2026-07-23; install-broken)

package/CONTRIBUTING.md

@@ -15,8 +15,10 @@ Please do not submit pull requests or code patches unless the maintainers have
 explicitly requested them under an approved contribution process.
 
 For maintainers, use small changes with tests. Do not add support for arbitrary
-SQL, multi-row updates, DDL, stored procedures, or model-generated write
-statements.
+SQL, model-generated or unbounded multi-row predicates, DDL, stored procedures,
+or model-generated write statements. Existing bounded-set support must retain
+its reviewer-fixed predicate, hard row/value caps, atomic execution, frozen
+members, and exact receipts.
 
 Before opening a change:
 
@@ -36,10 +38,15 @@ idempotency, replay, MCP tool exposure, or app-owned handlers must prove:
 
 - no model-facing `execute_sql`, raw SQL, approval, commit, apply, or writeback
   tool was added;
-- tenant/scope values come from trusted context, not model-controlled args;
+- tenant/principal values come from trusted context, not model-controlled args;
 - direct writeback still checks primary key, tenant key, allowed columns,
   expected version/conflict guard, affected-row count, idempotency, and receipt
   recording;
+- generated authority remains disabled until exact-digest human activation,
+  Scoped Explore remains local authoring-only, and reviewed relationship paths
+  cannot be supplied or activated by the model;
+- proposal/evidence freshness and supervised worker apply continue to fail
+  closed on source, digest, scope, policy, limit, or role-posture drift;
 - app-owned handler templates tell developers to re-check tenant/scope,
   expected version, idempotency, allowed action, transaction/rollback, and
   receipt shape.

package/README.md

@@ -21,9 +21,8 @@ No database, Docker, config, MCP client, LLM, or account is required:
 npx -y @synapsor/runner try --prove
 ```
 
-Timing begins after package resolution; cold `npx` download time varies.
-
-The embedded synthetic source requests a $55 waiver and proves:
+Cold `npx` download time is excluded. The embedded source requests a $55
+waiver and proves:
 
 ```text
 Proposed effect: late_fee_cents: 5500 -> 0
@@ -33,9 +32,8 @@ Restart-safe retry: yes; duplicate mutations: 0
 Stale apply refused: yes
 ```
 
-Review happens outside model-facing tools. State is stored under
-`./.synapsor/try/`; this proves the boundary, not your database connection.
-`demo --quick` remains a noninteractive compatibility alias.
+State stays under `./.synapsor/try/`. This proves the boundary, not your
+database connection; `demo --quick` remains a noninteractive compatibility alias.
 
 ## Audit An Existing MCP Server
 
@@ -45,41 +43,38 @@ Audit a typical raw-SQL MCP server without launching or calling one:
 npx -y @synapsor/runner audit --example dangerous-db-mcp
 ```
 
-Audit your own tool manifest, remote `tools/list`, or stdio server:
+Or audit your own manifest, remote `tools/list`, or stdio server:
 
 ```bash
 npx -y @synapsor/runner audit ./tools-list.json
 ```
 
 It flags raw SQL, arbitrary identifiers, model-controlled authority, and
-model-facing writeback without calling business tools. See [MCP Database Risk
-Review](docs/mcp-audit.md) and the [alternatives
-guide](docs/alternatives.md).
+model-facing writeback without calling business tools. See [MCP Audit](docs/mcp-audit.md).
 
 ## Connect Your Staging Application
 
-Use a dedicated SELECT-only, non-owner staging credential. Runner combines the
-whole database schema with statically parsed Prisma, Drizzle, OpenAPI, and
-existing Synapsor definitions. It does not execute adopter code, sample source
-rows, or use an LLM:
+Use a SELECT-only, non-owner development or staging credential. Runner combines
+database metadata with statically parsed Prisma, Drizzle, OpenAPI, and existing
+Synapsor definitions without executing adopter code, sampling rows, or using an
+LLM:
 
 ```bash
-npm install -g @synapsor/runner
-export DATABASE_URL="postgresql://runner_reader:REPLACE_ME@db.example.com:5432/app?sslmode=require"
-export SYNAPSOR_TENANT_ID="acme"
-export SYNAPSOR_PRINCIPAL="developer-1"
-synapsor-runner start --from-env DATABASE_URL --schema public
+npx -y @synapsor/runner start
 ```
 
-A fresh project opens the secured localhost Workbench and emits disabled DSL,
-canonical JSON, tests, review evidence, and a generation lock. Review scope,
-fields, aggregate members, relationships, privacy budgets, profile, and exact
-role/RLS posture, then activate the exact digest. Existing tools stay unchanged.
+Paste the URL into the hidden prompt, approve a regular project `.env` for this
+process, or export `DATABASE_URL`. Runner creates a validated zero-authority
+project and opens secured localhost Workbench. A personal-development fast lane
+offers one conservative resource with sensitive fields, relationships, and
+writes off; broader paths require full review.
+
+[Database To First Safe Tool](docs/guided-onboarding.md) covers the complete
+path.
 
 ## Ask Your First Real Question In Cursor
 
-After activation, let Runner add only the local authoring entry to this Cursor
-project:
+After activation, install only the local authoring entry in this Cursor project:
 
 ```bash
 synapsor-runner mcp install cursor \
@@ -103,21 +98,25 @@ Which reviewed regions and reason categories contributed most to the increase
 in churned accounts by week?
 ```
 
-Runner accepts a typed plan, not SQL. It validates every member against the
-activated digest, injects trusted scope, and runs a read-only transaction.
-Small cohorts are suppressed and durable budgets limit repeated differencing.
-This is descriptive analysis, not proof of causation.
+Runner validates a typed plan against the active digest, injects trusted scope,
+and runs read-only. Suppression and durable budgets limit extraction. Up to
+three activated one- or two-link many-to-one paths are supported; inactive or
+unsafe joins fail closed. This is descriptive analysis, not causation. See
+[Reviewed Relationships](docs/reviewed-relationships.md).
+
+### Optional: Ask In Workbench With Your Model
 
-Scoped Explore is local authoring only. Missing/unknown/production profiles,
-write-capable or owner credentials, stale generation locks, remote/shared HTTP,
-and non-loopback runtimes never advertise these tools.
+The no-model composer remains the default. Optional local Workbench Ask can use
+OpenAI, Anthropic, or a tested OpenAI-compatible endpoint after explicit
+digest-bound egress consent. It can call only displayed reviewed tools; keys
+and history remain in memory, and writes remain proposals. See [Workbench
+Ask](docs/workbench-ask.md).
 
 ## Protect This Query
 
-Choose the useful result in Workbench. No opaque ID needs to be copied. Runner
-freezes the reviewed shape into public DSL, canonical JSON, and tests under
-`synapsor/protected/drafts/`. The named capability starts disabled and requires
-exact-digest human activation outside MCP.
+Choose a useful result without copying an ID. Runner freezes public DSL,
+canonical JSON, and tests under `synapsor/protected/drafts/`; the named
+capability starts disabled.
 
 After activation, Scoped Explore is disabled. Update Cursor to the production
 config:
@@ -130,9 +129,8 @@ synapsor-runner mcp install cursor \
   --yes
 ```
 
-Production exposes the protected named capability, not `app.explore_data`.
-Read the complete [Auto Boundary, Scoped Explore, And Protect
-guide](docs/auto-boundary-and-scoped-explore.md).
+Production exposes the activated named capability, never `app.explore_data`.
+See [Explore And Protect](docs/auto-boundary-and-scoped-explore.md).
 
 ## Create An Exact Data PR
 
@@ -156,24 +154,17 @@ Effect   plan_credit_cents: 0 -> 2500
 Source unchanged before approval: Yes
 ```
 
-Approve in Workbench outside MCP; a trusted operator or worker commits. Runner
-supports guarded single-row INSERT/UPDATE/DELETE, fixed-predicate bounded
-UPDATE/DELETE, and exact-review batch INSERT. Rich transactions and external
-effects use app-owned executors.
-
-Runner rechecks scope, policy, row version, bounds, idempotency, and affected
-rows before returning a receipt. A retry cannot duplicate the mutation and a
-stale proposal conflicts. Inspect the latest lifecycle without copying an ID:
+Approval stays outside MCP. A trusted operator or worker rechecks scope,
+freshness, policy, version, bounds, idempotency, and affected rows before a
+receipt. Runner supports guarded single-row CRUD and bounded reviewed sets;
+rich transactions use app-owned executors. Inspect without copying an ID:
 
 ```bash
 synapsor-runner lifecycle --details --store ./.synapsor/local.db
 ```
 
-For proposals whose review depends on other source rows, Runner 1.6.1 can also
-require a live target/supporting-evidence check immediately before every local
-approval. Apply rechecks those declared same-database dependencies again inside
-the write transaction; stale evidence produces zero mutation and requires a new
-proposal:
+Optional same-database evidence freshness is checked before approval and again
+inside direct-SQL apply; drift produces zero mutation:
 
 ```bash
 synapsor-runner proposals check-freshness latest \
@@ -181,10 +172,8 @@ synapsor-runner proposals check-freshness latest \
   --store ./.synapsor/local.db
 ```
 
-See the [own-database guide](docs/getting-started-own-database.md),
-[Cursor plugin guide](docs/cursor-plugin.md), and
-[proposal freshness](docs/proposal-evidence-freshness.md) and
-[store lifecycle](docs/store-lifecycle.md) guides for the complete paths.
+See [Proposal Freshness](docs/proposal-evidence-freshness.md) and [Verified
+Operator Identity](docs/approval-roles-and-operator-identity.md).
 
 ## Safety Model
 
@@ -192,7 +181,8 @@ Contracts fix trusted context, fields, bounds, transitions, and approval.
 Model-facing tools can inspect scoped data and propose exact changes, but cannot
 approve, apply, or revert. A trusted operator/worker performs guarded writeback;
 the ledger links evidence, proposal, decision, receipt, and replay. Runner does
-not make raw SQL or prompt-injection-prone clients safe.
+not make raw SQL or prompt-injection-prone clients safe. Compare the boundary
+with [prompt and application guardrails](docs/why-synapsor-vs-app-guardrails.md).
 
 ## Choose An Isolation Mode
 
@@ -203,13 +193,10 @@ not make raw SQL or prompt-injection-prone clients safe.
 | `postgres_rls` | PostgreSQL also checks transaction-bound tenant/principal scope. Arbitrary trusted-context or credential control remains outside this guarantee. |
 | `tenant_bound` | Authenticated context selects a restricted per-tenant credential or process. |
 
-Use stdio; no socket opens. HTTP requires authentication; non-loopback
-listeners require TLS or an explicit trusted TLS proxy. Shared services require
-signed claims. Model-controlled input and MCP session IDs never establish
-identity. See [HTTP MCP].
-MySQL has no native RLS; use restricted views or tenant credentials. See
-[Database scope] and the
-[build-vs-adopt guide](docs/why-synapsor-vs-app-guardrails.md).
+Stdio opens no socket. HTTP requires authentication; remote listeners require
+TLS or a trusted TLS proxy, and shared services require signed claims. MySQL has
+no native RLS; use restricted views or tenant credentials. See [HTTP MCP] and
+[Database scope].
 
 ## Review And Prove Your Contract
 
@@ -220,37 +207,30 @@ and the [own-database guide](docs/getting-started-own-database.md).
 
 ## Trust And Verification
 
-Start with the **[Threat Model](THREAT_MODEL.md)**. It defines protected assets,
-trust boundaries, covered threats, non-goals, and required operator controls.
-
-[Conformance fixtures](docs/conformance.md) and `contract test` cover trusted
-scope, kept-out fields, proposals, approval, receipts, and replay. Resource
-handles re-check tenant/principal rather than acting as bearer authority. Live
-gates cover principal denial, no pre-approval mutation, idempotency, conflict,
-bounded sets, compensation, and proposal/evidence freshness on disposable
-databases.
-
-Runner is a narrow agent/database safety boundary, not a replacement for
-least-privilege database access, host security, or application authorization.
-See [Security Boundary](docs/security-boundary.md) and
-[Current Limitations](docs/limitations.md).
+Start with the **[Threat Model](THREAT_MODEL.md)** and [Security
+Boundary](docs/security-boundary.md). Conformance and live disposable-database
+gates cover scope, hidden fields, no pre-approval mutation, idempotency,
+conflicts, bounded sets, freshness, receipts, and replay. Runner does not
+replace least-privilege roles, host security, or application authorization.
 
 [Database scope]: docs/database-enforced-scope.md
 [HTTP MCP]: docs/http-mcp.md
 
 ## Operate The Approval Loop
 
-Policies can combine per-proposal and aggregate ceilings; exceeding one routes
-to human review. Local SQLite is the default, while bounded fleets can use
-verified HTTP claims and a shared Postgres runtime store. See
-[Production](docs/production.md), [Runner Config](docs/runner-config-reference.md),
-and [Small Runner Fleets](docs/running-a-runner-fleet.md).
+Auto-approval does not mean auto-apply. Manual apply remains default unless the
+exact contract digest and deployment both opt into a trusted supervised worker
+that repeats all guards. External notifications are disabled and quiet by default.
+A webhook response cannot approve or apply. See [Supervised
+Apply](docs/supervised-automatic-apply.md) and
+[Notifications](docs/human-attention-notifications.md).
 
 ## Packages
 
 | Package | Purpose |
 | --- | --- |
 | `@synapsor/runner` | CLI, MCP runtime, local ledger, proposals, approval, guarded writeback, replay, and MCP audit. |
+| `synapsor-runner` | Optional short command alias that delegates to the exact matching `@synapsor/runner`; no separate runtime. |
 | `@synapsor/spec` | Canonical portable contracts for contexts, capabilities, workflows, evidence, proposals, receipts, and replay. |
 | `@synapsor/dsl` | SQL-like authoring that compiles contexts, capabilities, and workflow declarations into canonical contract JSON. |
 | `@synapsor/cli` | Synapsor Cloud administration, contract governance, human review, Runner connections, and shared audit records. |
@@ -278,6 +258,8 @@ guide](https://github.com/Synapsor/Synapsor-Runner/blob/main/docs/cloud-cli.md).
 - Follow the [step-by-step Synapsor Tutorial](https://github.com/sandeshtiwari/Synapsor-Tutorial).
 - Run the [`support-billing-agent` flagship example](examples/support-billing-agent).
 - Connect [Claude, Cursor, OpenAI Agents SDK, or another MCP client](docs/mcp-clients.md).
+- Use the optional local [Workbench Ask](docs/workbench-ask.md) client without
+  broadening the reviewed tool surface.
 - Author and [push a validated contract to Cloud](docs/cloud-push.md).
 - Browse the [task-first documentation index](docs/README.md).
 - Report bugs or request features through [GitHub Issues](https://github.com/Synapsor/Synapsor-Runner/issues).

package/SECURITY.md

@@ -6,6 +6,18 @@ Do not include production credentials, customer data, or full source rows in bug
 
 ## Supported security scope
 
-The v0.1 runner protects the local writeback boundary for approved structured jobs. It does not make the hosted Synapsor control plane self-hosted, and it does not provide HA, compliance certification, or a general database proxy.
+Runner protects the local model/database boundary for reviewed semantic reads,
+structured proposals, verified approval, guarded writeback, receipts, replay,
+local authoring-only typed Explore/Protect, and optional exact-digest supervised
+execution. Optional Workbench Ask calls only that same reviewed runtime surface.
+Human-attention notifications are redacted interruption channels and never
+authority.
 
-See `docs/threat-model.md` for detailed trust boundaries, covered threats, non-goals, and release blockers.
+It does not make the hosted Synapsor control plane self-hosted, prevent prompt
+injection, replace database roles/RLS, or provide HA, compliance certification,
+or a general database proxy. Reviewed visible data sent to an
+operator-selected model provider is subject to that provider's own privacy and
+retention terms.
+
+See `THREAT_MODEL.md` and `docs/security-boundary.md` for detailed trust
+boundaries, covered threats, non-goals, and release blockers.

package/THREAT_MODEL.md

@@ -12,6 +12,13 @@ It is not a general MCP security gateway, not a prompt-injection cure, not a rep
 - Proposal diffs, evidence bundles, query audit, approvals, writeback jobs, receipts, and replay records.
 - Runner/session/operator tokens, local SQLite state, and optional shared
   Postgres proposal/evidence/replay ledger.
+- Exact-digest supervised-worker policy, worker leases, attention events,
+  notification delivery records, and webhook signing secrets.
+- Generated boundary drafts, review decisions, exact activation digests,
+  generation locks, reviewed relationship proofs, and Scoped Explore privacy
+  budgets.
+- Optional Workbench Ask provider credentials and direct-egress consent held
+  only in the local process.
 
 ## Trust Boundaries
 
@@ -21,8 +28,8 @@ MCP client/model
   -> reviewed capability config
   -> read-only database credential
   -> local proposal/evidence/replay store
-  -> human approval outside the model
-  -> guarded worker with write credential
+  -> human or reviewed deterministic policy approval outside the model
+  -> manual apply or separately enabled guarded worker with write credential
   -> Postgres/MySQL
 ```
 
@@ -37,7 +44,11 @@ MCP client/model
   -> Postgres/MySQL
 ```
 
-The model-facing MCP tool call has request/proposal authority. The trusted runner has execution authority only for already-approved, scoped writeback jobs.
+The model-facing MCP tool call has bounded request/proposal authority. The
+trusted runner has execution authority only for already-approved, scoped
+writeback jobs. Manual apply is the default. Supervised automatic execution
+requires both contract permission and a deployment allowlist for the exact
+active digest; the model controls neither.
 
 In small-fleet mode, a TLS load balancer sends signed sessions to stateless
 Runner instances. Every effective capability context must bind tenant and
@@ -48,6 +59,27 @@ idempotency boundary for effects.
 ## Covered Threats
 
 - Model asks for arbitrary SQL: no generic SQL tool is exposed in the Synapsor path.
+- Model tries to turn Scoped Explore into generic SQL or production authority:
+  Explore accepts only reviewed typed plans, is local authoring-only, and is
+  absent from production, unknown-profile, remote, shared HTTP, and non-loopback
+  tool catalogs. Protect output starts disabled and requires exact-digest human
+  activation.
+- Model invents or widens a join: aggregate relationships must be activated,
+  catalog-proven many-to-one paths with fan-out one; table/key/join semantics
+  and activation are not plan arguments. Ambiguous, one-to-many, many-to-many,
+  stale, and over-depth paths fail closed.
+- Generated authority widens after schema/role drift: generated capability and
+  exploration authority are bound to schema, compiler/Spec, role, grant,
+  ownership, RLS, and reviewed-proof fingerprints. Manual legacy projects are
+  unaffected unless they adopt a generation lock.
+- Optional Workbench Ask becomes a second policy engine: Ask lists and calls the
+  exact active MCP/runtime tools, adds no activation/approval/apply authority,
+  keeps provider choice outside model control, and treats provider prose/tool
+  arguments as untrusted.
+- Provider endpoint exfiltration or SSRF: official origins are fixed, custom
+  remote origins require HTTPS, plaintext is loopback-only, redirects are
+  refused, DNS is revalidated and pinned, and private/link-local/metadata
+  destinations fail closed.
 - Model supplies `tenant_id`, `principal`, source id, allowed columns, row version, or approval identity: runner rejects trusted-binding overrides.
 - Prompt injection in database content asks the model to bypass policy: the runner ignores text as authority and only accepts structured capability/job state.
 - Aggregate inference through a one-record group: reviewed aggregate tools
@@ -65,7 +97,17 @@ idempotency boundary for effects.
 - Over-broad write: direct INSERT/UPDATE/DELETE is single-row, tenant-bound,
   operation-guarded, and success requires exactly one affected row.
 - Cloud credential leakage: database URLs and write credentials stay local and are not sent to Cloud.
-- Model-callable approval: approval/commit tools are not exposed to MCP clients by default.
+- Model-callable approval or execution: activation, approval, apply, worker,
+  notification-routing, and recovery controls are not exposed to MCP clients.
+- Stale policy-approved work: supervised execution repeats current policy,
+  limit, tenant/principal, target and supporting-evidence freshness,
+  generation-lock, writer-posture, receipt, and lease checks before apply.
+- Notification confused deputy or replay: webhook destinations and filters are
+  operator-owned; payloads are redacted and HMAC-signed with event ID and
+  timestamp; response content and delivery replay cannot authorize or mutate.
+- Notification flood: the default external route is quiet; related incidents
+  coalesce, transient recovery stays internal, and per-sink budgets/cooldowns
+  bound non-critical interruption while retaining immutable events.
 - Claims/environment confusion: an `http_claims` server fails before serving
   if a capability resolves an environment/static contract context.
 - Leaked local resource handle: proposal, evidence, and replay reads resolve
@@ -88,12 +130,16 @@ idempotency boundary for effects.
 - Credential theft outside the runner process.
 - OAuth, SSRF, token-passthrough, or confused-deputy bugs in unrelated MCP systems.
 - Sensitive data already returned to a model.
+- Reviewed visible data intentionally sent to an operator-selected external
+  model provider after Workbench egress consent; the provider's retention and
+  training policy remains outside Runner.
 - Prompt injection itself.
 - Business invariants not represented in the capability config, proposal, application handler, or database constraints.
 - Generic multi-row business transactions, DDL, UPSERT, model-generated
   predicates, or cross-database atomicity in the Runner direct-write path.
 - A compromised IdP/JWKS host, ledger database, source database, TLS
   terminator, or administrator-approved contract.
+- A compromised operator-approved notification destination or signing secret.
 - Unbounded/high-throughput or multi-region ledger scale, compliance
   certification, or production SLA.
 
@@ -106,6 +152,12 @@ idempotency boundary for effects.
 - Prefer version/timestamp conflict guards over weak row-hash fallback.
 - Review proposal diffs and evidence before approval.
 - Monitor conflict/failed receipt rates.
+- Keep automatic execution disabled unless both exact-digest opt-ins and a
+  separately scoped least-privilege writer are reviewed. Monitor queue,
+  dead-letter, UNKNOWN, reconciliation, and writer-posture state.
+- Keep notifications disabled unless needed. Store webhook URL/signing secret
+  only in operator environment, allowlist egress, and treat Workbench/ledger as
+  authoritative rather than a chat or incident system.
 - Allowlist JWKS egress, keep `/metrics` separately authorized, budget source
   pools across replicas, back up/verify the shared ledger, and retain the
   configured `max_entries` safety bound.
@@ -113,6 +165,14 @@ idempotency boundary for effects.
   queues; `dev_env` is unverified.
 - Treat proposal/evidence/replay handles as identifiers, not authorization;
   preserve verified per-session context on every networked resource read.
+- Keep Scoped Explore and Workbench Ask local to explicit development/staging
+  authoring, verify a SELECT-only non-owner role, and disable Explore before
+  production. Production should serve only activated named capabilities.
+- Review generation-lock and relationship-proof drift instead of bypassing it,
+  and do not treat Prisma/Drizzle/OpenAPI names as authorization.
+- For Workbench Ask, choose provider/model/origin yourself, acknowledge direct
+  egress, keep keys out of project files and chat, and clear in-memory sessions
+  when finished.
 
 ## Release Blockers