synartesis 0.6.20 → 0.6.22

package/CHANGELOG.md

@@ -2,6 +2,75 @@
 
 What changed, and why it mattered. Dates are release dates.
 
+## 0.6.22 — 2026-09-16
+
+### Added
+
+- **The memory policy's undo is now proven, not just plausible.** It has always
+  declared `provenance: live` -- the tools were checked against the real server
+  and the shapes read off its own answers -- while the README said its recovery
+  guarantees were unproven. Both were true, and the gap between them is where a
+  policy can name every tool correctly, take exactly the arguments the server
+  wants, and still resolve an inverse that puts nothing back. That failure
+  looks like success: the drift check passes and the report says `rolled_back`.
+
+  `tests/adapter-memory.test.ts` makes each change against a real knowledge
+  graph, undoes it, and compares the file. What the agent added is gone and
+  what was already there is untouched; an entity the agent only *tried* to
+  create -- this server ignores a duplicate name -- is left alone rather than
+  deleted out from under its owner; a relation drawn or removed goes back; and
+  a delete of an entity is held for a person rather than approximated, because
+  one inverse cannot put back both the entity and the relations that went with
+  it. Every one of those was confirmed by breaking the policy and watching the
+  matching test fail.
+
+  Two of the four shipped policies are now round-tripped end to end.
+  `synartesis check`, the README and both guides say which, and `git` is still
+  named plainly as untested.
+
+- `check` also confirms the memory policy covers every tool that server offers,
+  so a server that grows one fails here rather than in front of somebody's
+  agent.
+
+## 0.6.21 — 2026-09-16
+
+### Fixed
+
+- **`live` claimed more than it meant, and the docs contradicted each other
+  about it.** `provenance: live` says a policy has met its server and that the
+  tools take the arguments it passes them. `check` printed that as "checked
+  against the real server", which reads as a claim that undo works -- and it is
+  not one: a policy can be right about every tool name and still record an
+  inverse that restores nothing. Meanwhile the README said memory's recovery
+  guarantees were unproven while the user guide listed memory among the
+  policies that say `live`, so a reader who saw one came away with the opposite
+  of what the other meant. `check` now says "shapes read from the real server"
+  and adds, once under the server list, that `live` is not a recovery claim and
+  that only filesystem has been round-tripped. README and both guides say the
+  same thing.
+
+### Added
+
+- **`check` names the tools no policy covers, instead of describing the rule.**
+  An unmatched tool has always been fail-closed -- irreversible, held for a
+  person the first time it is called -- and `check` said so as a sentence about
+  tools in general while the actual list sat one round trip away. It already
+  connects to every server and reads the whole tool list to verify the
+  policies, so the answer was in hand and thrown away, and the first anybody
+  learned a tool was ungoverned was an agent stopping on it mid-task. Now
+  named, per server, with a count. The proxy warns at startup for the same
+  reason, and `proxy ready` carries an `ungoverned` count so a policy with no
+  gaps and a build that forgot to look do not read alike.
+
+  For what almost everybody runs, the answer is none: the shipped filesystem
+  policy covers every tool that server offers, and there is a test that will
+  fail if that stops being true.
+
+- The build targeted `node20` while the package requires `>=22`, which is the
+  floor better-sqlite3 sets -- on Node 20 it segfaults the moment a database
+  opens. Targeting lower was harmless but said the wrong thing about what this
+  supports, in the one place a reader could check. Now `node22`.
+
 ## 0.6.20 — 2026-09-15
 
 ### Fixed

package/README.md

@@ -333,10 +333,25 @@ cannot start a process:** see the [user guide](docs/synartesis-user-guide.md).
   resolved when the call happens, so a mistake in a manifest is baked into every
   run made under it. `undo --replan` rebuilds them from a corrected one.
 
-The bundled **filesystem** policy is tested against the real server: exact
-byte-for-byte restoration, drift refusal, and absence told apart from a read
-that failed. The **memory, git and github** policies are checked only for tool
-existence — their recovery guarantees are not yet proven.
+Two bundled policies are tested against the real server, by making the change
+and undoing it. **filesystem**: exact byte-for-byte restoration, drift refusal,
+and absence told apart from a read that failed. **memory**: the graph is put
+back as it was, entities the agent only tried to create are left alone, and a
+delete of an entity is held rather than approximated. **git and github** are
+checked only for tool existence — their recovery guarantees are not yet proven.
+
+All three of filesystem, memory and git declare `provenance: live`, and that
+word is narrower than it looks: it says the policy has met its server and the
+tools take the arguments it passes them, not that undo has been round-tripped.
+`synartesis check` says so under the server list rather than leaving `live` to
+stand for both.
+
+**A tool no policy mentions is irreversible and held for a person** the first
+time it is called. That is the safe end of the trade, and it means a server
+that gains a tool in an update does not quietly get a free pass — but it also
+means an agent stopping mid-task on a call nobody expected. `synartesis check`
+names every such tool, and the proxy warns about them at startup, so you can
+write a policy before meeting one rather than after.
 
 ## Trust
 

package/dist/{chunk-SZHVLCJR.js → chunk-JLLAK2QC.js}

@@ -1554,18 +1554,30 @@ function untested(manifest) {
 function describeStanding(entry) {
   switch (entry.provenance) {
     case "live":
-      return "checked against the real server";
+      return "shapes read from the real server";
     case "documented":
       return "written from documentation, never run against the real server";
     case "unstated":
       return "no claim either way";
   }
 }
+var LIVE_IS_NOT_RECOVERY = "`live` means the policy has met its server, not that undo has been round-tripped against it. Of the policies that ship, filesystem and memory have been; git and github have not.";
 function warnUntested(servers) {
   const names = servers.join(", ");
   const these = servers.length === 1 ? "this policy has" : "these policies have";
   return `${names}: ${these} never been run against the real server. The classes and inverses here come from documentation, so undo may not work where it says it will. Run \`synartesis check\` against your own credentials, and expect to correct something.`;
 }
+function ungoverned(manifest, advertised) {
+  const resolver = createPolicyResolver(manifest);
+  const found = [];
+  for (const server of [...advertised.keys()].sort()) {
+    const tools = (advertised.get(server) ?? []).filter((tool) => !resolver.resolve(qualify(server, tool)).matched).sort();
+    if (tools.length > 0) {
+      found.push({ server, tools });
+    }
+  }
+  return found;
+}
 
 // src/proxy/routing.ts
 var SEPARATOR = "__";
@@ -1915,7 +1927,9 @@ export {
   standing,
   untested,
   describeStanding,
+  LIVE_IS_NOT_RECOVERY,
   warnUntested,
+  ungoverned,
   IDEMPOTENCY_META_KEY,
   withIdempotencyKey,
   createRouter,
@@ -1930,4 +1944,4 @@ export {
   observeState,
   connectStdioUpstream
 };
-//# sourceMappingURL=chunk-SZHVLCJR.js.map
+//# sourceMappingURL=chunk-JLLAK2QC.js.map

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   IDEMPOTENCY_META_KEY,
+  LIVE_IS_NOT_RECOVERY,
   NOTHING_RECORDED_YET,
   PROXY_FLAGS,
   WORDMARK,
@@ -32,11 +33,12 @@ import {
   toPayload,
   toResolvedRead,
   toolShapes,
+  ungoverned,
   untested,
   verifyAgainstServers,
   warnUntested,
   wasRefused
-} from "./chunk-SZHVLCJR.js";
+} from "./chunk-JLLAK2QC.js";
 import {
   DriftConflict,
   ManifestError,
@@ -2949,6 +2951,7 @@ async function runCheck(argv) {
     }
   }
   const upstreams = [];
+  const offered = /* @__PURE__ */ new Map();
   try {
     for (const [name, spec] of Object.entries(manifest.servers)) {
       upstreams.push(
@@ -2962,6 +2965,9 @@ async function runCheck(argv) {
       );
     }
     await verifyAgainstServers(upstreams, manifest);
+    for (const upstream of upstreams) {
+      offered.set(upstream.name, (await toolShapes(upstream)).map((tool) => tool.name));
+    }
   } finally {
     for (const upstream of upstreams) {
       await upstream.close();
@@ -2983,6 +2989,11 @@ async function runCheck(argv) {
       `  ${style.quiet("        ")} ${style.strong(entry.server)} ${entry.provenance === "documented" ? style.accent(said) : style.quiet(said)}`
     );
   }
+  if (standing(manifest).some((entry) => entry.provenance === "live")) {
+    for (const line2 of wrapped(LIVE_IS_NOT_RECOVERY, 66)) {
+      out(`  ${style.quiet("        ")} ${style.quiet(line2)}`);
+    }
+  }
   out(`  ${style.quiet("policies")} ${[...counts].map(([k, v]) => `${String(v)} ${k}`).join(", ")}`);
   out(`  ${style.quiet("guarded ")} ${style.accent(String(gated))}`);
   const pinned = Object.entries(manifest.pins ?? {});
@@ -2992,7 +3003,25 @@ async function runCheck(argv) {
     `  ${style.quiet("pinned  ")} ${pinned.length === 0 ? style.quiet("nothing -- run `synartesis pin`") : pinned.map(([name, tools]) => `${name} (${String(Object.keys(tools).length)})`).join(", ") + (unpinned.length === 0 ? "" : style.quiet(`; not ${unpinned.join(", ")}`))}`
   );
   out("");
-  out(`  ${style.quiet("Anything not mentioned here is treated as irreversible and guarded.")}`);
+  const uncovered = ungoverned(manifest, offered);
+  if (uncovered.length === 0) {
+    out(`  ${style.quiet("Every tool these servers offer has a policy.")}`);
+  } else {
+    const total = uncovered.reduce((sum, entry) => sum + entry.tools.length, 0);
+    out(
+      `  ${style.accent("guarded by default")} ${style.quiet(
+        `${String(total)} tool${total === 1 ? "" : "s"} here ${total === 1 ? "has" : "have"} no policy, so ${total === 1 ? "it is" : "they are"} treated as`
+      )}`
+    );
+    out(`  ${style.quiet("irreversible and held for a person the first time an agent calls")}`);
+    out(`  ${style.quiet(`${total === 1 ? "it" : "one"}. Write a policy for any you would rather it got on with.`)}`);
+    out("");
+    for (const entry of uncovered) {
+      for (const line2 of wrapped(entry.tools.join(", "), 60)) {
+        out(`  ${style.quiet(entry.server.padEnd(8))} ${style.strong(line2)}`);
+      }
+    }
+  }
   out("");
   hint(
     firstOf(

package/dist/proxy.js

@@ -19,11 +19,13 @@ import {
   refusal,
   runRead,
   toPayload,
+  toolShapes,
+  ungoverned,
   untested,
   verifyAgainstServers,
   warnUntested,
   withIdempotencyKey
-} from "./chunk-SZHVLCJR.js";
+} from "./chunk-JLLAK2QC.js";
 import {
   SnapshotError,
   UpstreamError,
@@ -1170,12 +1172,26 @@ async function main() {
       tools: manifest.tools.filter((rule) => rule.match.startsWith(`${String(argv.server)}.`))
     }
   );
+  const uncovered = ungoverned(
+    manifest,
+    new Map(await Promise.all(upstreams.map(async (upstream) => [
+      upstream.name,
+      (await toolShapes(upstream)).map((tool) => tool.name)
+    ])))
+  );
+  for (const entry of uncovered) {
+    log.warn(
+      { server: entry.server, tools: entry.tools },
+      "no policy covers these tools; they will be held for approval when called"
+    );
+  }
   log.info(
     {
       manifest: argv.manifest,
       journal: argv.journal,
       servers: upstreams.map((upstream) => upstream.name),
-      policies: manifest.tools.length
+      policies: manifest.tools.length,
+      ungoverned: uncovered.reduce((sum, entry) => sum + entry.tools.length, 0)
     },
     "proxy ready"
   );

package/manifests/memory.yaml

@@ -1,8 +1,14 @@
 # Policy for @modelcontextprotocol/server-memory, the knowledge graph an agent
 # keeps about you between sessions.
 #
-# Verified against the real server: every tool named here was listed by it, and
-# the shapes below were read off its own responses rather than from docs.
+# Verified against the real server twice over: every tool named here was listed
+# by it and the shapes below were read off its own responses rather than from
+# docs -- and then the undo itself was run. tests/adapter-memory.test.ts makes
+# each change against a real graph, undoes it, and compares the file: what the
+# agent added is gone, what was already there is untouched, an entity it only
+# tried to create is left alone, and a delete of an entity is held rather than
+# approximated. Every one of those was checked by breaking this policy and
+# watching the test fail.
 #
 # This is the server the taxonomy fits best. Almost everything it does has an
 # exact opposite sitting next to it in the same toolbox, which is what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.6.20",
+  "version": "0.6.22",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,
@@ -86,6 +86,7 @@
     "@fontsource/ibm-plex-sans": "^5.3.0",
     "@google/genai": "^2.22.0",
     "@modelcontextprotocol/server-filesystem": "^2026.7.10",
+    "@modelcontextprotocol/server-memory": "^2026.8.31",
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^26.2.0",
     "@types/react": "^19.3.0",