@sixb/core 0.1.12 → 0.1.14

package/src/storage/file-upload-sessions/provider.ts

@@ -0,0 +1,258 @@
+import { type Principal, principalsEqual } from "../../auth"
+import type { FileRef, SignedBlobUploadPart } from "../../blob-storage"
+import { FileUploadSessionError } from "./errors"
+import type {
+  CreateFileUploadSessionInput,
+  FileUploadSession,
+  FileUploadSessionStore,
+  FileUploadStatus,
+  FileUploadStrategy,
+  ListAbandonedFileUploadSessionsInput,
+} from "./types"
+import {
+  createFileUploadId,
+  isFileUploadSessionExpired,
+  isTerminalFileUploadSessionExpired,
+} from "./utils"
+
+export { fileUploadSessionReapAt } from "./utils"
+
+/** Database-specific row access used by the shared upload session state machine. */
+export interface FileUploadSessionPersistence {
+  now(): Promise<Date>
+  /** Returns false when the id already exists. */
+  insert(session: FileUploadSession): Promise<boolean>
+  /** Inside `transaction`, must lock the row until the transaction ends. */
+  get(uploadId: string): Promise<FileUploadSession | null>
+  update(session: FileUploadSession): Promise<void>
+  /** The project's `pending` rows holding a provider upload, `expires_at <= now`, oldest first. */
+  listAbandoned(input: ListAbandonedFileUploadSessionsInput): Promise<readonly FileUploadSession[]>
+  /** Deletes rows whose persisted `fileUploadSessionReapAt` is `<= now`. */
+  deleteReapable(now: Date): Promise<number>
+}
+
+/** Transaction and lock boundary supplied by a concrete durable storage provider. */
+export interface FileUploadSessionPersistenceBackend {
+  read<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T>
+  transaction<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T>
+}
+
+/**
+ * Shared durable implementation of the upload session lifecycle. Concrete providers own SQL,
+ * transactions and database time; every transition and retention rule lives here so SQLite,
+ * PostgreSQL and the in-memory reference cannot drift semantically.
+ *
+ * Every method is `async`: a storage's operation-scoped facade serializes only async methods, and
+ * a plain Promise-returning method would bypass it and join whatever SQLite transaction is open.
+ */
+export class DurableFileUploadSessions implements FileUploadSessionStore {
+  constructor(private readonly backend: FileUploadSessionPersistenceBackend) {}
+
+  async create(input: CreateFileUploadSessionInput): Promise<FileUploadSession> {
+    return this.backend.transaction(async (persistence) => {
+      const session: FileUploadSession = {
+        id: input.id ?? createFileUploadId(),
+        projectId: input.projectId,
+        principal: input.principal,
+        strategy: input.strategy,
+        status: "pending",
+        ...(input.fileName === undefined ? {} : { fileName: input.fileName }),
+        ...(input.mediaType === undefined ? {} : { mediaType: input.mediaType }),
+        ...(input.logicalPath === undefined ? {} : { logicalPath: input.logicalPath }),
+        ...(input.expectedSizeBytes === undefined
+          ? {}
+          : { expectedSizeBytes: input.expectedSizeBytes }),
+        ...(input.expectedDigest === undefined ? {} : { expectedDigest: input.expectedDigest }),
+        ...(input.providerUpload === undefined ? {} : { providerUpload: input.providerUpload }),
+        signedParts: [],
+        createdAt: await persistence.now(),
+        expiresAt: input.expiresAt,
+      }
+
+      if (!(await persistence.insert(session))) {
+        throw new Error(`[Sixb] File upload session '${session.id}' already exists.`)
+      }
+      return session
+    })
+  }
+
+  async getForPrincipal(uploadId: string, principal: Principal): Promise<FileUploadSession> {
+    return this.backend.read(async (persistence) => {
+      const session = await persistence.get(uploadId)
+      if (!session || !principalsEqual(session.principal, principal)) {
+        throw new FileUploadSessionError("not_found", "File upload session not found.")
+      }
+
+      const nowMs = (await persistence.now()).getTime()
+      if (isFileUploadSessionExpired(session, nowMs)) {
+        throw new FileUploadSessionError("expired", "File upload session has expired.")
+      }
+      if (isTerminalFileUploadSessionExpired(session, nowMs)) {
+        throw new FileUploadSessionError("not_found", "File upload session not found.")
+      }
+      return session
+    })
+  }
+
+  async markUploaded(uploadId: string, fileRef: FileRef): Promise<FileUploadSession> {
+    return this.transition(uploadId, (session) => ({ ...session, fileRef }))
+  }
+
+  async addSignedPart(uploadId: string, part: SignedBlobUploadPart): Promise<FileUploadSession> {
+    return this.transition(uploadId, (session) => ({
+      ...session,
+      signedParts: [
+        ...session.signedParts.filter((candidate) => candidate.partNumber !== part.partNumber),
+        part,
+      ].sort((left, right) => left.partNumber - right.partNumber),
+    }))
+  }
+
+  async complete(uploadId: string, fileRef: FileRef): Promise<FileUploadSession> {
+    return this.transition(uploadId, (session, now) => ({
+      ...session,
+      status: "completed",
+      fileRef,
+      completedAt: now,
+    }))
+  }
+
+  async abort(uploadId: string): Promise<FileUploadSession> {
+    return this.transition(uploadId, (session, now) => ({
+      ...session,
+      status: "aborted",
+      abortedAt: now,
+    }))
+  }
+
+  async listAbandoned(
+    input: ListAbandonedFileUploadSessionsInput
+  ): Promise<readonly FileUploadSession[]> {
+    if (input.projectId.trim().length === 0) {
+      throw new Error("[Sixb] File upload session listAbandoned projectId must not be blank.")
+    }
+    if (!Number.isSafeInteger(input.limit) || input.limit <= 0) {
+      throw new Error("[Sixb] File upload session listAbandoned limit must be a positive integer.")
+    }
+    return this.backend.read((persistence) => persistence.listAbandoned(input))
+  }
+
+  async cleanupExpired(now?: Date): Promise<number> {
+    return this.backend.transaction(async (persistence) =>
+      persistence.deleteReapable(now ?? (await persistence.now()))
+    )
+  }
+
+  private transition(
+    uploadId: string,
+    next: (session: FileUploadSession, now: Date) => FileUploadSession
+  ): Promise<FileUploadSession> {
+    return this.backend.transaction(async (persistence) => {
+      const session = await persistence.get(uploadId)
+      if (!session) {
+        throw new FileUploadSessionError("not_found", "File upload session not found.")
+      }
+      if (session.status !== "pending") {
+        throw new FileUploadSessionError(
+          session.status === "completed" ? "already_completed" : "already_aborted",
+          `File upload session is already ${session.status}.`
+        )
+      }
+
+      const updated = next(session, await persistence.now())
+      await persistence.update(updated)
+      return updated
+    })
+  }
+}
+
+const STRATEGIES: readonly FileUploadStrategy[] = ["server", "direct-put", "multipart"]
+const STATUSES: readonly FileUploadStatus[] = ["pending", "completed", "aborted"]
+const PRINCIPAL_TYPES: readonly Principal["type"][] = ["user", "serviceAccount", "system"]
+
+/**
+ * Rebuilds a session from a provider row. JSON columns may arrive parsed (jsonb) or as text
+ * (SQLite); nested `expiresAt` values are revived and every other nested field passes through,
+ * so blob providers can extend `providerUpload` without a migration. Fails closed on corruption.
+ */
+export function parseFileUploadSessionRow(row: {
+  readonly [column: string]: unknown
+}): FileUploadSession {
+  const id = text(row.id, "id", String(row.id))
+  const strategy = text(row.strategy, "strategy", id) as FileUploadStrategy
+  const status = text(row.status, "status", id) as FileUploadStatus
+  if (!STRATEGIES.includes(strategy)) throw corrupt(id, `unknown strategy '${strategy}'`)
+  if (!STATUSES.includes(status)) throw corrupt(id, `unknown status '${status}'`)
+  const principalType = text(row.ownerPrincipalType, "ownerPrincipalType", id)
+  if (!PRINCIPAL_TYPES.includes(principalType as Principal["type"])) {
+    throw corrupt(id, `unknown owner principal type '${principalType}'`)
+  }
+
+  const providerUpload = json(row.providerUpload)
+  const fileRef = json(row.fileRef)
+  const signedParts = json(row.signedParts)
+  if (!Array.isArray(signedParts)) throw corrupt(id, "signedParts is not an array")
+
+  const optional = <T>(key: string, value: T | null | undefined) =>
+    value === null || value === undefined ? {} : { [key]: value }
+
+  return {
+    id,
+    projectId: text(row.projectId, "projectId", id),
+    principal: {
+      type: principalType as Principal["type"],
+      id: text(row.ownerPrincipalId, "ownerPrincipalId", id),
+    },
+    strategy,
+    status,
+    ...optional("fileName", row.fileName as string | null),
+    ...optional("mediaType", row.mediaType as string | null),
+    ...optional("logicalPath", row.logicalPath as string | null),
+    ...optional(
+      "expectedSizeBytes",
+      row.expectedSizeBytes === null || row.expectedSizeBytes === undefined
+        ? null
+        : Number(row.expectedSizeBytes)
+    ),
+    ...optional("expectedDigest", row.expectedDigest as string | null),
+    ...optional(
+      "providerUpload",
+      providerUpload === null ? null : withExpiresAt(providerUpload, id)
+    ),
+    signedParts: signedParts.map((part) => withExpiresAt(part, id)) as SignedBlobUploadPart[],
+    ...optional("fileRef", fileRef as FileRef | null),
+    createdAt: date(row.createdAt, "createdAt", id),
+    expiresAt: date(row.expiresAt, "expiresAt", id),
+    ...optional(
+      "completedAt",
+      row.completedAt == null ? null : date(row.completedAt, "completedAt", id)
+    ),
+    ...optional("abortedAt", row.abortedAt == null ? null : date(row.abortedAt, "abortedAt", id)),
+  } as FileUploadSession
+}
+
+function json(value: unknown): unknown {
+  return typeof value === "string" ? JSON.parse(value) : (value ?? null)
+}
+
+function withExpiresAt<T>(value: unknown, id: string): T {
+  if (typeof value !== "object" || value === null)
+    throw corrupt(id, "nested record is not an object")
+  const record = value as Record<string, unknown>
+  return { ...record, expiresAt: date(record.expiresAt, "nested expiresAt", id) } as T
+}
+
+function text(value: unknown, column: string, id: string): string {
+  if (typeof value !== "string" || value.length === 0) throw corrupt(id, `${column} is not text`)
+  return value
+}
+
+function date(value: unknown, column: string, id: string): Date {
+  const parsed = value instanceof Date || typeof value === "string" ? new Date(value) : null
+  if (!parsed || !Number.isFinite(parsed.getTime())) throw corrupt(id, `${column} is not a date`)
+  return parsed
+}
+
+function corrupt(id: string, reason: string): Error {
+  return new Error(`[Sixb] Stored file upload session '${id}' is invalid: ${reason}.`)
+}

package/src/storage/file-upload-sessions/types.ts

@@ -26,7 +26,7 @@ export interface CreateFileUploadSessionInput {
 export interface FileUploadSession {
   readonly id: string
   readonly projectId: string
-  readonly principalKey: string
+  readonly principal: Principal
   readonly strategy: FileUploadStrategy
   readonly status: FileUploadStatus
   readonly fileName?: string
@@ -43,19 +43,38 @@ export interface FileUploadSession {
   readonly abortedAt?: Date
 }
 
+export interface ListAbandonedFileUploadSessionsInput {
+  readonly projectId: string
+  readonly now: Date
+  readonly limit: number
+}
+
 /**
  * State machine for a staged/direct-put upload session. A session is created
  * `pending`; `markUploaded` records the resolved {@link FileRef} but keeps the
  * session `pending` (non-terminal), while `complete` and `abort` move it to a
  * terminal `completed`/`aborted` state. Terminal sessions are retained briefly
  * (for idempotent retries) then reaped by `cleanupExpired`.
+ *
+ * An expired `pending` session that still holds a `providerUpload` is abandoned:
+ * the provider may be billing for parts only `abortUpload` can release. The store
+ * never deletes one. A sweep lists them with `listAbandoned`, aborts the provider
+ * upload, then calls `abort` so the row becomes terminal and is reaped normally.
  */
 export interface FileUploadSessionStore {
   create(input: CreateFileUploadSessionInput): Promise<FileUploadSession>
+  /**
+   * The expiry gate: throws `expired` or `not_found`, and never deletes. Callers check expiry
+   * here when a request starts; the transitions below do not re-check it, because a request
+   * that passed the gate may finish slow blob I/O after `expiresAt`.
+   */
   getForPrincipal(uploadId: string, principal: Principal): Promise<FileUploadSession>
   markUploaded(uploadId: string, fileRef: FileRef): Promise<FileUploadSession>
   addSignedPart(uploadId: string, part: SignedBlobUploadPart): Promise<FileUploadSession>
   complete(uploadId: string, fileRef: FileRef): Promise<FileUploadSession>
   abort(uploadId: string): Promise<FileUploadSession>
+  /** One project's abandoned sessions expired at or before `now`, oldest expiry first. */
+  listAbandoned(input: ListAbandonedFileUploadSessionsInput): Promise<readonly FileUploadSession[]>
+  /** Deletes reapable sessions and returns the count. Never deletes an abandoned session. */
   cleanupExpired(now?: Date): Promise<number>
 }

package/src/storage/file-upload-sessions/utils.ts

@@ -1,5 +1,4 @@
 import { randomUUID } from "node:crypto"
-import type { Principal } from "../../auth"
 import type { FileUploadSession } from "./types"
 
 export const DEFAULT_FILE_UPLOAD_SESSION_TTL_MS = 60 * 60 * 1000
@@ -13,10 +12,6 @@ export function createFileUploadId(): string {
   return `upload_${randomUUID().replaceAll("-", "")}`
 }
 
-export function principalKey(principal: Principal): string {
-  return `${principal.type}:${principal.id}`
-}
-
 export function isFileUploadSessionExpired(
   session: FileUploadSession,
   nowMs = Date.now()
@@ -24,12 +19,33 @@ export function isFileUploadSessionExpired(
   return session.status === "pending" && session.expiresAt.getTime() <= nowMs
 }
 
-export function shouldDeleteFileUploadSession(session: FileUploadSession, nowMs: number): boolean {
-  if (isFileUploadSessionExpired(session, nowMs)) {
-    return true
+/** Expired, still `pending`, and holding a provider upload only `abortUpload` can release. */
+export function isAbandonedFileUploadSession(
+  session: FileUploadSession,
+  nowMs = Date.now()
+): boolean {
+  return session.providerUpload !== undefined && isFileUploadSessionExpired(session, nowMs)
+}
+
+/**
+ * When a session may be deleted, or null when only a state change can make it deletable.
+ * This is the single retention rule: durable providers persist it as `reap_at` and delete
+ * `reap_at <= now`, so SQL never restates it.
+ */
+export function fileUploadSessionReapAt(session: FileUploadSession): Date | null {
+  if (session.status === "pending") {
+    return session.providerUpload === undefined ? session.expiresAt : null
   }
 
-  return isTerminalFileUploadSessionExpired(session, nowMs)
+  const terminalAt = session.completedAt ?? session.abortedAt
+  return terminalAt
+    ? new Date(terminalAt.getTime() + DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS)
+    : null
+}
+
+export function shouldDeleteFileUploadSession(session: FileUploadSession, nowMs: number): boolean {
+  const reapAt = fileUploadSessionReapAt(session)
+  return reapAt !== null && reapAt.getTime() <= nowMs
 }
 
 export function isTerminalFileUploadSessionExpired(

package/src/storage/index.ts

@@ -199,7 +199,6 @@ export type {
 export { AiUsageStorageError, aggregateAiModelCallUsage, InMemoryAiUsageStorage } from "./ai-usage"
 export type {
   AccessTokenRecord,
-  AccessTokenSubjectType,
   AuthAccessTokenStore,
   AuthDeviceAuthorizationStore,
   AuthGroupMembershipStore,
@@ -213,6 +212,7 @@ export type {
   AuthStorageErrorCode,
   AuthUserIdentityStore,
   AuthUserStore,
+  BearerSessionState,
   CompleteAuthSessionInput,
   CompleteDeviceAuthorizationInput,
   CompleteDeviceAuthorizationResult,
@@ -244,6 +244,7 @@ export type {
   MagicLinkRecord,
   OidcAuthorizationAttemptRecord,
   ReconcileAuthServiceAccountGroupMembershipsInput,
+  RotateSessionRefreshTokenResult,
   ServiceAccountGroupMembershipRecord,
   ServiceAccountRecord,
   ServiceAccountStatus,
@@ -357,6 +358,7 @@ export type {
   FileUploadSessionStore,
   FileUploadStatus,
   FileUploadStrategy,
+  ListAbandonedFileUploadSessionsInput,
 } from "./file-upload-sessions"
 export {
   DEFAULT_FILE_UPLOAD_SESSION_TTL_MS,
@@ -710,7 +712,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,

package/src/storage/objects/in-memory/query.ts

@@ -2,6 +2,7 @@ import type {
   ObjectQuery,
   ObjectQueryPredicate,
   ObjectQuerySortField,
+  QueryScalarKind,
 } from "../../../objects/query"
 import {
   compareQueryScalarValues,
@@ -82,6 +83,7 @@ export const IN_MEMORY_OBJECT_QUERY_CAPABILITIES: ObjectQueryCapabilities = {
     decimal: { equality: true, ordering: true },
     date: { equality: true, ordering: true },
     timestamp: { equality: true, ordering: true },
+    userRef: { equality: true },
   },
   limits: {
     totalCount: true,
@@ -423,17 +425,25 @@ function matchesPredicate(row: ObjectRow, predicate: ObjectQueryPredicate): bool
       return predicate.value ? exists : !exists
     }
     case "contains":
-      return containsValue(row.properties[predicate.propertyId], predicate.value)
+      return containsValue(
+        row.properties[predicate.propertyId],
+        predicate.value,
+        predicate.scalarKind
+      )
   }
 }
 
-function containsValue(actual: unknown, expected: unknown): boolean {
+function containsValue(
+  actual: unknown,
+  expected: unknown,
+  itemScalarKind: QueryScalarKind | undefined
+): boolean {
   if (typeof actual === "string" && typeof expected === "string") {
     return actual.includes(expected)
   }
 
   if (Array.isArray(actual)) {
-    return actual.some((item) => queryScalarValuesEqual(item, expected))
+    return actual.some((item) => queryScalarValuesEqual(item, expected, itemScalarKind))
   }
 
   if (isPlainObject(actual) && typeof expected === "string") {

package/src/storage/ontology/commits.ts

@@ -1,4 +1,5 @@
-import type { EventActor } from "../../events/envelope"
+import type { AuthorizablePrincipal } from "../../execution/types"
+import type { EventExecutor } from "../../materialization/events"
 import type {
   EditCommitResult,
   OntologyMaterializationOrigin,
@@ -57,7 +58,10 @@ interface OntologyCommitFields {
   readonly requestHash: string
   readonly executionId: string
   readonly origin: OntologyMaterializationOrigin
-  readonly actor?: EventActor
+  /** Principal on whose behalf the execution ran, copied from `ExecutionRecord.requestedBy`. */
+  readonly requestedBy?: AuthorizablePrincipal
+  /** Workload that wrote the commit, copied from its execution. */
+  readonly executor: EventExecutor
   readonly ontologyRevision: string
   readonly projectionRevision?: string
   readonly ownershipHash?: string

package/src/storage/ontology/in-memory/materializations.ts

@@ -64,6 +64,9 @@ import type {
 import type { OntologyMaterializationEvent } from "../outbox"
 import {
   appendScopeSnapshot,
+  assertExpectedLinkRevision,
+  assertExpectedLinkScopeRevision,
+  assertExpectedObjectRevision,
   assertMaterializationHeader,
   finishScopeAccumulator,
   type ProviderMaterializationTransactionLifecycle,
@@ -217,12 +220,7 @@ export class InMemoryOntologyMaterializationStorage implements OntologyMateriali
         expectedScopeRevisions.get(key) ??
         this.computeEffectiveLinkScope(input.commit.projectId, expected.source, expected.linkId)
       expectedScopeRevisions.set(key, current)
-      if (current.fingerprint !== expected.fingerprint) {
-        throw new MaterializationConflictError(
-          "effective-state",
-          `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`
-        )
-      }
+      assertExpectedLinkScopeRevision(current.fingerprint, expected)
     }
     for (const expected of input.expected.points) this.assertPoint(expected, input.commit.projectId)
 
@@ -1039,20 +1037,7 @@ export class InMemoryOntologyMaterializationStorage implements OntologyMateriali
       expected.ref.objectTypeId,
       expected.ref.primaryId
     )
-    if (!expected.exists) {
-      if (row)
-        throw new MaterializationConflictError(
-          "effective-state",
-          `Expected object ${objectRefKey(expected.ref)} to be absent.`
-        )
-      return
-    }
-    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError(
-        "effective-state",
-        `Expected object ${objectRefKey(expected.ref)} changed.`
-      )
-    }
+    assertExpectedObjectRevision(row ?? null, expected)
   }
 
   private async assertLink(expected: ExpectedLinkRevision, projectId: string): Promise<void> {
@@ -1067,20 +1052,7 @@ export class InMemoryOntologyMaterializationStorage implements OntologyMateriali
       targetTypeId: expected.ref.target.objectTypeId,
       targetId: expected.ref.target.primaryId,
     })
-    if (!expected.exists) {
-      if (row)
-        throw new MaterializationConflictError(
-          "effective-state",
-          `Expected link ${linkRefKey(expected.ref)} to be absent.`
-        )
-      return
-    }
-    if (!row || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError(
-        "effective-state",
-        `Expected link ${linkRefKey(expected.ref)} changed.`
-      )
-    }
+    assertExpectedLinkRevision(row?.lastCommitId, expected)
   }
 
   private assertPoint(expected: ExpectedTimeseriesPointRevision, projectId: string): void {

package/src/storage/ontology/provider-header-validation.ts

@@ -38,6 +38,55 @@ function assertCommitEnvelope(commit: OntologyCommitWrite): void {
   assertNonblank(commit.executionId, "Materialization execution id")
   assertNonblank(commit.ontologyRevision, "Materialization ontology revision")
   assertTimestamp(commit.committedAt, "Materialization commit time")
+  assertCommitAttribution(commit)
+}
+
+/** Shape only: the Materializer copies both values from the execution it has already verified. */
+function assertCommitAttribution(commit: OntologyCommitWrite): void {
+  const { requestedBy, executor } = commit
+  if (requestedBy !== undefined) {
+    if (requestedBy.type !== "user" && requestedBy.type !== "serviceAccount") {
+      invalidCorrelation("Materialization requester must be a user or service account.")
+    }
+    assertNonblank(requestedBy.id, "Materialization requester id")
+  }
+
+  switch (executor?.type) {
+    case "request":
+      assertNonblank(executor.requestId, "Materialization executor request id")
+      return
+    case "primitive":
+      assertNonblank(executor.kind, "Materialization executor primitive kind")
+      assertNonblank(executor.id, "Materialization executor primitive id")
+      assertNonblank(executor.runId, "Materialization executor run id")
+      return
+    case "agent":
+      assertNonblank(executor.runId, "Materialization executor Agent run id")
+      return
+    case "kernel":
+      assertNonblank(executor.operation?.type, "Materialization executor kernel operation")
+      return
+    default:
+      invalidCorrelation("Materialization executor is invalid.")
+  }
+}
+
+/** A governed or projected write is attributed to exactly the primitive run that owns it. */
+function assertPrimitiveExecutor(
+  commit: OntologyCommitWrite,
+  kind: "action" | "projection",
+  id: string,
+  runId: string
+): void {
+  const { executor } = commit
+  if (
+    executor.type !== "primitive" ||
+    executor.kind !== kind ||
+    executor.id !== id ||
+    executor.runId !== runId
+  ) {
+    invalidCorrelation(`Commit ${kind} origin does not match its executor.`)
+  }
 }
 
 function assertEditCommit(commit: OntologyCommitWrite, intent: EditOntologyCommitIntent): void {
@@ -47,6 +96,7 @@ function assertEditCommit(commit: OntologyCommitWrite, intent: EditOntologyCommi
     case "action":
       assertNonblank(commit.origin.actionId, "Action origin action id")
       assertNonblank(commit.origin.runId, "Action origin run id")
+      assertPrimitiveExecutor(commit, "action", commit.origin.actionId, commit.origin.runId)
       return
     case "runtime":
       assertNonblank(commit.origin.requestId, "Runtime origin request id")
@@ -77,6 +127,12 @@ function assertProjectionCommit(
   ) {
     invalidCorrelation("Projection commit origin does not match its dataset version.")
   }
+  assertPrimitiveExecutor(
+    commit,
+    "projection",
+    commit.origin.projectionId,
+    commit.origin.projectionRunId
+  )
 }
 
 function assertTelemetryCommit(
@@ -142,6 +198,7 @@ function assertProjectionTelemetryCommit(
   if (origin.batchOrdinal !== source.batchOrdinal) {
     invalidCorrelation("Projection telemetry origin does not match its batch ordinal.")
   }
+  assertPrimitiveExecutor(commit, "projection", origin.projectionId, origin.projectionRunId)
 }
 
 function assertProjectionTelemetryBatch(

package/src/storage/ontology/provider-work.ts

@@ -9,6 +9,7 @@ import {
   objectRefKey,
   telemetryPointKey,
 } from "../../materialization/refs"
+import type { OntologyCommitWrite } from "./commits"
 import {
   type ExactTimeseriesPointWrite,
   type MaterializationCardinalityOccupantWorkRecord,
@@ -107,8 +108,7 @@ export function assertWorkRecord(
       record.draft.commitId !== header.commit.id ||
       record.draft.occurredAt !== header.commit.committedAt ||
       stableJsonStringify(record.draft.origin) !== stableJsonStringify(header.commit.origin) ||
-      stableJsonStringify(record.draft.actor ?? null) !==
-        stableJsonStringify(header.commit.actor ?? null)
+      !sameAttribution(record.draft, header.commit)
     ) {
       throw new MaterializationValidationError("Materialization event work is invalid.")
     }
@@ -312,7 +312,7 @@ function assertOutboxCorrelation(
     value.availableAt !== commit.committedAt ||
     value.createdAt !== commit.committedAt ||
     stableJsonStringify(envelope.origin) !== stableJsonStringify(commit.origin) ||
-    stableJsonStringify(envelope.actor ?? null) !== stableJsonStringify(commit.actor ?? null) ||
+    !sameAttribution(envelope, commit) ||
     !Number.isSafeInteger(envelope.commitOrdinal) ||
     envelope.commitOrdinal < 0 ||
     envelope.id !== createEventId(commit.projectId, commit.id, envelope.commitOrdinal)
@@ -347,3 +347,15 @@ function assertLinkRefEqual(left: OntologyLinkRef, right: OntologyLinkRef, label
     invalidCorrelation(`${label} row and expected references differ.`)
   }
 }
+
+/** Events carry exactly the attribution of the commit that produced them. */
+function sameAttribution(
+  event: Pick<OntologyCommitWrite, "requestedBy" | "executor">,
+  commit: Pick<OntologyCommitWrite, "requestedBy" | "executor">
+): boolean {
+  return (
+    stableJsonStringify(event.requestedBy ?? null) ===
+      stableJsonStringify(commit.requestedBy ?? null) &&
+    stableJsonStringify(event.executor) === stableJsonStringify(commit.executor)
+  )
+}