@sixb/core 0.1.12 → 0.1.13

package/src/events/service.ts

@@ -12,13 +12,7 @@ import {
   resolveEventStorage,
 } from "./definitions"
 import { EventsError } from "./errors"
-import type {
-  DomainEvent,
-  EventActor,
-  EventDraft,
-  StoredAuthorableEvent,
-  StoredDomainEvent,
-} from "./types"
+import type { DomainEvent, EventDraft, StoredAuthorableEvent, StoredDomainEvent } from "./types"
 
 // Keep domain events as a short recent log. This is 2 days in milliseconds.
 export const DEFAULT_EVENTS_RETENTION_MS = 2 * 24 * 60 * 60 * 1000
@@ -37,7 +31,6 @@ export interface DomainEventServiceOptions {
 }
 
 export interface EventsAppendInput {
-  readonly actor?: EventActor
   readonly correlationId?: string
   readonly causationId?: string
   readonly events: readonly EventDraft[]
@@ -146,7 +139,6 @@ export class DomainEventService implements DomainEventLog, StableEventPublisher
     const payloads = input.events.map((event) =>
       toStoredEventPayload({
         projectId: this.projectId,
-        actor: input.actor,
         correlationId: input.correlationId,
         causationId: input.causationId,
         event,
@@ -306,7 +298,6 @@ type StoredEventPayload = Omit<StoredAuthorableEvent, "cursor">
 
 function toStoredEventPayload(params: {
   projectId: string
-  actor?: EventActor
   correlationId?: string
   causationId?: string
   event: EventDraft
@@ -326,7 +317,6 @@ function toStoredEventPayload(params: {
   setIfDefined(payload, "correlationId", params.correlationId)
   setIfDefined(payload, "causationId", params.causationId)
   setIfDefined(payload, "idempotencyKey", params.event.idempotencyKey)
-  setIfDefined(payload, "actor", params.actor)
   setIfDefined(payload, "origin", params.event.origin)
   setIfDefined(payload, "metadata", params.event.metadata)
 

package/src/events/toStoredEvent.ts

@@ -1,10 +1,9 @@
 import { randomUUID } from "node:crypto"
 import { resolveEventStorage } from "./definitions"
-import type { EventActor, EventDraft, StoredAuthorableEvent } from "./types/index"
+import type { EventDraft, StoredAuthorableEvent } from "./types/index"
 
 export function toStoredEvent(params: {
   projectId: string
-  actor?: EventActor
   correlationId?: string
   causationId?: string
   event: EventDraft
@@ -18,7 +17,6 @@ export function toStoredEvent(params: {
     correlationId: params.correlationId,
     causationId: params.causationId,
     idempotencyKey: params.event.idempotencyKey,
-    actor: params.actor,
     origin: params.event.origin,
     metadata: params.event.metadata,
     cursor: params.cursor,

package/src/events/types/index.ts

@@ -12,9 +12,9 @@ import type { SyncEvent } from "./syncs"
 import type { TelemetryEvent } from "./telemetry"
 import type { WorkflowEvent } from "./workflows"
 
+export type { EventExecutor } from "../../materialization/events"
 export type {
   ActionEventOrigin,
-  EventActor,
   EventEnvelope,
   EventOrigin,
   ProjectionEventOrigin,

package/src/execution/agent.ts

@@ -1,5 +1,4 @@
 import { type AgentExecutionAuthorization, agentServiceAccountId } from "../agents/authority"
-import type { OntologySource } from "../ontology"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
 import type { ExecutionRecord } from "../storage/executions"
 import { ExecutionStorageError } from "../storage/executions"
@@ -99,7 +98,7 @@ export function bindDurableAgentExecution(
     readonly runId: string
     readonly authorization: AgentExecutionAuthorization
   }
-): Sixb<readonly OntologySource[]> {
+): Sixb {
   const scope = restoreAgentExecutionScope(input)
   const sixb = host.withScope(scope)
   if (!isBoundSixb(sixb)) {

package/src/execution/authorized-object-reader.ts

@@ -1,3 +1,4 @@
+import { assertNever } from "../assert-never"
 import { assertAuthorized, isAllowed } from "../authorization"
 import { AuthorizationError } from "../authorization/errors"
 import type { AuthorizationContext } from "../authorization/types"
@@ -602,16 +603,13 @@ function objectStorageForAuthority(
         limits: authority.objectRead.limits,
       })
     default:
-      return assertNever(authority)
+      return assertNever(
+        authority,
+        `[Sixb] Unsupported object reader authority '${String((authority as { type?: unknown }).type)}'.`
+      )
   }
 }
 
-function assertNever(value: never): never {
-  throw new Error(
-    `[Sixb] Unsupported object reader authority '${String((value as { type?: unknown }).type)}'.`
-  )
-}
-
 function ontologySelectionForAuthority(
   authority: ResolvedExecutionAuthority,
   ontology: OntologyRegistry

package/src/execution/primitive.ts

@@ -1,5 +1,4 @@
 import { bindModelExecutionAttempt, type ModelExecutionAttempt } from "../models/execution/binding"
-import type { OntologySource } from "../ontology"
 import type { OntologyMutationRuntime } from "../runtime/ontology-mutations"
 import { getOntologyMutationRuntime } from "../runtime/ontology-mutations"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
@@ -14,7 +13,7 @@ export interface PrimitiveExecutionHost {
 }
 
 export interface BoundPrimitiveExecution {
-  readonly sixb: Sixb<readonly OntologySource[]>
+  readonly sixb: Sixb
   /** Internal mutation port guarded by the same runtime authority as `sixb`. */
   readonly ontologyMutations: OntologyMutationRuntime
 }

package/src/execution/request.ts

@@ -1,7 +1,6 @@
 import { randomUUID } from "node:crypto"
 import type { AuthorizationContext } from "../authorization"
 import { bindModelExecutionAttempt } from "../models/execution/binding"
-import type { OntologySource } from "../ontology"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
 import {
   objectReadScopeForAccessPlan,
@@ -97,7 +96,7 @@ export interface RequestExecutionHost {
 export function bindRequestExecution(
   host: RequestExecutionHost,
   input: BindRequestExecutionInput
-): Sixb<readonly OntologySource[]> {
+): Sixb {
   const requestId = requestIdentifier(input.request)
   const correlationId = correlationIdentifier(input.request, requestId)
   const scope = createRequestScope(host.id, requestId, correlationId, input.authorization)

package/src/index.ts

@@ -20,6 +20,7 @@ export type {
   ObjectLink,
   ObjectLinkTargetMetadata,
   ObjectLinkTargetType,
+  ObjectPropertiesMetadata,
   ObjectRef,
   ObjectRefSchema,
   ObjectSchema,
@@ -40,6 +41,8 @@ export type {
   Schema,
   SchemaOrRef,
   SixbObjectTypeMap,
+  SixbValueTypeMap,
+  UserRef,
   ValueType,
   ValueTypeRefSchema,
 } from "./ontology"
@@ -56,6 +59,7 @@ export {
   prop,
   ref,
   stringEnum,
+  userRef,
   valueTypeRef,
 } from "./ontology"
 
@@ -75,9 +79,6 @@ export type {
   ActionParamConfig,
   ActionParamsConfig,
   ActionReadFacade,
-  ActionReadObjectByIdHandle,
-  ActionReadObjectSet,
-  ActionReadObjectSetSource,
   ActionRunPhaseInfo,
   ActionRuntimeFacade,
   ActionSubject,
@@ -247,8 +248,8 @@ export type {
   DatasetVersionCommittedEvent,
   DomainEvent,
   DomainEventLog,
-  EventActor,
   EventDraft,
+  EventExecutor,
   EventOrigin,
   EventPropertySelector,
   EventScopeKeys,
@@ -412,7 +413,6 @@ export type {
   MembershipCapabilities,
   MembershipOperationCapabilities,
   Principal,
-  SecurityContext,
   SixbAuthConfig,
 } from "./auth"
 export {
@@ -951,6 +951,9 @@ export type {
   ObjectQueryFacetResult,
   ObjectQueryListOptions,
   ObjectQueryRow,
+  ObjectReadByIdHandle,
+  ObjectReader,
+  ObjectReadSet,
   ObjectSet,
   ObjectSetListInput,
   ObjectSetQueryPropertyToken,
@@ -958,8 +961,6 @@ export type {
   ObjectWhereClause,
   OntologyDocumentInput,
   OntologySource,
-  RegisteredObjectType,
-  RegisteredValueTypes,
   SchedulerController,
   Sixb,
   SixbDefinitions,

package/src/maintenance/ontology-maintenance.ts

@@ -1,5 +1,11 @@
+import { type BlobStorage, supportsDirectUpload } from "../blob-storage"
 import type { OntologyOutboxDispatcher } from "../events"
-import type { Storage } from "../storage"
+import {
+  type FileUploadSession,
+  FileUploadSessionError,
+  type FileUploadSessionStore,
+  type Storage,
+} from "../storage"
 import type {
   OntologyMaintenanceCleanupSnapshot,
   OntologyMaintenanceHandle,
@@ -14,11 +20,17 @@ const DEFAULT_CLEANUP_LIMIT = 1_000
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 30_000
 const DEGRADED_ATTEMPT_THRESHOLD = 3
 const DEGRADED_FAILURE_THRESHOLD = 2
+// A request that passed the expiry gate may still be finishing blob I/O, and the API clock may
+// run ahead of the database's; the sweep leaves sessions alone until this long past expiry.
+const ABANDONED_UPLOAD_SWEEP_DELAY_MS = 5 * 60_000
+const ABANDONED_UPLOAD_ABORT_GRACE_MS = 15 * 60_000
 
 interface OntologyMaintenanceDependencies {
   readonly projectId: string
   readonly storage: Storage
   readonly dispatcher: OntologyOutboxDispatcher
+  /** Aborts the provider side of abandoned staged uploads. */
+  readonly blobStorage?: BlobStorage
   readonly options?: OntologyMaintenanceOptions
   readonly now?: () => Date
   readonly onError?: (error: unknown) => void
@@ -29,6 +41,7 @@ export class OntologyMaintenance {
   private readonly projectId: string
   private readonly storage: Storage
   private readonly dispatcher: OntologyOutboxDispatcher
+  private readonly blobStorage: BlobStorage | undefined
   private readonly intervalMs: number
   private readonly publishedOutboxRetentionMs: number
   private readonly terminalSourceRetentionMs: number
@@ -48,6 +61,7 @@ export class OntologyMaintenance {
     this.projectId = dependencies.projectId
     this.storage = dependencies.storage
     this.dispatcher = dependencies.dispatcher
+    this.blobStorage = dependencies.blobStorage
     this.intervalMs = positiveInteger(options.intervalMs ?? DEFAULT_INTERVAL_MS, "intervalMs")
     this.publishedOutboxRetentionMs = nonnegativeInteger(
       options.publishedOutboxRetentionMs ?? DEFAULT_RETENTION_MS,
@@ -174,6 +188,12 @@ export class OntologyMaintenance {
       failures,
       { rowsDeleted: 0, materializationsDeleted: 0 }
     )
+    const uploads = this.storage.fileUploadSessions
+    if (uploads) {
+      // Retire abandoned uploads first: the store never reaps one that is still pending.
+      await captureFailure(() => this.retireAbandonedUploads(uploads, started, failures), failures)
+      await captureFailure(() => uploads.cleanupExpired(started), failures, 0)
+    }
 
     return {
       publishedOutboxRowsDeleted,
@@ -182,6 +202,62 @@ export class OntologyMaintenance {
     }
   }
 
+  private async retireAbandonedUploads(
+    uploads: FileUploadSessionStore,
+    now: Date,
+    failures: unknown[]
+  ): Promise<void> {
+    const abandoned = await uploads.listAbandoned({
+      projectId: this.projectId,
+      now: new Date(now.getTime() - ABANDONED_UPLOAD_SWEEP_DELAY_MS),
+      limit: this.cleanupLimit,
+    })
+    for (const session of abandoned) {
+      await captureFailure(() => this.retireAbandonedUpload(uploads, session, now), failures)
+    }
+  }
+
+  /**
+   * Releases one abandoned upload's provider-side parts, then makes its row terminal so
+   * `cleanupExpired` can reap it. Throwing records a pass failure and moves on to the next.
+   */
+  private async retireAbandonedUpload(
+    uploads: FileUploadSessionStore,
+    session: FileUploadSession,
+    now: Date
+  ): Promise<void> {
+    const blobStorage = this.blobStorage
+    const providerUpload = session.providerUpload
+    let abortFailure: unknown
+    if (providerUpload && blobStorage && supportsDirectUpload(blobStorage)) {
+      try {
+        await blobStorage.abortUpload({
+          uploadId: session.id,
+          stagingKey: providerUpload.stagingKey,
+          ...(providerUpload.providerUploadId === undefined
+            ? {}
+            : { providerUploadId: providerUpload.providerUploadId }),
+        })
+      } catch (error) {
+        // Retry on later passes for a bounded time. After that the bucket lifecycle rule owns
+        // the parts: a row that can never be aborted would hold a slot in every pass's limit.
+        if (now.getTime() - session.expiresAt.getTime() < ABANDONED_UPLOAD_ABORT_GRACE_MS)
+          throw error
+        abortFailure = error
+      }
+    }
+
+    try {
+      await uploads.abort(session.id)
+    } catch (error) {
+      // Another API instance's pass retired it first.
+      if (!(error instanceof FileUploadSessionError && error.reason === "already_aborted")) {
+        throw error
+      }
+    }
+    if (abortFailure !== undefined) throw abortFailure
+  }
+
   private async readOperationalSummaries(failures: unknown[]): Promise<{
     readonly outbox: OntologyMaintenanceSnapshot["outbox"]
     readonly terminalSources: OntologyMaintenanceSnapshot["terminalSources"]

package/src/materialization/errors.ts

@@ -7,6 +7,8 @@ export type MaterializationConflictKind =
   | "execution-lost"
   | "run-correlation"
   | "effective-state"
+  /** A state the commit was told to expect (an Action's reads) no longer matches. */
+  | "expectation"
   | "timeseries-point"
   | "outbox-lease"
 

package/src/materialization/events.ts

@@ -1,20 +1,45 @@
-import type { EventActor } from "../events/envelope"
 import type { LinkDeletedEventPayload, LinkMutationEventPayload } from "../events/types/links"
 import type { ObjectDeletedEventPayload, ObjectMutationEventPayload } from "../events/types/objects"
 import type { TelemetryAppendedEventPayload } from "../events/types/telemetry"
+import type {
+  AuthorizablePrincipal,
+  KernelOperation,
+  TrustedPrimitiveKind,
+} from "../execution/types"
 import type { JsonValue } from "../json"
 import type {
   OntologyMaterializationOrigin,
   OntologyMaterializationPropertyChangeMap,
 } from "./model"
 
+/**
+ * Workload that made an ontology change, copied from its execution.
+ *
+ * It names what ran; `requestedBy` names on whose behalf. A primitive carries its definition id so
+ * a consumer can tell which workflow, sync, or webhook wrote without reading the run. An Agent
+ * `runId` is its Agent run, or the step run of a Workflow Agent step.
+ */
+export type EventExecutor =
+  | { readonly type: "request"; readonly requestId: string }
+  | {
+      readonly type: "primitive"
+      readonly kind: TrustedPrimitiveKind
+      readonly id: string
+      readonly runId: string
+    }
+  | { readonly type: "agent"; readonly runId: string }
+  | { readonly type: "kernel"; readonly operation: KernelOperation }
+
 interface OntologyMaterializationEventBase {
   readonly id: string
   readonly schemaVersion: 1
   readonly projectId: string
   readonly occurredAt: string
   readonly correlationId: string
-  readonly actor?: EventActor
+  /** Principal on whose behalf the write ran; absent for automatic or anonymous work. */
+  readonly requestedBy?: AuthorizablePrincipal
+  /** Workload that made the write. */
+  readonly executor: EventExecutor
   readonly origin: OntologyMaterializationOrigin
   readonly commitId: string
   readonly commitOrdinal: number

package/src/materializer/README.md

@@ -51,6 +51,8 @@ Materializer      -> semantic planning and cross-store transaction orchestration
 
 Every ontology commit references its immutable execution through `executionId`. Storage providers enforce that reference. `origin` remains the semantic idempotency and run-correlation key: it says which runtime request, Action, projection replacement, or telemetry batch the commit represents; the execution says under which durable authority it ran. Neither field duplicates the other.
 
+A commit and each of its events also carry a copy of two execution facts, so consumers can answer "who changed this" without reading the execution: `requestedBy`, the principal on whose behalf the execution chain runs (absent for automatic, anonymous, or auth-disabled work), and `executor`, the request, primitive run, Agent run, or kernel operation that wrote. Both are derived from the bound scope in `execution/scope.ts`, which is already proven identical to the durable record, so they are a pure function of `executionId` and never caller input. Authority is deliberately not copied: it stays on the execution's `authorizationRef`. Header validation requires an Action or projection origin to name the exact primitive run in `executor`, and provider work requires every event to carry its commit's attribution.
+
 Run records do not duplicate ontology commit ids or semantic commit history. Replacement projections need no resume checkpoint; projection telemetry stores only its next batch/row checkpoint on the run.
 
 Logical origins are unique in the ontology ledger: one commit per Action run, one per replacement

package/src/materializer/edits/commit.ts

@@ -34,6 +34,7 @@ import { compileEditExecutionUnits, type EditExecutionUnit } from "./execution-u
 import { loadEditWorkingState } from "./load-state"
 import { applyEditOperation, type EditUndoJournal, undoEditJournal } from "./operations"
 import { stageEditPlan } from "./plan"
+import { loadReferencedUsers, type ReferencedUsers } from "./user-refs"
 import { authorizeVectorIndexingCommit } from "./vector-authority"
 import { commitVectorWrites } from "./vectors"
 import type { EditWorkingState } from "./working-state"
@@ -45,20 +46,22 @@ interface PreparedEditCommit {
   readonly identity: TimedCommitIdentity
   readonly origin: OntologyMaterializationOrigin
   readonly execution: MaterializerExecution
+  /** Read before the transaction opens; see `user-refs.ts`. */
+  readonly users: ReferencedUsers
 }
 
 export async function commitEdits(
   context: MaterializerContext,
   raw: MaterializerCommand<OntologyEditCommit>
 ): Promise<EditCommitResult> {
-  const command = prepareEditCommit(context, raw)
+  const command = await prepareEditCommit(context, raw)
   return executeEditCommit(context, command)
 }
 
-function prepareEditCommit(
-  context: Pick<MaterializerContext, "projectId" | "clock">,
+async function prepareEditCommit(
+  context: Pick<MaterializerContext, "projectId" | "clock" | "ontology" | "storage">,
   raw: MaterializerCommand<OntologyEditCommit>
-): PreparedEditCommit {
+): Promise<PreparedEditCommit> {
   const input = normalizeOntologyEditCommit(raw.input)
   const idempotencyKey = editIdempotencyKey(input)
   const identity = createTimedCommitIdentity({
@@ -72,6 +75,7 @@ function prepareEditCommit(
     identity,
     origin: input.source,
     execution: prepareMaterializerExecution(context.projectId, raw.scope),
+    users: await loadReferencedUsers(context, input.operations),
   }
 }
 
@@ -226,13 +230,14 @@ function buildEditCommit(
   context: Pick<MaterializerContext, "projectId" | "projectionRegistry">,
   command: PreparedEditCommit
 ): OntologyCommitWrite {
-  const commit: OntologyCommitWrite = {
+  return {
     projectId: context.projectId,
     id: command.identity.commitId,
     idempotencyKey: command.identity.idempotencyKey,
     requestHash: command.identity.requestHash,
     executionId: command.execution.executionId,
     origin: command.origin,
+    ...command.execution.attribution,
     ontologyRevision: context.projectionRegistry.ontologyRevision,
     intent: {
       kind: "edit",
@@ -244,8 +249,6 @@ function buildEditCommit(
     },
     committedAt: command.identity.committedAt,
   }
-  if (command.execution.actor === undefined) return commit
-  return { ...commit, actor: command.execution.actor }
 }
 
 function editExpectations(input: NormalizedEditCommit) {
@@ -291,7 +294,7 @@ function applyOneEditOperation(
   command: PreparedEditCommit
 ): OntologyOperationOutcome {
   try {
-    return applyEditOperation(context, state, operation, command.identity)
+    return applyEditOperation(context, state, operation, command.identity, command.users)
   } catch (error) {
     if (!isRecoverableEditValidation(command.input, error)) throw error
     return { id: operation.id, ok: false, error: { code: "validation", message: error.message } }
@@ -317,7 +320,14 @@ function applyEditOperationGroup(
   for (const operation of group) {
     let outcome: OntologyOperationOutcome
     try {
-      outcome = applyEditOperation(context, state, operation, command.identity, journal)
+      outcome = applyEditOperation(
+        context,
+        state,
+        operation,
+        command.identity,
+        command.users,
+        journal
+      )
     } catch (error) {
       if (!isRecoverableEditValidation(command.input, error)) throw error
       undoEditJournal(journal)
@@ -353,13 +363,12 @@ function isRecoverableEditValidation(
 }
 
 function editPlanContext(command: PreparedEditCommit) {
-  const context = {
+  return {
     identity: command.identity,
     origin: command.origin,
     correlationId: command.execution.correlationId,
+    attribution: command.execution.attribution,
   }
-  if (command.execution.actor === undefined) return context
-  return { ...context, actor: command.execution.actor }
 }
 
 async function finalizeEditMaterialization(

package/src/materializer/edits/operations.ts

@@ -4,6 +4,7 @@ import type { OntologyEditOperation, OntologyOperationOutcome } from "../../mate
 import { linkRefKey, linkScopeKey, objectRefKey } from "../../materialization/refs"
 import type { MaterializerContext } from "../context"
 import { diffEffectiveObject } from "../effective/diff"
+import type { ResolvedObjectValue } from "../effective/resolve"
 import {
   validateEffectiveObject,
   validateLinkAuthorityProperties,
@@ -15,6 +16,7 @@ import {
 import type { TimedCommitIdentity } from "../shared/identity"
 import { applyLinkEdit, applyObjectEdit } from "./apply"
 import { linkCardinality } from "./read-set"
+import { assertIntroducedUsersActive, type ReferencedUsers } from "./user-refs"
 import {
   type EditWorkingState,
   resolveLinkEdge,
@@ -53,11 +55,12 @@ export function applyEditOperation(
   state: EditWorkingState,
   operation: OntologyEditOperation,
   identity: TimedCommitIdentity,
+  users: ReferencedUsers,
   journal?: EditUndoJournal
 ): OntologyOperationOutcome {
   validateOperationRef(context, operation)
   if (isObjectOperation(operation)) {
-    return applyObjectOperation(context, state, operation, identity, journal)
+    return applyObjectOperation(context, state, operation, identity, users, journal)
   }
   return applyLinkOperation(
     context,
@@ -84,6 +87,7 @@ function applyObjectOperation(
   state: EditWorkingState,
   operation: ObjectOperation,
   identity: TimedCommitIdentity,
+  users: ReferencedUsers,
   journal?: EditUndoJournal
 ): OntologyOperationOutcome {
   const working = requireWorkingObject(state, operation)
@@ -99,7 +103,27 @@ function applyObjectOperation(
     ...normalized,
   })
 
-  applyObjectTransition(context, state, working, transition.next, transition.editedAt, journal)
+  // Restore brings back values the object already held; only caller-written values are new.
+  const assertUsers =
+    operation.kind === "object.restore"
+      ? undefined
+      : (resolved: ResolvedObjectValue) =>
+          assertIntroducedUsersActive(
+            context.ontology,
+            operation.ref.objectTypeId,
+            currentEffective?.properties,
+            resolved.properties,
+            users
+          )
+  applyObjectTransition(
+    context,
+    state,
+    working,
+    transition.next,
+    transition.editedAt,
+    journal,
+    assertUsers
+  )
 
   return objectOperationOutcome(operation, working, transition.changed, context, identity)
 }
@@ -149,7 +173,8 @@ function applyObjectTransition(
   working: WorkingObject,
   next: WorkingObject["override"],
   nextEditedAt: Readonly<Record<string, string>>,
-  journal?: EditUndoJournal
+  journal?: EditUndoJournal,
+  validateResolved?: (resolved: ResolvedObjectValue) => void
 ): void {
   const previous = working.override
   const previousEditedAt = working.editedAt
@@ -157,7 +182,10 @@ function applyObjectTransition(
   working.editedAt = { ...nextEditedAt }
   try {
     const resolved = resolveObject(context.ontology, working)
-    if (resolved) validateEffectiveObject(context.ontology, resolved.ref, resolved.properties)
+    if (resolved) {
+      validateEffectiveObject(context.ontology, resolved.ref, resolved.properties)
+      validateResolved?.(resolved)
+    }
     validateWorkingCardinality(state.links.slots)
   } catch (error) {
     working.override = previous

package/src/materializer/edits/plan.ts

@@ -1,4 +1,3 @@
-import type { EventActor } from "../../events/envelope"
 import type {
   EffectiveLinkChange,
   EffectiveObjectChange,
@@ -27,6 +26,7 @@ import {
 } from "../effective/build-events"
 import { diffEffectiveLink, diffEffectiveLinkSlot, diffEffectiveObject } from "../effective/diff"
 import { validateEffectiveObject } from "../effective/validate"
+import type { MaterializerAttribution } from "../execution/scope"
 import { stageWorkBounded } from "../execution/work-executor"
 import {
   appendEffectiveLinkWork,
@@ -59,7 +59,7 @@ interface EditPlanContext {
   readonly identity: TimedCommitIdentity
   readonly origin: OntologyMaterializationOrigin
   readonly correlationId: string
-  readonly actor?: EventActor
+  readonly attribution: MaterializerAttribution
 }
 
 export async function stageEditPlan(
@@ -237,15 +237,14 @@ function materializationEventContext(
   context: Pick<MaterializerContext, "projectId">,
   planContext: EditPlanContext
 ) {
-  const base = {
+  return {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
     origin: planContext.origin,
     correlationId: planContext.correlationId,
+    attribution: planContext.attribution,
   }
-  if (planContext.actor === undefined) return base
-  return { ...base, actor: planContext.actor }
 }
 
 function sortedObjects(objects: EditWorkingState["objects"]): WorkingObject[] {