[Masterleeaus]

What changed

• Extracted the fail-closed Policy Engine into a framework-independent PHP package with payload-bound HMAC approvals, tenant/role/scope/fresh-auth checks, numeric limits, and focused tests.
• Added a five-minute no-credential demo and an optional live OpenAI proposal path that only proposes; the normal command gate denies unapproved actions.
• Reworked the 80-engine inventory and implementations: meaningful deterministic behavior, tests for key invariants, request-scoped bindings, and explicit partial/integration boundaries.
• Added deterministic 100-case authority evaluation and CI measurements for compiler latency, duplicate handling, and encrypted outbox enqueue/decrypt.
• Added PHP and TypeScript coverage reporting, a maintained-file SHA-256 check, and a locked Node toolchain.
• Removed checked-in dist output and internal history/process notes; the original history is retained on archive/interaction-engine-history.
• Chose MIT licensing and removed the external tarball import workflow.
• Preserved the newer template catalogue, commerce pack, AI engineering map, and 31-case authority corpus from main. Updated its evaluator for the extracted policy package and payload-bound approvals.

Verification

• npm ci && npm test: passed locally; Node coverage is reported by the test runner.
• JSON resources parse and the 80-row engine inventory matches the 80 contract names.
• git diff --check: passed.
• PHP is not installed in the development sandbox. The PR workflows run PHP 8.2 tests, coverage, both authority evaluations, and benchmarks; measured reports will be added after Actions completes.

Boundaries

The demo approval is simulated and the handler is in-memory. The live model example demonstrates a denied proposal, not production execution. Several of the 80 engines remain explicitly partial because they use heuristics, in-memory state, or host schema/adapters.

[Masterleeaus]

README handoff for the current branding and portfolio pass

Current main is 55d9c86 and uses docs/images/interaction-engine-banner.svg; PR #6 is still based on 9fd0411, owns README.md, and currently reports mergeable=false. Please rebase/reconcile before applying this opening.

Replace the opening through the first section heading with:

![Interaction Engine — GOVERNED WORKFLOWS · ONLINE + OFFLINE](docs/images/interaction-engine-banner.svg)

<div align="center">

# Interaction Engine

**A governed workflow runtime that turns conversational intent and optional model proposals into policy-checked business actions—online or offline.**

</div>

[![Authority Policy Evaluation](https://github.com/Masterleeaus/Interaction-engine/actions/workflows/authority-policy-eval.yml/badge.svg?branch=main)](https://github.com/Masterleeaus/Interaction-engine/actions/workflows/authority-policy-eval.yml)

Interaction Engine is for teams building chat, voice, mobile, desktop, and API experiences where a recommendation must become a traceable, replay-safe workflow without silently becoming permission. It combines schema-driven wizards, deterministic local intelligence, optional cloud-model proposals, tenant- and actor-scoped policy, signed approval, idempotent command dispatch, and an encrypted offline outbox.

## What it solves

Business interfaces often recognize intent but leave the path to a durable action implicit. Interaction Engine makes that path inspectable:

```text
request → wizard/template → local or optional model proposal
        → policy and approval → governed command
        → online host or offline outbox → outcome evidence

The design keeps understanding, recommendation, authorization, execution, and evidence as distinct stages.

Why engineers use it

• Governed execution: PolicyEngine, CapabilityPolicy, and ApprovalSigner fail closed on unknown capabilities, wrong tenants, missing scopes, stale authentication, invalid approvals, and numeric-limit breaches.
• Workflow architecture: UniversalWizardEngine, versioned templates, CommandBus, and WorkCoreAdapter connect structured requests to host-facing capability commands.
• Offline continuity: the TypeScript IndexedDB companion stores encrypted drafts and commands for replay, with policy checks repeated during synchronization.
• Measured boundary: the committed 31-case policy report records 0/24 unauthorized allows, 0/7 wrongly denied valid actions, and 0/1 wrong-tenant approval accepts. Keep this labeled as the historical report until the post-PR-Implement governed policy package and complete 80 engine behaviors #6 evaluator result is merged.

This keeps PR #6’s later policy-engine, 100-case evaluation, optional OpenAI proposal, template, installation, and limitation sections intact while making the first screen product-first.