@stigmer/protos 3.10.0 → 3.11.0

package/ai/stigmer/activity/v1/io_pb.d.ts

@@ -70,14 +70,18 @@ export type ListRecentActivityRequest = Message<"ai.stigmer.activity.v1.ListRece
     /**
      * Organization slug to scope the query.
      *
-     * When provided, the handler attempts an org-scoped fast path: if the
-     * caller is a member of this organization, it queries MongoDB directly
-     * with `metadata.org = org` instead of enumerating per-resource FGA
-     * tuples. This turns an O(n) FGA reverse-index scan into a single
-     * membership check + indexed MongoDB query.
+     * When provided, results are narrowed to resources in this organization.
+     * The org NEVER widens visibility: per-resource read authority is always
+     * enforced (on the hosted edition, FGA `can_view` enumeration per kind),
+     * and the org filter only intersects that authorized set. Both recents
+     * kinds are private by default — sessions are personal resources and
+     * workflow executions opt in to org observability per instance — so org
+     * membership alone must never substitute for the per-resource check. An
+     * earlier "org member = query by org directly" fast path leaked session
+     * titles to every org member (stigmer-cloud#258).
      *
-     * When empty, falls back to per-resource FGA enumeration (slower but
-     * works regardless of org context).
+     * When empty, results span every organization the caller has resource
+     * access in.
      *
      * @generated from field: string org = 2;
      */

package/ai/stigmer/activity/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uGAAuG;AACvG,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAY,aAAa,CAClE,QAAQ,CAAC,odAAod,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAoDngB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAgCjD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAiBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uGAAuG;AACvG,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAY,aAAa,CAClE,QAAQ,CAAC,odAAod,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAoDngB;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAoCjD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;AAiBjD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/activity/v1/query_connect.d.ts

@@ -21,11 +21,16 @@ export declare const ActivityQueryController: {
          * List recent activity across sessions and workflow executions.
          *
          * Returns a merged, time-sorted list of the caller's most recent
-         * sessions and workflow executions. Authorization filtering is applied
-         * server-side via FGA (cloud) or returned unfiltered (OSS).
+         * sessions and workflow executions. On the hosted edition, per-resource
+         * authorization filtering is applied server-side (FGA `can_view`
+         * enumeration for both kinds — the same permission the per-kind `get`
+         * RPCs enforce, so every listed entry is openable by construction). The
+         * OSS server does not currently implement this RPC (stigmer#461).
          *
          * @internal
-         * Authorization is handled in-handler via FGA-filtered queries.
+         * Authorization is handled in-handler: the FGA id enumeration is the only
+         * gate (hence is_skip_authorization); the request's org merely narrows
+         * the authorized set.
          *
          * @generated from rpc ai.stigmer.activity.v1.ActivityQueryController.listRecentActivity
          */

package/ai/stigmer/activity/v1/query_connect.js

@@ -27,11 +27,16 @@ export const ActivityQueryController = {
          * List recent activity across sessions and workflow executions.
          *
          * Returns a merged, time-sorted list of the caller's most recent
-         * sessions and workflow executions. Authorization filtering is applied
-         * server-side via FGA (cloud) or returned unfiltered (OSS).
+         * sessions and workflow executions. On the hosted edition, per-resource
+         * authorization filtering is applied server-side (FGA `can_view`
+         * enumeration for both kinds — the same permission the per-kind `get`
+         * RPCs enforce, so every listed entry is openable by construction). The
+         * OSS server does not currently implement this RPC (stigmer#461).
          *
          * @internal
-         * Authorization is handled in-handler via FGA-filtered queries.
+         * Authorization is handled in-handler: the FGA id enumeration is the only
+         * gate (hence is_skip_authorization); the request's org merely narrows
+         * the authorized set.
          *
          * @generated from rpc ai.stigmer.activity.v1.ActivityQueryController.listRecentActivity
          */

package/ai/stigmer/activity/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,0GAA0G;AAC1G,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;;;;;;;;WAWG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,0GAA0G;AAC1G,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,gDAAgD;IAC1D,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;WAgBG;QACH,kBAAkB,EAAE;YAClB,IAAI,EAAE,oBAAoB;YAC1B,CAAC,EAAE,yBAAyB;YAC5B,CAAC,EAAE,0BAA0B;YAC7B,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/activity/v1/query_pb.d.ts

@@ -25,11 +25,16 @@ export declare const ActivityQueryController: GenService<{
      * List recent activity across sessions and workflow executions.
      *
      * Returns a merged, time-sorted list of the caller's most recent
-     * sessions and workflow executions. Authorization filtering is applied
-     * server-side via FGA (cloud) or returned unfiltered (OSS).
+     * sessions and workflow executions. On the hosted edition, per-resource
+     * authorization filtering is applied server-side (FGA `can_view`
+     * enumeration for both kinds — the same permission the per-kind `get`
+     * RPCs enforce, so every listed entry is openable by construction). The
+     * OSS server does not currently implement this RPC (stigmer#461).
      *
      * @internal
-     * Authorization is handled in-handler via FGA-filtered queries.
+     * Authorization is handled in-handler: the FGA id enumeration is the only
+     * gate (hence is_skip_authorization); the request's org merely narrows
+     * the authorized set.
      *
      * @generated from rpc ai.stigmer.activity.v1.ActivityQueryController.listRecentActivity
      */

package/ai/stigmer/activity/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0GAA0G;AAC1G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAY,aAAa,CACrE,QAAQ,CAAC,kTAAkT,EAAE,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE7Y;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAkB/B,aAAa,CAChB,WAAW,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/activity/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0GAA0G;AAC1G,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAY,aAAa,CACrE,QAAQ,CAAC,kTAAkT,EAAE,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE7Y;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAuB/B,aAAa,CAChB,WAAW,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agent/v1/io_pb.d.ts

@@ -26,6 +26,9 @@ export declare const AgentIdSchema: GenMessage<AgentId>;
  * @internal
  * The handler resolves the default agent globally (by label stigmer.ai/default-agent: "true"
  * with visibility_public), but the org is needed for authorization scoping.
+ * Resolution is deliberately NOT scoped to this org: the default agent is a
+ * platform-level singleton seeded in the system org and served to callers of
+ * every org (see the getDefault rpc docs for the determinism contract).
  *
  * @generated from message ai.stigmer.agentic.agent.v1.GetDefaultAgentRequest
  */

package/ai/stigmer/agentic/agent/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,oNAAoN,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAc/P;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,aAAa,CAC7D,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAoBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,iHAAiH;AACjH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAY,aAAa,CACvE,QAAQ,CAAC,oNAAoN,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAc/P;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,aAAa,CAC7D,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;AAuBtD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agent/v1/query_connect.d.ts

@@ -46,6 +46,13 @@ export declare const AgentQueryController: {
          * Resolves the agent labeled stigmer.ai/default-agent: "true" with
          * visibility_public. Custom authorization in handler.
          *
+         * Resolution is deterministic (stigmer/stigmer#356): only public labeled
+         * agents are candidates, and with multiple candidates — a reachable state,
+         * since safe label rotation applies the new default before retiring the
+         * old — the one with the lowest metadata.id (the incumbent) wins. The
+         * default changes only when the incumbent's label is explicitly removed,
+         * never as a side effect of another agent gaining the label.
+         *
          * @generated from rpc ai.stigmer.agentic.agent.v1.AgentQueryController.getDefault
          */
         readonly getDefault: {

package/ai/stigmer/agentic/agent/v1/query_connect.js

@@ -54,6 +54,13 @@ export const AgentQueryController = {
          * Resolves the agent labeled stigmer.ai/default-agent: "true" with
          * visibility_public. Custom authorization in handler.
          *
+         * Resolution is deterministic (stigmer/stigmer#356): only public labeled
+         * agents are candidates, and with multiple candidates — a reachable state,
+         * since safe label rotation applies the new default before retiring the
+         * old — the one with the lowest metadata.id (the incumbent) wins. The
+         * default changes only when the incumbent's label is explicitly removed,
+         * never as a side effect of another agent gaining the label.
+         *
          * @generated from rpc ai.stigmer.agentic.agent.v1.AgentQueryController.getDefault
          */
         getDefault: {

package/ai/stigmer/agentic/agent/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,kDAAkD;IAC5D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;WAcG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oHAAoH;AACpH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE,kDAAkD;IAC5D,OAAO,EAAE;QACP;;;;WAIG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,OAAO;YACV,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;WASG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,YAAY;YAClB,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/agent/v1/query_pb.d.ts

@@ -50,6 +50,13 @@ export declare const AgentQueryController: GenService<{
      * Resolves the agent labeled stigmer.ai/default-agent: "true" with
      * visibility_public. Custom authorization in handler.
      *
+     * Resolution is deterministic (stigmer/stigmer#356): only public labeled
+     * agents are candidates, and with multiple candidates — a reachable state,
+     * since safe label rotation applies the new default before retiring the
+     * old — the one with the lowest metadata.id (the incumbent) wins. The
+     * default changes only when the incumbent's label is explicitly removed,
+     * never as a side effect of another agent gaining the label.
+     *
      * @generated from rpc ai.stigmer.agentic.agent.v1.AgentQueryController.getDefault
      */
     getDefault: {

package/ai/stigmer/agentic/agent/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,omBAAomB,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE30B;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GA8C5B,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oHAAoH;AACpH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAY,aAAa,CAC1E,QAAQ,CAAC,omBAAomB,EAAE,CAAC,oCAAoC,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAE30B;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAqD5B,aAAa,CAChB,WAAW,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/agent/v1/spec_pb.d.ts

@@ -165,7 +165,16 @@ export type McpServerUsage = Message<"ai.stigmer.agentic.agent.v1.McpServerUsage
      * Only names from discovered_capabilities.tools are valid here.
      * Do NOT include names from discovered_capabilities.resource_templates —
      * resource templates are read-only data endpoints, not callable tools.
-     * Including a resource template name here causes a fatal runtime error.
+     * A name the server does not expose (including a resource template name)
+     * is warned and ignored at execution: the runner enforces the INTERSECTION
+     * with the server's live toolset, so a stale or mistyped entry narrows the
+     * toolset but never widens it or fails the run.
+     *
+     * Enforcement: the native (deep-agent) harness filters the discovered
+     * toolset before it reaches the model; the Cursor harness cannot hide a
+     * server's tools (its SDK config has no allow-list field), so its HITL
+     * hook permanently denies calls to non-enabled tools instead — the model
+     * may still see the tool listed, but every call is refused.
      *
      * @generated from field: repeated string enabled_tools = 2;
      */
@@ -174,6 +183,9 @@ export type McpServerUsage = Message<"ai.stigmer.agentic.agent.v1.McpServerUsage
      * Override approval requirements for specific tools.
      * Takes precedence over McpServerSpec.pinned_tool_approvals and
      * McpServerStatus.tool_approvals.
+     * Scoped to THIS usage's server: an override applies only to tools of
+     * the McpServer referenced by mcp_server_ref — a same-named tool on
+     * another server is unaffected.
      *
      * @generated from field: repeated ai.stigmer.agentic.agent.v1.ToolApprovalOverride tool_approval_overrides = 3;
      */
@@ -259,6 +271,9 @@ export declare const McpAccessSchema: GenMessage<McpAccess>;
  * McpServerSpec.pinned_tool_approvals and McpServerStatus.tool_approvals,
  * but can be bypassed at execution time by AgentExecution.auto_approve_all.
  *
+ * An override is scoped to the McpServer referenced by its parent usage:
+ * it never affects a same-named tool on another server.
+ *
  * @internal
  * Policy chain (lowest to highest priority):
  * 1. McpServerStatus.tool_approvals — system-generated defaults

package/ai/stigmer/agentic/agent/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mHAAmH;AACnH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,43EAA43E,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA0E/iF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA8DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAgDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAgCxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA+BxD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAiDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/agent/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mHAAmH;AACnH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAY,aAAa,CACzE,QAAQ,CAAC,43EAA43E,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AA0E/iF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA8DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAyB,aAAa,CAC/D,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA4DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAgCxD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AA+BxD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;AAoDxD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/executioncontext/v1/command_connect.d.ts

@@ -2,13 +2,22 @@
  * ExecutionContextCommandController handles write operations for ExecutionContext resources.
  *
  * @internal
- * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
- * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
- * FGA model. Authorization is derived from the parent execution:
- *   - create: Caller must have can_edit on parent agent_execution or workflow_execution
- *   - delete: Caller must have can_edit on parent agent_execution or workflow_execution
- *
- * This avoids FGA tuple churn for short-lived resources while maintaining proper access control.
+ * Every write RPC uses is_skip_authorization with a real handler-level check
+ * (the framework's declarative FGA options cannot express any of these):
+ *   - create: the caller-class differs by transport. Internal in-process
+ *     pipeline calls (agent execution, workflow execution, workflow recovery,
+ *     MCP connect) are trusted — the parent operation already authorized the
+ *     run against its session-or-org, and the EC is created before that parent
+ *     is persisted, so it carries no resource to re-check. External callers
+ *     must hold can_create_execution_in on metadata.org (the same bar that
+ *     gates creating an execution in the org; held by members and guests).
+ *     A declarative org option cannot encode the internal/external split.
+ *   - apply: intentionally unannotated router — it delegates to create
+ *     (create-or-fail; ExecutionContext has no update RPC) and the delegated
+ *     pipeline runs under create's handler, authorization included.
+ *   - delete: caller must have can_edit on execution_context:<id> (owner-only,
+ *     per the execution_context FGA model). The FGA target is the loaded
+ *     resource, so it cannot be a declarative method option.
  *
  * @generated from service ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController
  */
@@ -19,8 +28,9 @@ export declare const ExecutionContextCommandController: {
          * Create or update an ExecutionContext.
          *
          * @internal
-         * The authorization and state-operation are determined depending on whether the execution context
-         * is going to be created or updated which is determined as part of the request execution.
+         * Router only: delegates to create when the resource does not exist and
+         * fails with ALREADY_EXISTS when it does (no update RPC). Authorization is
+         * inherited from the delegated create pipeline.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.apply
          */
@@ -34,8 +44,13 @@ export declare const ExecutionContextCommandController: {
          * Create a new ExecutionContext for an execution.
          *
          * @internal
-         * Called by execution pipeline on behalf of the user.
-         * Handler-level derived auth: checks can_edit on parent agent_execution or workflow_execution.
+         * Called by the execution pipelines (agent execution, workflow execution,
+         * workflow recovery, MCP connect) as sub-steps, and reachable directly by
+         * API clients. is_skip_authorization because the caller-class split cannot
+         * be a declarative option: the create handler trusts internal in-process
+         * calls (already authorized upstream) and requires external callers to hold
+         * can_create_execution_in on metadata.org. The pipeline additionally grants
+         * the caller the owner tuple, which gates all subsequent reads and delete.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.create
          */
@@ -49,8 +64,10 @@ export declare const ExecutionContextCommandController: {
          * Delete an ExecutionContext.
          *
          * @internal
-         * Called when execution completes. Handler-level derived auth: checks can_edit
-         * on parent agent_execution or workflow_execution.
+         * Called when execution completes. Handler-level auth (the FGA target is the
+         * loaded resource, so it cannot be a declarative option): caller must have
+         * can_edit on execution_context:<id>, which the FGA model resolves to the
+         * owner written at create time.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.delete
          */

package/ai/stigmer/agentic/executioncontext/v1/command_connect.js

@@ -9,13 +9,22 @@ import { ApiResourceDeleteInput } from "../../../commons/apiresource/io_pbjs";
  * ExecutionContextCommandController handles write operations for ExecutionContext resources.
  *
  * @internal
- * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
- * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
- * FGA model. Authorization is derived from the parent execution:
- *   - create: Caller must have can_edit on parent agent_execution or workflow_execution
- *   - delete: Caller must have can_edit on parent agent_execution or workflow_execution
- *
- * This avoids FGA tuple churn for short-lived resources while maintaining proper access control.
+ * Every write RPC uses is_skip_authorization with a real handler-level check
+ * (the framework's declarative FGA options cannot express any of these):
+ *   - create: the caller-class differs by transport. Internal in-process
+ *     pipeline calls (agent execution, workflow execution, workflow recovery,
+ *     MCP connect) are trusted — the parent operation already authorized the
+ *     run against its session-or-org, and the EC is created before that parent
+ *     is persisted, so it carries no resource to re-check. External callers
+ *     must hold can_create_execution_in on metadata.org (the same bar that
+ *     gates creating an execution in the org; held by members and guests).
+ *     A declarative org option cannot encode the internal/external split.
+ *   - apply: intentionally unannotated router — it delegates to create
+ *     (create-or-fail; ExecutionContext has no update RPC) and the delegated
+ *     pipeline runs under create's handler, authorization included.
+ *   - delete: caller must have can_edit on execution_context:<id> (owner-only,
+ *     per the execution_context FGA model). The FGA target is the loaded
+ *     resource, so it cannot be a declarative method option.
  *
  * @generated from service ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController
  */
@@ -26,8 +35,9 @@ export const ExecutionContextCommandController = {
          * Create or update an ExecutionContext.
          *
          * @internal
-         * The authorization and state-operation are determined depending on whether the execution context
-         * is going to be created or updated which is determined as part of the request execution.
+         * Router only: delegates to create when the resource does not exist and
+         * fails with ALREADY_EXISTS when it does (no update RPC). Authorization is
+         * inherited from the delegated create pipeline.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.apply
          */
@@ -41,8 +51,13 @@ export const ExecutionContextCommandController = {
          * Create a new ExecutionContext for an execution.
          *
          * @internal
-         * Called by execution pipeline on behalf of the user.
-         * Handler-level derived auth: checks can_edit on parent agent_execution or workflow_execution.
+         * Called by the execution pipelines (agent execution, workflow execution,
+         * workflow recovery, MCP connect) as sub-steps, and reachable directly by
+         * API clients. is_skip_authorization because the caller-class split cannot
+         * be a declarative option: the create handler trusts internal in-process
+         * calls (already authorized upstream) and requires external callers to hold
+         * can_create_execution_in on metadata.org. The pipeline additionally grants
+         * the caller the owner tuple, which gates all subsequent reads and delete.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.create
          */
@@ -56,8 +71,10 @@ export const ExecutionContextCommandController = {
          * Delete an ExecutionContext.
          *
          * @internal
-         * Called when execution completes. Handler-level derived auth: checks can_edit
-         * on parent agent_execution or workflow_execution.
+         * Called when execution completes. Handler-level auth (the FGA target is the
+         * loaded resource, so it cannot be a declarative option): caller must have
+         * can_edit on execution_context:<id>, which the FGA model resolves to the
+         * owner written at create time.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.delete
          */

package/ai/stigmer/agentic/executioncontext/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,4IAA4I;AAC5I,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,QAAQ,EAAE,0EAA0E;IACpF,OAAO,EAAE;QACP;;;;;;;;;WASG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;WAaG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;WAUG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,sBAAsB;YACzB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/executioncontext/v1/command_pb.d.ts

@@ -9,13 +9,22 @@ export declare const file_ai_stigmer_agentic_executioncontext_v1_command: GenFil
  * ExecutionContextCommandController handles write operations for ExecutionContext resources.
  *
  * @internal
- * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
- * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
- * FGA model. Authorization is derived from the parent execution:
- *   - create: Caller must have can_edit on parent agent_execution or workflow_execution
- *   - delete: Caller must have can_edit on parent agent_execution or workflow_execution
- *
- * This avoids FGA tuple churn for short-lived resources while maintaining proper access control.
+ * Every write RPC uses is_skip_authorization with a real handler-level check
+ * (the framework's declarative FGA options cannot express any of these):
+ *   - create: the caller-class differs by transport. Internal in-process
+ *     pipeline calls (agent execution, workflow execution, workflow recovery,
+ *     MCP connect) are trusted — the parent operation already authorized the
+ *     run against its session-or-org, and the EC is created before that parent
+ *     is persisted, so it carries no resource to re-check. External callers
+ *     must hold can_create_execution_in on metadata.org (the same bar that
+ *     gates creating an execution in the org; held by members and guests).
+ *     A declarative org option cannot encode the internal/external split.
+ *   - apply: intentionally unannotated router — it delegates to create
+ *     (create-or-fail; ExecutionContext has no update RPC) and the delegated
+ *     pipeline runs under create's handler, authorization included.
+ *   - delete: caller must have can_edit on execution_context:<id> (owner-only,
+ *     per the execution_context FGA model). The FGA target is the loaded
+ *     resource, so it cannot be a declarative method option.
  *
  * @generated from service ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController
  */
@@ -24,8 +33,9 @@ export declare const ExecutionContextCommandController: GenService<{
      * Create or update an ExecutionContext.
      *
      * @internal
-     * The authorization and state-operation are determined depending on whether the execution context
-     * is going to be created or updated which is determined as part of the request execution.
+     * Router only: delegates to create when the resource does not exist and
+     * fails with ALREADY_EXISTS when it does (no update RPC). Authorization is
+     * inherited from the delegated create pipeline.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.apply
      */
@@ -38,8 +48,13 @@ export declare const ExecutionContextCommandController: GenService<{
      * Create a new ExecutionContext for an execution.
      *
      * @internal
-     * Called by execution pipeline on behalf of the user.
-     * Handler-level derived auth: checks can_edit on parent agent_execution or workflow_execution.
+     * Called by the execution pipelines (agent execution, workflow execution,
+     * workflow recovery, MCP connect) as sub-steps, and reachable directly by
+     * API clients. is_skip_authorization because the caller-class split cannot
+     * be a declarative option: the create handler trusts internal in-process
+     * calls (already authorized upstream) and requires external callers to hold
+     * can_create_execution_in on metadata.org. The pipeline additionally grants
+     * the caller the owner tuple, which gates all subsequent reads and delete.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.create
      */
@@ -52,8 +67,10 @@ export declare const ExecutionContextCommandController: GenService<{
      * Delete an ExecutionContext.
      *
      * @internal
-     * Called when execution completes. Handler-level derived auth: checks can_edit
-     * on parent agent_execution or workflow_execution.
+     * Called when execution completes. Handler-level auth (the FGA target is the
+     * loaded resource, so it cannot be a declarative option): caller must have
+     * can_edit on execution_context:<id>, which the FGA model resolves to the
+     * owner written at create time.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController.delete
      */

package/ai/stigmer/agentic/executioncontext/v1/command_pb.js

@@ -14,13 +14,22 @@ export const file_ai_stigmer_agentic_executioncontext_v1_command = /*@__PURE__*/
  * ExecutionContextCommandController handles write operations for ExecutionContext resources.
  *
  * @internal
- * Authorization: All RPCs use is_skip_authorization with custom handler-level derived auth.
- * ExecutionContext is ephemeral (1:1 with its parent execution) and has no dedicated
- * FGA model. Authorization is derived from the parent execution:
- *   - create: Caller must have can_edit on parent agent_execution or workflow_execution
- *   - delete: Caller must have can_edit on parent agent_execution or workflow_execution
- *
- * This avoids FGA tuple churn for short-lived resources while maintaining proper access control.
+ * Every write RPC uses is_skip_authorization with a real handler-level check
+ * (the framework's declarative FGA options cannot express any of these):
+ *   - create: the caller-class differs by transport. Internal in-process
+ *     pipeline calls (agent execution, workflow execution, workflow recovery,
+ *     MCP connect) are trusted — the parent operation already authorized the
+ *     run against its session-or-org, and the EC is created before that parent
+ *     is persisted, so it carries no resource to re-check. External callers
+ *     must hold can_create_execution_in on metadata.org (the same bar that
+ *     gates creating an execution in the org; held by members and guests).
+ *     A declarative org option cannot encode the internal/external split.
+ *   - apply: intentionally unannotated router — it delegates to create
+ *     (create-or-fail; ExecutionContext has no update RPC) and the delegated
+ *     pipeline runs under create's handler, authorization included.
+ *   - delete: caller must have can_edit on execution_context:<id> (owner-only,
+ *     per the execution_context FGA model). The FGA target is the loaded
+ *     resource, so it cannot be a declarative method option.
  *
  * @generated from service ai.stigmer.agentic.executioncontext.v1.ExecutionContextCommandController
  */

package/ai/stigmer/agentic/executioncontext/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAY,aAAa,CACvF,QAAQ,CAAC,4sBAA4sB,EAAE,CAAC,+CAA+C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEz5B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iCAAiC,GA2CzC,aAAa,CAChB,WAAW,CAAC,mDAAmD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,4IAA4I;AAC5I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,mDAAmD,GAAY,aAAa,CACvF,QAAQ,CAAC,4sBAA4sB,EAAE,CAAC,+CAA+C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEz5B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAmDzC,aAAa,CAChB,WAAW,CAAC,mDAAmD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/executioncontext/v1/query_connect.d.ts

@@ -56,12 +56,14 @@ export declare const ExecutionContextQueryController: {
          * Handler-level auth (cloud): direct FGA can_view on the execution_context resource.
          *
          * Secret handling (cloud): the decrypt path is gated by caller credential
-         * class, not by FGA — runners authenticate as the user who owns the
-         * execution, so permissions cannot tell them apart. Callers presenting a
-         * platform-minted runner token (token_type of sandbox, workflow_sandbox,
-         * connect_sandbox, or embedded_runner) receive decrypted secret values;
-         * every other caller (user JWT, SDK, console) receives the same redaction
-         * as get/getByReference.
+         * class AND scope, not by FGA — runners authenticate as the user who owns
+         * the execution, so permissions cannot tell them apart. Callers presenting
+         * a platform-minted runner token (token_type of sandbox, workflow_sandbox,
+         * or connect_sandbox) whose scope claim binds it to this very execution
+         * receive decrypted secret values. The unscoped embedded_runner bootstrap
+         * credential is refused; desktop runners exchange it for a scoped token
+         * via getRunnerScopedToken before reading. Every other caller (user JWT,
+         * SDK, console) receives the same redaction as get/getByReference.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextQueryController.getByExecutionId
          */

package/ai/stigmer/agentic/executioncontext/v1/query_connect.js

@@ -64,12 +64,14 @@ export const ExecutionContextQueryController = {
          * Handler-level auth (cloud): direct FGA can_view on the execution_context resource.
          *
          * Secret handling (cloud): the decrypt path is gated by caller credential
-         * class, not by FGA — runners authenticate as the user who owns the
-         * execution, so permissions cannot tell them apart. Callers presenting a
-         * platform-minted runner token (token_type of sandbox, workflow_sandbox,
-         * connect_sandbox, or embedded_runner) receive decrypted secret values;
-         * every other caller (user JWT, SDK, console) receives the same redaction
-         * as get/getByReference.
+         * class AND scope, not by FGA — runners authenticate as the user who owns
+         * the execution, so permissions cannot tell them apart. Callers presenting
+         * a platform-minted runner token (token_type of sandbox, workflow_sandbox,
+         * or connect_sandbox) whose scope claim binds it to this very execution
+         * receive decrypted secret values. The unscoped embedded_runner bootstrap
+         * credential is refused; desktop runners exchange it for a scoped token
+         * via getRunnerScopedToken before reading. Every other caller (user JWT,
+         * SDK, console) receives the same redaction as get/getByReference.
          *
          * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextQueryController.getByExecutionId
          */

package/ai/stigmer/agentic/executioncontext/v1/query_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,0IAA0I;AAC1I,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gCAAgC,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,wEAAwE;IAClF,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,gCAAgC;YACnC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"query_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/query_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,0IAA0I;AAC1I,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,gCAAgC,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,EAAE,wEAAwE;IAClF,OAAO,EAAE;QACP;;;;;;;;WAQG;QACH,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;WAQG;QACH,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,CAAC,EAAE,gCAAgC;YACnC,CAAC,EAAE,gBAAgB;YACnB,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/agentic/executioncontext/v1/query_pb.d.ts

@@ -60,12 +60,14 @@ export declare const ExecutionContextQueryController: GenService<{
      * Handler-level auth (cloud): direct FGA can_view on the execution_context resource.
      *
      * Secret handling (cloud): the decrypt path is gated by caller credential
-     * class, not by FGA — runners authenticate as the user who owns the
-     * execution, so permissions cannot tell them apart. Callers presenting a
-     * platform-minted runner token (token_type of sandbox, workflow_sandbox,
-     * connect_sandbox, or embedded_runner) receive decrypted secret values;
-     * every other caller (user JWT, SDK, console) receives the same redaction
-     * as get/getByReference.
+     * class AND scope, not by FGA — runners authenticate as the user who owns
+     * the execution, so permissions cannot tell them apart. Callers presenting
+     * a platform-minted runner token (token_type of sandbox, workflow_sandbox,
+     * or connect_sandbox) whose scope claim binds it to this very execution
+     * receive decrypted secret values. The unscoped embedded_runner bootstrap
+     * credential is refused; desktop runners exchange it for a scoped token
+     * via getRunnerScopedToken before reading. Every other caller (user JWT,
+     * SDK, console) receives the same redaction as get/getByReference.
      *
      * @generated from rpc ai.stigmer.agentic.executioncontext.v1.ExecutionContextQueryController.getByExecutionId
      */

package/ai/stigmer/agentic/executioncontext/v1/query_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0IAA0I;AAC1I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,8CAA8C,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,0vBAA0vB,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEv/B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAoDvC,aAAa,CAChB,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"query_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/executioncontext/v1/query_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0IAA0I;AAC1I,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,+CAA+C,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,8CAA8C,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG;;GAEG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAY,aAAa,CACrF,QAAQ,CAAC,0vBAA0vB,EAAE,CAAC,+CAA+C,EAAE,8CAA8C,EAAE,sCAAsC,EAAE,uDAAuD,EAAE,0CAA0C,CAAC,CAAC,CAAC;AAEv/B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAsDvC,aAAa,CAChB,WAAW,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.d.ts

@@ -71,13 +71,18 @@ export type McpServerSpec = Message<"ai.stigmer.agentic.mcpserver.v1.McpServerSp
     /**
      * Default tools to enable from this MCP server.
      * Empty list means all tools are enabled by default.
+     * Applies whenever an agent's McpServerUsage.enabled_tools is empty.
      *
      * @internal
      * Tool names must match exactly what the MCP server reports via tools/list.
      * Only names from discovered_capabilities.tools are valid here.
      * Do NOT include names from discovered_capabilities.resource_templates —
      * resource templates are read-only data endpoints, not callable tools.
-     * Including a resource template name here causes a fatal runtime error.
+     * A name the server does not expose (including a resource template name)
+     * is warned and ignored at execution: the runner enforces the INTERSECTION
+     * with the server's live toolset, so a stale or mistyped entry narrows the
+     * toolset but never widens it or fails the run. Enforcement is per harness
+     * — see McpServerUsage.enabled_tools in agent/v1/spec.proto.
      *
      * @generated from field: repeated string default_enabled_tools = 7;
      */

package/ai/stigmer/agentic/mcpserver/v1/spec_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAmK7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"spec_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/spec_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2HAA2H;AAC3H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AAErH,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF;;GAEG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAY,aAAa,CAC7E,QAAQ,CAAC,0mEAA0mE,EAAE,CAAC,2CAA2C,EAAE,iDAAiD,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAwK7xE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA+D5D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkC,aAAa,CACjF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA4E5D;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AAqE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;AA6H5D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,aAAa,CACzE,WAAW,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/mcpserver/v1/status_pb.d.ts

@@ -102,8 +102,9 @@ export declare const McpServerStatusSchema: GenMessage<McpServerStatus>;
  *   - tools: Callable actions the agent can invoke (e.g., search_code, create_pr).
  *     Only tool names are valid in Agent enabled_tools and McpServer default_enabled_tools.
  *   - resource_templates: Read-only data endpoints accessed by URI template.
- *     Resource template names must NEVER appear in enabled_tools — doing so causes
- *     a fatal runtime error.
+ *     Resource template names must NEVER appear in enabled_tools — such a name
+ *     never matches a discovered tool, so the runner warns and ignores it
+ *     (enforcing the intersection with the live toolset).
  *
  * Populated by:
  * - Seedpack bootstrap (built-in servers with known, stable tool sets)

package/ai/stigmer/agentic/mcpserver/v1/status_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGrG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,y2DAAy2D,EAAE,CAAC,yCAAyC,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAsFljE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAkC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA2C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6D9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eA0BX;AA1BD,WAAY,eAAe;IACzB;;;;;OAKG;IACH,qGAAgC,CAAA;IAEhC;;;;;;OAMG;IACH,uDAAS,CAAA;IAET;;;;;;OAMG;IACH,2DAAW,CAAA;AACb,CAAC,EA1BW,eAAe,KAAf,eAAe,QA0B1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,cA6BX;AA7BD,WAAY,cAAc;IACxB;;;;OAIG;IACH,mGAAgC,CAAA;IAEhC;;;;OAIG;IACH,6FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,qFAAyB,CAAA;AAC3B,CAAC,EA7BW,cAAc,KAAd,cAAc,QA6BzB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4B,aAAa,CACxE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"status_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/mcpserver/v1/status_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,6HAA6H;AAC7H,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,yCAAyC,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGrG;;GAEG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAY,aAAa,CAC/E,QAAQ,CAAC,y2DAAy2D,EAAE,CAAC,yCAAyC,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAsFljE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA8C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAkC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B,aAAa,CAC3E,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA2C9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AA6D9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,aAAa,CACrE,WAAW,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAN,IAAY,eA0BX;AA1BD,WAAY,eAAe;IACzB;;;;;OAKG;IACH,qGAAgC,CAAA;IAEhC;;;;;;OAMG;IACH,uDAAS,CAAA;IAET;;;;;;OAMG;IACH,2DAAW,CAAA;AACb,CAAC,EA1BW,eAAe,KAAf,eAAe,QA0B1B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,aAAa,CAC1E,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,cA6BX;AA7BD,WAAY,cAAc;IACxB;;;;OAIG;IACH,mGAAgC,CAAA;IAEhC;;;;OAIG;IACH,6FAA6B,CAAA;IAE7B;;;;OAIG;IACH,qGAAiC,CAAA;IAEjC;;;;;OAKG;IACH,qFAAyB,CAAA;AAC3B,CAAC,EA7BW,cAAc,KAAd,cAAc,QA6BzB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4B,aAAa,CACxE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/agentic/workflowexecution/v1/io_pb.d.ts

@@ -857,8 +857,9 @@ export type SendSignalInput = Message<"ai.stigmer.agentic.workflowexecution.v1.S
      * Optional idempotency key for deduplication of signal delivery.
      *
      * @internal
-     * When provided, duplicate signals with the same key (within the 24-hour TTL window)
-     * return the cached response instead of re-delivering the signal.
+     * When provided, a duplicate signal with the same key (within the 24-hour
+     * TTL window) is rejected with ALREADY_EXISTS instead of being re-delivered;
+     * nothing is cached or replayed. Both editions enforce this identically.
      * Keys are scoped to the organization to prevent cross-org collisions.
      *
      * @since Gap B2 (Event Dedupe)

package/ai/stigmer/agentic/workflowexecution/v1/io_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowexecution/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yIAAyI;AACzI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,8CAA8C,EAAE,MAAM,oCAAoC,CAAC;AAEpG,OAAO,EAAE,gDAAgD,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,cAAc,CAAC;AAEjF,OAAO,EAAE,kDAAkD,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGpI;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,8qOAA8qO,EAAE,CAAC,8CAA8C,EAAE,gDAAgD,EAAE,iDAAiD,EAAE,kDAAkD,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuB9/O;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+BlE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAqGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAmElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAwD,aAAa,CAC7H,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+GlE;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAmD,aAAa,CACnH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA6DlE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAiGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAuBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAkD,aAAa,CACjH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAoClE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA6CnE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAyBnE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA4DnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAqCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA+BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAmCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAiFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA8BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAqCX;AArCD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,yEAAe,CAAA;IAEf;;;;OAIG;IACH,uEAAc,CAAA;IAEd;;;;;;OAMG;IACH,mEAAY,CAAA;IAEZ;;;;OAIG;IACH,2DAAQ,CAAA;IAER;;;;OAIG;IACH,+DAAU,CAAA;AACZ,CAAC,EArCW,kBAAkB,KAAlB,kBAAkB,QAqC7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAyBX;AAzBD,WAAY,iBAAiB;IAC3B;;OAEG;IACH,uEAAe,CAAA;IAEf;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,+DAAW,CAAA;IAEX;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,iEAAY,CAAA;AACd,CAAC,EAzBW,iBAAiB,KAAjB,iBAAiB,QAyB5B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA+B,aAAa,CAC9E,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"io_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/agentic/workflowexecution/v1/io_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yIAAyI;AACzI,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,8CAA8C,EAAE,MAAM,oCAAoC,CAAC;AAEpG,OAAO,EAAE,gDAAgD,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,iDAAiD,EAAE,MAAM,cAAc,CAAC;AAEjF,OAAO,EAAE,kDAAkD,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAGpI;;GAEG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAY,aAAa,CACnF,QAAQ,CAAC,8qOAA8qO,EAAE,CAAC,8CAA8C,EAAE,gDAAgD,EAAE,iDAAiD,EAAE,kDAAkD,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAuB9/O;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B,aAAa,CACnE,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+BlE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAqGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAmElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAwD,aAAa,CAC7H,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA+GlE;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAmD,aAAa,CACnH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AA6DlE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAsGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAiGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAuBlE;;;GAGG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAkD,aAAa,CACjH,WAAW,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAoClE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAgD,aAAa,CAC7G,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA6CnE;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAyBnE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA6C,aAAa,CACvG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA6DnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAqCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAgEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC,aAAa,CAC3F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwC,aAAa,CAC7F,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAsCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAoFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,aAAa,CAC/E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA0BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA+BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsC,aAAa,CACzF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAmCnE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4C,aAAa,CACrG,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAiFnE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgC,aAAa,CAC7E,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AA8BnE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,aAAa,CACvF,WAAW,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kBAqCX;AArCD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,yEAAe,CAAA;IAEf;;;;OAIG;IACH,uEAAc,CAAA;IAEd;;;;;;OAMG;IACH,mEAAY,CAAA;IAEZ;;;;OAIG;IACH,2DAAQ,CAAA;IAER;;;;OAIG;IACH,+DAAU,CAAA;AACZ,CAAC,EArCW,kBAAkB,KAAlB,kBAAkB,QAqC7B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,aAAa,CAChF,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAyBX;AAzBD,WAAY,iBAAiB;IAC3B;;OAEG;IACH,uEAAe,CAAA;IAEf;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,+DAAW,CAAA;IAEX;;OAEG;IACH,iEAAY,CAAA;IAEZ;;OAEG;IACH,iEAAY,CAAA;AACd,CAAC,EAzBW,iBAAiB,KAAjB,iBAAiB,QAyB5B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA+B,aAAa,CAC9E,QAAQ,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/commons/apiresource/enum_pb.d.ts

@@ -119,7 +119,9 @@ export declare const ApiResourceStateOperationTypeSchema: GenEnum<ApiResourceSta
  *
  * The visibility levels map to FGA tuples:
  * - PRIVATE: no additional viewer tuples (owner-only access)
- * - ORG: resource#viewer@organization:<org>#member tuple (all org members)
+ * - ORG: resource#viewer@organization:<org>#viewer tuple (everyone in the
+ *   org — the org role hierarchy flows downward, so owners, admins, members
+ *   AND read-only viewers all satisfy the organization#viewer userset)
  * - PUBLIC: resource#viewer@identity_account:* with allow_public (all users)
  * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
  *   (all members of all organizations managed by the owning org's
@@ -165,14 +167,23 @@ export declare enum ApiResourceVisibility {
      */
     visibility_public = 2,
     /**
-     * All members of the owning organization can access (read) this resource.
+     * Everyone in the owning organization can access (read) this resource —
+     * all org roles including read-only viewers (the role SSO auto-provisioning
+     * grants by default). Running or otherwise spending against the resource
+     * still requires the org-level member-or-guest permissions
+     * (can_create_session / can_create_execution_in); org visibility widens
+     * read, never spend.
      * Used for instances where a team wants shared observability of executions
      * without granting access to all authenticated users.
      *
-     * FGA tuple: resource#viewer@organization:<org>#member
+     * FGA tuple: resource#viewer@organization:<org>#viewer
+     * (Before cloud#257 the tuple targeted organization#member, which
+     * excluded viewer-role users; legacy tuples keep resolving until the
+     * cloud's boot-time backfill converges them.)
      *
      * For workflow instances, this enables zero-tuple-per-execution shared
-     * observability: all org members see all executions via inheritance.
+     * observability: everyone in the org sees all executions via inheritance
+     * once the instance opts in.
      *
      * @generated from enum value: visibility_org = 3;
      */

package/ai/stigmer/commons/apiresource/enum_pb.js

@@ -124,7 +124,9 @@ export const ApiResourceStateOperationTypeSchema = /*@__PURE__*/ enumDesc(file_a
  *
  * The visibility levels map to FGA tuples:
  * - PRIVATE: no additional viewer tuples (owner-only access)
- * - ORG: resource#viewer@organization:<org>#member tuple (all org members)
+ * - ORG: resource#viewer@organization:<org>#viewer tuple (everyone in the
+ *   org — the org role hierarchy flows downward, so owners, admins, members
+ *   AND read-only viewers all satisfy the organization#viewer userset)
  * - PUBLIC: resource#viewer@identity_account:* with allow_public (all users)
  * - PLATFORM: resource#platform_viewer@identity_provider:<idp>#platform_user
  *   (all members of all organizations managed by the owning org's
@@ -171,14 +173,23 @@ export var ApiResourceVisibility;
      */
     ApiResourceVisibility[ApiResourceVisibility["visibility_public"] = 2] = "visibility_public";
     /**
-     * All members of the owning organization can access (read) this resource.
+     * Everyone in the owning organization can access (read) this resource —
+     * all org roles including read-only viewers (the role SSO auto-provisioning
+     * grants by default). Running or otherwise spending against the resource
+     * still requires the org-level member-or-guest permissions
+     * (can_create_session / can_create_execution_in); org visibility widens
+     * read, never spend.
      * Used for instances where a team wants shared observability of executions
      * without granting access to all authenticated users.
      *
-     * FGA tuple: resource#viewer@organization:<org>#member
+     * FGA tuple: resource#viewer@organization:<org>#viewer
+     * (Before cloud#257 the tuple targeted organization#member, which
+     * excluded viewer-role users; legacy tuples keep resolving until the
+     * cloud's boot-time backfill converges them.)
      *
      * For workflow instances, this enables zero-tuple-per-execution shared
-     * observability: all org members see all executions via inheritance.
+     * observability: everyone in the org sees all executions via inheritance
+     * once the instance opts in.
      *
      * @generated from enum value: visibility_org = 3;
      */

package/ai/stigmer/commons/apiresource/enum_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,qBA+EX;AA/ED,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;;;;;;;;;;;OAgBG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;OAWG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EA/EW,qBAAqB,KAArB,qBAAqB,QA+EhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enum_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/commons/apiresource/enum_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yHAAyH;AACzH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,oqBAAoqB,CAAC,CAAC;AAEjrB;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,oBA0CX;AA1CD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,6EAAe,CAAA;IAEf;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,qEAAW,CAAA;IAEX;;;;OAIG;IACH,iGAAyB,CAAA;AAC3B,CAAC,EA1CW,oBAAoB,KAApB,oBAAoB,QA0C/B;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,aAAa,CACpF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BA0CX;AA1CD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,mKAAiD,CAAA;IAEjD;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,qFAAU,CAAA;IAEV;;;;OAIG;IACH,iFAAQ,CAAA;IAER;;;;OAIG;IACH,qFAAU,CAAA;AACZ,CAAC,EA1CW,6BAA6B,KAA7B,6BAA6B,QA0CxC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2C,aAAa,CACtG,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,qBAwFX;AAxFD,WAAY,qBAAqB;IAC/B;;;;;;;OAOG;IACH,+HAAuC,CAAA;IAEvC;;;;;;;;;;;;;;;;OAgBG;IACH,6FAAsB,CAAA;IAEtB;;;;;;;OAOG;IACH,2FAAqB,CAAA;IAErB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qFAAkB,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,+FAAuB,CAAA;AACzB,CAAC,EAxFW,qBAAqB,KAArB,qBAAqB,QAwFhC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC,aAAa,CACtF,QAAQ,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_connect.d.ts

@@ -203,6 +203,9 @@ export declare const IamPolicyCommandController: {
          *
          * Authorization:
          * - Caller must have 'can_grant_access' permission on the organization
+         * - System flows running as the platform machine account cannot satisfy this
+         *   check (the machine account holds no org-scoped grants by design) and must
+         *   use bootstrapRevokeOrgAccess instead
          *
          * Use Cases:
          * - Removing a member from an organization
@@ -219,5 +222,50 @@ export declare const IamPolicyCommandController: {
             readonly O: any;
             readonly kind: any;
         };
+        /**
+         * Revoke all of a user's access to an organization via the system (bootstrap) path.
+         *
+         * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+         * authorized by can_bootstrap_iam on platform:stigmer instead of
+         * can_grant_access on the organization.
+         *
+         * @internal
+         * Exists because system flows execute the revoke as the platform machine
+         * account, which by design holds no org-scoped grants. The system channel does
+         * NOT bypass authorization — it authenticates as the machine account, which
+         * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+         * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+         * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+         * create (see https://github.com/stigmer/stigmer/issues/332).
+         *
+         * The operation (identical to revokeOrgAccess after authorization):
+         * 1. Validates can_bootstrap_iam permission on platform:stigmer
+         * 2. Loads all policies where the identity account is principal within the org
+         *    scope, plus policies directly on the organization itself
+         * 3. Deletes all matching policies from MongoDB
+         * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+         *
+         * Authorization:
+         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+         * - This is typically only granted to platform services (machine accounts)
+         *
+         * Use Cases:
+         * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+         * - Any platform-driven offboarding that runs under system credentials
+         *
+         * End-user member removal must use revokeOrgAccess, which checks
+         * can_grant_access on the organization.
+         *
+         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+         * Output: Empty (google.protobuf.Empty)
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+         */
+        readonly bootstrapRevokeOrgAccess: {
+            readonly name: "bootstrapRevokeOrgAccess";
+            readonly I: any;
+            readonly O: any;
+            readonly kind: any;
+        };
     };
 };

package/ai/stigmer/iam/iampolicy/v1/command_connect.js

@@ -211,6 +211,9 @@ export const IamPolicyCommandController = {
          *
          * Authorization:
          * - Caller must have 'can_grant_access' permission on the organization
+         * - System flows running as the platform machine account cannot satisfy this
+         *   check (the machine account holds no org-scoped grants by design) and must
+         *   use bootstrapRevokeOrgAccess instead
          *
          * Use Cases:
          * - Removing a member from an organization
@@ -227,6 +230,51 @@ export const IamPolicyCommandController = {
             O: Empty,
             kind: MethodKind.Unary,
         },
+        /**
+         * Revoke all of a user's access to an organization via the system (bootstrap) path.
+         *
+         * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+         * authorized by can_bootstrap_iam on platform:stigmer instead of
+         * can_grant_access on the organization.
+         *
+         * @internal
+         * Exists because system flows execute the revoke as the platform machine
+         * account, which by design holds no org-scoped grants. The system channel does
+         * NOT bypass authorization — it authenticates as the machine account, which
+         * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+         * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+         * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+         * create (see https://github.com/stigmer/stigmer/issues/332).
+         *
+         * The operation (identical to revokeOrgAccess after authorization):
+         * 1. Validates can_bootstrap_iam permission on platform:stigmer
+         * 2. Loads all policies where the identity account is principal within the org
+         *    scope, plus policies directly on the organization itself
+         * 3. Deletes all matching policies from MongoDB
+         * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+         *
+         * Authorization:
+         * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+         * - This is typically only granted to platform services (machine accounts)
+         *
+         * Use Cases:
+         * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+         * - Any platform-driven offboarding that runs under system credentials
+         *
+         * End-user member removal must use revokeOrgAccess, which checks
+         * can_grant_access on the organization.
+         *
+         * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+         * Output: Empty (google.protobuf.Empty)
+         *
+         * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+         */
+        bootstrapRevokeOrgAccess: {
+            name: "bootstrapRevokeOrgAccess",
+            I: RevokeOrgAccessInput,
+            O: Empty,
+            kind: MethodKind.Unary,
+        },
     }
 };
 //# sourceMappingURL=command_connect.js.map

package/ai/stigmer/iam/iampolicy/v1/command_connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}
+{"version":3,"file":"command_connect.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_connect.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,sHAAsH;AACtH,oBAAoB;AACpB,cAAc;AAEd,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ,EAAE,wDAAwD;IAClE,OAAO,EAAE;QACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAgCG;QACH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE,SAAS;YACZ,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;QACH,uBAAuB,EAAE;YACvB,IAAI,EAAE,yBAAyB;YAC/B,CAAC,EAAE,cAAc;YACjB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,iBAAiB;YACvB,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;QACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsCG;QACH,wBAAwB,EAAE;YACxB,IAAI,EAAE,0BAA0B;YAChC,CAAC,EAAE,oBAAoB;YACvB,CAAC,EAAE,KAAK;YACR,IAAI,EAAE,UAAU,CAAC,KAAK;SACvB;KACF;CACO,CAAC"}

package/ai/stigmer/iam/iampolicy/v1/command_pb.d.ts

@@ -206,6 +206,9 @@ export declare const IamPolicyCommandController: GenService<{
      *
      * Authorization:
      * - Caller must have 'can_grant_access' permission on the organization
+     * - System flows running as the platform machine account cannot satisfy this
+     *   check (the machine account holds no org-scoped grants by design) and must
+     *   use bootstrapRevokeOrgAccess instead
      *
      * Use Cases:
      * - Removing a member from an organization
@@ -221,4 +224,48 @@ export declare const IamPolicyCommandController: GenService<{
         input: typeof RevokeOrgAccessInputSchema;
         output: typeof EmptySchema;
     };
+    /**
+     * Revoke all of a user's access to an organization via the system (bootstrap) path.
+     *
+     * The system-flow twin of revokeOrgAccess: identical revocation behavior, but
+     * authorized by can_bootstrap_iam on platform:stigmer instead of
+     * can_grant_access on the organization.
+     *
+     * @internal
+     * Exists because system flows execute the revoke as the platform machine
+     * account, which by design holds no org-scoped grants. The system channel does
+     * NOT bypass authorization — it authenticates as the machine account, which
+     * can only satisfy platform-scoped permissions. revokeOrgAccess therefore
+     * always fails with PERMISSION_DENIED on the system channel; this RPC is the
+     * sanctioned path, mirroring how bootstrapPolicy is the system-path twin of
+     * create (see https://github.com/stigmer/stigmer/issues/332).
+     *
+     * The operation (identical to revokeOrgAccess after authorization):
+     * 1. Validates can_bootstrap_iam permission on platform:stigmer
+     * 2. Loads all policies where the identity account is principal within the org
+     *    scope, plus policies directly on the organization itself
+     * 3. Deletes all matching policies from MongoDB
+     * 4. Removes all corresponding tuples from OpenFGA (idempotent if none exist)
+     *
+     * Authorization:
+     * - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
+     * - This is typically only granted to platform services (machine accounts)
+     *
+     * Use Cases:
+     * - Federated account deprovisioning (deprovisionFederatedAccount's revoke step)
+     * - Any platform-driven offboarding that runs under system credentials
+     *
+     * End-user member removal must use revokeOrgAccess, which checks
+     * can_grant_access on the organization.
+     *
+     * Input: RevokeOrgAccessInput with identity_account_id and organization_id
+     * Output: Empty (google.protobuf.Empty)
+     *
+     * @generated from rpc ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController.bootstrapRevokeOrgAccess
+     */
+    bootstrapRevokeOrgAccess: {
+        methodKind: "unary";
+        input: typeof RevokeOrgAccessInputSchema;
+        output: typeof EmptySchema;
+    };
 }>;

package/ai/stigmer/iam/iampolicy/v1/command_pb.js

@@ -11,7 +11,7 @@ import { file_google_protobuf_empty } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file ai/stigmer/iam/iampolicy/v1/command.proto.
  */
-export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMswGChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
+export const file_ai_stigmer_iam_iampolicy_v1_command = /*@__PURE__*/ fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMpsIChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKCAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IiTCuBggCAQqHHVuYXV0aG9yaXplZCB0byBncmFudCBhY2Nlc3MSgwEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjGiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSIlwrgYIQgEKh11bmF1dGhvcml6ZWQgdG8gcmV2b2tlIGFjY2VzcxLCAQoPYm9vdHN0cmFwUG9saWN5EiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IlvCuBhXCBEQHypIdW5hdXRob3JpemVkIHRvIGJvb3RzdHJhcCBwb2xpY3kgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEsQBChdjbGVhbnVwUmVzb3VyY2VQb2xpY2llcxIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZhoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSJkwrgYYAgREB8qUXVuYXV0aG9yaXplZCB0byBjbGVhbnVwIHJlc291cmNlIHBvbGljaWVzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchKQAQoPcmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IjLCuBguCAQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxLMAQoYYm9vdHN0cmFwUmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImXCuBhhCBEQHypSdW5hdXRob3JpemVkIHRvIHJldm9rZSBvcmdhbml6YXRpb24gYWNjZXNzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z", [file_ai_stigmer_commons_apiresource_rpc_service_options, file_ai_stigmer_commons_rpc_method_options, file_ai_stigmer_iam_iampolicy_v1_api, file_ai_stigmer_iam_iampolicy_v1_io, file_ai_stigmer_iam_iampolicy_v1_spec, file_google_protobuf_empty]);
 /**
  * IAM Policy Command Controller
  *

package/ai/stigmer/iam/iampolicy/v1/command_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,stCAAstC,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEx9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAmMlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"command_pb.js","sourceRoot":"","sources":["../../../../../../ai/stigmer/iam/iampolicy/v1/command_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sHAAsH;AACtH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uDAAuD,EAAE,MAAM,wDAAwD,CAAC;AACjI,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAEvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE;;GAEG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAY,aAAa,CAC5E,QAAQ,CAAC,0+CAA0+C,EAAE,CAAC,uDAAuD,EAAE,0CAA0C,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAE5uD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAkPlC,aAAa,CAChB,WAAW,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/platform/v1/server_info_pb.d.ts

@@ -183,8 +183,10 @@ export declare const GetRunnerScopedTokenInputSchema: GenMessage<GetRunnerScoped
  * @internal
  * Cloud authorizes against the pool claim record, not FGA: the pool_sandboxes
  * row for the caller token's pool_member_id must be CLAIMED for exactly this
- * session_id (the DB is the authorization source), and the minted session
- * token's TTL is the window-covering value recorded on that row at claim time.
+ * session_id (the DB is the authorization source). Identity and org are minted
+ * from the values the claimer recorded on that row — never from the client —
+ * and the TTL is the config-owned standard sandbox TTL, like every session
+ * token (stigmer-cloud#256; renewal, not lifetime, carries long conversations).
  * OSS has no pool and mints nothing (empty output, presence-based contract).
  *
  * @generated from message ai.stigmer.platform.v1.PoolClaim
@@ -228,9 +230,10 @@ export declare const PoolClaimSchema: GenMessage<PoolClaim>;
  * the same of its workflow_sandboxes row. The record IS the revocation
  * lever: when the lifecycle reconciler reaps the sandbox, renewal dies with
  * it, so a credential's renewable lifetime is exactly its sandbox's
- * lifetime. Minted TTL is the standard sandbox TTL (not window-covering) —
- * renewal is what makes short TTLs sufficient. OSS has no signing key and
- * mints nothing (empty output, presence-based contract).
+ * lifetime. Minted TTL is the standard sandbox TTL — every mint path uses it
+ * (stigmer-cloud#256), and renewal is what makes short TTLs sufficient. OSS
+ * has no signing key and mints nothing (empty output, presence-based
+ * contract).
  *
  * @generated from message ai.stigmer.platform.v1.TokenRenewal
  */

package/ai/stigmer/platform/v1/server_info_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,yuDAAyuD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUh0D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA6B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAoC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA8F/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server_info_pb.js","sourceRoot":"","sources":["../../../../../ai/stigmer/platform/v1/server_info_pb.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gHAAgH;AAChH,oBAAoB;AAGpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAGrF;;GAEG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAY,aAAa,CAC3E,QAAQ,CAAC,yuDAAyuD,EAAE,CAAC,0CAA0C,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAUh0D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmC,aAAa,CACnF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAuB1D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,aAAa,CACrF,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAW1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA8C,aAAa,CACzG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA8D1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,aAAa,CAC3G,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAwD1D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAA0C,aAAa,CACjG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA+B1D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0B,aAAa,CACjE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAqC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,aAAa,CACvE,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AA2C1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2C,aAAa,CACnG,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,aAqBX;AArBD,WAAY,aAAa;IACvB;;OAEG;IACH,6FAA8B,CAAA;IAE9B;;;;;OAKG;IACH,+CAAO,CAAA;IAEP;;;;;OAKG;IACH,mDAAS,CAAA;AACX,CAAC,EArBW,aAAa,KAAb,aAAa,QAqBxB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B,aAAa,CACtE,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GA8F/B,aAAa,CAChB,WAAW,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC"}

package/ai/stigmer/search/v1/io_pb.d.ts

@@ -31,12 +31,12 @@ export type SearchRequest = Message<"ai.stigmer.search.v1.SearchRequest"> & {
      *
      * Behavior:
      * - Empty: Search all searchable kinds (discover mode)
-     *   Searchable kinds: agent, skill, mcp_server, workflow
      * - Single kind: Search only that resource type
      * - Multiple kinds: Search specified types
      *
-     * @internal
-     * Invalid kinds are silently ignored (allows forward compatibility).
+     * The searchable set is edition-defined (the cloud and open-source servers
+     * each publish their own); kinds outside it are silently ignored
+     * (allows forward compatibility).
      *
      * @generated from field: repeated ai.stigmer.commons.apiresource.apiresourcekind.ApiResourceKind kinds = 1;
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/protos",
-  "version": "3.10.0",
+  "version": "3.11.0",
   "description": "Generated TypeScript protobuf stubs for Stigmer APIs",
   "license": "Apache-2.0",
   "type": "module",