@kindgi/api 0.1.4 → 0.1.5-rc.0

package/src/routes/deployments.ts

@@ -9,7 +9,12 @@ import type { Agent, AgentId, AgentPins } from '@kindgi/agents';
 import { tuplesForCreate } from '@kindgi/authz';
 import { parsePublicKeyPem, verifyEd25519 } from '@kindgi/crypto';
 import type { Flow, FlowPins } from '@kindgi/flow';
-import { type Guardrail, validateGuardrailSpec } from '@kindgi/guardrails';
+import {
+  GUARDRAIL_SPEC_KEYS,
+  type Guardrail,
+  createCheckRegistry,
+  validateGuardrailSpec,
+} from '@kindgi/guardrails';
 import type { ProjectBinding, Scope } from '@kindgi/platform';
 import { validateToolManifest } from '@kindgi/tools';
 import type {
@@ -42,6 +47,7 @@ import { type FlowPinsLive, publishDeployedFlow, resolveFlowPins } from '../flow
 import type { GuardrailRegistryBinding } from '../guardrail-binding.js';
 import type { ImageRegistryBinding } from '../image-registry-binding.js';
 import type { LiveVersionBinding } from '../live-version-binding.js';
+import type { Authorizer } from '../middleware/authorize.js';
 import { PublishRefused } from '../publish-refused.js';
 import { type RegistryReadOnly, refuseReadOnly } from '../registry-read-only.js';
 import type { SecretBinding } from '../secrets-binding.js';
@@ -51,6 +57,7 @@ import type { AppEnv } from '../types.js';
 import { hasCapability, requireEnvName } from './env.js';
 import type { GuardrailWriteHook } from './guardrails.js';
 import { clampLimit } from './pagination.js';
+import { tenantResourceAccess } from './tenant-access.js';
 import type { ToolWriteHook } from './tools.js';
 
 /**
@@ -167,8 +174,12 @@ export interface DeploymentsRouterBindings {
   readonly onGuardrailWrite?: GuardrailWriteHook;
 }
 
-export function deploymentsRouter(bindings: DeploymentsRouterBindings): Hono<AppEnv> {
+export function deploymentsRouter(
+  bindings: DeploymentsRouterBindings,
+  authorizer?: Authorizer,
+): Hono<AppEnv> {
   const r = new Hono<AppEnv>();
+  r.use('*', tenantResourceAccess(authorizer));
 
   // ---------- GET / (list, cursor-paginated) ----------
   r.get('/', async (c) => {
@@ -476,10 +487,11 @@ export function deploymentsRouter(bindings: DeploymentsRouterBindings): Hono<App
     }
 
     // ---- Manifest validation ----
-    const validation = validatePrimitives(imageIndex, {
-      imageRef: wire.imageRef,
-      artifactVersion: wire.artifactVersion,
-    });
+    const validation = validatePrimitives(
+      imageIndex,
+      { imageRef: wire.imageRef, artifactVersion: wire.artifactVersion },
+      c.get('log'),
+    );
     if (validation.kind === 'err') {
       c.status(statusFor('deployment-validation-failed') as never);
       return c.json(
@@ -580,7 +592,7 @@ export function deploymentsRouter(bindings: DeploymentsRouterBindings): Hono<App
               await bindings.toolRegistry?.unregister({ tenantId, toolId, version });
             });
           } else if (outcome.kind !== 'already-registered') {
-            throw new PublishRefused('tool', `${tool.id}@${tool.version}`, outcome.kind);
+            throw new PublishRefused('tool', `${tool.id}@${tool.version}`, outcome);
           }
         }
       }
@@ -605,7 +617,7 @@ export function deploymentsRouter(bindings: DeploymentsRouterBindings): Hono<App
               await bindings.guardrailRegistry?.unregister({ tenantId, guardrailId });
             });
           } else if (outcome.kind !== 'already-registered') {
-            throw new PublishRefused('guardrail', guardrail.id, outcome.kind);
+            throw new PublishRefused('guardrail', guardrail.id, outcome);
           }
         }
       }
@@ -645,6 +657,13 @@ export function deploymentsRouter(bindings: DeploymentsRouterBindings): Hono<App
       // A primitive refused with a typed outcome is the caller's to fix:
       // that outcome's own status and code. Anything thrown is a 500.
       if (cause instanceof PublishRefused) {
+        if (cause.projectId !== undefined) {
+          c.get('log').info(`${cause.message}: deploy refused`, {
+            primitive: cause.primitive,
+            id: cause.id,
+            ownerProjectId: cause.projectId as unknown as string,
+          });
+        }
         c.status(statusFor(cause.code) as never);
         return c.json(
           toWireError(
@@ -1236,9 +1255,13 @@ function ociCodeArtifactRef(image: DeployedImage, modulePath: unknown) {
  * a guardrail's `checkId` becomes its `check`, as `kindgi dev`'s disk
  * registry maps it.
  */
+/** The built-in checks, for the config of a guardrail naming one. */
+const builtInChecks = createCheckRegistry();
+
 function validatePrimitives(
   index: Readonly<Record<string, unknown>>,
   image: DeployedImage,
+  log?: { debug(message: string): void },
 ): ValidateResult {
   const details: ValidationDetail[] = [];
 
@@ -1286,12 +1309,20 @@ function validatePrimitives(
       details.push({ primitive: 'guardrail', index: i, path: '', message: 'must be an object' });
       return;
     }
-    const {
-      checkModulePath,
-      checkId,
-      configSchema: _configSchema,
-      ...rest
-    } = raw as Record<string, unknown>;
+    // The rest is the guardrail as registered, its `configSchema` included:
+    // the runtime checks a guardrail naming this check against it. A field
+    // the guardrail spec doesn't have (an index from a newer CLI) is dropped,
+    // never refused, so a newer CLI never breaks a deployment.
+    const { checkModulePath, checkId, ...indexed } = raw as Record<string, unknown>;
+    const dropped = Object.keys(indexed).filter((k) => !GUARDRAIL_SPEC_KEYS.includes(k));
+    const rest = Object.fromEntries(
+      Object.entries(indexed).filter(([k]) => GUARDRAIL_SPEC_KEYS.includes(k)),
+    );
+    if (dropped.length > 0) {
+      log?.debug(
+        `deployment: guardrail ${String(indexed.id)}: ignored index field(s) this runtime doesn't know: ${dropped.join(', ')}`,
+      );
+    }
     const r = validateGuardrailSpec({
       ...rest,
       check: checkId ?? rest.check ?? rest.id,
@@ -1325,6 +1356,21 @@ function validatePrimitives(
       }
       return;
     }
+    // A guardrail naming a built-in check: its config against the built-in's.
+    const builtIn = builtInChecks.get(r.value.check);
+    const configProblems = builtIn?.configProblems?.(r.value.config) ?? [];
+    if (configProblems.length > 0) {
+      for (const problem of configProblems) {
+        details.push({
+          primitive: 'guardrail',
+          index: i,
+          id: r.value.id as unknown as string,
+          path: problem.path,
+          message: problem.message,
+        });
+      }
+      return;
+    }
     validatedGuardrails.push(r.value);
   });
 
@@ -1524,7 +1570,7 @@ async function registerAgents(input: {
       const outcome = await agents.publish({ tenantId, projectId, agent, enqueueTuples });
       if (outcome.kind === 'ok') written(outcome.agentId, outcome.version);
       else if (outcome.kind !== 'already-registered') {
-        throw new PublishRefused('agent', `${agent.id}@${agent.version}`, outcome.kind);
+        throw new PublishRefused('agent', `${agent.id}@${agent.version}`, outcome);
       }
     }
     return input.defined.map(deployedPrimitive);
@@ -1588,7 +1634,7 @@ async function registerFlows(input: {
       const outcome = await flows.publish({ tenantId, projectId, flow, enqueueTuples });
       if (outcome.kind === 'ok') written(outcome.flowId, outcome.version as unknown as string);
       else if (outcome.kind !== 'already-registered') {
-        throw new PublishRefused('flow', `${flow.id}@${flow.version}`, outcome.kind);
+        throw new PublishRefused('flow', `${flow.id}@${flow.version}`, outcome);
       }
     }
     return input.defined.map(deployedPrimitive);

package/src/routes/eval-comparison.ts

@@ -5,12 +5,18 @@ import type { AgentId } from '@kindgi/agents';
 import type { FlowVersionOverrides } from '@kindgi/flow';
 import type { ProjectId, Semver } from '@kindgi/types';
 
-import type { EvalBaseline, EvalComparison } from '../eval-run-binding.js';
+import type {
+  EvalBaseline,
+  EvalComparison,
+  EvalOverrides,
+  EvalSample,
+} from '../eval-run-binding.js';
 import { DEFAULT_COMPARISON } from '../judged-dispatcher.js';
 import { parseSegmentsBody } from './segments.js';
 
 const MAX_REPETITIONS = 10;
 const MAX_K = 100;
+const MAX_OVERRIDDEN_BLOCKS = 20;
 
 function obj(value: unknown): Record<string, unknown> | undefined {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
@@ -84,6 +90,71 @@ function integerIn(raw: unknown, name: string, max: number): number | string {
     : `\`${name}\` must be an integer from 1 to ${max}`;
 }
 
+/** `overrides: { settings?, prompts? }`; `undefined` when it names nothing. */
+function parseOverrides(raw: unknown): EvalOverrides | undefined | string {
+  const o = obj(raw);
+  if (o === undefined) return '`overrides` must be an object: { settings?, prompts? }';
+  const extra = Object.keys(o).filter((key) => key !== 'settings' && key !== 'prompts');
+  if (extra.length > 0) {
+    return `\`overrides\` takes \`settings\` and \`prompts\`, not \`${extra[0]}\``;
+  }
+  const settings = o.settings === undefined ? {} : obj(o.settings);
+  const prompts = o.prompts === undefined ? {} : obj(o.prompts);
+  const settingsBlocks = settings === undefined ? [] : Object.entries(settings);
+  const promptBlocks = prompts === undefined ? [] : Object.entries(prompts);
+  if (
+    settings === undefined ||
+    settingsBlocks.length > MAX_OVERRIDDEN_BLOCKS ||
+    settingsBlocks.some(([id, values]) => id === '' || obj(values) === undefined)
+  ) {
+    return `\`overrides.settings\` must be an object of { blockId: { …values } } (at most ${MAX_OVERRIDDEN_BLOCKS} blocks)`;
+  }
+  if (
+    prompts === undefined ||
+    promptBlocks.length > 1 ||
+    promptBlocks.some(([id, content]) => {
+      const c = obj(content);
+      return (
+        id === '' ||
+        c === undefined ||
+        typeof c.template !== 'string' ||
+        Object.keys(c).length !== 1
+      );
+    })
+  ) {
+    return '`overrides.prompts` must be { blockId: { template } } for the prompt block (one)';
+  }
+  if (settingsBlocks.length === 0 && promptBlocks.length === 0) return undefined;
+  return {
+    ...(settingsBlocks.length > 0 && {
+      settings: settings as Readonly<Record<string, Readonly<Record<string, unknown>>>>,
+    }),
+    ...(promptBlocks.length > 0 && {
+      prompts: prompts as Readonly<Record<string, { readonly template: string }>>,
+    }),
+  };
+}
+
+/** `sample: { part, seed, holdOutShare }`, or an error message. */
+function parseSample(raw: unknown): EvalSample | string {
+  const o = obj(raw);
+  const share = o?.holdOutShare;
+  if (
+    o === undefined ||
+    (o.part !== 'search' && o.part !== 'hold-out') ||
+    typeof o.seed !== 'string' ||
+    o.seed === '' ||
+    o.seed.length > 200 ||
+    typeof share !== 'number' ||
+    share < 0.1 ||
+    share > 0.9 ||
+    Object.keys(o).some((key) => !['part', 'seed', 'holdOutShare'].includes(key))
+  ) {
+    return "`sample` must be { part: 'search' | 'hold-out', seed, holdOutShare } with holdOutShare from 0.1 to 0.9";
+  }
+  return { part: o.part, seed: o.seed, holdOutShare: share };
+}
+
 /**
  * A comparison eval run's settings from the start body: `baseline`,
  * `reads`, `repetitions`, `k`, `classWeights` and a flow candidate's
@@ -99,13 +170,19 @@ export function parseComparison(
   const { baseline, reads, repetitions, k, classWeights } = b;
   const versions = b.versions === undefined ? undefined : parseVersions(b.versions);
   if (typeof versions === 'string') return { kind: 'err', message: versions };
+  const overrides = b.overrides === undefined ? undefined : parseOverrides(b.overrides);
+  if (typeof overrides === 'string') return { kind: 'err', message: overrides };
+  const sample = b.sample === undefined ? undefined : parseSample(b.sample);
+  if (typeof sample === 'string') return { kind: 'err', message: sample };
   if (
     baseline === undefined &&
     reads === undefined &&
     repetitions === undefined &&
     k === undefined &&
     versions === undefined &&
-    classWeights === undefined
+    classWeights === undefined &&
+    overrides === undefined &&
+    sample === undefined
   ) {
     return { kind: 'ok' };
   }
@@ -144,6 +221,8 @@ export function parseComparison(
       k: topK,
       ...(versions !== undefined && { versions }),
       ...(classWeights !== undefined && { classWeights }),
+      ...(overrides !== undefined && { overrides }),
+      ...(sample !== undefined && { sample }),
     },
   };
 }

package/src/routes/eval-overrides.ts

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * An agent candidate's `overrides`, checked when the comparison starts:
+ * each settings block must be one the version pins, its values satisfying
+ * the schema of the version it pins (model settings, for the
+ * model-settings block); a prompt template must be for the prompt block
+ * the version pins, and pass `checkDraftedTemplate` (it reads and names
+ * only what the agent has). Checked once, here, before any run exists:
+ * the replays use them as given, on resume too.
+ */
+
+import {
+  type AgentId,
+  MODEL_SETTINGS_SCHEMA,
+  checkDraftedTemplate,
+  settingsSchemaIssues,
+} from '@kindgi/agents';
+import type { Semver, TenantId } from '@kindgi/types';
+
+import type { AgentRegistryBinding } from '../agent-binding.js';
+import type { BlockRegistryBinding } from '../block-binding.js';
+import type { EvalOverrides } from '../eval-run-binding.js';
+
+/** Where the check reads the agent version and its blocks. */
+export interface SettingsOverridesCheck {
+  readonly agents: AgentRegistryBinding;
+  readonly blocks: BlockRegistryBinding;
+}
+
+export interface OverridesIssue {
+  readonly path: string;
+  readonly message: string;
+}
+
+/** A JSON Pointer token: `~` and `/` escaped. */
+const token = (id: string): string => id.replaceAll('~', '~0').replaceAll('/', '~1');
+
+export async function checkSettingsOverrides(
+  check: SettingsOverridesCheck,
+  tenantId: TenantId,
+  candidate: { readonly agentId: string; readonly version: string },
+  overrides: EvalOverrides,
+): Promise<OverridesIssue[]> {
+  const settings = overrides.settings ?? {};
+  const label = `${candidate.agentId} ${candidate.version}`;
+  const found = await check.agents.getVersion({
+    tenantId,
+    agentId: candidate.agentId as AgentId,
+    version: candidate.version as Semver,
+  });
+  if (found === null) {
+    return [{ path: '/agentRef/version', message: `agent ${label} isn't registered` }];
+  }
+  if (found.pins === undefined) {
+    return [
+      {
+        path: '/overrides/settings',
+        message: `${label} was published before pins: it has no pinned settings to replace`,
+      },
+    ];
+  }
+  const issues: OverridesIssue[] = [];
+  for (const [id, values] of Object.entries(settings)) {
+    const path = `/overrides/settings/${token(id)}`;
+    const version = found.pins.settings[id];
+    if (version === undefined) {
+      issues.push({ path, message: `${label} doesn't pin settings block "${id}"` });
+      continue;
+    }
+    const block = await check.blocks.getVersion({ tenantId, blockId: id, version });
+    if (block === null || block.kind !== 'settings') {
+      issues.push({ path, message: `settings block "${id}" version ${version} isn't published` });
+      continue;
+    }
+    const schema = found.modelSettings?.id === id ? MODEL_SETTINGS_SCHEMA : block.content.schema;
+    if (schema === undefined) continue;
+    for (const issue of settingsSchemaIssues(values, schema)) {
+      issues.push({ path: `${path}${issue.path}`, message: issue.message });
+    }
+  }
+  for (const [id, { template }] of Object.entries(overrides.prompts ?? {})) {
+    const path = `/overrides/prompts/${token(id)}`;
+    const version = found.pins.prompts[id];
+    if (version === undefined) {
+      issues.push({ path, message: `${label} doesn't pin prompt block "${id}"` });
+      continue;
+    }
+    const block = await check.blocks.getVersion({ tenantId, blockId: id, version });
+    if (block === null || block.kind !== 'prompt') {
+      issues.push({ path, message: `prompt block "${id}" version ${version} isn't published` });
+      continue;
+    }
+    const drafted = checkDraftedTemplate(template, {
+      current: block.content,
+      settingsBlocks: Object.keys(found.pins.settings),
+      knownIds: [
+        candidate.agentId,
+        ...Object.keys(found.pins.tools),
+        ...Object.keys(found.pins.prompts),
+        ...Object.keys(found.pins.settings),
+      ],
+    });
+    for (const issue of drafted) issues.push({ path, message: issue.message });
+  }
+  return issues;
+}

package/src/routes/eval-runs.ts

@@ -2,8 +2,10 @@
 // Copyright (C) 2026 Kindgi Inc.
 
 import { Hono } from 'hono';
+import type { Context } from 'hono';
 
 import type { AgentId } from '@kindgi/agents';
+import { type Action, ref } from '@kindgi/authz';
 import type { Cursor, FlowId, ProjectId, RunId, Semver, TenantId, Timestamp } from '@kindgi/types';
 
 import { statusFor, toWireError } from '../errors.js';
@@ -18,8 +20,11 @@ import {
   type FlowRef,
 } from '../eval-run-binding.js';
 import { VERSIONS_NEED_A_FLOW } from '../judged-dispatcher.js';
+import type { Authorizer } from '../middleware/authorize.js';
 import type { AppEnv } from '../types.js';
+import { deniedBy } from './denied.js';
 import { parseComparison } from './eval-comparison.js';
+import { type SettingsOverridesCheck, checkSettingsOverrides } from './eval-overrides.js';
 import { type FlowVersionsCheck, checkFlowVersions } from './eval-versions.js';
 import { clampLimit } from './pagination.js';
 import { parseScopeParams } from './scope-params.js';
@@ -43,6 +48,13 @@ import { formatSseFrame } from './sse.js';
  * The binding chooses its underlying substrate (the in-process
  * reference keeps runs in memory; a durable binding can back them with
  * runs and their journal); this route only sees the surface.
+ *
+ * With an authorizer (T243 A): starting a run needs `write` on the
+ * project it lands in and `execute` on what it evaluates (the agent or
+ * flow), on top of the eval-suites router's own check on the suite. An
+ * eval run is read through its suite: `read` on the suite to list, get or
+ * follow it, `write` to cancel it. A run that isn't there is still the
+ * handler's 404.
  */
 export interface EvalRunsRouters {
   readonly start: Hono<AppEnv>;
@@ -57,10 +69,12 @@ export interface EvalRunsRouters {
 export function evalRunsRouters(
   binding: EvalRunBinding,
   versionsCheck?: FlowVersionsCheck,
+  overridesCheck?: SettingsOverridesCheck,
+  authorizer?: Authorizer,
 ): EvalRunsRouters {
   return {
-    start: startRouter(binding, versionsCheck),
-    readback: readbackRouter(binding),
+    start: startRouter(binding, versionsCheck, overridesCheck, authorizer),
+    readback: readbackRouter(binding, authorizer),
   };
 }
 
@@ -91,7 +105,42 @@ async function versionsRefusal(
   };
 }
 
-function startRouter(binding: EvalRunBinding, versionsCheck?: FlowVersionsCheck): Hono<AppEnv> {
+/** The `validation-failed` error for an agent candidate's settings `overrides` that don't fit it; `undefined` when they do. */
+async function overridesRefusal(
+  check: SettingsOverridesCheck | undefined,
+  tenantId: TenantId,
+  start: ParsedStartBody,
+) {
+  const overrides = start.comparison?.overrides;
+  const agentRef = start.agentRef;
+  if (overrides === undefined || agentRef?.version === undefined) return undefined;
+  if (check === undefined) {
+    return {
+      code: 'validation-failed' as const,
+      message: "This runtime can't check overrides (it serves no agent or block registry).",
+      issues: [],
+    };
+  }
+  const issues = await checkSettingsOverrides(
+    check,
+    tenantId,
+    { agentId: agentRef.agentId as unknown as string, version: agentRef.version },
+    overrides,
+  );
+  if (issues.length === 0) return undefined;
+  return {
+    code: 'validation-failed' as const,
+    message: `The overrides don't fit ${agentRef.agentId as unknown as string} ${agentRef.version} (${issues.length} issue${issues.length === 1 ? '' : 's'})`,
+    issues: issues as unknown as Record<string, unknown>[],
+  };
+}
+
+function startRouter(
+  binding: EvalRunBinding,
+  versionsCheck?: FlowVersionsCheck,
+  overridesCheck?: SettingsOverridesCheck,
+  authorizer?: Authorizer,
+): Hono<AppEnv> {
   const r = new Hono<AppEnv>();
 
   r.post('/:suiteId/runs', async (c) => {
@@ -119,7 +168,18 @@ function startRouter(binding: EvalRunBinding, versionsCheck?: FlowVersionsCheck)
       c.status(statusFor(parsed.error.code) as never);
       return c.json(toWireError(parsed.error, requestId));
     }
-    const refusal = await versionsRefusal(versionsCheck, tenantId, parsed.value);
+    const { projectId, agentRef, flowRef } = parsed.value;
+    const target =
+      agentRef !== undefined
+        ? ref('agent', agentRef.agentId as unknown as string)
+        : ref('flow', flowRef?.flowId as unknown as string);
+    const refused =
+      (await deniedBy(authorizer, c, 'write', ref('project', projectId as unknown as string))) ??
+      (await deniedBy(authorizer, c, 'execute', target));
+    if (refused !== undefined) return refused;
+    const refusal =
+      (await versionsRefusal(versionsCheck, tenantId, parsed.value)) ??
+      (await overridesRefusal(overridesCheck, tenantId, parsed.value));
     if (refusal !== undefined) {
       c.status(statusFor(refusal.code) as never);
       return c.json(toWireError(refusal, requestId));
@@ -206,8 +266,16 @@ function startRouter(binding: EvalRunBinding, versionsCheck?: FlowVersionsCheck)
 
 // ---------- /v1/eval-runs/* (readback + cancel + SSE) ----------
 
-function readbackRouter(binding: EvalRunBinding): Hono<AppEnv> {
+function readbackRouter(binding: EvalRunBinding, authorizer?: Authorizer): Hono<AppEnv> {
   const r = new Hono<AppEnv>();
+  /** The refusal, if any, of `action` on the suite of the run named in the path. */
+  const onRunSuite = async (c: Context<AppEnv>, action: Action): Promise<Response | undefined> => {
+    if (authorizer === undefined) return undefined;
+    const tenantId = c.get('tenantId') as TenantId;
+    const run = await binding.get({ tenantId, runId: c.req.param('runId') as RunId });
+    if (run === null) return undefined;
+    return deniedBy(authorizer, c, action, ref('eval_suite', run.suiteId));
+  };
 
   // ---------- GET / (list) ----------
   r.get('/', async (c) => {
@@ -270,8 +338,14 @@ function readbackRouter(binding: EvalRunBinding): Hono<AppEnv> {
       ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
       ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
     });
+    const visible =
+      authorizer === undefined
+        ? page.data
+        : await authorizer.filterByCan(c, 'read', page.data, (run) =>
+            ref('eval_suite', run.suiteId),
+          );
     return c.json({
-      data: page.data.map(serializeEvalRun),
+      data: visible.map(serializeEvalRun),
       hasMore: page.nextCursor !== undefined,
       ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor as unknown as string }),
     });
@@ -279,6 +353,8 @@ function readbackRouter(binding: EvalRunBinding): Hono<AppEnv> {
 
   // ---------- GET /:runId ----------
   r.get('/:runId', async (c) => {
+    const refused = await onRunSuite(c, 'read');
+    if (refused !== undefined) return refused;
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const runId = c.req.param('runId') as RunId;
@@ -298,6 +374,8 @@ function readbackRouter(binding: EvalRunBinding): Hono<AppEnv> {
 
   // ---------- POST /:runId/cancel ----------
   r.post('/:runId/cancel', async (c) => {
+    const refused = await onRunSuite(c, 'write');
+    if (refused !== undefined) return refused;
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const runId = c.req.param('runId') as RunId;
@@ -340,6 +418,8 @@ function readbackRouter(binding: EvalRunBinding): Hono<AppEnv> {
 
   // ---------- GET /:runId/events (SSE) ----------
   r.get('/:runId/events', async (c) => {
+    const refused = await onRunSuite(c, 'read');
+    if (refused !== undefined) return refused;
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const runId = c.req.param('runId') as RunId;

package/src/routes/eval-suites.ts

@@ -16,6 +16,7 @@ import {
 import type { Authorizer } from '../middleware/authorize.js';
 import type { AppEnv } from '../types.js';
 import { clampLimit } from './pagination.js';
+import { projectMismatch } from './project-mismatch.js';
 import { parseScopeParams } from './scope-params.js';
 
 /**
@@ -77,6 +78,19 @@ export function evalSuitesRouter(
     r.use('/:suiteId/*', async (c, next) => {
       const action = c.req.method === 'GET' ? 'read' : 'admin';
       const suiteId = c.req.param('suiteId') ?? '';
+      // A test set built from judgments under a suite id never registered
+      // (no head row) has no suite to check yet: the build checks `admin`
+      // on the project it names, the project the new suite belongs to. A
+      // tombstoned suite keeps its head row, so it's checked as an existing
+      // one. Anything else under a suite id, and a build under an existing
+      // suite, checks the suite.
+      if (
+        c.req.method === 'POST' &&
+        c.req.path.endsWith('/versions/from-judgments') &&
+        !(await binding.headExists({ tenantId: c.get('tenantId') as TenantId, suiteId }))
+      ) {
+        return next();
+      }
       const mw = authorizer.authorize(action, () => ref('eval_suite', suiteId));
       return mw(c, next);
     });
@@ -128,8 +142,15 @@ export function evalSuitesRouter(
       ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
       ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
     });
+    // Only what the caller may read (T243 A), as `GET …/:id` asks.
+    const visible =
+      authorizer === undefined
+        ? page.data
+        : await authorizer.filterByCan(c, 'read', page.data, (a) =>
+            ref('eval_suite', a.id as unknown as string),
+          );
     return c.json({
-      data: page.data.map(serializeEvalSuite),
+      data: visible.map(serializeEvalSuite),
       hasMore: page.nextCursor !== undefined,
       ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor as unknown as string }),
     });
@@ -318,6 +339,9 @@ export function evalSuitesRouter(
         ),
       );
     }
+    if (outcome.kind === 'project-mismatch') {
+      return projectMismatch(c, 'eval-suite', outcome.suiteId, outcome.projectId);
+    }
     if (outcome.kind === 'project-not-found') {
       // Caller supplied a `projectId` that does not resolve within
       // this tenant. Distinct signal from `already-registered` so the