@synoi/gateway-lite 0.1.0

package/dist/receipt-store.js

@@ -0,0 +1,801 @@
+"use strict";
+/**
+ * receipt-store.ts
+ *
+ * Persists Decision Receipts and a lightweight action log to SQLite so the
+ * dashboard can show them. Separate from the core EdgeStore / Evidence Journal
+ * (which live in synoi-memory) — this is the gateway's own observable surface.
+ *
+ * Schema:
+ *   receipts     — one row per Sentinel decision
+ *   action_log   — one row per gateway request (shadow + enforce)
+ *   policy_suggestions — auto-classification suggestions per tenant+action_type
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.receiptStore = exports.ReceiptStore = void 0;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const fs_1 = __importDefault(require("fs"));
+// ─── ReceiptStore ─────────────────────────────────────────────────────────────
+class ReceiptStore {
+    db;
+    constructor(dataDir) {
+        fs_1.default.mkdirSync(dataDir, { recursive: true });
+        this.db = new better_sqlite3_1.default(path_1.default.join(dataDir, 'receipts.db'));
+        this.db.pragma('journal_mode = WAL');
+        this.migrate();
+    }
+    migrate() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS receipts (
+        receipt_id    TEXT PRIMARY KEY,
+        intent_id     TEXT NOT NULL,
+        tenant_id     TEXT NOT NULL,
+        decision      TEXT NOT NULL,
+        action_class  TEXT NOT NULL,
+        risk_level    TEXT NOT NULL,
+        action_type   TEXT NOT NULL,
+        action_desc   TEXT NOT NULL,
+        oid_hex       TEXT NOT NULL,
+        provider      TEXT NOT NULL DEFAULT '',
+        pts_tier      INTEGER NOT NULL DEFAULT 0,
+        latency_ms    INTEGER NOT NULL DEFAULT 0,
+        mode          TEXT NOT NULL DEFAULT 'observe',
+        signature     TEXT NOT NULL DEFAULT '',
+        signer_key_id TEXT NOT NULL DEFAULT '',
+        policy_refs   TEXT NOT NULL DEFAULT '[]',
+        recorded_at   INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_receipts_tenant
+        ON receipts(tenant_id, recorded_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_receipts_decision
+        ON receipts(tenant_id, decision, recorded_at DESC);
+
+      CREATE TABLE IF NOT EXISTS action_log (
+        id           INTEGER PRIMARY KEY AUTOINCREMENT,
+        tenant_id    TEXT NOT NULL,
+        action_type  TEXT NOT NULL,
+        risk_level   TEXT NOT NULL,
+        decision     TEXT NOT NULL,
+        receipt_id   TEXT NOT NULL,
+        oid_hex      TEXT NOT NULL,
+        savings_usd  REAL NOT NULL DEFAULT 0,
+        recorded_at  INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_action_log_tenant
+        ON action_log(tenant_id, recorded_at DESC);
+
+      CREATE TABLE IF NOT EXISTS policy_suggestions (
+        tenant_id       TEXT NOT NULL,
+        action_type     TEXT NOT NULL,
+        suggested_class TEXT NOT NULL,
+        confidence      REAL NOT NULL DEFAULT 0,
+        sample_count    INTEGER NOT NULL DEFAULT 0,
+        example_desc    TEXT NOT NULL DEFAULT '',
+        last_seen       INTEGER NOT NULL,
+        PRIMARY KEY (tenant_id, action_type)
+      );
+
+      CREATE TABLE IF NOT EXISTS human_approvals (
+        approval_id   TEXT PRIMARY KEY,
+        receipt_id    TEXT NOT NULL,
+        tenant_id     TEXT NOT NULL,
+        approved_by   TEXT NOT NULL,
+        note          TEXT NOT NULL DEFAULT '',
+        expires_at    INTEGER,
+        approved_at   INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_approvals_receipt
+        ON human_approvals(receipt_id);
+      CREATE INDEX IF NOT EXISTS idx_approvals_tenant
+        ON human_approvals(tenant_id, approved_at DESC);
+    `);
+        // Idempotent migrations for columns added after initial schema
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN parent_receipt_id TEXT`);
+        }
+        catch { /* already exists */ }
+        // Sprint 1 (2026-05-19) — informational SRAID OID + manifest hash
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN sraid_oid_hex TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN gateway_manifest_sha256 TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN degraded INTEGER`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN degraded_reason TEXT`);
+        }
+        catch { }
+        // Sprint 3 (2026-05-19) — anchor metadata. Receipts get a leaf_hash
+        // computed at signing time; the anchor worker batches unanchored
+        // receipts every 10 min, builds a Merkle root, and writes back
+        // batch_id + merkle_proof_json + anchor_* columns.
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN leaf_hash         TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN batch_id          TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN merkle_proof_json TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN anchor_status     TEXT`);
+        }
+        catch { } // 'pending' | 'submitted' | 'confirmed' | 'failed'
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN anchored_at       INTEGER`);
+        }
+        catch { }
+        try {
+            this.db.exec(`CREATE INDEX IF NOT EXISTS idx_receipts_unanchored ON receipts(anchor_status, recorded_at) WHERE anchor_status IS NULL OR anchor_status = 'pending'`);
+        }
+        catch { }
+        // Compliance pack tagging (2026-05-19) — receipts carry a JSON array
+        // of compliance-subcategory tags (e.g. ['NIST.MEASURE-2.6',
+        // 'NIST.MANAGE-4.1', 'EU.Article12']). Auditors filter receipts by
+        // tag to assemble per-framework evidence bundles. Derivation rules
+        // live in src/compliance-tagger.ts.
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN compliance_tags TEXT`);
+        }
+        catch { }
+        // Sprint 11 (2026-05-20) — post-quantum hybrid signature. Receipts
+        // produced from this version forward carry BOTH the Ed25519
+        // signature (signature column above) AND an ML-DSA-65 (FIPS 204)
+        // signature in this column, over the same canonical bytes. NULL on
+        // legacy receipts; the /verify endpoint falls back to Ed25519-only
+        // verification when this is NULL.
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN ml_dsa_signature TEXT`);
+        }
+        catch { }
+        // T14 (#274) — Authority context columns. All optional; NULL when the
+        // gateway's direct-inference path ran without an GAP grant, GAP invocation,
+        // or matched risk-policy rule. When present, these values are included in
+        // the SIGNED canonical payload so tampering any authority field is
+        // cryptographically detectable.
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN grant_oid   TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN intent_oid  TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN rule_id     TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN subject_oid TEXT`);
+        }
+        catch { }
+        // #101 (Step 1) -- four governance-sensing fields. All signed.
+        // session_id: GAP actor_session_id; null on direct-inference path.
+        // policy_versions: JSON array of {id,version} tuples for active packs.
+        // action_payload_hash: SHA-256 hex of action payload; null when absent.
+        // sequence: per-tenant monotonic counter from tenant_sequences table.
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN session_id          TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN policy_versions     TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN action_payload_hash TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN sequence            INTEGER`);
+        }
+        catch { }
+        // #124 (Step 4) -- authorized-axis correlation key fields. All signed.
+        // target_id:    v0 = pack_id for gateway policy packs; null on direct-inference.
+        // target_class: category of authorized target; null on direct-inference.
+        // state_sha256: SHA-256 of canonicalPolicyState at authorization time; null in v0.
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN target_id    TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN target_class TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE receipts ADD COLUMN state_sha256 TEXT`);
+        }
+        catch { }
+        // #124 -- index supporting getLatestAllowingReceiptForTarget.
+        // Idempotent; runs after the ADD COLUMN above.
+        try {
+            this.db.exec(`CREATE INDEX IF NOT EXISTS idx_receipts_target ON receipts(tenant_id, target_id, decision, recorded_at DESC)`);
+        }
+        catch { }
+        // Sequence counter table: one row per tenant. The counter is incremented
+        // atomically inside the same SQLite write transaction as the receipt row.
+        // Using SQLite's ROWID-backed INTEGER PRIMARY KEY guarantees monotonicity
+        // within the single-writer WAL journal without external locking.
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS tenant_sequences (
+        tenant_id TEXT PRIMARY KEY,
+        seq       INTEGER NOT NULL DEFAULT 0
+      )
+    `);
+        // Anchor batch table — one row per Merkle batch.
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS anchor_batches (
+        batch_id        TEXT PRIMARY KEY,           -- random 16-byte hex
+        merkle_root     TEXT NOT NULL,              -- 32-byte hex
+        leaf_count      INTEGER NOT NULL,
+        created_at      INTEGER NOT NULL,
+        ots_proof       TEXT,                       -- OpenTimestamps OTS bytes, base64 (NULL until submitted)
+        ots_submitted_at INTEGER,
+        ots_upgraded_at  INTEGER,                   -- when Bitcoin attestation became available
+        rekor_log_id    TEXT,                       -- sigstore Rekor log entry id (future)
+        rekor_log_index INTEGER,
+        rekor_at        INTEGER,
+        notes           TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_anchor_batches_created ON anchor_batches(created_at DESC);
+    `);
+        // Sprint 5 — SynOI counter-signature on each batch.
+        // Gateway submits batch_root to control plane BEFORE OpenTimestamps;
+        // SynOI cross-validates the install's integrity posture and signs a
+        // canonical bundle. Both the SynOI signature AND the OTS proof end
+        // up on the same anchor_batches row.
+        try {
+            this.db.exec(`ALTER TABLE anchor_batches ADD COLUMN synoi_signature        TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE anchor_batches ADD COLUMN synoi_signer_key_id    TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE anchor_batches ADD COLUMN synoi_status           TEXT`);
+        }
+        catch { } // 'trusted' | 'flagged'
+        try {
+            this.db.exec(`ALTER TABLE anchor_batches ADD COLUMN synoi_reason           TEXT`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE anchor_batches ADD COLUMN synoi_signed_at        INTEGER`);
+        }
+        catch { }
+        try {
+            this.db.exec(`ALTER TABLE anchor_batches ADD COLUMN synoi_canonical_bundle TEXT`);
+        }
+        catch { }
+        // N16 Phase 1: human_approvals is append-only.
+        //
+        // An approval record must never be modified or deleted after it is written —
+        // the Class C gate in isApproved() trusts its presence as immutable evidence.
+        // The triggers below enforce this at the SQLite layer so the invariant holds
+        // regardless of which code path touches the table.
+        this.db.exec(`
+      CREATE TRIGGER IF NOT EXISTS trg_approvals_no_update
+      BEFORE UPDATE ON human_approvals
+      BEGIN
+        SELECT RAISE(ABORT,'human_approvals are append-only');
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS trg_approvals_no_delete
+      BEFORE DELETE ON human_approvals
+      BEGIN
+        SELECT RAISE(ABORT,'human_approvals are append-only');
+      END;
+    `);
+    }
+    /**
+     * Atomically increment and return the next sequence number for a tenant.
+     * Uses an INSERT OR REPLACE so the first call for a new tenant starts at 1.
+     * Called inside putReceipt; callers never need to call this directly.
+     */
+    nextSequence(tenant_id) {
+        this.db.prepare(`
+      INSERT INTO tenant_sequences (tenant_id, seq)
+      VALUES (@tenant_id, 1)
+      ON CONFLICT(tenant_id) DO UPDATE SET seq = seq + 1
+    `).run({ tenant_id });
+        const row = this.db.prepare(`SELECT seq FROM tenant_sequences WHERE tenant_id = ?`).get(tenant_id);
+        return row.seq;
+    }
+    putReceipt(r) {
+        // Sequence is NOT auto-assigned here. The caller is responsible for
+        // pre-fetching the sequence via nextSequence() and including it in both
+        // the signed canonical payload AND the StoredReceipt before calling
+        // putReceipt. This ensures the stored sequence always matches what was
+        // signed; silent auto-assignment here would mutate the canonical bytes
+        // after signing and break verification for legacy receipts or any path
+        // that was signed without a sequence. Only signAndStoreAnthropic (and
+        // equivalent signers for new paths) should call nextSequence.
+        const sequence = r.sequence ?? null;
+        this.db.prepare(`
+      INSERT OR REPLACE INTO receipts
+        (receipt_id, intent_id, tenant_id, decision, action_class, risk_level,
+         action_type, action_desc, oid_hex, provider, pts_tier, latency_ms,
+         mode, signature, signer_key_id, policy_refs, recorded_at, parent_receipt_id,
+         sraid_oid_hex, gateway_manifest_sha256, degraded, degraded_reason,
+         compliance_tags, ml_dsa_signature,
+         grant_oid, intent_oid, rule_id, subject_oid,
+         session_id, policy_versions, action_payload_hash, sequence,
+         target_id, target_class, state_sha256)
+      VALUES
+        (@receipt_id, @intent_id, @tenant_id, @decision, @action_class, @risk_level,
+         @action_type, @action_desc, @oid_hex, @provider, @pts_tier, @latency_ms,
+         @mode, @signature, @signer_key_id, @policy_refs, @recorded_at, @parent_receipt_id,
+         @sraid_oid_hex, @gateway_manifest_sha256, @degraded, @degraded_reason,
+         @compliance_tags, @ml_dsa_signature,
+         @grant_oid, @intent_oid, @rule_id, @subject_oid,
+         @session_id, @policy_versions, @action_payload_hash, @sequence,
+         @target_id, @target_class, @state_sha256)
+    `).run({
+            ...r,
+            parent_receipt_id: r.parent_receipt_id ?? null,
+            sraid_oid_hex: r.sraid_oid_hex ?? null,
+            gateway_manifest_sha256: r.gateway_manifest_sha256 ?? null,
+            degraded: r.degraded ? 1 : 0,
+            degraded_reason: r.degraded_reason ?? null,
+            compliance_tags: r.compliance_tags ?? null,
+            ml_dsa_signature: r.ml_dsa_signature ?? null,
+            grant_oid: r.grant_oid ?? null,
+            intent_oid: r.intent_oid ?? null,
+            rule_id: r.rule_id ?? null,
+            subject_oid: r.subject_oid ?? null,
+            session_id: r.session_id ?? null,
+            policy_versions: r.policy_versions ?? null,
+            action_payload_hash: r.action_payload_hash ?? null,
+            sequence,
+            // #124 -- correlation key fields
+            target_id: r.target_id ?? null,
+            target_class: r.target_class ?? null,
+            state_sha256: r.state_sha256 ?? null,
+        });
+        this.db.prepare(`
+      INSERT INTO action_log
+        (tenant_id, action_type, risk_level, decision, receipt_id, oid_hex, recorded_at)
+      VALUES
+        (@tenant_id, @action_type, @risk_level, @decision, @receipt_id, @oid_hex, @recorded_at)
+    `).run({
+            tenant_id: r.tenant_id,
+            action_type: r.action_type,
+            risk_level: r.risk_level,
+            decision: r.decision,
+            receipt_id: r.receipt_id,
+            oid_hex: r.oid_hex,
+            recorded_at: r.recorded_at,
+        });
+        this._updateSuggestion(r);
+        // SRAID Phase 4 — mirror the signed receipt as a CDRO into an
+        // EdgeStore-backed store. Best-effort; if the mirror fails the SQLite
+        // write is already done. Lazy require avoids a circular import at boot.
+        if (r.signature) {
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { mirrorReceipt } = require('./cdro-mirror');
+                mirrorReceipt({
+                    receipt_id: r.receipt_id,
+                    tenant_id: r.tenant_id,
+                    decision: r.decision,
+                    action_class: r.action_class,
+                    risk_level: r.risk_level,
+                    oid_hex: r.oid_hex,
+                    signature: r.signature,
+                    signer_key_id: r.signer_key_id,
+                    recorded_at: r.recorded_at,
+                    gateway_manifest_sha256: r.gateway_manifest_sha256 ?? null,
+                });
+            }
+            catch { /* mirror is best-effort */ }
+        }
+    }
+    listReceipts(tenant_id, limit = 50, offset = 0) {
+        return this.db.prepare(`
+      SELECT * FROM receipts
+      WHERE tenant_id = ?
+      ORDER BY recorded_at DESC
+      LIMIT ? OFFSET ?
+    `).all(tenant_id, limit, offset);
+    }
+    getReceipt(receipt_id) {
+        return this.db.prepare(`SELECT * FROM receipts WHERE receipt_id = ? LIMIT 1`).get(receipt_id);
+    }
+    /**
+     * All receipts for a specific (tenant_id, session_id) pair within a time
+     * window. Used by session-observation.ts (#102) to compute windowed
+     * aggregates for the governance PIP layer.
+     *
+     * Tenant isolation is enforced at the SQL level: both tenant_id AND
+     * session_id must match. The query is bounded by the (tenant_id,
+     * recorded_at DESC) index so it never scans the full table; session_id
+     * filtering happens inside that already-indexed set.
+     *
+     * Limit of 10,000 prevents runaway memory on pathological sessions.
+     * Circuit-breaker (#103) should trip long before this limit is reached.
+     */
+    listReceiptsForSession(tenant_id, session_id, since_ms, limit = 10_000) {
+        return this.db.prepare(`
+      SELECT * FROM receipts
+      WHERE tenant_id  = ?
+        AND session_id = ?
+        AND recorded_at >= ?
+      ORDER BY recorded_at ASC
+      LIMIT ?
+    `).all(tenant_id, session_id, since_ms, limit);
+    }
+    // ── Compliance export (2026-05-19) ─────────────────────────────────────
+    /**
+     * Receipts in a tenant + time window. Used by the compliance-export
+     * pipeline. `tag_filter`, when present, filters by a single
+     * NIST/EU/ISO subcategory tag.
+     */
+    receiptsForExport(args) {
+        if (args.tag_filter) {
+            // SQLite has no portable JSON contains operator. Tag strings are
+            // wrapped in quotes inside the JSON array; LIKE on the
+            // double-quoted-tag-substring matches without false positives.
+            const like = `%${JSON.stringify(args.tag_filter)}%`;
+            return this.db.prepare(`
+        SELECT * FROM receipts
+        WHERE tenant_id = ?
+          AND recorded_at BETWEEN ? AND ?
+          AND compliance_tags LIKE ?
+        ORDER BY recorded_at ASC
+        LIMIT ?
+      `).all(args.tenant_id, args.from_ms, args.to_ms, like, args.limit ?? 10_000);
+        }
+        return this.db.prepare(`
+      SELECT * FROM receipts
+      WHERE tenant_id = ?
+        AND recorded_at BETWEEN ? AND ?
+      ORDER BY recorded_at ASC
+      LIMIT ?
+    `).all(args.tenant_id, args.from_ms, args.to_ms, args.limit ?? 10_000);
+    }
+    /** Distinct compliance tags seen in receipts for a tenant + window. */
+    distinctTagsForTenant(tenant_id, from_ms, to_ms) {
+        const rows = this.db.prepare(`
+      SELECT DISTINCT compliance_tags
+      FROM receipts
+      WHERE tenant_id = ?
+        AND recorded_at BETWEEN ? AND ?
+        AND compliance_tags IS NOT NULL
+    `).all(tenant_id, from_ms, to_ms);
+        const set = new Set();
+        for (const r of rows) {
+            try {
+                const arr = JSON.parse(r.compliance_tags);
+                for (const t of arr)
+                    set.add(t);
+            }
+            catch { /* skip malformed */ }
+        }
+        return [...set].sort();
+    }
+    // ── Sprint 3 — Anchor batch helpers ────────────────────────────────────
+    /** Receipts not yet assigned to an anchor batch. Ordered by recorded_at ASC
+     *  so each batch covers a contiguous time window. */
+    getUnanchoredReceipts(limit) {
+        return this.db.prepare(`
+      SELECT * FROM receipts
+      WHERE (anchor_status IS NULL OR anchor_status = '')
+      ORDER BY recorded_at ASC
+      LIMIT ?
+    `).all(limit);
+    }
+    /** Insert an anchor batch row + mark each receipt as anchored with its
+     *  Merkle proof. Atomic via SQLite transaction. */
+    recordAnchorBatch(args) {
+        const cs = args.synoi_countersignature ?? null;
+        const tx = this.db.transaction(() => {
+            this.db.prepare(`
+        INSERT INTO anchor_batches
+          (batch_id, merkle_root, leaf_count, created_at, ots_proof, ots_submitted_at,
+           rekor_log_id, rekor_log_index, rekor_at,
+           synoi_signature, synoi_signer_key_id, synoi_status, synoi_reason,
+           synoi_signed_at, synoi_canonical_bundle)
+        VALUES
+          (@batch_id, @merkle_root, @leaf_count, @created_at, @ots_proof, @ots_submitted_at,
+           @rekor_log_id, @rekor_log_index, @rekor_at,
+           @synoi_signature, @synoi_signer_key_id, @synoi_status, @synoi_reason,
+           @synoi_signed_at, @synoi_canonical_bundle)
+      `).run({
+                batch_id: args.batch_id,
+                merkle_root: args.merkle_root,
+                leaf_count: args.leaf_count,
+                created_at: args.created_at,
+                ots_proof: args.ots_proof ?? null,
+                ots_submitted_at: args.ots_submitted_at ?? null,
+                rekor_log_id: args.rekor_log_id ?? null,
+                rekor_log_index: args.rekor_log_index ?? null,
+                rekor_at: args.rekor_at ?? null,
+                synoi_signature: cs?.signature ?? null,
+                synoi_signer_key_id: cs?.signer_key_id ?? null,
+                synoi_status: cs?.status ?? null,
+                synoi_reason: cs?.reason ?? null,
+                synoi_signed_at: cs?.signed_at ?? null,
+                synoi_canonical_bundle: cs?.canonical_bundle ?? null,
+            });
+            const update = this.db.prepare(`
+        UPDATE receipts SET
+          leaf_hash         = @leaf_hash,
+          batch_id          = @batch_id,
+          merkle_proof_json = @proof_json,
+          anchor_status     = @status,
+          anchored_at       = @anchored_at
+        WHERE receipt_id = @receipt_id
+      `);
+            const status = args.ots_proof ? 'submitted' : 'pending';
+            for (const r of args.receipts) {
+                update.run({
+                    batch_id: args.batch_id,
+                    leaf_hash: r.leaf_hash,
+                    proof_json: r.proof_json,
+                    status,
+                    anchored_at: args.created_at,
+                    receipt_id: r.receipt_id,
+                });
+            }
+        });
+        tx();
+    }
+    getAnchorBatch(batch_id) {
+        return this.db.prepare(`SELECT * FROM anchor_batches WHERE batch_id = ? LIMIT 1`).get(batch_id);
+    }
+    /** For tests + diagnostics — list recent batches. */
+    listAnchorBatches(limit = 20) {
+        return this.db.prepare(`SELECT * FROM anchor_batches ORDER BY created_at DESC LIMIT ?`).all(limit);
+    }
+    /** Count of shadow_block decisions in the last 7 days */
+    /** Total receipts written since `since_ms`, across all tenants. Used by
+     *  /status as a cheap liveness probe (indexed on recorded_at). */
+    countSince(since_ms) {
+        const row = this.db.prepare(`
+      SELECT COUNT(*) AS n FROM receipts WHERE recorded_at >= ?
+    `).get(since_ms);
+        return row.n;
+    }
+    /**
+     * Count receipts for a tenant matching any of a list of action_types
+     * within a sliding window. Powers mass-read rate-limit risk rules — the
+     * defense against the NYC H+H-class mass-exfiltration pattern. Cheap:
+     * (tenant_id, recorded_at) is the natural index, action_type filter is
+     * a small IN clause.
+     *
+     * Use case:
+     *   countRecentActionsByType(
+     *     'nychhc-prod',
+     *     ['patient.read', 'patient.search'],
+     *     Date.now() - 5 * 60_000
+     *   )
+     *   → 142 reads in the last 5 minutes
+     *
+     * Trigger HITL if > N. See src/rate-limit.ts.
+     */
+    countRecentActionsByType(tenant_id, action_types, since_ms) {
+        if (action_types.length === 0)
+            return 0;
+        // SQLite parameter expansion for IN — build placeholder list.
+        const placeholders = action_types.map(() => '?').join(',');
+        const row = this.db.prepare(`
+      SELECT COUNT(*) AS n FROM receipts
+      WHERE tenant_id = ?
+        AND recorded_at >= ?
+        AND action_type IN (${placeholders})
+        AND decision IN ('allow', 'shadow_block')
+    `).get(tenant_id, since_ms, ...action_types);
+        return row.n;
+    }
+    shadowBlockCount(tenant_id) {
+        const since = Date.now() - 7 * 24 * 60 * 60 * 1000;
+        const row = this.db.prepare(`
+      SELECT COUNT(*) as n FROM receipts
+      WHERE tenant_id = ? AND decision = 'shadow_block' AND recorded_at >= ?
+    `).get(tenant_id, since);
+        return row.n;
+    }
+    getSuggestions(tenant_id) {
+        return this.db.prepare(`
+      SELECT * FROM policy_suggestions WHERE tenant_id = ?
+      ORDER BY sample_count DESC
+    `).all(tenant_id);
+    }
+    /** Summary stats for the dashboard */
+    summary(tenant_id, since_ms) {
+        const row = this.db.prepare(`
+      SELECT
+        COUNT(*) as total,
+        SUM(CASE WHEN decision = 'allow'        THEN 1 ELSE 0 END) as allows,
+        SUM(CASE WHEN decision = 'shadow_block' THEN 1 ELSE 0 END) as shadow_blocks,
+        SUM(CASE WHEN decision = 'deny'         THEN 1 ELSE 0 END) as hard_blocks
+      FROM receipts
+      WHERE tenant_id = ? AND recorded_at >= ?
+    `).get(tenant_id, since_ms);
+        return {
+            total: row.total ?? 0,
+            allows: row.allows ?? 0,
+            shadow_blocks: row.shadow_blocks ?? 0,
+            hard_blocks: row.hard_blocks ?? 0,
+        };
+    }
+    // ── Human approvals (Class C gate) ────────────────────────────────────────
+    /**
+     * Record that a human has approved a specific receipt_id for execution.
+     * In enforce mode the handler checks this before allowing Class C (high-risk) requests.
+     * expires_at: optional unix ms — approval expires (useful for time-boxed permits).
+     */
+    approveReceipt(receipt_id, approved_by, note = '', expires_at) {
+        const receipt = this.getReceipt(receipt_id);
+        if (!receipt)
+            throw new Error(`Receipt not found: ${receipt_id}`);
+        const approval_id = `apv-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+        this.db.prepare(`
+      INSERT INTO human_approvals
+        (approval_id, receipt_id, tenant_id, approved_by, note, expires_at, approved_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `).run(approval_id, receipt_id, receipt.tenant_id, approved_by, note, expires_at ?? null, Date.now());
+        return approval_id;
+    }
+    /** Returns true if the given receipt_id has a valid (non-expired) human approval. */
+    isApproved(receipt_id) {
+        const row = this.db.prepare(`
+      SELECT approval_id, expires_at FROM human_approvals
+      WHERE receipt_id = ?
+      LIMIT 1
+    `).get(receipt_id);
+        if (!row)
+            return false;
+        if (row.expires_at !== null && Date.now() > row.expires_at)
+            return false;
+        return true;
+    }
+    listApprovals(tenant_id, limit = 50) {
+        return this.db.prepare(`
+      SELECT ha.*, r.action_type, r.risk_level, r.action_desc
+      FROM human_approvals ha
+      JOIN receipts r ON r.receipt_id = ha.receipt_id
+      WHERE ha.tenant_id = ?
+      ORDER BY ha.approved_at DESC
+      LIMIT ?
+    `).all(tenant_id, limit);
+    }
+    // ── KB stale detection helper ─────────────────────────────────────────────
+    /**
+     * Returns the recorded_at timestamp of the most recent 'allow' receipt for
+     * a given tenant + OID, or null if no such receipt exists.
+     * Used by the Notion stale detection path to determine when a cached response
+     * was first stored, so it can be compared against KB supersession timestamps.
+     */
+    getLatestAllowedAt(tenant_id, oid_hex) {
+        const row = this.db.prepare(`
+      SELECT MAX(recorded_at) AS latest FROM receipts
+      WHERE tenant_id = ? AND oid_hex = ? AND decision = 'allow'
+    `).get(tenant_id, oid_hex);
+        return row.latest;
+    }
+    /**
+     * Returns the receipt_id and recorded_at of the most recent 'allow' receipt
+     * for a given tenant + OID, or null if none exists.
+     *
+     * Used by the compare engine (#116) so AUTHORIZED items can carry the exact
+     * receipt id, enabling #121 revoke-and-reclassify without a full table scan.
+     * Kept separate from getLatestAllowedAt (timestamp-only) so existing callers
+     * are unaffected.
+     */
+    getLatestAllowingReceipt(tenant_id, oid_hex) {
+        const row = this.db.prepare(`
+      SELECT receipt_id, recorded_at FROM receipts
+      WHERE tenant_id = ? AND oid_hex = ? AND decision = 'allow'
+      ORDER BY recorded_at DESC LIMIT 1
+    `).get(tenant_id, oid_hex);
+        return row ?? null;
+    }
+    /**
+     * Returns the receipt_id and recorded_at of the most recent 'allow' receipt
+     * for a given (tenant_id, target_id) pair, or null if none exists.
+     *
+     * #124 — the authorized-path receipt producer (signAndStorePolicyChange)
+     * sets target_id on every policy-change receipt. The compare engine joins on
+     * (tenant_id, target_id) via this getter so a gateway-authorized policy change
+     * classifies AUTHORIZED without requiring oid_hex identity between the
+     * producer and the sensor.
+     *
+     * Tenant isolation is enforced at the SQL level: both tenant_id AND target_id
+     * must match. The (tenant_id, target_id, decision, recorded_at DESC) index
+     * keeps this O(log n).
+     *
+     * Window check stays in compare-engine (as with getLatestAllowingReceipt)
+     * so this getter returns the newest match and the engine applies the lookback
+     * / grace bounds.
+     */
+    getLatestAllowingReceiptForTarget(tenant_id, target_id) {
+        const row = this.db.prepare(`
+      SELECT receipt_id, recorded_at FROM receipts
+      WHERE tenant_id = ? AND target_id = ? AND decision = 'allow'
+      ORDER BY recorded_at DESC LIMIT 1
+    `).get(tenant_id, target_id);
+        return row ?? null;
+    }
+    /**
+     * #119 FIX 4 — window-bounded in-window allow-receipt existence check.
+     *
+     * Returns the latest allow-receipt for (tenant_id, target_id) WHOSE
+     * recorded_at falls within [window_start, window_end] inclusive, or null.
+     *
+     * The window bounds are pushed into the SQL so a newer out-of-window
+     * allow-receipt cannot shadow a legitimate in-window one. The plain
+     * getLatestAllowingReceiptForTarget returns the single newest row regardless
+     * of window; the compare engine then window-checked that one row, so a newer
+     * out-of-window receipt masked an in-window receipt and the change was
+     * misclassified ORPHANED -> wrongly blocked in enforce mode.
+     *
+     * Tenant isolation: both tenant_id AND target_id must match.
+     * Uses the (tenant_id, target_id, decision, recorded_at DESC) index (line 368).
+     */
+    getInWindowAllowingReceiptForTarget(tenant_id, target_id, window_start, window_end) {
+        const row = this.db.prepare(`
+      SELECT receipt_id, recorded_at FROM receipts
+      WHERE tenant_id = ? AND target_id = ? AND decision = 'allow'
+        AND recorded_at >= ? AND recorded_at <= ?
+      ORDER BY recorded_at DESC LIMIT 1
+    `).get(tenant_id, target_id, window_start, window_end);
+        return row ?? null;
+    }
+    // ── Auto-classification ────────────────────────────────────────────────────
+    _updateSuggestion(r) {
+        const suggested_class = riskToClass(r.risk_level);
+        const existing = this.db.prepare(`
+      SELECT * FROM policy_suggestions WHERE tenant_id = ? AND action_type = ?
+    `).get(r.tenant_id, r.action_type);
+        if (!existing) {
+            this.db.prepare(`
+        INSERT INTO policy_suggestions
+          (tenant_id, action_type, suggested_class, confidence, sample_count, example_desc, last_seen)
+        VALUES (?, ?, ?, ?, 1, ?, ?)
+      `).run(r.tenant_id, r.action_type, suggested_class, 0.6, r.action_desc, r.recorded_at);
+            return;
+        }
+        // Bayesian-lite: confidence grows with consistent sample_count
+        const newCount = existing.sample_count + 1;
+        const sameClass = existing.suggested_class === suggested_class;
+        const newConfidence = sameClass
+            ? Math.min(existing.confidence + 0.05, 0.98)
+            : Math.max(existing.confidence - 0.10, 0.40);
+        const newClass = newConfidence < 0.50 ? suggested_class : existing.suggested_class;
+        this.db.prepare(`
+      UPDATE policy_suggestions SET
+        suggested_class = ?, confidence = ?, sample_count = ?, last_seen = ?
+      WHERE tenant_id = ? AND action_type = ?
+    `).run(newClass, newConfidence, newCount, r.recorded_at, r.tenant_id, r.action_type);
+    }
+}
+exports.ReceiptStore = ReceiptStore;
+function riskToClass(risk) {
+    if (risk === 'high')
+        return 'C';
+    if (risk === 'medium')
+        return 'B';
+    return 'A';
+}
+// ─── Singleton ────────────────────────────────────────────────────────────────
+const _dataDir = process.env.SYNOI_DATA_DIR
+    ? path_1.default.join(process.env.SYNOI_DATA_DIR, '_gateway')
+    : path_1.default.join(os_1.default.homedir(), '.synoi', 'gateway', '_gateway');
+exports.receiptStore = new ReceiptStore(_dataDir);