@synapsor/runner 1.6.3 → 1.6.5

package/AGENTS.md

@@ -10,8 +10,8 @@ writeback, and local evidence/replay.
 Use the stable package for public/user-facing examples:
 
 ```bash
-npx -y -p @synapsor/runner synapsor-runner demo --quick
-npx -y -p @synapsor/runner synapsor-runner audit --example dangerous-db-mcp
+npx -y @synapsor/runner demo --quick
+npx -y @synapsor/runner audit --example dangerous-db-mcp
 ```
 
 Use the local checkout while editing this repo:

package/CHANGELOG.md

@@ -1,6 +1,94 @@
 # Changelog
 
-## 1.6.3 (prepared, not published)
+## 1.6.5 (prepared, not published)
+
+### Managed Claude Code and VS Code project MCP installs
+
+- Extends Runner's reviewed project MCP lifecycle from Cursor to Claude Code
+  and VS Code. `mcp install`, `mcp status`, and `mcp uninstall` now manage only
+  Runner's project-local entry in `.mcp.json` or `.vscode/mcp.json`.
+- Preserves unrelated servers and settings, creates backups, pins the exact
+  Runner package version, tracks ownership with an integrity marker, refuses
+  tampered or unowned entries, and keeps credentials and trusted scope out of
+  client configuration.
+- Preserves VS Code JSONC comments and trailing commas. Static status and a
+  real optional stdio `tools/list` launch check prove that each client receives
+  the same reviewed model-facing authority.
+- Makes onboarding, Workbench guidance, README positioning, host recipes, and
+  `doctor` client-neutral while retaining the existing Cursor lifecycle and
+  `--check-cursor` compatibility.
+
+Prepared package versions: `@synapsor/runner@1.6.5` and the optional
+`synapsor-runner@1.6.5` command alias. `@synapsor/spec@1.7.0` and
+`@synapsor/dsl@1.7.0` are unchanged. No package is published by this change.
+
+## 1.6.4 (published 2026-07-25)
+
+### Review-correct onboarding and reviewed relationship paths
+
+- Repairs generated-boundary review state so edits invalidate only dependent
+  confirmations, stale browser revisions fail compare-and-swap checks, and
+  unrelated reviewed decisions survive. Secure headless activation now uses the
+  same exact-digest/operator boundary as Workbench.
+- Reworks the first Workbench experience around a small starter resource pack,
+  clearer plain-language authority and source-change status, stable
+  progressive disclosure, managed identity/scope decisions, and one primary
+  next action. Nested-project config discovery and resume behavior no longer
+  force a developer to rediscover paths or restart review.
+- Adds a no-argument first-run path that accepts the database URL through a
+  hidden terminal prompt or explicitly confirmed, key-specific environment-file
+  discovery. A conservative local-development fast lane reaches a real safe
+  read with at most two plain questions and one recorded exact-digest human
+  gesture, without exporting the URL or editing generated files.
+- Tightens deterministic sensitive-field classification across unfamiliar
+  schemas and combines database, Prisma, Drizzle, OpenAPI, and existing
+  Synapsor evidence without an LLM. Ambiguous identity/scope and high-risk
+  fields stay blocked or kept out for human review.
+- Adds public, additive reviewed relationship paths for protected aggregate
+  reads: up to three activated paths, each containing one or two
+  catalog-proven many-to-one links with fan-out one. The model may reference an
+  active path by name but cannot supply identifiers, join semantics, or
+  activation.
+- Adds demand-driven relationship review. A plan requiring an inactive proven
+  path fails closed, Workbench stages that exact proof for an operator, nullable
+  links require an explicit `EXCLUDE` or `KEEP NULL` choice, and a new digest is
+  required before retry.
+- Enforces trusted tenant/principal scope on every participating relation,
+  suppression after final grouping, generation-lock/catalog-proof drift, and
+  permanent rejection of one-to-many, many-to-many, ambiguous-cardinality,
+  over-depth, and model-improvised joins. Complex formulas and relationship
+  graphs remain on reviewed database views.
+- Adds clean-room Community Solar and Retail onboarding/PM-analysis journeys,
+  plus live PostgreSQL/MySQL star/depth-two, nullable-link, drift, privacy, and
+  deliberately wrong fan-out tests. Published `1.6.3` contracts, digests,
+  startup routes, and tool surfaces remain byte-compatible unless the new
+  feature is explicitly adopted.
+- Adds optional local Workbench Ask over the exact reviewed MCP/runtime tool
+  surface. OpenAI, Anthropic, and custom OpenAI-compatible adapters use
+  digest-bound direct-egress consent, in-memory credentials/history, fixed
+  size/time/tool/token bounds, escaped model output, and proposal-only writes;
+  the no-model composer remains complete and enabled by default.
+- Hardens provider endpoints with fixed official origins, remote HTTPS,
+  loopback-only plaintext, redirect refusal, per-connection DNS validation and
+  address pinning, private/special destination refusal, and redacted failures.
+  The pinned lookup supports Node 22's multi-address callback shape.
+- Extends both packed clean-room labs through the actual Ask UI. Retail visibly
+  refuses a kept-out customer-note aggregate, and Community Solar proves a
+  proposal cannot commit. An owner-authorized live OpenAI `gpt-5-mini` run
+  matched official MCP results and passed exact-key artifact/browser scans;
+  Anthropic and generic compatible claims remain protocol-scoped.
+- Uses direct `npx` only for first acquisition and the installed
+  `synapsor-runner` binary afterward. The optional unscoped command package is a
+  version-locked delegate with no independent runtime or authority logic;
+  explicit pinned and automation invocations remain compatible.
+- Adds one local, escaped, copy-exact DSL syntax highlighter for every
+  Workbench DSL preview, with no CDN or unsafe HTML path, and gives activity,
+  review, and apply detail the full available width on desktop and mobile.
+- Published `@synapsor/runner@1.6.4`, `@synapsor/spec@1.7.0`,
+  `@synapsor/dsl@1.7.0`, and the optional `synapsor-runner@1.6.4` command
+  alias.
+
+## 1.6.3 (published 2026-07-24)
 
 ### Guided adoption without weaker authority
 
@@ -67,13 +155,11 @@
   additive behavior is staged as `@synapsor/spec@1.6.0` and
   `@synapsor/dsl@1.6.0`; legacy contracts retain their exact normalization and
   digests.
-- Prepares `@synapsor/runner@1.6.3`, `@synapsor/spec@1.6.0`, and
-  `@synapsor/dsl@1.6.0`. No package is published by this change.
-- Makes the clean Runner tarball gate use the locally packed public Spec while
-  the new Spec version is still unpublished, then automatically return to the
-  stronger registry-only dependency-resolution proof once npm has that exact
-  Spec. This preserves the required Spec-first release order without masking a
-  broken packed Runner manifest.
+- Published `@synapsor/runner@1.6.3`, `@synapsor/spec@1.6.0`, and
+  `@synapsor/dsl@1.6.0`.
+- The clean Runner tarball gate used the locally packed public Spec before the
+  coordinated release, then returned to the stronger registry-only
+  dependency-resolution proof once npm had that exact Spec.
 
 ## 1.6.2 (published 2026-07-23)
 

package/CONTRIBUTING.md

@@ -15,8 +15,10 @@ Please do not submit pull requests or code patches unless the maintainers have
 explicitly requested them under an approved contribution process.
 
 For maintainers, use small changes with tests. Do not add support for arbitrary
-SQL, multi-row updates, DDL, stored procedures, or model-generated write
-statements.
+SQL, model-generated or unbounded multi-row predicates, DDL, stored procedures,
+or model-generated write statements. Existing bounded-set support must retain
+its reviewer-fixed predicate, hard row/value caps, atomic execution, frozen
+members, and exact receipts.
 
 Before opening a change:
 
@@ -36,10 +38,15 @@ idempotency, replay, MCP tool exposure, or app-owned handlers must prove:
 
 - no model-facing `execute_sql`, raw SQL, approval, commit, apply, or writeback
   tool was added;
-- tenant/scope values come from trusted context, not model-controlled args;
+- tenant/principal values come from trusted context, not model-controlled args;
 - direct writeback still checks primary key, tenant key, allowed columns,
   expected version/conflict guard, affected-row count, idempotency, and receipt
   recording;
+- generated authority remains disabled until exact-digest human activation,
+  Scoped Explore remains local authoring-only, and reviewed relationship paths
+  cannot be supplied or activated by the model;
+- proposal/evidence freshness and supervised worker apply continue to fail
+  closed on source, digest, scope, policy, limit, or role-posture drift;
 - app-owned handler templates tell developers to re-check tenant/scope,
   expected version, idempotency, allowed action, transaction/rollback, and
   receipt shape.

package/README.md

@@ -8,10 +8,10 @@
 
 **MCP connects the agent. Synapsor controls the commit.**
 
-Synapsor Runner is an open-source MCP runtime for Postgres and MySQL. It gives
-agents reviewed business actions, records proposed changes as exact Data PRs,
-and keeps credentials, activation, approval, and commit authority outside the
-model-facing surface.
+Synapsor Runner is an open-source MCP runtime for Postgres and MySQL. It lets
+agents ask bounded business questions of reviewed data and propose exact Data
+PRs, while keeping credentials, activation, approval, and commit authority
+outside the model-facing surface.
 
 ## Prove The Boundary In Four Seconds
 
@@ -21,9 +21,8 @@ No database, Docker, config, MCP client, LLM, or account is required:
 npx -y @synapsor/runner try --prove
 ```
 
-Timing begins after package resolution; cold `npx` download time varies.
-
-The embedded synthetic source requests a $55 waiver and proves:
+Cold `npx` download time is excluded. The embedded source requests a $55
+waiver and proves:
 
 ```text
 Proposed effect: late_fee_cents: 5500 -> 0
@@ -33,9 +32,8 @@ Restart-safe retry: yes; duplicate mutations: 0
 Stale apply refused: yes
 ```
 
-Review happens outside model-facing tools. State is stored under
-`./.synapsor/try/`; this proves the boundary, not your database connection.
-`demo --quick` remains a noninteractive compatibility alias.
+State stays under `./.synapsor/try/`. This proves the boundary, not your
+database connection; `demo --quick` remains a noninteractive compatibility alias.
 
 ## Audit An Existing MCP Server
 
@@ -45,52 +43,64 @@ Audit a typical raw-SQL MCP server without launching or calling one:
 npx -y @synapsor/runner audit --example dangerous-db-mcp
 ```
 
-Audit your own tool manifest, remote `tools/list`, or stdio server:
+Or audit your own manifest, remote `tools/list`, or stdio server:
 
 ```bash
 npx -y @synapsor/runner audit ./tools-list.json
 ```
 
 It flags raw SQL, arbitrary identifiers, model-controlled authority, and
-model-facing writeback without calling business tools. See [MCP Database Risk
-Review](docs/mcp-audit.md) and the [alternatives
-guide](docs/alternatives.md).
+model-facing writeback without calling business tools. See [MCP Audit](docs/mcp-audit.md).
 
 ## Connect Your Staging Application
 
-Use a dedicated SELECT-only, non-owner staging credential. Runner combines the
-whole database schema with statically parsed Prisma, Drizzle, OpenAPI, and
-existing Synapsor definitions. It does not execute adopter code, sample source
-rows, or use an LLM:
+Use a SELECT-only, non-owner development or staging credential. Runner combines
+database metadata with statically parsed Prisma, Drizzle, OpenAPI, and existing
+Synapsor definitions without executing adopter code, sampling rows, or using an
+LLM:
 
 ```bash
-export DATABASE_URL="postgresql://runner_reader:REPLACE_ME@db.example.com:5432/app?sslmode=require"
-export SYNAPSOR_TENANT_ID="acme"
-export SYNAPSOR_PRINCIPAL="developer-1"
-npx -y @synapsor/runner@latest start --from-env DATABASE_URL
+npx -y @synapsor/runner start
 ```
 
-A fresh project checks credentials, inspects metadata, emits a validated
-zero-authority project, and opens secured localhost Workbench. Review its
-disabled DSL, fields, scope, analytical boundary, and role/RLS posture before
-activating the exact digest.
+Paste the URL into the hidden prompt, approve a regular project `.env` for this
+process, or export `DATABASE_URL`. Runner creates a validated zero-authority
+project and opens secured localhost Workbench. A personal-development fast lane
+offers one conservative resource with sensitive fields, relationships, and
+writes off; broader paths require full review.
 
 [Database To First Safe Tool](docs/guided-onboarding.md) covers the complete
 path.
 
-## Ask Your First Real Question In Cursor
+## Ask Your First Real Question
+
+Runner is host-neutral. These three paths execute the same typed plans against
+the same activated digest, trusted scope, suppression rules, budgets, and
+denials:
 
-After activation, install only the local authoring entry in this Cursor project:
+1. **Workbench composer:** no MCP client, model, or API key. Choose only reviewed
+   measures, dimensions, filters, and time buckets.
+2. **Workbench Ask:** optional OpenAI, Anthropic, or loopback
+   OpenAI-compatible model after explicit digest-bound egress consent. Keys and
+   conversation history remain in memory; a loopback model keeps data local.
+3. **Any MCP client:** use a managed project installer for Cursor, Claude Code,
+   or VS Code, or a checked recipe for Claude Desktop, Codex, OpenAI Agents,
+   LangChain/LangGraph, Google ADK, LlamaIndex, and generic stdio.
+
+For a managed project, choose one:
 
 ```bash
-synapsor-runner mcp install cursor \
-  --project \
-  --authoring \
-  --project-root . \
-  --yes
+synapsor-runner mcp install cursor --project --authoring --project-root . --yes
+synapsor-runner mcp install claude-code --project --authoring --project-root . --yes
+synapsor-runner mcp install vscode --project --authoring --project-root . --yes
 ```
 
-Cursor sees exactly two temporary tools:
+Runner merges only its `synapsor` entry into `.cursor/mcp.json`, `.mcp.json`, or
+`.vscode/mcp.json`; it preserves other settings, backs up existing files, pins
+the exact Runner version, and writes no credentials. See
+[Client And Framework Recipes](docs/client-recipes.md).
+
+The selected client sees exactly two temporary tools:
 
 ```text
 app.describe_data
@@ -104,35 +114,36 @@ Which reviewed regions and reason categories contributed most to the increase
 in churned accounts by week?
 ```
 
-Runner validates a typed plan against the activated digest, injects trusted
-scope, and runs a read-only transaction. Cohort suppression and durable budgets
-limit extraction. This is descriptive analysis, not proof of causation.
+Runner validates a typed plan against the active digest, injects trusted scope,
+and runs read-only. Suppression and durable budgets limit extraction. Up to
+three activated one- or two-link many-to-one paths are supported; inactive or
+unsafe joins fail closed. This is descriptive analysis, not causation. See
+[Reviewed Relationships](docs/reviewed-relationships.md).
 
-Scoped Explore is local authoring only. Missing/unknown/production profiles,
-write-capable or owner credentials, stale generation locks, remote/shared HTTP,
-and non-loopback runtimes never advertise these tools.
+This is bounded, governed analytics over reviewed measures, dimensions, time
+grains, and relationship paths, not a general BI dashboard or SQL surface.
+Protect turns a useful analysis into a named, digest-reviewed metric capability.
+See [Workbench Ask](docs/workbench-ask.md).
 
 ## Protect This Query
 
-Choose the useful result in Workbench. No opaque ID needs to be copied. Runner
-freezes the reviewed shape into public DSL, canonical JSON, and tests under
-`synapsor/protected/drafts/`. The named capability starts disabled and requires
-exact-digest human activation outside MCP.
+Choose a useful result without copying an ID. Runner freezes public DSL,
+canonical JSON, and tests under `synapsor/protected/drafts/`; the named
+capability starts disabled.
 
-After activation, Scoped Explore is disabled. Update Cursor to the production
-config:
+After activation, Scoped Explore is disabled. Update the selected project
+client to the production config:
 
 ```bash
-synapsor-runner mcp install cursor \
-  --project \
+CLIENT=claude-code # or cursor / vscode
+synapsor-runner mcp install "$CLIENT" --project \
   --config ./synapsor.runner.json \
   --store ./.synapsor/local.db \
   --yes
 ```
 
-Production exposes the protected named capability, not `app.explore_data`.
-Read the complete [Auto Boundary, Scoped Explore, And Protect
-guide](docs/auto-boundary-and-scoped-explore.md).
+Production exposes the activated named capability, never `app.explore_data`.
+See [Explore And Protect](docs/auto-boundary-and-scoped-explore.md).
 
 ## Create An Exact Data PR
 
@@ -156,24 +167,17 @@ Effect   plan_credit_cents: 0 -> 2500
 Source unchanged before approval: Yes
 ```
 
-Approve in Workbench outside MCP; a trusted operator or worker commits. Runner
-supports guarded single-row INSERT/UPDATE/DELETE, fixed-predicate bounded
-UPDATE/DELETE, and exact-review batch INSERT. Rich transactions and external
-effects use app-owned executors.
-
-Runner rechecks scope, policy, row version, bounds, idempotency, and affected
-rows before returning a receipt. A retry cannot duplicate the mutation and a
-stale proposal conflicts. Inspect the latest lifecycle without copying an ID:
+Approval stays outside MCP. A trusted operator or worker rechecks scope,
+freshness, policy, version, bounds, idempotency, and affected rows before a
+receipt. Runner supports guarded single-row CRUD and bounded reviewed sets;
+rich transactions use app-owned executors. Inspect without copying an ID:
 
 ```bash
 synapsor-runner lifecycle --details --store ./.synapsor/local.db
 ```
 
-For proposals whose review depends on other source rows, Runner 1.6.1 can also
-require a live target/supporting-evidence check immediately before every local
-approval. Apply rechecks those declared same-database dependencies again inside
-the write transaction; stale evidence produces zero mutation and requires a new
-proposal:
+Optional same-database evidence freshness is checked before approval and again
+inside direct-SQL apply; drift produces zero mutation:
 
 ```bash
 synapsor-runner proposals check-freshness latest \
@@ -181,12 +185,8 @@ synapsor-runner proposals check-freshness latest \
   --store ./.synapsor/local.db
 ```
 
-See the [own-database guide](docs/getting-started-own-database.md),
-[proposal freshness](docs/proposal-evidence-freshness.md), and
-[store lifecycle](docs/store-lifecycle.md). For production identity, follow
-`APPROVAL ROLE` through verified OIDC/signed-key approval and a separate apply
-role in [Approval Roles And Verified Operator
-Identity](docs/approval-roles-and-operator-identity.md).
+See [Proposal Freshness](docs/proposal-evidence-freshness.md) and [Verified
+Operator Identity](docs/approval-roles-and-operator-identity.md).
 
 ## Safety Model
 
@@ -194,7 +194,8 @@ Contracts fix trusted context, fields, bounds, transitions, and approval.
 Model-facing tools can inspect scoped data and propose exact changes, but cannot
 approve, apply, or revert. A trusted operator/worker performs guarded writeback;
 the ledger links evidence, proposal, decision, receipt, and replay. Runner does
-not make raw SQL or prompt-injection-prone clients safe.
+not make raw SQL or prompt-injection-prone clients safe. Compare the boundary
+with [prompt and application guardrails](docs/why-synapsor-vs-app-guardrails.md).
 
 ## Choose An Isolation Mode
 
@@ -205,13 +206,10 @@ not make raw SQL or prompt-injection-prone clients safe.
 | `postgres_rls` | PostgreSQL also checks transaction-bound tenant/principal scope. Arbitrary trusted-context or credential control remains outside this guarantee. |
 | `tenant_bound` | Authenticated context selects a restricted per-tenant credential or process. |
 
-Use stdio; no socket opens. HTTP requires authentication; non-loopback
-listeners require TLS or an explicit trusted TLS proxy. Shared services require
-signed claims. Model-controlled input and MCP session IDs never establish
-identity. See [HTTP MCP].
-MySQL has no native RLS; use restricted views or tenant credentials. See
-[Database scope] and the
-[build-vs-adopt guide](docs/why-synapsor-vs-app-guardrails.md).
+Stdio opens no socket. HTTP requires authentication; remote listeners require
+TLS or a trusted TLS proxy, and shared services require signed claims. MySQL has
+no native RLS; use restricted views or tenant credentials. See [HTTP MCP] and
+[Database scope].
 
 ## Review And Prove Your Contract
 
@@ -222,49 +220,30 @@ and the [own-database guide](docs/getting-started-own-database.md).
 
 ## Trust And Verification
 
-Start with the **[Threat Model](THREAT_MODEL.md)**. It defines protected assets,
-trust boundaries, covered threats, non-goals, and required operator controls.
-
-[Conformance fixtures](docs/conformance.md) and `contract test` cover trusted
-scope, kept-out fields, proposals, approval, receipts, and replay. Resource
-handles re-check tenant/principal rather than acting as bearer authority. Live
-gates cover principal denial, no pre-approval mutation, idempotency, conflict,
-bounded sets, compensation, and proposal/evidence freshness on disposable
-databases.
-
-Runner is a narrow agent/database safety boundary, not a replacement for
-least-privilege database access, host security, or application authorization.
-See [Security Boundary](docs/security-boundary.md) and
-[Current Limitations](docs/limitations.md).
+Start with the **[Threat Model](THREAT_MODEL.md)** and [Security
+Boundary](docs/security-boundary.md). Conformance and live disposable-database
+gates cover scope, hidden fields, no pre-approval mutation, idempotency,
+conflicts, bounded sets, freshness, receipts, and replay. Runner does not
+replace least-privilege roles, host security, or application authorization.
 
 [Database scope]: docs/database-enforced-scope.md
 [HTTP MCP]: docs/http-mcp.md
 
 ## Operate The Approval Loop
 
-Policies can combine per-proposal and aggregate ceilings; exceeding one routes
-to human review. Auto-approval does not mean auto-apply: existing policies wait
-for manual apply unless the exact contract digest and deployment both opt into
-a separately trusted supervised worker. That worker repeats scope, freshness,
-policy, limit, credential-posture, idempotency, and guarded-write checks before
-every execution.
-
-The ledger and secured Workbench also provide a Human Attention Inbox.
-External notifications are disabled and quiet by default; an operator can route
-review-required, UNKNOWN, reconciliation, dead-letter, drift, or sustained
-health incidents through a signed generic webhook without granting the receiver
-approval authority. A webhook response cannot approve, apply, or change Runner
-state. See [Supervised Automatic
-Apply](docs/supervised-automatic-apply.md), [Human Attention And
-Notifications](docs/human-attention-notifications.md),
-[Production](docs/production.md), and [Small Runner
-Fleets](docs/running-a-runner-fleet.md).
+Auto-approval does not mean auto-apply. Manual apply remains default unless the
+exact contract digest and deployment both opt into a trusted supervised worker
+that repeats all guards. External notifications are disabled and quiet by default.
+A webhook response cannot approve or apply. See [Supervised
+Apply](docs/supervised-automatic-apply.md) and
+[Notifications](docs/human-attention-notifications.md).
 
 ## Packages
 
 | Package | Purpose |
 | --- | --- |
 | `@synapsor/runner` | CLI, MCP runtime, local ledger, proposals, approval, guarded writeback, replay, and MCP audit. |
+| `synapsor-runner` | Optional short command alias that delegates to the exact matching `@synapsor/runner`; no separate runtime. |
 | `@synapsor/spec` | Canonical portable contracts for contexts, capabilities, workflows, evidence, proposals, receipts, and replay. |
 | `@synapsor/dsl` | SQL-like authoring that compiles contexts, capabilities, and workflow declarations into canonical contract JSON. |
 | `@synapsor/cli` | Synapsor Cloud administration, contract governance, human review, Runner connections, and shared audit records. |
@@ -292,6 +271,8 @@ guide](https://github.com/Synapsor/Synapsor-Runner/blob/main/docs/cloud-cli.md).
 - Follow the [step-by-step Synapsor Tutorial](https://github.com/sandeshtiwari/Synapsor-Tutorial).
 - Run the [`support-billing-agent` flagship example](examples/support-billing-agent).
 - Connect [Claude, Cursor, OpenAI Agents SDK, or another MCP client](docs/mcp-clients.md).
+- Use the optional local [Workbench Ask](docs/workbench-ask.md) client without
+  broadening the reviewed tool surface.
 - Author and [push a validated contract to Cloud](docs/cloud-push.md).
 - Browse the [task-first documentation index](docs/README.md).
 - Report bugs or request features through [GitHub Issues](https://github.com/Synapsor/Synapsor-Runner/issues).

package/SECURITY.md

@@ -8,12 +8,16 @@ Do not include production credentials, customer data, or full source rows in bug
 
 Runner protects the local model/database boundary for reviewed semantic reads,
 structured proposals, verified approval, guarded writeback, receipts, replay,
-and optional exact-digest supervised execution. Human-attention notifications
-are redacted interruption channels and never authority.
+local authoring-only typed Explore/Protect, and optional exact-digest supervised
+execution. Optional Workbench Ask calls only that same reviewed runtime surface.
+Human-attention notifications are redacted interruption channels and never
+authority.
 
 It does not make the hosted Synapsor control plane self-hosted, prevent prompt
 injection, replace database roles/RLS, or provide HA, compliance certification,
-or a general database proxy.
+or a general database proxy. Reviewed visible data sent to an
+operator-selected model provider is subject to that provider's own privacy and
+retention terms.
 
 See `THREAT_MODEL.md` and `docs/security-boundary.md` for detailed trust
 boundaries, covered threats, non-goals, and release blockers.

package/THREAT_MODEL.md

@@ -14,6 +14,11 @@ It is not a general MCP security gateway, not a prompt-injection cure, not a rep
   Postgres proposal/evidence/replay ledger.
 - Exact-digest supervised-worker policy, worker leases, attention events,
   notification delivery records, and webhook signing secrets.
+- Generated boundary drafts, review decisions, exact activation digests,
+  generation locks, reviewed relationship proofs, and Scoped Explore privacy
+  budgets.
+- Optional Workbench Ask provider credentials and direct-egress consent held
+  only in the local process.
 
 ## Trust Boundaries
 
@@ -54,6 +59,27 @@ idempotency boundary for effects.
 ## Covered Threats
 
 - Model asks for arbitrary SQL: no generic SQL tool is exposed in the Synapsor path.
+- Model tries to turn Scoped Explore into generic SQL or production authority:
+  Explore accepts only reviewed typed plans, is local authoring-only, and is
+  absent from production, unknown-profile, remote, shared HTTP, and non-loopback
+  tool catalogs. Protect output starts disabled and requires exact-digest human
+  activation.
+- Model invents or widens a join: aggregate relationships must be activated,
+  catalog-proven many-to-one paths with fan-out one; table/key/join semantics
+  and activation are not plan arguments. Ambiguous, one-to-many, many-to-many,
+  stale, and over-depth paths fail closed.
+- Generated authority widens after schema/role drift: generated capability and
+  exploration authority are bound to schema, compiler/Spec, role, grant,
+  ownership, RLS, and reviewed-proof fingerprints. Manual legacy projects are
+  unaffected unless they adopt a generation lock.
+- Optional Workbench Ask becomes a second policy engine: Ask lists and calls the
+  exact active MCP/runtime tools, adds no activation/approval/apply authority,
+  keeps provider choice outside model control, and treats provider prose/tool
+  arguments as untrusted.
+- Provider endpoint exfiltration or SSRF: official origins are fixed, custom
+  remote origins require HTTPS, plaintext is loopback-only, redirects are
+  refused, DNS is revalidated and pinned, and private/link-local/metadata
+  destinations fail closed.
 - Model supplies `tenant_id`, `principal`, source id, allowed columns, row version, or approval identity: runner rejects trusted-binding overrides.
 - Prompt injection in database content asks the model to bypass policy: the runner ignores text as authority and only accepts structured capability/job state.
 - Aggregate inference through a one-record group: reviewed aggregate tools
@@ -104,6 +130,9 @@ idempotency boundary for effects.
 - Credential theft outside the runner process.
 - OAuth, SSRF, token-passthrough, or confused-deputy bugs in unrelated MCP systems.
 - Sensitive data already returned to a model.
+- Reviewed visible data intentionally sent to an operator-selected external
+  model provider after Workbench egress consent; the provider's retention and
+  training policy remains outside Runner.
 - Prompt injection itself.
 - Business invariants not represented in the capability config, proposal, application handler, or database constraints.
 - Generic multi-row business transactions, DDL, UPSERT, model-generated
@@ -136,6 +165,14 @@ idempotency boundary for effects.
   queues; `dev_env` is unverified.
 - Treat proposal/evidence/replay handles as identifiers, not authorization;
   preserve verified per-session context on every networked resource read.
+- Keep Scoped Explore and Workbench Ask local to explicit development/staging
+  authoring, verify a SELECT-only non-owner role, and disable Explore before
+  production. Production should serve only activated named capabilities.
+- Review generation-lock and relationship-proof drift instead of bypassing it,
+  and do not treat Prisma/Drizzle/OpenAPI names as authorization.
+- For Workbench Ask, choose provider/model/origin yourself, acknowledge direct
+  egress, keep keys out of project files and chat, and clear in-memory sessions
+  when finished.
 
 ## Release Blockers