synartesis 0.6.19 → 0.6.22

package/CHANGELOG.md

@@ -2,6 +2,107 @@
 
 What changed, and why it mattered. Dates are release dates.
 
+## 0.6.22 — 2026-09-16
+
+### Added
+
+- **The memory policy's undo is now proven, not just plausible.** It has always
+  declared `provenance: live` -- the tools were checked against the real server
+  and the shapes read off its own answers -- while the README said its recovery
+  guarantees were unproven. Both were true, and the gap between them is where a
+  policy can name every tool correctly, take exactly the arguments the server
+  wants, and still resolve an inverse that puts nothing back. That failure
+  looks like success: the drift check passes and the report says `rolled_back`.
+
+  `tests/adapter-memory.test.ts` makes each change against a real knowledge
+  graph, undoes it, and compares the file. What the agent added is gone and
+  what was already there is untouched; an entity the agent only *tried* to
+  create -- this server ignores a duplicate name -- is left alone rather than
+  deleted out from under its owner; a relation drawn or removed goes back; and
+  a delete of an entity is held for a person rather than approximated, because
+  one inverse cannot put back both the entity and the relations that went with
+  it. Every one of those was confirmed by breaking the policy and watching the
+  matching test fail.
+
+  Two of the four shipped policies are now round-tripped end to end.
+  `synartesis check`, the README and both guides say which, and `git` is still
+  named plainly as untested.
+
+- `check` also confirms the memory policy covers every tool that server offers,
+  so a server that grows one fails here rather than in front of somebody's
+  agent.
+
+## 0.6.21 — 2026-09-16
+
+### Fixed
+
+- **`live` claimed more than it meant, and the docs contradicted each other
+  about it.** `provenance: live` says a policy has met its server and that the
+  tools take the arguments it passes them. `check` printed that as "checked
+  against the real server", which reads as a claim that undo works -- and it is
+  not one: a policy can be right about every tool name and still record an
+  inverse that restores nothing. Meanwhile the README said memory's recovery
+  guarantees were unproven while the user guide listed memory among the
+  policies that say `live`, so a reader who saw one came away with the opposite
+  of what the other meant. `check` now says "shapes read from the real server"
+  and adds, once under the server list, that `live` is not a recovery claim and
+  that only filesystem has been round-tripped. README and both guides say the
+  same thing.
+
+### Added
+
+- **`check` names the tools no policy covers, instead of describing the rule.**
+  An unmatched tool has always been fail-closed -- irreversible, held for a
+  person the first time it is called -- and `check` said so as a sentence about
+  tools in general while the actual list sat one round trip away. It already
+  connects to every server and reads the whole tool list to verify the
+  policies, so the answer was in hand and thrown away, and the first anybody
+  learned a tool was ungoverned was an agent stopping on it mid-task. Now
+  named, per server, with a count. The proxy warns at startup for the same
+  reason, and `proxy ready` carries an `ungoverned` count so a policy with no
+  gaps and a build that forgot to look do not read alike.
+
+  For what almost everybody runs, the answer is none: the shipped filesystem
+  policy covers every tool that server offers, and there is a test that will
+  fail if that stops being true.
+
+- The build targeted `node20` while the package requires `>=22`, which is the
+  floor better-sqlite3 sets -- on Node 20 it segfaults the moment a database
+  opens. Targeting lower was harmless but said the wrong thing about what this
+  supports, in the one place a reader could check. Now `node22`.
+
+## 0.6.20 — 2026-09-15
+
+### Fixed
+
+- **The undo preview showed a write nobody confirmed as one that was
+  confirmed.** A tool call can land and then fail to say so -- the server
+  writes the record and times out, or answers with an error on its way out.
+  Synartesis already handled this correctly: it refuses to read `isError` as a
+  promise that nothing happened, reads the resource back, and records the
+  change so it stays recoverable. What it did not do was say so afterwards.
+  The row that came out of that path carried no trace of it at all -- the
+  refusal was written to the log, which nobody reads, at the moment it
+  happens, which is not the moment it matters -- so `undo --dry-run` printed
+  `revert ... state matches; applying inverse`, character for character what a
+  confirmed write prints. The row now records how it was established, and the
+  preview prints it under the step as `caveat`. Same in the app's
+  `preview_undo`, so a model cannot describe an inferred write to somebody as
+  a confirmed one.
+
+- **A halt that named the consequence and hid the cause.** Where the transport
+  failed and the read-back proved the write had landed, undo correctly stopped
+  rather than reverting on an unverified assumption -- but said only "the
+  post-state was never captured, so drift could not be ruled out", which reads
+  as a missed reading. The reason there was no reading, which the row knew all
+  along, is now printed with it.
+
+- An action whose outcome is unknown was told it got that way because "the
+  process died mid-call". A timeout, or an error the read-back could not
+  settle, arrives in exactly the same state and was told the same wrong story.
+  It now says what is actually known, and the row's own error says which of
+  them it was.
+
 ## 0.6.19 — 2026-09-15
 
 ### Fixed

package/README.md

@@ -333,10 +333,25 @@ cannot start a process:** see the [user guide](docs/synartesis-user-guide.md).
   resolved when the call happens, so a mistake in a manifest is baked into every
   run made under it. `undo --replan` rebuilds them from a corrected one.
 
-The bundled **filesystem** policy is tested against the real server: exact
-byte-for-byte restoration, drift refusal, and absence told apart from a read
-that failed. The **memory, git and github** policies are checked only for tool
-existence — their recovery guarantees are not yet proven.
+Two bundled policies are tested against the real server, by making the change
+and undoing it. **filesystem**: exact byte-for-byte restoration, drift refusal,
+and absence told apart from a read that failed. **memory**: the graph is put
+back as it was, entities the agent only tried to create are left alone, and a
+delete of an entity is held rather than approximated. **git and github** are
+checked only for tool existence — their recovery guarantees are not yet proven.
+
+All three of filesystem, memory and git declare `provenance: live`, and that
+word is narrower than it looks: it says the policy has met its server and the
+tools take the arguments it passes them, not that undo has been round-tripped.
+`synartesis check` says so under the server list rather than leaving `live` to
+stand for both.
+
+**A tool no policy mentions is irreversible and held for a person** the first
+time it is called. That is the safe end of the trade, and it means a server
+that gains a tool in an update does not quietly get a free pass — but it also
+means an agent stopping mid-task on a call nobody expected. `synartesis check`
+names every such tool, and the proxy warns about them at startup, so you can
+write a policy before meeting one rather than after.
 
 ## Trust
 

package/dist/{chunk-SZHVLCJR.js → chunk-JLLAK2QC.js}

@@ -1554,18 +1554,30 @@ function untested(manifest) {
 function describeStanding(entry) {
   switch (entry.provenance) {
     case "live":
-      return "checked against the real server";
+      return "shapes read from the real server";
     case "documented":
       return "written from documentation, never run against the real server";
     case "unstated":
       return "no claim either way";
   }
 }
+var LIVE_IS_NOT_RECOVERY = "`live` means the policy has met its server, not that undo has been round-tripped against it. Of the policies that ship, filesystem and memory have been; git and github have not.";
 function warnUntested(servers) {
   const names = servers.join(", ");
   const these = servers.length === 1 ? "this policy has" : "these policies have";
   return `${names}: ${these} never been run against the real server. The classes and inverses here come from documentation, so undo may not work where it says it will. Run \`synartesis check\` against your own credentials, and expect to correct something.`;
 }
+function ungoverned(manifest, advertised) {
+  const resolver = createPolicyResolver(manifest);
+  const found = [];
+  for (const server of [...advertised.keys()].sort()) {
+    const tools = (advertised.get(server) ?? []).filter((tool) => !resolver.resolve(qualify(server, tool)).matched).sort();
+    if (tools.length > 0) {
+      found.push({ server, tools });
+    }
+  }
+  return found;
+}
 
 // src/proxy/routing.ts
 var SEPARATOR = "__";
@@ -1915,7 +1927,9 @@ export {
   standing,
   untested,
   describeStanding,
+  LIVE_IS_NOT_RECOVERY,
   warnUntested,
+  ungoverned,
   IDEMPOTENCY_META_KEY,
   withIdempotencyKey,
   createRouter,
@@ -1930,4 +1944,4 @@ export {
   observeState,
   connectStdioUpstream
 };
-//# sourceMappingURL=chunk-SZHVLCJR.js.map
+//# sourceMappingURL=chunk-JLLAK2QC.js.map

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   IDEMPOTENCY_META_KEY,
+  LIVE_IS_NOT_RECOVERY,
   NOTHING_RECORDED_YET,
   PROXY_FLAGS,
   WORDMARK,
@@ -32,11 +33,12 @@ import {
   toPayload,
   toResolvedRead,
   toolShapes,
+  ungoverned,
   untested,
   verifyAgainstServers,
   warnUntested,
   wasRefused
-} from "./chunk-SZHVLCJR.js";
+} from "./chunk-JLLAK2QC.js";
 import {
   DriftConflict,
   ManifestError,
@@ -375,7 +377,12 @@ function classify(action, replanning, goAhead) {
     case "pending":
       return {
         kind: "halt",
-        reason: "outcome unknown: the process died mid-call, so whether this applied cannot be determined",
+        // Not "the process died mid-call". That is one of the ways a row ends
+        // up here; a server that timed out, or answered with an error the
+        // read-back could not settle, arrives in exactly the same state and is
+        // told the same wrong story. The row's own error says which it was,
+        // and the halt prints it directly underneath.
+        reason: "outcome unknown: the call went out and its outcome was never established, so whether this applied cannot be determined",
         verified: false
       };
     case "gated":
@@ -452,7 +459,14 @@ ${seen}` : seen;
     if (!parsedPlan.success) {
       const approved = action.approvedBy === void 0 ? "" : `, approved by ${action.approvedBy}`;
       const reason = action.class === "irreversible" ? `cannot be undone${approved}; left in place` : `no usable inverse was recorded${action.error === void 0 ? "" : `: ${action.error}`}; left in place`;
-      steps.push({ ...describeStep(action), kind: "permanent", reason, verified: false });
+      const unconfirmed = action.class === "irreversible" ? caveat(action) : void 0;
+      steps.push({
+        ...describeStep(action),
+        kind: "permanent",
+        reason,
+        verified: false,
+        ...unconfirmed === void 0 ? {} : { note: unconfirmed }
+      });
       leftInPlace = true;
       continue;
     }
@@ -517,13 +531,23 @@ ${seen}` : seen;
     }
     if (!verified && action.class === "reversible" && !force) {
       const reason = unverifiedBecause(action);
+      const because = caveat(action);
       halted = {
         seq: action.seq,
         reason,
-        detail: "Without it there is no way to tell this resource from one somebody has edited since, so the recorded value was not written.",
+        detail: (because === void 0 ? "" : `${because}
+
+`) + "Without it there is no way to tell this resource from one somebody has edited since, so the recorded value was not written.",
         conflict: true
       };
-      steps.push({ ...describeStep(action), kind: "halt", reason, verified: false, plan });
+      steps.push({
+        ...describeStep(action),
+        kind: "halt",
+        reason,
+        verified: false,
+        plan,
+        ...because === void 0 ? {} : { note: because }
+      });
       break;
     }
     if (!verified && action.status === "rolling_back") {
@@ -539,13 +563,15 @@ ${seen}` : seen;
       const after = intendedAfterInverse(action);
       projected.set(resourceKey(toResolvedRead(verifyRead.data)), after ?? UNFORESEEABLE);
     }
+    const recordedWith = caveat(action);
     steps.push({
       ...describeStep(action),
       kind: "revert",
       reason: verified ? "state matches; applying inverse" : forcedOver ?? unverifiedBecause(action),
       verified,
       plan,
-      ...rebuilt.inverse === void 0 ? {} : { replanned: true }
+      ...rebuilt.inverse === void 0 ? {} : { replanned: true },
+      ...recordedWith === void 0 ? {} : { note: recordedWith }
     });
     if (dryRun) {
       continue;
@@ -613,6 +639,9 @@ ${seen}` : seen;
 function unverifiedBecause(action) {
   return action.verify === void 0 ? "no read declared for this tool, so drift could not be ruled out -- a `verify` read in its policy would give it one" : "the post-state was never captured, so drift could not be ruled out";
 }
+function caveat(action) {
+  return action.status === "applied" && action.error !== void 0 && action.error !== "" ? action.error : void 0;
+}
 function describeStep(action) {
   return { seq: action.seq, server: action.server, tool: action.tool };
 }
@@ -2922,6 +2951,7 @@ async function runCheck(argv) {
     }
   }
   const upstreams = [];
+  const offered = /* @__PURE__ */ new Map();
   try {
     for (const [name, spec] of Object.entries(manifest.servers)) {
       upstreams.push(
@@ -2935,6 +2965,9 @@ async function runCheck(argv) {
       );
     }
     await verifyAgainstServers(upstreams, manifest);
+    for (const upstream of upstreams) {
+      offered.set(upstream.name, (await toolShapes(upstream)).map((tool) => tool.name));
+    }
   } finally {
     for (const upstream of upstreams) {
       await upstream.close();
@@ -2956,6 +2989,11 @@ async function runCheck(argv) {
       `  ${style.quiet("        ")} ${style.strong(entry.server)} ${entry.provenance === "documented" ? style.accent(said) : style.quiet(said)}`
     );
   }
+  if (standing(manifest).some((entry) => entry.provenance === "live")) {
+    for (const line2 of wrapped(LIVE_IS_NOT_RECOVERY, 66)) {
+      out(`  ${style.quiet("        ")} ${style.quiet(line2)}`);
+    }
+  }
   out(`  ${style.quiet("policies")} ${[...counts].map(([k, v]) => `${String(v)} ${k}`).join(", ")}`);
   out(`  ${style.quiet("guarded ")} ${style.accent(String(gated))}`);
   const pinned = Object.entries(manifest.pins ?? {});
@@ -2965,7 +3003,25 @@ async function runCheck(argv) {
     `  ${style.quiet("pinned  ")} ${pinned.length === 0 ? style.quiet("nothing -- run `synartesis pin`") : pinned.map(([name, tools]) => `${name} (${String(Object.keys(tools).length)})`).join(", ") + (unpinned.length === 0 ? "" : style.quiet(`; not ${unpinned.join(", ")}`))}`
   );
   out("");
-  out(`  ${style.quiet("Anything not mentioned here is treated as irreversible and guarded.")}`);
+  const uncovered = ungoverned(manifest, offered);
+  if (uncovered.length === 0) {
+    out(`  ${style.quiet("Every tool these servers offer has a policy.")}`);
+  } else {
+    const total = uncovered.reduce((sum, entry) => sum + entry.tools.length, 0);
+    out(
+      `  ${style.accent("guarded by default")} ${style.quiet(
+        `${String(total)} tool${total === 1 ? "" : "s"} here ${total === 1 ? "has" : "have"} no policy, so ${total === 1 ? "it is" : "they are"} treated as`
+      )}`
+    );
+    out(`  ${style.quiet("irreversible and held for a person the first time an agent calls")}`);
+    out(`  ${style.quiet(`${total === 1 ? "it" : "one"}. Write a policy for any you would rather it got on with.`)}`);
+    out("");
+    for (const entry of uncovered) {
+      for (const line2 of wrapped(entry.tools.join(", "), 60)) {
+        out(`  ${style.quiet(entry.server.padEnd(8))} ${style.strong(line2)}`);
+      }
+    }
+  }
   out("");
   hint(
     firstOf(
@@ -3783,6 +3839,11 @@ function report(result, alreadyForcing = false, as = "") {
     out(
       `  ${style.quiet(String(step.seq).padStart(3))}  ${kind} ${style.strong(`${step.server}.${step.tool}`)}  ${style.quiet(step.reason)}${unverified}`
     );
+    if (step.note !== void 0 && step.kind !== "halt") {
+      for (const [at, line2] of wrapped(step.note, 62).entries()) {
+        out(`       ${at === 0 ? style.accent("caveat") : "      "}  ${style.quiet(line2)}`);
+      }
+    }
     if (step.plan !== void 0 && step.kind === "revert") {
       const verb = `${step.replanned === true ? "replanned, " : ""}${result.dryRun ? "would call" : "called"}`;
       out(

package/dist/proxy.js

@@ -19,11 +19,13 @@ import {
   refusal,
   runRead,
   toPayload,
+  toolShapes,
+  ungoverned,
   untested,
   verifyAgainstServers,
   warnUntested,
   withIdempotencyKey
-} from "./chunk-SZHVLCJR.js";
+} from "./chunk-JLLAK2QC.js";
 import {
   SnapshotError,
   UpstreamError,
@@ -755,6 +757,7 @@ function createProxyServer(options) {
           const result = await route.upstream.client.request(forwarded, PassthroughResult, {
             signal: extra.signal
           });
+          let inferred;
           const refused = refusal(result);
           if (refused !== void 0) {
             const settled = policy.refusal === "clean" ? "none" : await whatHappened(router, probe, priorState, extra.signal);
@@ -774,6 +777,7 @@ function createProxyServer(options) {
               );
               return result;
             }
+            inferred = `the upstream answered with an error and the change was established by reading the resource back, so nothing confirmed it: ${refused}`;
             log?.warn(
               { seq: pending.seq, tool: route.tool, reason: refused },
               "the upstream reported an error after changing the resource"
@@ -781,6 +785,9 @@ function createProxyServer(options) {
           }
           const context = { args, snapshot, result: toPayload(result) };
           const warnings = [];
+          if (inferred !== void 0) {
+            warnings.push(inferred);
+          }
           if (missingPriorState !== void 0) {
             warnings.push(
               `no prior state existed, so there is nothing to restore: ${missingPriorState}`
@@ -1165,12 +1172,26 @@ async function main() {
       tools: manifest.tools.filter((rule) => rule.match.startsWith(`${String(argv.server)}.`))
     }
   );
+  const uncovered = ungoverned(
+    manifest,
+    new Map(await Promise.all(upstreams.map(async (upstream) => [
+      upstream.name,
+      (await toolShapes(upstream)).map((tool) => tool.name)
+    ])))
+  );
+  for (const entry of uncovered) {
+    log.warn(
+      { server: entry.server, tools: entry.tools },
+      "no policy covers these tools; they will be held for approval when called"
+    );
+  }
   log.info(
     {
       manifest: argv.manifest,
       journal: argv.journal,
       servers: upstreams.map((upstream) => upstream.name),
-      policies: manifest.tools.length
+      policies: manifest.tools.length,
+      ungoverned: uncovered.reduce((sum, entry) => sum + entry.tools.length, 0)
     },
     "proxy ready"
   );

package/manifests/memory.yaml

@@ -1,8 +1,14 @@
 # Policy for @modelcontextprotocol/server-memory, the knowledge graph an agent
 # keeps about you between sessions.
 #
-# Verified against the real server: every tool named here was listed by it, and
-# the shapes below were read off its own responses rather than from docs.
+# Verified against the real server twice over: every tool named here was listed
+# by it and the shapes below were read off its own responses rather than from
+# docs -- and then the undo itself was run. tests/adapter-memory.test.ts makes
+# each change against a real graph, undoes it, and compares the file: what the
+# agent added is gone, what was already there is untouched, an entity it only
+# tried to create is left alone, and a delete of an entity is held rather than
+# approximated. Every one of those was checked by breaking this policy and
+# watching the test fail.
 #
 # This is the server the taxonomy fits best. Almost everything it does has an
 # exact opposite sitting next to it in the same toolbox, which is what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.6.19",
+  "version": "0.6.22",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,
@@ -86,6 +86,7 @@
     "@fontsource/ibm-plex-sans": "^5.3.0",
     "@google/genai": "^2.22.0",
     "@modelcontextprotocol/server-filesystem": "^2026.7.10",
+    "@modelcontextprotocol/server-memory": "^2026.8.31",
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^26.2.0",
     "@types/react": "^19.3.0",