[codex] governed action integration dx refresh (#25)

* feat(examples): hosted replay for claude-code capture (post-cloud)

Adds an optional HostedDelivery mode to the capture harness (default stays
fully isolated) and a post-cloud script mirroring the governance POC's env
contract, so a dev/demo tenant gains realistic agent-session and code-change
evidence through the real hook binary and hosted ingest.

* governed action integration dx refresh

* fix(ci): refresh root bun lockfile

* chore(release): prepare 0.4.0 packages

Author: EP93

.agents/skills/veritio-implement-feature/SKILL.md

@@ -15,11 +15,17 @@ Use this when working in the Veritio repository on actionable implementation tas
 4. Keep `spec/` as the language-neutral source of truth.
 5. Keep TypeScript, Python, and Go SDKs semantically aligned.
 6. Keep adapters thin and injected.
-7. Run the strongest feasible check, usually `bun run verify`.
+7. For server-side entity mutations, prefer the governed-action helper
+   (`createGovernedActionDraft` / `create_governed_action_draft` /
+   `CreateGovernedActionDraft`) over hand-wiring change/activity IDs,
+   changed paths, and idempotency hashes.
+8. Run the strongest feasible check, usually `bun run verify`.
 
 ## Guardrails
 
 - No legal-compliance guarantees in product copy.
 - No raw secrets or unnecessary personal data in event metadata.
 - No framework-specific fields in the core event protocol.
 - No hosted-provider requirement for OSS SDK usage.
+- Record governed actions at the host application's server mutation boundary,
+  not in browser form state or framework adapters.

.agents/skills/veritio-protocol-change/SKILL.md

@@ -11,9 +11,10 @@ Protocol work must preserve cross-language clarity.
 ## Checklist
 
 1. Start at `spec/event.schema.json` or the relevant spec file.
-2. Update TypeScript, Python, and Go SDKs together when the core event contract changes.
+2. Update TypeScript, Python, and Go SDKs together when the core event contract
+   or governed-action draft behavior changes.
 3. Add equivalent tests in each affected SDK.
-4. Update docs that show event examples.
+4. Update docs that show event, governed-action, or integration examples.
 5. Run `bun run verify`.
 
 ## Guardrails

.agents/skills/veritio-protocol-review/SKILL.md

@@ -12,13 +12,17 @@ Use this for reviews or changes involving:
 - `sdks/python/**`
 - `sdks/go/**`
 - event metadata, redaction, hashing, or retention semantics
+- governed-action draft helpers, changed paths, idempotency hashes, or
+  revision evidence
 
 ## Review Focus
 
 - SDK field names match the JSON schema.
 - Redaction behavior is deterministic.
 - Hash-chain inputs are explicit and tested.
 - TypeScript, Python, and Go stay aligned.
+- Governed action helpers derive the same IDs, changed paths, idempotency hash,
+  and outbox shape across languages.
 - Examples avoid raw emails, secrets, tokens, and credentials unless demonstrating redaction.
 
 ## Verification

.agents/skills/veritio-review-diff/SKILL.md

@@ -13,8 +13,9 @@ Use this before handoff on non-trivial diffs.
 1. Inspect `git diff --stat`, `git diff`, and `git diff --cached`.
 2. Route checks:
    - `spec/**` or SDK event types: protocol compatibility.
-   - `sdks/**`: SDK parity.
-   - `adapters/**` or `server/**`: adapter/server boundary.
+   - `sdks/**`: SDK parity, including governed-action helper parity.
+   - `adapters/**` or `server/**`: adapter/server boundary; governed CRUD
+     belongs in host mutation code, not adapters.
    - docs/product copy: compliance claim safety.
 3. Lead with findings ordered by severity and include file/line evidence.
 4. If clean, say so and list remaining test gaps.

.claude/agents/adapter-boundary-reviewer.md

@@ -17,9 +17,11 @@ You review changes under:
 
 1. Adapters translate framework context into Veritio events; they do not redefine protocol semantics.
 2. Adapters receive configured recorders/clients from host apps.
-3. Server-only credentials do not enter browser code or examples.
-4. Hosted-provider code remains optional.
-5. Peer dependencies are optional unless a package cannot function without them.
-6. Examples are honest about placeholder versus working behavior.
+3. Governed CRUD actions call the SDK governed-action helper from host
+   server-side mutation code, not from browser UI state or adapter internals.
+4. Server-only credentials do not enter browser code or examples.
+5. Hosted-provider code remains optional.
+6. Peer dependencies are optional unless a package cannot function without them.
+7. Examples are honest about placeholder versus working behavior.
 
 If clean: `OK - adapter/server boundaries intact.`

.claude/agents/privacy-redaction-reviewer.md

@@ -13,10 +13,13 @@ You enforce Veritio's privacy/security boundary.
 
 1. No raw secrets, passwords, API keys, bearer tokens, authorization headers, database URLs, or connector credentials are recorded.
 2. Metadata redaction is deterministic and tested.
-3. Examples prefer stable IDs over emails or display names.
-4. Product copy says Veritio supports compliance evidence; it does not guarantee legal compliance.
-5. Browser/client packages do not receive server credentials.
-6. DSAR, consent, and retention docs do not overclaim legal completeness.
+3. Governed-action drafts do not leak raw idempotency keys, keyed-digest
+   secrets, raw emails, or omitted governed fields in events, edges, revision
+   evidence, or outbox entries.
+4. Examples prefer stable IDs over emails or display names.
+5. Product copy says Veritio supports compliance evidence; it does not guarantee legal compliance.
+6. Browser/client packages do not receive server credentials.
+7. DSAR, consent, and retention docs do not overclaim legal completeness.
 
 ## Output
 

.claude/agents/protocol-compat-reviewer.md

@@ -19,15 +19,18 @@ Inspect changed files from:
 - `sdks/typescript/src/**`
 - `sdks/python/src/**`
 - `sdks/go/**`
-- docs that describe event shape or hashing
+- docs that describe event shape, hashing, or governed-action draft behavior
 
 ## Checks
 
 1. Field names in SDKs match `spec/event.schema.json`.
 2. TypeScript, Python, and Go use equivalent meanings for actor, action, target, scope, metadata, previous hash, and event hash.
 3. Canonical JSON remains deterministic.
 4. Hash input changes are explicit in docs and tests.
-5. Required fields are not weakened without a documented migration plan.
+5. Governed-action helpers preserve the cross-language fixture for derived IDs,
+   changed paths, idempotency hash, event actions, edge relations, and outbox
+   shape without adding framework-owned protocol semantics.
+6. Required fields are not weakened without a documented migration plan.
 
 ## Output
 

.claude/agents/sdk-parity-reviewer.md

@@ -20,7 +20,10 @@ You review SDK parity across:
 3. Redaction rules match across languages.
 4. Date/time normalization is consistent enough for cross-language evidence.
 5. Optional fields are omitted consistently.
-6. Any intentional language-specific behavior is documented.
+6. Governed-action helpers derive the same change/activity IDs,
+   tenant-scoped idempotency hash, changed paths, revision evidence, event
+   actions, edge relations, and outbox shape.
+7. Any intentional language-specific behavior is documented.
 
 ## Useful Commands
 

.claude/claude-security-guidance.md

@@ -53,6 +53,10 @@ Redaction must run before persistence/transport and must be provable.
   boundary entry modules in `server/`/`cli/` may read env).
 - SDK core stays framework-agnostic. Flag React/Vue/Svelte or server-framework imports in
   `sdks/**`.
+- Governed-action helpers must keep raw idempotency keys at the capture
+  boundary and emit only the tenant-scoped idempotency hash. Flag any
+  `outboxEntry`, event metadata, edge metadata, or revision evidence that leaks
+  raw idempotency keys or keyed-digest secrets.
 
 ## 5. Storage & adapter boundaries
 
@@ -62,6 +66,10 @@ Redaction must run before persistence/transport and must be provable.
 - Adapters are translators, not protocol owners. They receive configured recorders/clients
   from the host app. Flag adapters that re-implement hashing, canonical JSON, or redaction
   instead of calling an SDK.
+- Governed create/update/delete evidence must be recorded from the host
+  application's server-side mutation boundary with the SDK governed-action
+  helper. Flag browser form state or framework adapters that compute changed
+  paths, idempotency hashes, revision IDs, or storage writes themselves.
 - Hosted-provider code must remain optional and must not block self-hosted OSS usage.
 
 ## 6. Compliance-claim safety

.claude/rules/02-sdk-parity.md

@@ -12,6 +12,11 @@
     languages, pinned by `spec/conformance` fixtures
   - `security.risk` assertion builders, with `hashAssertionRecord` parity with
     `hashAuditRecord`
+  - governed-action draft helpers: `createGovernedActionDraft`,
+    `create_governed_action_draft`, and `CreateGovernedActionDraft` must derive
+    the same change/activity IDs, tenant-scoped idempotency hash, changed paths,
+    revision evidence, event actions, edge relations, and outbox shape, pinned
+    by `spec/conformance/governed-action-draft.json`
 - If a feature lands in one SDK only, document it as experimental or add parity tasks before handoff.
 - Prefer standard libraries in core SDKs.
 - Do not read environment variables in SDK core.