@opengeni/core 1.0.1 → 2.2.0-canary.0

package/dist/rigs/index.d.ts

@@ -1,10 +1,18 @@
-import type { AccessGrant, CreateRigRequest, RigDefinitionEditPayload, ProposeRigChangeRequest, Rig, RigChange, RigVersion, UpdateRigRequest } from "@opengeni/contracts";
+import type { AccessGrant, CreateRigRequest, RigDefinitionEditPayload, ProposeRigChangeRequest, Rig, RigChange, ResourceAuthorityScope, RigVersion, UpdateRigRequest } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 export * from "./provider-images.js";
 export declare const MAX_RIGS_PER_WORKSPACE = 50;
 export declare const MAX_CHECKS_PER_RIG = 100;
 export declare const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;
 export declare const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;
+export declare const RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY = 4;
+type VariableSetEnvironment = {
+    values: Record<string, string>;
+} | null;
+/** Load complete rig defaults concurrently while preserving listed precedence. */
+export declare function loadRigDefaultVariableSetEnvironment(variableSetIds: readonly string[], load: (variableSetId: string) => Promise<VariableSetEnvironment>): Promise<Record<string, string>>;
+/** Rig defaults layer below the session's explicitly selected variable set. */
+export declare function mergeRigDefaultVariableSetEnvironment(rigDefaultValues: Record<string, string>, sessionValues: Record<string, string>): Record<string, string>;
 export type RigServices = {
     db: Database;
 };
@@ -16,11 +24,20 @@ export declare function recordRigAuditEvent(db: Database, input: {
     metadata?: Record<string, unknown>;
 }): Promise<void>;
 export declare function rigActorForGrant(grant: AccessGrant): string;
-export declare function requireRigForApi(db: Database, workspaceId: string, rigId: string): Promise<Rig>;
+export declare function requireRigForApi(db: Database, grant: AccessGrant, rigId: string): Promise<Rig>;
 export declare function requireRigChangeForApi(db: Database, workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
-export declare function createRigForApi(deps: RigServices, grant: AccessGrant, payload: CreateRigRequest): Promise<Rig>;
-export declare function updateRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig, payload: UpdateRigRequest): Promise<Rig>;
-export declare function deleteRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig): Promise<void>;
+/** A resource may depend only on Variable Sets whose audience is no narrower
+ * than its own. User-owned rigs may use anything visible to their owner. */
+export declare function variableSetScopeAllowedForRig(rigScope: ResourceAuthorityScope, variableSetScope: ResourceAuthorityScope): boolean;
+export declare function createRigForApi(deps: RigServices, grant: AccessGrant, payload: CreateRigRequest, options?: {
+    allowOrganization?: boolean;
+}): Promise<Rig>;
+export declare function updateRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig, payload: UpdateRigRequest, options?: {
+    allowOrganization?: boolean;
+}): Promise<Rig>;
+export declare function deleteRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig, options?: {
+    allowOrganization?: boolean;
+}): Promise<void>;
 export declare function proposeRigChangeForApi(deps: RigServices, grant: AccessGrant, rig: Rig, request: ProposeRigChangeRequest, options?: {
     proposedBy?: string;
 }): Promise<RigChange>;

package/dist/sandbox/fleet.d.ts

@@ -1,7 +1,7 @@
 import type { Settings } from "@opengeni/config";
 import { type Database, type SandboxRecord } from "@opengeni/db";
 import type { EventBus } from "@opengeni/events";
-import { type BackendUnresolvableCode, type ControlRpc, type SelfhostedRelayConfig, type SelfhostedOpStreamDeps } from "@opengeni/runtime/sandbox";
+import { type BackendUnresolvableCode, type ControlRpc, type SelfhostedRelayConfig, type SelfhostedOpStreamDeps, type SelfhostedOperationAdmission, type SelfhostedOperationResourcePolicy } from "@opengeni/runtime/sandbox";
 export type FleetServices = {
     db: Database;
     settings: Settings;
@@ -18,6 +18,13 @@ export type FleetReadinessHold = {
 export type FleetContext = {
     accountId: string;
     workspaceId: string;
+    subjectId?: string;
+    attemptAuthority?: {
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+        initiatingHumanSubjectId: string;
+    };
     /** The calling session (the pointer the attach/swap mutates + whose group box
      *  is the default fleet member). */
     sessionId: string;
@@ -42,6 +49,8 @@ export declare function buildFleetContextForSession(deps: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
+    subjectId?: string;
+    attemptAuthority?: FleetContext["attemptAuthority"];
 }): Promise<FleetContext>;
 /** The dominant liveness of a fleet member, surfaced to the dock + the agent. */
 export type FleetLiveness = "online" | "reconnecting" | "offline";
@@ -50,14 +59,15 @@ export type FleetOperationAvailability = "ready" | "wakeable" | "recovering" | "
  * A fleet member as the agent + the dock see it (the M8b/M9 UI seam — the
  * `sandboxes_list` response entry the dock renders). STABLE shape: the dock keys
  * on `id`, renders `name`/`kind`/`liveness`, and marks `active`. The session's own
- * Modal group box is a synthetic entry with `id: groupId`, `kind: "modal"`, and a
- * null `enrollmentId`; an enrolled machine carries its sandbox + enrollment ids.
+ * managed group box is a synthetic entry with `id: groupId`, its actual
+ * provisioned backend kind, and a null `enrollmentId`; an enrolled machine
+ * carries its sandbox + enrollment ids.
  */
 export type FleetSandboxEntry = {
     /** The sandbox id used as the attach/swap/run_on `target`. For the session's
      *  own group box this is the group id (a null active pointer == this box). */
     id: string;
-    kind: "modal" | "selfhosted";
+    kind: "modal" | "selfhosted" | "opensandbox";
     name: string;
     liveness: FleetLiveness;
     /** True for the session's currently-active sandbox (the routing target). */
@@ -106,7 +116,7 @@ export type FleetSwapResult = {
     activeSandboxId: string | null;
     activeEpoch: number;
     reason?: string;
-    code?: BackendUnresolvableCode | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
+    code?: BackendUnresolvableCode | "invalid_working_directory" | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
 };
 /**
  * List the fleet: the session's own group box when it has one (a synthetic
@@ -157,6 +167,9 @@ export type RunOnResult = {
 export type RunOnSelfhostedMachine = {
     workspaceId: string;
     agentId: string;
+    /** Exact live daemon pinned for this operation. */
+    connectionInstanceId: string;
+    workspaceRoot: string;
     controlRpc: ControlRpc;
     relay: SelfhostedRelayConfig;
     /** Short request/reply deadline for read/write and other control operations. */
@@ -165,6 +178,21 @@ export type RunOnSelfhostedMachine = {
     execTimeoutMs: number;
     /** Streaming transport required when execTimeoutMs is 0 (unbounded). */
     opStream?: SelfhostedOpStreamDeps;
+    operationResourcePolicy?: SelfhostedOperationResourcePolicy;
+    operationResourcePolicySupported?: boolean;
+    operationCpuQuotaSupported?: boolean;
+    /** Last-boundary authority/connection resolver invoked before every physical
+     * provider operation. */
+    resolveOperationAdmission?: () => Promise<SelfhostedOperationAdmission | null>;
+    /**
+     * Exact-attempt values for this one child process. Never persisted on the
+     * enrollment or machine. The caller may supply these only after authenticating
+     * the active attempt that owns the one-off operation.
+     */
+    transientExecEnvironment?: Readonly<Record<string, string>>;
+};
+export type RunOnOptions = {
+    transientExecEnvironment?: Readonly<Record<string, string>>;
 };
 /**
  * Execute the one-off machine operation once the workspace/enrollment lookup has
@@ -182,7 +210,7 @@ export declare function executeRunOnSelfhostedMachine(machine: RunOnSelfhostedMa
  * agent subject; an offline machine surfaces a clear reason, never a wrong-box
  * landing.
  */
-export declare function runOnSandbox(services: FleetServices, ctx: FleetContext, target: string, op: RunOnOp): Promise<RunOnResult>;
+export declare function runOnSandbox(services: FleetServices, ctx: FleetContext, target: string, op: RunOnOp, options?: RunOnOptions): Promise<RunOnResult>;
 export type ProvisionResult = {
     kind: "selfhosted";
     instructions: string;

package/dist/sandbox/routing.d.ts

@@ -1,7 +1,19 @@
 import { type Settings } from "@opengeni/config";
 import { type Database } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
-import { type EstablishedSandboxSession, type RoutingSandboxOperationObserver, type SelfhostedRelayConfig } from "@opengeni/runtime/sandbox";
+import { type EstablishedSandboxSession, type ResolvedActiveBackend, type RoutingRetainedProcess, type RoutingSandboxOperationObserver, type SelfhostedRelayConfig } from "@opengeni/runtime/sandbox";
+type DirectRetainedProcessRoute = {
+    providerSessionId: number;
+    providerBackend: string;
+    providerInstanceId: string;
+    leaseEpoch: number;
+    routeKind: "home" | "active";
+    routeTargetId: string | null;
+    routeEpoch: number;
+};
+/** API-direct requests always use active-route authority. The default active
+ * pointer is represented by a null target id; it is not a home-route write. */
+export declare function directRetainedProcessMatchesBackend(durable: DirectRetainedProcessRoute, process: RoutingRetainedProcess, backend: ResolvedActiveBackend): boolean;
 export type ChannelARoutingServices = {
     db: Database;
     settings: Settings;
@@ -37,6 +49,7 @@ export declare function wrapChannelABoxWithRouting(services: ChannelARoutingServ
     accountId: string;
     workspaceId: string;
     sessionId: string;
+    resourceSubjectId: string;
     homeLease?: {
         sandboxGroupId: string;
         leaseEpoch: number;
@@ -55,3 +68,4 @@ export declare function wrapChannelABoxWithRouting(services: ChannelARoutingServ
         holderId: string;
     };
 }, established: EstablishedSandboxSession): EstablishedSandboxSession;
+export {};

package/dist/sandbox/runtime-settings.d.ts

@@ -0,0 +1,39 @@
+import type { Settings } from "@opengeni/config";
+import { CapabilityPack, type RigVersion, type Session, type SandboxBackend } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { resolveModalCheckpointProviderBinding } from "@opengeni/runtime/sandbox";
+/** Pre-V2 Packs are the sole compatibility path where a Pack can still own a
+ * sandbox image. V2 installations select a Rig instead. Keep this predicate at
+ * the shared runtime boundary so turns, API-direct tools, viewers, Browser and
+ * Computer cannot resolve different physical machines for the same session. */
+export declare function packInstallationUsesLegacyRuntime(input: {
+    manifestSnapshot: unknown | null;
+    manifestDigest: string | null;
+}): boolean;
+export declare function resolveWorkspaceLegacyRuntimePacks(db: Database, workspaceId: string): Promise<CapabilityPack[]>;
+export declare function legacySandboxRuntimeFromPacks(packs: readonly CapabilityPack[]): {
+    sandboxImage: string | null;
+    sandboxProviderImages: CapabilityPack["sandboxProviderImages"] | null;
+};
+export declare function settingsWithPackSandboxImage(settings: Settings, sandboxImage: string | null, sandboxProviderImages?: CapabilityPack["sandboxProviderImages"] | null): Settings;
+export declare function settingsWithRigImage(settings: Settings, rigImage: string | null): Settings;
+export declare function rigProviderImageSourceImage(settings: Settings, backend: SandboxBackend): string | null;
+export type RigProviderImageSelectionReason = "selected" | "missing" | "provider_unsupported" | "not_ready" | "not_cold_boot_validated" | "content_mismatch" | "provider_binding_unavailable" | "provider_binding_mismatch";
+export declare function resolveRigProviderImageSelection(settings: Settings, version: RigVersion | null, backend: SandboxBackend, currentProviderBindingKeyHash: string | null): {
+    settings: Settings;
+    reason: RigProviderImageSelectionReason;
+    contentHash: string | null;
+    imageId: string | null;
+};
+export declare function resolveRigProviderImageForRun(settings: Settings, version: RigVersion | null, backend: SandboxBackend, resolveBinding?: typeof resolveModalCheckpointProviderBinding): Promise<ReturnType<typeof resolveRigProviderImageSelection>>;
+export declare function settingsWithRigProviderImage(settings: Settings, version: RigVersion | null, backend: SandboxBackend, resolveBinding?: typeof resolveModalCheckpointProviderBinding): Promise<Settings>;
+export type SessionSandboxRuntime = {
+    /** Exact logical image/rig settings used to fence the durable group lease. */
+    settings: Settings;
+    image: string | null;
+    rigVersion: RigVersion | null;
+};
+export declare function resolveSessionSandboxRuntime(db: Database, settings: Settings, session: Pick<Session, "workspaceId" | "sandboxBackend" | "rigId" | "rigVersionId">): Promise<SessionSandboxRuntime>;
+/** Resolve provider-native cold-create optimization only for the single CAS
+ * winner. Ordinary API calls never perform provider identity I/O. */
+export declare function providerSettingsForSessionSandboxRuntime(runtime: SessionSandboxRuntime, backend: SandboxBackend): Promise<Settings>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "1.0.1",
+  "version": "2.2.0-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -33,6 +33,10 @@
     "./canonical-human-identities": {
       "types": "./dist/canonical-human-identities.d.ts",
       "import": "./dist/canonical-human-identities.js"
+    },
+    "./connection-authority": {
+      "types": "./dist/domain/connection-authority.d.ts",
+      "import": "./dist/domain/connection-authority.js"
     }
   },
   "publishConfig": {
@@ -46,16 +50,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.17",
-    "@opengeni/config": "^0.16.4",
-    "@opengeni/contracts": "^1.0.1",
-    "@opengeni/db": "^1.0.1",
-    "@opengeni/documents": "^0.5.41",
-    "@opengeni/events": "^0.3.112",
-    "@opengeni/observability": "^0.7.7",
-    "@opengeni/runtime": "^1.0.1",
-    "@opengeni/storage": "^0.2.96",
-    "hono": "^4.12.18"
+    "@opengeni/codex": "^0.2.19-canary.0",
+    "@opengeni/config": "^0.19.1-canary.0",
+    "@opengeni/contracts": "^2.3.0-canary.0",
+    "@opengeni/db": "^3.2.0-canary.0",
+    "@opengeni/documents": "^0.7.0-canary.0",
+    "@opengeni/events": "^0.3.124-canary.0",
+    "@opengeni/observability": "^0.8.4-canary.0",
+    "@opengeni/runtime": "^1.3.1-canary.0",
+    "@opengeni/storage": "^0.2.106-canary.0",
+    "hono": "^4.12.18",
+    "zod": "^4.2.1"
   },
   "engines": {
     "node": ">=18"

package/src/access/index.ts

@@ -22,6 +22,41 @@ import { getManagedSession } from "../managed-session";
 const bearerPrefix = "Bearer ";
 const accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null>>();
 
+/**
+ * Contexts that were authenticated by a verified canonical managed cookie
+ * (Better Auth session), stamped at the single branch of
+ * {@link resolveAccessContext} that performs that verification.
+ *
+ * This is provenance — HOW the request authenticated — not a shape check on a
+ * value. It cannot be forged by a token claim, and it FAILS CLOSED by default:
+ * membership is only ever added at that one branch, so every other path
+ * (delegated bearer, API key, local bootstrap, configured key, and any path
+ * added later) is absent from the set without anyone maintaining a list. A
+ * request that never resolves an access context has no context to test at all.
+ *
+ * Keyed on the resolved `AccessContext` object identity, deliberately NOT on
+ * the `Request`: a reused, wrapped, or retried request object can therefore
+ * never carry a stale positive into a differently-authenticated resolution, and
+ * the non-cached `requireFreshAccessGrant` path is stamped correctly too. Each
+ * resolution produces a fresh context object, so the mark travels with exactly
+ * the value the cookie branch produced.
+ */
+const canonicalManagedCookieContexts = new WeakSet<AccessContext>();
+const resolvedAccessGrantAuthorizations = new WeakSet<object>();
+
+/**
+ * Opaque, request-local proof that the canonical access resolver authorized the
+ * exact account administrator named by the stamp. The random id is audit and
+ * replay provenance only; object identity is what prevents a caller from
+ * manufacturing this proof inside the API process.
+ */
+export type AccountAdminAuthorizationStamp = Readonly<{
+  authorizationId: string;
+  accountId: string;
+  actorSubjectId: string;
+  permission: "account:admin";
+}>;
+
 export type AccessDeps = {
   db: Database;
   settings: Settings;
@@ -50,11 +85,38 @@ export async function requireAccessGrant(
   return (await requireAccessGrantAuthorization(c, deps, workspaceId, permission)).grant;
 }
 
+/**
+ * Re-resolve the authenticated principal and its current grants without using
+ * the request-local access cache. Long-lived responses use this to ensure a
+ * membership suspension or revocation takes effect while the connection is
+ * still open.
+ */
+export async function requireFreshAccessGrant(
+  c: Context,
+  deps: AccessDeps,
+  workspaceId: string,
+  permission?: Permission,
+): Promise<AccessGrant> {
+  const context = await resolveAccessContext(c, deps);
+  if (!context) {
+    throw new HTTPException(401, { message: "authentication required" });
+  }
+  return (await accessGrantAuthorization(context, deps, workspaceId, permission)).grant;
+}
+
 export type AccessGrantAuthorization = {
   grant: AccessGrant;
   accountGrant: AccountGrant | null;
   authenticatedSubjectId: string;
   contextIntegrity: boolean;
+  /**
+   * Did this request authenticate as the canonical managed-cookie (Better Auth)
+   * session that OWNS this grant's subject? The single input to the owner-only
+   * managed personal-workspace exception; see `isCanonicalManagedHumanSession`.
+   * False for every bearer, API-key, delegated, service, local, and configured
+   * principal, and for any future path that does not verify a cookie.
+   */
+  canonicalManagedHumanSession: boolean;
 };
 
 export function accessGrantAuthorizationFromContext(
@@ -81,12 +143,46 @@ export function accessGrantAuthorizationFromContext(
     ) &&
     matchingAccountGrants.length === 1 &&
     matchingAccountGrants[0]?.subjectId === context.subjectId;
-  return {
+  const authorization: AccessGrantAuthorization = {
     grant,
     accountGrant: contextIntegrity ? matchingAccountGrants[0]! : null,
     authenticatedSubjectId: context.subjectId,
     contextIntegrity,
+    canonicalManagedHumanSession: isCanonicalManagedHumanSession(context, grant),
   };
+  resolvedAccessGrantAuthorizations.add(authorization);
+  return authorization;
+}
+
+/**
+ * Mint the capability passed to an account-admin database lifecycle.
+ *
+ * This deliberately accepts every canonical access mode (managed,
+ * local/configured, and signed delegation). Organization-membership rows are
+ * one possible source of account authority, not the definition of it. A plain
+ * object with matching fields is rejected because only values returned by the
+ * access resolver are present in `resolvedAccessGrantAuthorizations`.
+ */
+export function requireAccountAdminAuthorizationStamp(
+  authorization: AccessGrantAuthorization,
+): AccountAdminAuthorizationStamp {
+  const { grant, accountGrant } = authorization;
+  if (
+    !resolvedAccessGrantAuthorizations.has(authorization) ||
+    !authorization.contextIntegrity ||
+    authorization.authenticatedSubjectId !== grant.subjectId ||
+    accountGrant?.accountId !== grant.accountId ||
+    accountGrant.subjectId !== grant.subjectId ||
+    !accountGrant.permissions.includes("account:admin")
+  ) {
+    throw new HTTPException(403, { message: "missing permission: account:admin" });
+  }
+  return Object.freeze({
+    authorizationId: crypto.randomUUID(),
+    accountId: grant.accountId,
+    actorSubjectId: grant.subjectId,
+    permission: "account:admin" as const,
+  });
 }
 
 export async function requireAccessGrantAuthorization(
@@ -96,6 +192,15 @@ export async function requireAccessGrantAuthorization(
   permission?: Permission,
 ): Promise<AccessGrantAuthorization> {
   const context = await requireAccessContext(c, deps);
+  return await accessGrantAuthorization(context, deps, workspaceId, permission);
+}
+
+async function accessGrantAuthorization(
+  context: AccessContext,
+  deps: AccessDeps,
+  workspaceId: string,
+  permission?: Permission,
+): Promise<AccessGrantAuthorization> {
   const principalKind = hostedHumanSessionPrincipalKind(context);
   const grant =
     context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ??
@@ -118,6 +223,43 @@ export async function requireAccessGrantAuthorization(
   return accessGrantAuthorizationFromContext(context, grant);
 }
 
+/**
+ * May this grant use the owner-only managed personal-workspace exception?
+ *
+ * A managed human's personal workspace carries no `workspace_memberships` row,
+ * so seams that fence on one must consult the
+ * `organization_memberships.personal_workspace_id` pointer instead. That is a
+ * runtime property, not a schema one: migration 0219's `42501` is a
+ * precondition inside the provisioning function rather than a constraint, and
+ * the parity report records `personal_workspace_has_no_membership_row` as
+ * `basis: "runtime"` - its own term for something nothing in the schema
+ * prevents. It holds because every membership writer requires `members:manage`
+ * on the target, which a personal-workspace grant deliberately omits. `AGENTS.md`
+ * scopes that exception tightly: it "derives an owner-only personal-workspace
+ * grant only for the canonical managed-cookie (Better Auth) session", and
+ * "Bearer/delegated principals, API keys, and account or organization
+ * administrators receive no personal-workspace access through that exception."
+ *
+ * This asks about PROVENANCE, not shape. Inspecting a grant's `principalKind`,
+ * `metadata.delegated`, or `serviceInitiator` is not sufficient: a delegated
+ * bearer chooses every one of those claims inside its own host-signed token and
+ * can name any subject, including the owner's. So the answer comes from
+ * {@link canonicalManagedCookieContexts}, stamped only where a Better Auth
+ * cookie was actually verified.
+ *
+ * The subject equality is the second half: the exception is OWNER-only, so the
+ * grant must belong to the authenticated human itself, not to some other
+ * subject reached from an authenticated session. `user:` excludes machine
+ * principals, which can never own an organization membership.
+ */
+function isCanonicalManagedHumanSession(context: AccessContext, grant: AccessGrant): boolean {
+  return (
+    canonicalManagedCookieContexts.has(context) &&
+    grant.subjectId === context.subjectId &&
+    grant.subjectId.startsWith("user:")
+  );
+}
+
 function hostedHumanSessionPrincipalKind(context: AccessContext): "human_session" | undefined {
   if (context.mode !== "managed" || context.workspaceGrants.length === 0) {
     return undefined;
@@ -165,42 +307,19 @@ export function requireLiteralPermission(grant: AccessGrant, permission: Permiss
 }
 
 export function hasLiteralPermission(permissions: Permission[], permission: Permission): boolean {
+  if (!Array.isArray(permissions)) return false;
   return permissions.includes(permission);
 }
 
 export function hasPermission(permissions: Permission[], permission: Permission): boolean {
+  if (!Array.isArray(permissions)) return false;
   if (permission === "secrets:read") {
     return permissions.includes("secrets:read");
   }
-  const aliases: Partial<Record<Permission, Permission[]>> = {
-    "variable-sets:use": ["environments:use" as Permission],
-    "variable-sets:manage": ["environments:manage" as Permission],
-    "variable-sets:list": [
-      "variable-sets:use",
-      "variable-sets:manage",
-      "environments:use" as Permission,
-      "environments:manage" as Permission,
-    ],
-    "variable-sets:read": [
-      "variable-sets:use",
-      "variable-sets:manage",
-      "environments:use" as Permission,
-      "environments:manage" as Permission,
-    ],
-    "variable-sets:write": ["variable-sets:manage", "environments:manage" as Permission],
-    "secrets:list": [
-      "variable-sets:use",
-      "variable-sets:manage",
-      "environments:use" as Permission,
-      "environments:manage" as Permission,
-    ],
-    "secrets:write": ["variable-sets:manage", "environments:manage" as Permission],
-  };
-  return (
-    permissions.includes(permission) ||
-    (aliases[permission]?.some((alias) => permissions.includes(alias)) ?? false) ||
-    permissions.includes("workspace:admin")
-  );
+  // Variable-set metadata, plaintext read, write/rotation, attachment, and
+  // runtime use are independent capabilities. Deprecated broad permissions
+  // remain parseable but do not imply any of the exact permissions.
+  return permissions.includes(permission) || permissions.includes("workspace:admin");
 }
 
 async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext | null> {
@@ -260,11 +379,18 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
   if (deps.managedAuth) {
     const session = await getManagedSession(c, deps.managedAuth, { db: deps.db });
     if (session?.user) {
-      return await ensureManagedAccessForUser(deps.db, {
+      // THE canonical managed-cookie (Better Auth) branch, and the only place
+      // that may stamp a context as such. Every `return` above this point leaves
+      // its context unstamped, so the owner-only personal-workspace exception
+      // fails closed for them without depending on an exclusion list.
+      const context = await ensureManagedAccessForUser(deps.db, {
         userId: session.user.id,
         email: session.user.email,
         name: session.user.name,
+        emailVerified: session.user.emailVerified,
       });
+      canonicalManagedCookieContexts.add(context);
+      return context;
     }
   }
 

package/src/application/new-session-drafts.ts

@@ -12,6 +12,7 @@ import {
   getVariableSet,
   NewSessionDraftAccessError,
   newSessionDraftToolsProvided,
+  newSessionSelectionHistory,
   publicNewSessionDraftOptions,
   requireFileForSubject,
   saveNewSessionDraftInTransaction,
@@ -50,6 +51,7 @@ function mapNewSessionDraft(
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
     options: publicNewSessionDraftOptions(row),
+    selectionHistory: newSessionSelectionHistory(row),
     updatedAt: row.updatedAt.toISOString(),
   });
 }
@@ -103,8 +105,13 @@ async function hydrateNewSessionDraft(
   const options = { ...mapped.options };
   if (options.variableSetId) {
     if (
+      !hasPermission(grant.permissions, "variable-sets:attach") ||
       !hasPermission(grant.permissions, "variable-sets:use") ||
-      !(await getVariableSet(deps.db, workspaceId, options.variableSetId))
+      !(await getVariableSet(
+        deps.db,
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        options.variableSetId,
+      ))
     ) {
       delete options.variableSetId;
     }
@@ -178,6 +185,7 @@ export async function getActorNewSessionDraft(
       reasoningEffort: deps.settings.openaiReasoningEffort,
       latencyMode: "standard",
       options: {},
+      selectionHistory: { projects: [] },
       updatedAt: null,
     }
   );
@@ -195,6 +203,13 @@ export async function saveActorNewSessionDraft(
   grant: AccessGrant,
   workspaceId: string,
   rawInput: unknown,
+  /**
+   * `AccessGrantAuthorization.canonicalManagedHumanSession` — did this request
+   * authenticate as the canonical managed cookie that owns `grant.subjectId`?
+   * Defaults to false so every caller that has not proven it fails closed onto
+   * the historical bare-membership fence.
+   */
+  canonicalManagedHumanSession = false,
 ): Promise<NewSessionDraftValue> {
   const input = SaveNewSessionDraftRequest.parse(rawInput);
   // The pre-marker client contract required `tools` and had no
@@ -212,7 +227,9 @@ export async function saveActorNewSessionDraft(
   const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];
   await validateGitHubRepositorySelection(deps.db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
-    throw new HTTPException(503, { message: "object storage is not configured" });
+    throw new HTTPException(503, {
+      message: "object storage is not configured",
+    });
   }
   await validateFileResources(deps.db, grant.accountId, workspaceId, grant.subjectId, resources);
   assertConfiguredModel(deps.settings, input.model);
@@ -239,6 +256,11 @@ export async function saveActorNewSessionDraft(
           // worker MCP principal) legitimately have no workspace_memberships
           // row, so they must not be rejected by the human-removal fence.
           requireWorkspaceMembership: grant.subjectId.startsWith("user:"),
+          // A managed human's own personal workspace has no membership row at
+          // all, so the human-removal fence above must fall back to the
+          // organization-membership pointer for them — and only for the
+          // canonical managed-cookie session that owns it.
+          personalWorkspaceOwnerException: canonicalManagedHumanSession,
         }),
       ),
     );