release: @proofable/sdk 0.1.4 - fail closed on empty delegated allowlist

[chrisjleal]

What

Runtime-mount permission evaluation now fails closed for delegated bundles whose mounted permission proof has an empty or missing allowedActions list.

• buildRuntimeBundle preserves a present-but-empty allowedActions instead of dropping the field, so "scoped to nothing" is never read as "unscoped".
• evaluateRuntimeAction denies delegated actions when the allowlist is empty or absent, returning ACTION_NOT_ALLOWED.
• Controller-owned mounts (no delegation) keep their existing behavior.
• CHANGELOG documents the fix and adds the 0.1.4 comparison links.

Why

An empty delegated allowlist must grant nothing. Dropping the field turned a scoped-to-nothing delegation into a permissive mount.

Release

Version bumped 0.1.3 -> 0.1.4. After merge, push tag v0.1.4 to trigger the Release workflow and publish @proofable/sdk@0.1.4.

Verification

• npm run lint - 0 errors
• npm test - 209/209 pass (16 files), including the new empty/absent allowlist and controller-authority cases
• npm pack - artifact contains the fix in runtime-mount.js (lines 313 and 626)

Acceptance: @proofable/sdk@0.1.4 empty delegated allowedActions => DENY; full tests pass; packed artifact contains the fix; npm registry reads back 0.1.4.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.