@opengeni/worker-bundle 1.0.1 → 2.0.0

package/src/activities/context-compaction.ts

@@ -1,3 +1,4 @@
+import { readReasoningConfiguration } from "@opengeni/codex";
 import {
   applyContextCompaction,
   getActiveSessionHistoryItemsPaged,
@@ -21,6 +22,7 @@ import {
   sanitizeHistoryItemsForModel,
   summarizeForCompaction,
   type CompactionItem,
+  type CompactionProviderRejection,
 } from "@opengeni/runtime";
 import { contextInputBudgetTokens, type Settings } from "@opengeni/config";
 import type { SessionEvent } from "@opengeni/contracts";
@@ -260,6 +262,12 @@ export async function settleFailedContextCompactionLandmark(
   options: {
     clearRequestedCompaction?: boolean;
     publishLiveEvents?: (events: SessionEvent[]) => Promise<void>;
+    /**
+     * Closed identifier record of a definitive provider rejection. Carried on
+     * the visible `compaction.skipped` landmark so the timeline can name the
+     * rejected field instead of offering a retry that cannot succeed.
+     */
+    providerRejection?: CompactionProviderRejection | null;
   } = {},
 ): Promise<Extract<MaybeCompactResult, { compacted: false }>> {
   const settled = await settleSkippedAfterStart(db, scope, options, "summarization_failed");
@@ -287,6 +295,7 @@ async function settleSkippedAfterStart(
   },
   options: {
     clearRequestedCompaction?: boolean;
+    providerRejection?: CompactionProviderRejection | null;
   },
   reason:
     | "no_history"
@@ -304,6 +313,7 @@ async function settleSkippedAfterStart(
     // an operator `/compact` flag — auto/overflow never set one.
     requirePendingRequest: false,
     clearRequestedCompaction,
+    ...(options.providerRejection ? { providerRejection: options.providerRejection } : {}),
   });
   if (!skipped.recorded) {
     throw new TurnAttemptFencedError(
@@ -370,7 +380,10 @@ async function compactContextRemoteV2(
   );
   const estimatedTokensAfter = estimateTokens(await projectForWire(replacementHistory));
   const replacementFingerprint = compactionReplacementFingerprint(replacementHistory);
-  const tailItem = replacementHistory.at(-1);
+  const summaryIndex =
+    replacementHistory.length -
+    (readReasoningConfiguration(replacementHistory.at(-1) ?? {}) ? 2 : 1);
+  const tailItem = replacementHistory[summaryIndex];
   if (!tailItem) {
     throw new EmptyCompactionSummaryError({
       stage: "remote_v2_replacement",
@@ -384,7 +397,10 @@ async function compactContextRemoteV2(
     turnId: scope.turnId,
     expectedExecutionGeneration: scope.executionGeneration,
     expectedAttemptId: scope.attemptId,
-    replacementItems: replacementHistory.slice(0, -1),
+    replacementItems: replacementHistory.slice(0, summaryIndex),
+    ...(replacementHistory.length > summaryIndex + 1
+      ? { trailingItems: replacementHistory.slice(summaryIndex + 1) }
+      : {}),
     summaryItem: tailItem as Record<string, unknown>,
     ...(options.clearRequestedCompaction ? { clearRequestedCompaction: true } : {}),
     eventPayload: {
@@ -447,7 +463,10 @@ async function compactContextPortable(
   const estimatedTokensAfter = estimateTokens(await projectForWire(replacementHistory));
   const replacementFingerprint = compactionReplacementFingerprint(replacementHistory);
   const previousReplacementFingerprint = latestCompactionReplacementFingerprint(canonicalItems);
-  const summaryItem = replacementHistory.at(-1);
+  const summaryIndex =
+    replacementHistory.length -
+    (readReasoningConfiguration(replacementHistory.at(-1) ?? {}) ? 2 : 1);
+  const summaryItem = replacementHistory[summaryIndex];
   if (!summaryItem) {
     // Started already fanout; settle visibly so the landmark cannot stick on
     // "Compacting…". This is not an operator-request clear path.
@@ -466,7 +485,10 @@ async function compactContextPortable(
     turnId: scope.turnId,
     expectedExecutionGeneration: scope.executionGeneration,
     expectedAttemptId: scope.attemptId,
-    replacementItems: replacementHistory.slice(0, -1),
+    replacementItems: replacementHistory.slice(0, summaryIndex),
+    ...(replacementHistory.length > summaryIndex + 1
+      ? { trailingItems: replacementHistory.slice(summaryIndex + 1) }
+      : {}),
     summaryItem: summaryItem as Record<string, unknown>,
     ...(options.clearRequestedCompaction ? { clearRequestedCompaction: true } : {}),
     eventPayload: {

package/src/activities/goals.ts

@@ -308,6 +308,7 @@ export function goalContinuationPrompt(
     "- For every explicit requirement, named artifact, command, test, gate, invariant, and deliverable, identify and inspect the authoritative evidence that would prove it.",
     "- Match verification scope to requirement scope. Treat uncertain, indirect, incomplete, or missing evidence as not achieved and continue working.",
     "- The audit must prove completion, not merely fail to find obvious remaining work.",
+    "- For user-facing report deliverables, including reports produced during another task, follow the Documents Skill: create the durable native document first, inspect its relevant final head after the last edit, and provide the returned artifact reference. Declare report requirements through the available goal tools before authoring and satisfy every persisted report requirement with verified artifact delivery evidence before completion. Sandbox paths and raw file IDs do not prove report delivery. If artifact tooling or access is unavailable, keep that deliverable incomplete and state the blocker; never invent proof or silently substitute a local report. Ordinary chat answers, short progress updates, source-code links, and explicitly requested local-file work remain outside this report contract.",
     "",
     "Do not rely on intent, partial progress, memory of earlier work, or a plausible final answer as proof of completion. Call opengeni__goal_complete with concrete evidence only when the full objective is actually achieved and no required work remains.",
     "",

package/src/activities/google-drive-publication.ts

@@ -90,9 +90,7 @@ export async function resolveGoogleDrivePublicationTarget(
   );
   if (frozen.length !== 1) return null;
   const delegation = frozen[0]!;
-  const activated = delegation.userDelegation !== undefined;
   if (
-    !activated &&
     !(await ports.getMembership(db, {
       accountId: workspace.accountId,
       workspaceId,
@@ -101,7 +99,7 @@ export async function resolveGoogleDrivePublicationTarget(
   ) {
     return null;
   }
-  const originWorkspaceId = activated ? delegation.originWorkspaceId : workspaceId;
+  const originWorkspaceId = delegation.originWorkspaceId;
   if (!originWorkspaceId) return null;
   const connection = await ports.getConnection(
     db,

package/src/activities/mcp-account-routes.ts

@@ -0,0 +1,139 @@
+import type { Settings } from "@opengeni/config";
+import type {
+  McpConnectionAccountBinding,
+  ToolRef,
+  ToolAuthNeededPayload,
+} from "@opengeni/contracts";
+import type { ApiIntegrationRuntime } from "@opengeni/db";
+
+export function accountRouteAuthNeededPayload(
+  payload: ToolAuthNeededPayload,
+  bindings: readonly McpConnectionAccountBinding[] | null | undefined,
+): ToolAuthNeededPayload {
+  const binding = bindings?.find((candidate) => candidate.serverId === payload.serverId);
+  return binding
+    ? {
+        ...payload,
+        canonicalServerId: binding.canonicalServerId,
+        connectionSubjectScope: binding.subjectScope,
+      }
+    : payload;
+}
+
+/** Expand only after canonical tool-policy admission. Aliases are execution
+ * identities, never an alternate way to gain admission to a connector. */
+export function expandMcpAccountRoutes(input: {
+  settings: Settings;
+  tools: ToolRef[];
+  bindings: readonly McpConnectionAccountBinding[] | null | undefined;
+}): { settings: Settings; tools: ToolRef[]; accountLabels: ReadonlyMap<string, string> } {
+  // Only historical work has no binding snapshot. A present empty snapshot is
+  // an explicit lack of account authority, never a request for current defaults.
+  if (input.bindings == null) {
+    return { settings: input.settings, tools: input.tools, accountLabels: new Map() };
+  }
+  const configured = new Map(input.settings.mcpServers.map((server) => [server.id, server]));
+  const byCanonical = new Map<string, McpConnectionAccountBinding[]>();
+  const routes = new Set<string>();
+  const accounts = new Set<string>();
+  for (const binding of input.bindings) {
+    const account = JSON.stringify([binding.canonicalServerId, binding.connectionId]);
+    if (
+      routes.has(binding.serverId) ||
+      accounts.has(account) ||
+      configured.has(binding.serverId) ||
+      (binding.subjectScope === "subject") !== (binding.ownerSubjectId !== null) ||
+      binding.connectionRef.authoritySource === "host" ||
+      binding.connectionRef.connectionId !== binding.connectionId ||
+      binding.connectionRef.subjectScope !== binding.subjectScope ||
+      binding.connectionRef.providerDomain !== binding.providerDomain ||
+      binding.connectionRef.kind !== binding.kind
+    ) {
+      throw new Error("Invalid accepted MCP account route");
+    }
+    routes.add(binding.serverId);
+    accounts.add(account);
+    const siblings = byCanonical.get(binding.canonicalServerId) ?? [];
+    siblings.push(binding);
+    byCanonical.set(binding.canonicalServerId, siblings);
+  }
+  const servers: Settings["mcpServers"] = [];
+  const tools: ToolRef[] = [];
+  const accountLabels = new Map<string, string>();
+  for (const tool of input.tools) {
+    const bindings = byCanonical.get(tool.id);
+    if (!bindings) {
+      if (!configured.get(tool.id)?.connectionRef) tools.push(tool);
+      continue;
+    }
+    const canonical = configured.get(tool.id);
+    if (!canonical?.connectionRef) {
+      throw new Error("Accepted MCP account route has no canonical connection configuration");
+    }
+    for (const binding of bindings) {
+      if (
+        canonical.connectionRef.authoritySource === "host" ||
+        canonical.connectionRef.providerDomain !== binding.providerDomain ||
+        (canonical.connectionRef.kind && canonical.connectionRef.kind !== binding.kind)
+      ) {
+        throw new Error("Accepted MCP account route does not match canonical provider");
+      }
+      // Static headers can belong to the formerly selected account. Credentials
+      // for account-qualified routes come exclusively from the native resolver.
+      const { headers: _headers, ...config } = canonical;
+      const label = `${canonical.name ?? canonical.id} — ${binding.subjectScope === "subject" ? "Personal" : "Workspace"}: ${binding.accountLabel}`;
+      servers.push({
+        ...config,
+        id: binding.serverId,
+        name: label,
+        connectionRef: structuredClone(binding.connectionRef),
+      });
+      tools.push({ ...tool, id: binding.serverId });
+      accountLabels.set(binding.serverId, label);
+    }
+  }
+  return {
+    settings: {
+      ...input.settings,
+      mcpServers: [
+        ...input.settings.mcpServers.filter((server) => !server.connectionRef),
+        ...servers,
+      ],
+    },
+    tools,
+    accountLabels,
+  };
+}
+
+/** Each adapter closes over its own immutable credential ref and authority
+ * generation. Sharing a provider transport never shares a credential resolver. */
+export function expandApiIntegrationAccountRoutes(input: {
+  integrations: readonly ApiIntegrationRuntime[];
+  bindings: readonly McpConnectionAccountBinding[] | null | undefined;
+  tools: readonly ToolRef[];
+}): ApiIntegrationRuntime[] {
+  const selected = new Set(input.tools.map((tool) => tool.id));
+  if (input.bindings == null)
+    return input.integrations.filter((item) => selected.has(item.serverId));
+  const acceptedBindings = input.bindings;
+  return input.integrations.flatMap((integration) => {
+    const bindings = acceptedBindings.filter(
+      (binding) => binding.canonicalServerId === integration.serverId,
+    );
+    if (bindings.length === 0)
+      return !integration.connectionRef && selected.has(integration.serverId) ? [integration] : [];
+    return bindings
+      .filter((binding) => selected.has(binding.serverId))
+      .map((binding) => {
+        if (binding.connectionAuthorityGeneration === undefined) {
+          throw new Error("Accepted API integration account route has no authority generation");
+        }
+        return {
+          ...integration,
+          serverId: binding.serverId,
+          connectionRef: structuredClone(binding.connectionRef),
+          connectionAuthorityGeneration: binding.connectionAuthorityGeneration,
+        };
+      });
+  });
+}

package/src/activities/mcp-credentials.ts

@@ -1,47 +1,46 @@
 import type { Settings } from "@opengeni/config";
-import type { ConnectionCredentialsPort } from "@opengeni/contracts";
-import type { HostMcpAcceptedAuthority } from "@opengeni/contracts/host-mcp-bindings";
+import { stableJson } from "@opengeni/contracts";
 import {
   buildConnectionTokenResolver,
-  buildHostConnectionTokenResolver,
-  getSessionTurnForAttempt,
-  authorizeDirectHostMcpUse,
-  resolveAcceptedHostMcpBinding,
   resolveAcceptedConnectionUse,
-  sessionTenancyProductActivated,
   type Database,
   type ResolveConnectionCredentialInput,
   type ResolveConnectionCredentialResult,
   type SessionTurnForExecution,
 } from "@opengeni/db";
-import { recordTenancyCompatibilityLaneUse, type Observability } from "@opengeni/observability";
 import { mcpOperationAuthorityDigest } from "./mcp-operation-authority";
 
-const OPENGENI_CONNECTION_ID_PATTERN =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
-
-export function connectionTokenResolverForTurn(input: {
+type TurnConnectionInput = {
   db: Database;
   settings: Settings;
-  connectionCredentials?: ConnectionCredentialsPort | null;
   accountId: string;
   workspaceId: string;
   sessionId: string;
-  rootSessionId: string;
   attemptId: string;
   turn: SessionTurnForExecution;
+  /** Policy identities before account expansion; never used to select credentials. */
+  canonicalMcpServerIds?: readonly string[];
   authorizeAcceptedUse?: typeof resolveAcceptedConnectionUse;
-  /** Test seam; production always reads the canonical active-attempt projection. */
-  getHostTurnForAttempt?: typeof getSessionTurnForAttempt;
-  /** Test seam for the activation fence on pre-snapshot workspace refs. */
-  isSessionTenancyProductActivated?: typeof sessionTenancyProductActivated;
-  /** Optional; used only for content-free compatibility-lane counters. */
-  observability?: Observability | null | undefined;
-}): (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {
-  const hostResolver = input.connectionCredentials?.mcpCredentials;
-  const readHostTurn = input.getHostTurnForAttempt ?? getSessionTurnForAttempt;
-  const hostDb = input.db;
-  const nativeResolver = buildConnectionTokenResolver(input.db, input.settings);
+};
+
+type CredentialResolver = (
+  request: ResolveConnectionCredentialInput,
+) => Promise<ResolveConnectionCredentialResult>;
+
+export function connectionTokenResolverForTurn(input: TurnConnectionInput): CredentialResolver {
+  return bindNativeConnectionCredentialsToTurn(
+    input,
+    buildConnectionTokenResolver(input.db, input.settings),
+  );
+}
+
+/** Bind the ordinary credential resolver to one immutable accepted turn.
+ * Credential acquisition and refresh stay inside the native connection engine;
+ * this layer adds the exact execution context and physical-request checks. */
+export function bindNativeConnectionCredentialsToTurn(
+  input: TurnConnectionInput,
+  nativeResolver: CredentialResolver,
+): CredentialResolver {
   const recoveryEnabled = (serverId: string) =>
     input.settings.mcpServers.some(
       (server) =>
@@ -50,84 +49,14 @@ export function connectionTokenResolverForTurn(input: {
         server.operationRecovery !== undefined &&
         Object.keys(server.operationRecovery ?? {}).length > 0,
     );
-  const configuredResolver = hostResolver
-    ? async (
-        credentialRequest: ResolveConnectionCredentialInput,
-      ): Promise<ResolveConnectionCredentialResult> => {
-        let authorizedSnapshot: HostMcpAcceptedAuthority | undefined;
-        const wantsDigest = recoveryEnabled(credentialRequest.serverId);
-        const resolver = buildHostConnectionTokenResolver(hostResolver, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sessionId: input.sessionId,
-          rootSessionId: input.rootSessionId,
-          turnId: input.turn.id,
-          attemptId: input.attemptId,
-          executionGeneration: input.turn.executionGeneration,
-          initiator: input.turn.initiator,
-          initiatorContext: input.turn.initiatorContext,
-          surface: "model",
-          resolveAcceptedBinding: (request) => resolveAcceptedHostMcpBinding(hostDb, request),
-          // Only immutable captured direct-turn authority is currently supported.
-          // Direct, scheduled and exact causal/child snapshots are validated;
-          // no authority follows merely from a binding or creator identity.
-          authorizeDurableBinding: (request) =>
-            authorizeDirectHostMcpUse(
-              hostDb,
-              request,
-              wantsDigest
-                ? (snapshot) => {
-                    authorizedSnapshot = snapshot;
-                  }
-                : undefined,
-            ),
-          authorizeExecution: async (request) => {
-            // Native UUID references already pass the accepted-use boundary below.
-            // Legacy opaque host IDs retain their compatibility path, but not a
-            // right to execute after their accepted attempt has stopped.
-            if (
-              request.connectionRef.authoritySource !== "host" &&
-              (!request.connectionRef.connectionId ||
-                OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId))
-            )
-              return true;
-            if (!request.attemptId) return false;
-            const current = await readHostTurn(
-              hostDb,
-              request.workspaceId,
-              request.sessionId,
-              request.attemptId,
-            );
-            return (
-              current !== null &&
-              current.id === request.turnId &&
-              current.executionGeneration === request.executionGeneration
-            );
-          },
-        });
-        const result = await resolver(credentialRequest);
-        return result.status === "ok" && authorizedSnapshot
-          ? {
-              ...result,
-              operationAuthorityDigest: mcpOperationAuthorityDigest(credentialRequest, {
-                host: authorizedSnapshot,
-              }),
-            }
-          : result;
-      }
-    : nativeResolver;
-  const baseResolver = (request: ResolveConnectionCredentialInput) =>
-    input.connectionCredentials?.mcpAuthoritySource === "host" &&
-    request.connectionRef.authoritySource !== "host"
-      ? nativeResolver(request)
-      : configuredResolver(request);
+  const canonicalMcpServerIds = new Set(
+    input.canonicalMcpServerIds ??
+      input.settings.mcpServers.filter((server) => server.connectionRef).map((server) => server.id),
+  );
   return async (request) => {
-    // Host-owned refs carry explicit provenance because their opaque ids may
-    // themselves be valid UUIDs. They never enter OpenGeni's native connection
-    // authority or PostgreSQL UUID lookup; the bound host authorizes the exact
-    // immutable turn context on every credential request.
+    // Superseded host references must never fall through to native lookup,
+    // even when their opaque identifier happens to be a valid native UUID.
     if (request.connectionRef.authoritySource === "host") {
-      if (hostResolver) return await baseResolver(request);
       return {
         status: "auth_needed",
         reason: "unsupported_auth",
@@ -144,34 +73,31 @@ export function connectionTokenResolverForTurn(input: {
           : {}),
       };
     }
-    // Before explicit provenance existed, the public embedding contract let a
-    // bound host use any non-UUID opaque id. Preserve those frozen/stored refs
-    // during upgrades while keeping every UUID-shaped omission on OpenGeni's
-    // native accepted-use authority. New host refs must carry authoritySource
-    // so UUID-shaped host ids are unambiguous.
+    const accountBindings = input.turn.mcpAccountBindings ?? [];
+    const accountBinding = accountBindings.find((binding) => binding.serverId === request.serverId);
+    // Canonical policy identity cannot be invoked as a credential fallback once
+    // this turn selected explicit account routes for that connector.
     if (
-      hostResolver &&
-      input.connectionCredentials?.mcpAuthoritySource !== "host" &&
-      request.connectionRef.connectionId &&
-      !OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId)
+      (input.turn.mcpAccountBindings != null &&
+        !accountBinding &&
+        canonicalMcpServerIds.has(request.serverId)) ||
+      (!accountBinding &&
+        accountBindings.some((binding) => binding.canonicalServerId === request.serverId)) ||
+      (accountBinding &&
+        (request.connectionRef.connectionId !== accountBinding.connectionId ||
+          request.connectionRef.providerDomain !== accountBinding.providerDomain ||
+          request.connectionRef.kind !== accountBinding.kind ||
+          request.connectionRef.subjectScope !== accountBinding.subjectScope ||
+          stableJson(request.connectionRef) !== stableJson(accountBinding.connectionRef) ||
+          (accountBinding.subjectScope === "subject" &&
+            request.subjectId !== accountBinding.ownerSubjectId)))
     ) {
-      try {
-        return await baseResolver(request);
-      } catch {
-        return {
-          status: "auth_needed",
-          reason: "refresh_failed",
-          providerDomain: request.connectionRef.providerDomain,
-          authoritySource: "host",
-          ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
-          connectionId: request.connectionRef.connectionId,
-          ...(request.connectionRef.scopes ? { scopes: request.connectionRef.scopes } : {}),
-          ...(request.connectionRef.resource ? { resource: request.connectionRef.resource } : {}),
-          ...(request.connectionRef.selectedResources
-            ? { selectedResources: request.connectionRef.selectedResources }
-            : {}),
-        };
-      }
+      return {
+        status: "auth_needed",
+        reason: "personal_authority_unavailable",
+        providerDomain: request.connectionRef.providerDomain,
+        ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
+      };
     }
     const acceptedDelegation = input.turn.personalConnectionDelegations.find(
       (delegation) =>
@@ -191,9 +117,7 @@ export function connectionTokenResolverForTurn(input: {
     const subjectScope: "subject" | "workspace" =
       request.connectionRef.subjectScope === "subject" ? "subject" : "workspace";
     // Every subject-scoped request must match an exact connection frozen on the
-    // accepted turn. This also hard-fences pre-cutover common-user turns that
-    // lack a userDelegation: the DB resolver denies those rows because only a
-    // true legacy_user connection is eligible for bounded compatibility.
+    // accepted turn. The database then checks its immutable sender snapshot.
     if (
       subjectScope === "subject" &&
       (!acceptedDelegation || !request.connectionRef.connectionId)
@@ -205,31 +129,15 @@ export function connectionTokenResolverForTurn(input: {
         ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
       };
     }
-    // Workspace-scope requests now run through the same accepted-use authority
-    // (migration 0279): the exact workspace-owned connection is revalidated
-    // inside the canonical lifecycle fences and every use leaves an idempotent
-    // audit fact. A ref with no connection id is the bounded pre-snapshot
-    // legacy path - it cannot be authorized by exact identity, so it keeps the
-    // unprivileged resolution the old short-circuit used.
+    // Workspace connections also need an exact identity for accepted-use
+    // validation and attribution. Never rediscover a credential by domain here.
     if (subjectScope === "workspace" && !request.connectionRef.connectionId) {
-      if (
-        await (input.isSessionTenancyProductActivated ?? sessionTenancyProductActivated)(
-          input.db,
-          input.workspaceId,
-        )
-      ) {
-        return {
-          status: "auth_needed",
-          reason: "missing_connection",
-          providerDomain: request.connectionRef.providerDomain,
-          ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
-        };
-      }
-      // This lane writes no `connection_use_audit_facts` row, so this counter is
-      // the only evidence it was taken. Lane name only - never the server,
-      // provider domain, connection, or subject.
-      recordTenancyCompatibilityLaneUse(input.observability, "connection_pre_snapshot_ref");
-      return await baseResolver(request);
+      return {
+        status: "auth_needed",
+        reason: "missing_connection",
+        providerDomain: request.connectionRef.providerDomain,
+        ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
+      };
     }
     const credentialUseContext = {
       accountId: input.accountId,
@@ -299,50 +207,31 @@ export function connectionTokenResolverForTurn(input: {
         },
       };
     };
-    // One place records the `legacy_user` lane for both resolution paths: the
-    // scope comes back on the resolver result when the DB resolver authorized
-    // internally, and on the resolution itself when the host resolver did.
-    const recordAuthorizedScope = (scope: "workspace" | "user" | "legacy_user" | undefined) => {
-      if (scope === "legacy_user") {
-        recordTenancyCompatibilityLaneUse(input.observability, "connection_legacy_user");
-      }
-    };
-    if (!hostResolver) {
-      const result = await baseResolver({
-        ...request,
-        connectionUseContext: credentialUseContext,
-      });
-      if (result.status === "ok") recordAuthorizedScope(result.connectionUseAttribution?.scope);
-      return withProviderRequestAuthorization(result);
-    }
-    const authorization = await authorize(credentialUseContext);
-    if (authorization.status === "denied") {
+    const { subjectId: requestSubjectId, ...requestWithoutSubject } = request;
+    const result = await nativeResolver({
+      ...requestWithoutSubject,
+      ...(accountBinding?.connectionAuthorityGeneration !== undefined
+        ? { expectedAuthorityGeneration: accountBinding.connectionAuthorityGeneration }
+        : {}),
+      // Workspace authority has no personal owner, even when the turn has a
+      // causal human. Do not pass that human as credential ownership context.
+      ...(accountBinding?.subjectScope !== "workspace" && requestSubjectId !== undefined
+        ? { subjectId: requestSubjectId }
+        : {}),
+      connectionUseContext: credentialUseContext,
+    });
+    if (
+      accountBinding &&
+      result.status === "ok" &&
+      result.connectionId !== accountBinding.connectionId
+    ) {
       return {
         status: "auth_needed",
-        reason:
-          request.connectionRef.subjectScope === "subject"
-            ? "personal_authority_unavailable"
-            : "missing_connection",
-        providerDomain: request.connectionRef.providerDomain,
-        ...(request.connectionRef.provider ? { provider: request.connectionRef.provider } : {}),
+        reason: "personal_authority_unavailable",
+        providerDomain: accountBinding.providerDomain,
       };
     }
-    recordAuthorizedScope(authorization.attribution.scope);
-    const result = await baseResolver({
-      ...request,
-      connectionUseContext: credentialUseContext,
-      connectionUseAuthority: authorization.attribution,
-      connectionRef: {
-        ...request.connectionRef,
-        connectionId: authorization.attribution.connectionId,
-        kind: authorization.connectionKind,
-        subjectScope: authorization.attribution.scope === "workspace" ? "workspace" : "subject",
-      },
-      ...(authorization.attribution.ownerSubjectId
-        ? { subjectId: authorization.attribution.ownerSubjectId }
-        : {}),
-    });
-    return withProviderRequestAuthorization(result, authorization.attribution);
+    return withProviderRequestAuthorization(result);
   };
 }