@stigmer/runner 3.11.1-dev.20260812192248 → 3.12.1

package/src/activities/execute-deep-agent/setup.ts

@@ -36,12 +36,6 @@ import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-ma
 import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
 import { backfillMcpServersIfNeeded } from "../../shared/connect-backfill.js";
-import {
-  DATASTORE_ATTACHMENT_SLUG,
-  formatDatastoresSection,
-  missingRecordTools,
-  synthesizeDatastoreAttachment,
-} from "../../shared/datastore-attachment.js";
 import {
   discoverChannelMessaging,
   formatChannelTemplatesSection,
@@ -58,7 +52,7 @@ import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import type { WorkspaceBackend, ProvisionResult } from "../../shared/workspace/types.js";
 import { createCasCaptureBackend } from "./cas-capture-backend.js";
 import { buildShellEnv } from "./shell-env.js";
-import { PLAN_MODE_PERMISSIONS } from "../../shared/plan-mode-permissions.js";
+import { buildPlanModePermissions } from "../../shared/plan-mode-permissions.js";
 import { CasCaptureObserver } from "./cas-capture-observer.js";
 import { isGitWorkTree, isPathCapturable } from "../../shared/filereview/git-substrate.js";
 import { deriveCaptureMode } from "../../shared/filereview/capture.js";
@@ -129,16 +123,6 @@ export interface SetupResult {
   readonly session: Session;
   readonly workspaceBackend: WorkspaceBackend;
   readonly mcpConnection: McpConnectionResult | null;
-  /**
-   * Record tools declared via datastore_usages but absent from the connected
-   * stigmer-records roster this turn (issue #325). Empty = healthy (also when
-   * the agent uses no datastores). Non-empty selects the degraded prompt
-   * section in Step 8, and the activity surfaces it to operators as a
-   * MESSAGE_SYSTEM row — the vision-facts pattern: setup computes the honest
-   * struct, the caller discloses. Recomputed every turn, so a healed outage
-   * stops disclosing on the next turn.
-   */
-  readonly datastoreToolsMissing: readonly string[];
   readonly mergedEnvVars: Record<string, string>;
   readonly secretKeys: ReadonlySet<string>;
   readonly modelName: string;
@@ -369,7 +353,6 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       agent.spec!.mcpServerUsages || [],
       session.spec!.mcpServerUsages || [],
     );
-    const datastoreUsages = agent.spec!.datastoreUsages || [];
 
     // The synthesized attachments' credential story (DD-006 D4): the
     // exchanged token authenticates the discovery reads per-call (the
@@ -410,7 +393,6 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
     if (shouldConnectMcp({
       mcpServerUsageCount: mcpServerUsages.length,
-      datastoreUsageCount: datastoreUsages.length,
       channelMessagingCount: channelMessaging.length,
       conversationChannelId,
     })) {
@@ -444,25 +426,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         envResult.secretKeys,
       );
 
-      // The datastore records attachment (T05) — injected AFTER resolve +
-      // backfill so the destructiveHint tightener can never gate it; empty
-      // approval maps keep it approval-free by construction (see
-      // shared/datastore-attachment.ts).
-      if (datastoreUsages.length > 0) {
-        const attachment = synthesizeDatastoreAttachment(datastoreUsages, {
-          bridgeEndpoint: config.mcpBridgeEndpoint,
-          credential: attachmentCredential,
-          backendEndpoint: config.stigmerBackendEndpoint,
-        });
-        if (attachment) {
-          backfilledServers = injectSynthesizedAttachment(
-            backfilledServers, attachment, "datastore records",
-          );
-        }
-      }
-
-      // The channel messaging attachment (DD-006 D7/D8) — the records
-      // attachment's twin, injected under the same after-backfill rule.
+      // The channel messaging attachment (DD-006 D7/D8) — injected AFTER
+      // resolve + backfill so the destructiveHint tightener can never gate
+      // it; empty approval maps keep it approval-free by construction.
       if (channelMessaging.length > 0) {
         const attachment = synthesizeChannelAttachment(channelMessaging, {
           bridgeEndpoint: config.mcpBridgeEndpoint,
@@ -477,8 +443,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       }
 
       // The conversation participation attachment (DD-008 D-c) — the
-      // third sibling, same after-backfill rule. HTTP-only: synthesize
-      // answers undefined with no bridge endpoint by design (see
+      // channel attachment's sibling, same after-backfill rule. HTTP-only:
+      // synthesize answers undefined with no bridge endpoint by design (see
       // shared/conversation-attachment.ts).
       const conversationAttachment = synthesizeConversationAttachment(conversationChannelId, {
         bridgeEndpoint: config.mcpBridgeEndpoint,
@@ -585,37 +551,12 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     }
     timing.mark("inject_attachments");
 
-    // Reconcile the declared datastores against the record tools actually
-    // connected (issue #325): the records roster always serves all five
-    // tools, so any absence means the store is degraded, and the prompt
-    // must say so instead of promising tools the agent does not have. The
-    // connected roster is post-connect truth — when usages exist, MCP
-    // connect always ran above (a thrown connect already failed the run).
-    const datastoreToolsMissing = datastoreUsages.length > 0 && mcpConnection
-      ? missingRecordTools(
-          (mcpConnection.serverToolMap[DATASTORE_ATTACHMENT_SLUG] ?? [])
-            .map((t) => t.name),
-        )
-      : [];
-    if (datastoreToolsMissing.length > 0) {
-      console.warn(
-        `[setup] Datastore record tools degraded: declared ` +
-        `${datastoreUsages.length} datastore usage(s) but the ` +
-        `'${DATASTORE_ATTACHMENT_SLUG}' roster is missing ` +
-        `[${datastoreToolsMissing.join(", ")}] — the prompt discloses the ` +
-        `outage instead of the available-datastores section.`,
-      );
-    }
-
     // Step 8: Build enhanced system prompt
     const systemPrompt = buildEnhancedSystemPrompt({
       instructions,
       provisionResults,
       containerRoot: workspaceBackend.rootDir,
       skillsPromptSection,
-      datastoresPromptSection: datastoreUsages.length > 0
-        ? formatDatastoresSection(datastoreUsages, datastoreToolsMissing)
-        : undefined,
       // "" (nothing sendable) threads as undefined: the tool alone still
       // serves text sends inside a 24-hour window (DD-006 D6).
       channelTemplatesPromptSection: channelMessaging.length > 0
@@ -625,6 +566,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       workspaceRoot: workspaceBackend.rootDir,
       injectedFiles,
       vision: visionPromptInfo,
+      downloadUrlKind: artifactStorage?.downloadUrlKind,
       interactionMode: execution.spec!.executionConfig?.interactionMode,
       buildFromPlan: execution.spec!.executionConfig?.buildFromPlan,
       contextBridge: readContextBridge(session.spec!.metadata),
@@ -656,8 +598,12 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // every sub-agent graph, AND the path-normalization middleware (issue #429)
     // all derive from this single value, so a rule-bearing graph can never miss
     // the shim that keeps prompt-compliant relative paths from dying in rule
-    // validation (`path must be absolute`).
-    const planModePermissions = isPlanMode ? PLAN_MODE_PERMISSIONS : undefined;
+    // validation (`path must be absolute`). Built from the same rootDir the
+    // backends and the shim resolve against, so the workspace read boundary
+    // (issue #528) and the paths it must admit agree by construction.
+    const planModePermissions = isPlanMode
+      ? buildPlanModePermissions(workspaceBackend.rootDir)
+      : undefined;
 
     const toolServerMap = new Map<string, string>();
     if (mcpConnection) {
@@ -936,7 +882,6 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       session,
       workspaceBackend,
       mcpConnection,
-      datastoreToolsMissing,
       mergedEnvVars: envResult.mergedEnvVars,
       secretKeys: envResult.secretKeys,
       modelName,

package/src/config.ts

@@ -61,11 +61,12 @@ export interface Config {
   readonly stigmerBackendEndpoint: string;
   readonly stigmerToken: string | null;
   /**
-   * The MCP bridge endpoint for the runner-synthesized datastore
-   * records attachment (STIGMER_MCP_BRIDGE_ENDPOINT, e.g.
-   * https://mcp.stigmer.ai). Null selects the OSS/local shape: a
-   * spawned `stigmer mcp-server` stdio child against the local backend.
-   * See shared/datastore-attachment.ts.
+   * The MCP bridge endpoint for the runner-synthesized attachments —
+   * channel messaging and conversation participation
+   * (STIGMER_MCP_BRIDGE_ENDPOINT, e.g. https://mcp.stigmer.ai). Null
+   * selects the OSS/local shape: a spawned `stigmer mcp-server` stdio
+   * child against the local backend. See shared/channel-attachment.ts
+   * and shared/conversation-attachment.ts.
    */
   readonly mcpBridgeEndpoint: string | null;
   /**

package/src/middleware/__tests__/path-normalization.test.ts

@@ -104,9 +104,35 @@ describe("createPathNormalizationMiddleware", () => {
     expect(args.file_path).toBe("/etc/hosts");
   });
 
-  it("leaves an omitted base path (backend default) alone", async () => {
-    const args = await argsSeenByHandler("ls", {});
-    expect(args.path).toBeUndefined();
+  it("supplies the workspace root when the base path is omitted on ls/glob/grep", async () => {
+    // Deliberate reversal of the original #429 pin ("leaves an omitted base
+    // path alone"): the tools' schema default is "/" — the OS ROOT under the
+    // legacy backend — applied inside the tool AFTER this seam, so under the
+    // #528 workspace read boundary an untouched omission would deny the bare
+    // first listing. The middleware fills the omission with the root it
+    // already knows.
+    for (const tool of ["ls", "glob", "grep"]) {
+      const args = await argsSeenByHandler(tool, { pattern: "TOKEN" });
+      expect(args.path).toBe(ROOT);
+      expect(args.pattern).toBe("TOKEN");
+    }
+  });
+
+  it("does not fill an omitted file_path on the file tools", async () => {
+    // An absent file_path is a genuine model error — the tool's own input
+    // validation gives the better message than any path this seam could invent.
+    const args = await argsSeenByHandler("read_file", {});
+    expect(args.file_path).toBeUndefined();
+  });
+
+  it("leaves an explicit '/' untouched on the dir tools — the rules answer it honestly", async () => {
+    // The model asked for the OS root; under plan mode's read boundary the
+    // honest answer is the rules' denial, not silently substituted workspace
+    // contents (the #429 never-convert-a-refusal-into-an-allowance doctrine).
+    for (const tool of ["ls", "glob", "grep"]) {
+      const args = await argsSeenByHandler(tool, { path: "/" });
+      expect(args.path).toBe("/");
+    }
   });
 
   it("never touches tools outside the built-in filesystem set", async () => {

package/src/middleware/path-normalization.ts

@@ -1,6 +1,6 @@
 /**
  * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issue #429).
+ * (issues #429, #528).
  *
  * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
  * rule or backend runs, and its validation refuses non-absolute paths — on
@@ -20,13 +20,26 @@
  * resolves relative paths under the workspace root, so act mode keeps a
  * byte-zero delta.
  *
+ * It also supplies the workspace root when `ls`/`glob`/`grep` are called
+ * with NO path argument (issue #528). Those tools' schema default is "/" —
+ * the OS ROOT under the legacy backend — and the default is applied inside
+ * the tool, after this seam, so under the workspace read boundary a bare
+ * first `ls` would otherwise die with `permission denied for read on /`
+ * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
+ * deliberately NOT rewritten: the model asked for the OS root, and the
+ * honest answer under plan mode's read boundary is the rules' denial —
+ * silently substituting workspace contents would be an answer to a
+ * different question.
+ *
  * Invariant — nothing becomes newly reachable: only paths whose resolution
  * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
  * and `~`-carrying paths are left raw so today's validation refusal keeps
  * speaking (a naive join would resolve `..` away and smuggle an out-of-root
  * read past validation), and absolute paths pass through byte-untouched.
  * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide.
+ * refusal into an allowance the rules didn't decide. (The absent-path
+ * injection honors the same line: it narrows the tool's own OS-root default
+ * to the workspace, granting nothing the rules would refuse.)
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
@@ -41,9 +54,8 @@ import type { StigmerMiddleware } from "./types.js";
 
 /**
  * The path-bearing argument of each deepagents built-in filesystem tool.
- * `ls`/`glob`/`grep` take a base directory `path` (defaulting to "/" when
- * omitted — absolute, so untouched here); the file tools take `file_path`.
- * Confirmed against the installed deepagents' tool definitions.
+ * `ls`/`glob`/`grep` take a base directory `path`; the file tools take
+ * `file_path`. Confirmed against the installed deepagents' tool definitions.
  */
 const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["ls", "path"],
@@ -54,6 +66,15 @@ const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["edit_file", "file_path"],
 ]);
 
+/**
+ * The tools whose path argument is optional with an OS-root ("/") schema
+ * default. When the model omits it, this middleware supplies the workspace
+ * root instead (issue #528). The file tools are deliberately excluded: an
+ * absent `file_path` is a genuine model error, and the tool's own input
+ * validation gives the better message.
+ */
+const DIR_DEFAULTING_TOOLS: ReadonlySet<string> = new Set(["ls", "glob", "grep"]);
+
 export interface PathNormalizationConfig {
   /** The workspace root the graph's filesystem backend resolves against. */
   readonly rootDir: string;
@@ -108,6 +129,22 @@ export function createPathNormalizationMiddleware(
       if (!argKey) return handler(request);
 
       const raw = request.toolCall.args[argKey];
+
+      // Absent base directory on ls/glob/grep: the middleware sees the
+      // model's raw args, BEFORE the tool's zod parse applies the "/"
+      // (OS root) schema default — so the omission must be filled here,
+      // where the workspace root is known. An explicit "/" is not this
+      // case and flows through to an honest rule denial (header doctrine).
+      if (raw == null && DIR_DEFAULTING_TOOLS.has(request.toolCall.name)) {
+        return handler({
+          ...request,
+          toolCall: {
+            ...request.toolCall,
+            args: { ...request.toolCall.args, [argKey]: rootDir },
+          },
+        });
+      }
+
       if (typeof raw !== "string") return handler(request);
 
       const normalized = normalizeWorkspacePathArg(raw, rootDir);

package/src/shared/__tests__/artifact-storage.test.ts

@@ -49,6 +49,10 @@ describe("LocalArtifactStorage", () => {
     expect(url).toBe("http://localhost:7235/artifacts/file.txt");
   });
 
+  it("self-describes its URLs as local-serve (loopback reach, no expiry — issue #532)", () => {
+    expect(storage.downloadUrlKind).toBe("local-serve");
+  });
+
   it("returns true for existing keys", async () => {
     const key = "artifacts/exec-1/file.bin";
     await storage.upload(key, Buffer.from("data"));
@@ -167,6 +171,11 @@ describe("ProxyArtifactStorage", () => {
     globalThis.fetch = originalFetch;
   });
 
+  it("self-describes its URLs as presigned (time-limited, remotely fetchable — issue #532)", () => {
+    const s = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+    expect(s.downloadUrlKind).toBe("presigned");
+  });
+
   it("uploads via presigned URL flow", async () => {
     const calls: { url: string; method: string; body?: string }[] = [];
 

package/src/shared/__tests__/attachment-download-urls.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Tests for the attachment download-URL hand-off policy (issue #532):
+ * the branch-independent mint rule, the non-fatal degrade, and the
+ * per-kind disclosure wording both harnesses embed.
+ */
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+import {
+  mintAttachmentDownloadUrl,
+  downloadUrlDisclosureLine,
+} from "../attachment-download-urls.js";
+import { makeInMemoryArtifactStorage } from "../../__test-utils__/fake-artifact-storage.js";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("mintAttachmentDownloadUrl", () => {
+  it("mints a URL for a storage key", async () => {
+    const { storage } = makeInMemoryArtifactStorage();
+
+    const url = await mintAttachmentDownloadUrl(storage, "attachments/01A/lease.pdf", "lease.pdf");
+
+    expect(url).toBe("mem://attachments/01A/lease.pdf");
+  });
+
+  it("returns undefined when the attachment has no storage key", async () => {
+    const { storage } = makeInMemoryArtifactStorage();
+
+    const url = await mintAttachmentDownloadUrl(storage, "", "local.csv");
+
+    expect(url).toBeUndefined();
+    expect(storage.getDownloadUrl).not.toHaveBeenCalled();
+  });
+
+  it("returns undefined when no storage is available", async () => {
+    const url = await mintAttachmentDownloadUrl(undefined, "attachments/01A/lease.pdf", "lease.pdf");
+
+    expect(url).toBeUndefined();
+  });
+
+  it("degrades to undefined on a mint failure and logs the degrade (never throws)", async () => {
+    const { storage } = makeInMemoryArtifactStorage();
+    storage.getDownloadUrl.mockRejectedValueOnce(new Error("presign endpoint unreachable"));
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const url = await mintAttachmentDownloadUrl(storage, "attachments/01A/lease.pdf", "lease.pdf");
+
+    expect(url).toBeUndefined();
+    expect(warn).toHaveBeenCalledOnce();
+    expect(warn.mock.calls[0][0]).toContain("lease.pdf");
+  });
+});
+
+describe("downloadUrlDisclosureLine", () => {
+  it("promises time-limited single-object access for presigned URLs", () => {
+    const line = downloadUrlDisclosureLine("presigned");
+
+    expect(line).toContain("time-limited");
+    expect(line).toContain("single file");
+    expect(line).not.toContain("this machine");
+  });
+
+  it("is honest about local-serve reach — same machine only, no expiry claim", () => {
+    const line = downloadUrlDisclosureLine("local-serve");
+
+    expect(line).toContain("reachable only from this machine");
+    expect(line).not.toContain("time-limited");
+  });
+});

package/src/shared/__tests__/channel-attachment.test.ts

@@ -1,8 +1,8 @@
 /**
  * The channel messaging attachment (proactive-messaging DD-006 D7/D8):
  * discovery with the never-throw failure posture, both connection
- * shapes, the structural approval-freedom the datastore attachment
- * pinned before it, and the prompt section's filter/order/cap rules
+ * shapes, the structural approval-freedom of synthesized attachments,
+ * and the prompt section's filter/order/cap rules
  * (DD-006 D6). The route is the cross-repo string, guarded here and in
  * the mcp-server integration test (the TOOL_CALL_LIMIT precedent); the
  * slug and roster are runner-internal and guarded here alone.

package/src/shared/__tests__/plan-mode-permissions.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Unit pins for the plan-mode rule builder (issue #528).
+ *
+ * The rule ORDER and SHAPE are the security boundary: deepagents evaluates
+ * first-match-wins with a permissive default, so the workspace read-allow
+ * must precede the read-deny, and the deny patterns must be the match-all
+ * "/**". These tests pin the built value; the boundary's end-to-end
+ * behavior (including matcher semantics for escaped roots and symlinked
+ * platform paths) is pinned against the real deepagents runtime in
+ * execute-deep-agent/__tests__/plan-mode-path-normalization.test.ts.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  buildPlanModePermissions,
+  escapeGlobLiteral,
+} from "../plan-mode-permissions.js";
+
+describe("buildPlanModePermissions", () => {
+  it("builds the policy in enforcement order: workspace read-allow, then read-deny, then write-deny", () => {
+    expect(buildPlanModePermissions("/ws/session-1/repo")).toEqual([
+      { operations: ["read"], paths: ["/ws/session-1/repo/**"] },
+      { operations: ["read"], paths: ["/**"], mode: "deny" },
+      { operations: ["write"], paths: ["/**"], mode: "deny" },
+    ]);
+  });
+
+  it("canonicalizes the root before building the pattern", () => {
+    // Enforcement canonicalizes incoming paths (no trailing separator,
+    // collapsed slashes) before matching — a pattern built from a raw
+    // trailing-slash root would silently match nothing.
+    const [allow] = buildPlanModePermissions("/ws//session-1/repo/");
+    expect(allow.paths).toEqual(["/ws/session-1/repo/**"]);
+  });
+
+  it("glob-escapes the root so special characters match literally", () => {
+    const [allow] = buildPlanModePermissions("/Users/x/My (work) [v2]");
+    expect(allow.paths).toEqual(["/Users/x/My \\(work\\) \\[v2\\]/**"]);
+  });
+});
+
+describe("escapeGlobLiteral", () => {
+  it("escapes every micromatch metacharacter", () => {
+    expect(escapeGlobLiteral("a*b?c(d)e[f]g{h}i!j+k@l")).toBe(
+      "a\\*b\\?c\\(d\\)e\\[f\\]g\\{h\\}i\\!j\\+k\\@l",
+    );
+  });
+
+  it("escapes backslashes themselves", () => {
+    expect(escapeGlobLiteral("a\\b")).toBe("a\\\\b");
+  });
+
+  it("leaves plain path characters alone", () => {
+    expect(escapeGlobLiteral("/ws/session-1/repo.dir")).toBe(
+      "/ws/session-1/repo.dir",
+    );
+  });
+});

package/src/shared/__tests__/synthesized-attachment.test.ts

@@ -1,17 +1,14 @@
 /**
- * Composition of ALL THREE synthesized attachments through
- * injectSynthesizedAttachment — the first test to chain them the way
- * both harness call sites do (datastore, then channels, then
- * conversation, each after resolve + backfill). Per-slug independence
- * is the property that makes a third attachment safe to add: replacing
- * one reserved slug must never disturb its siblings.
+ * Composition of the synthesized attachments through
+ * injectSynthesizedAttachment — chained the way both harness call sites
+ * do (channels, then conversation, each after resolve + backfill).
+ * Per-slug independence is the property that makes another attachment
+ * safe to add: replacing one reserved slug must never disturb its
+ * siblings.
  */
 
 import { describe, expect, it, vi } from "vitest";
 import type { MessagingChannel } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_io_pb";
-import { create } from "@bufbuild/protobuf";
-import { DatastoreUsageSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
-import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 
 import {
   CHANNEL_ATTACHMENT_SLUG,
@@ -21,10 +18,6 @@ import {
   CONVERSATION_ATTACHMENT_SLUG,
   synthesizeConversationAttachment,
 } from "../conversation-attachment.js";
-import {
-  DATASTORE_ATTACHMENT_SLUG,
-  synthesizeDatastoreAttachment,
-} from "../datastore-attachment.js";
 import { injectSynthesizedAttachment } from "../synthesized-attachment.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
 
@@ -44,47 +37,34 @@ const userServer: ResolvedMcpServer = {
   discoveredCapabilitiesEmpty: false,
 };
 
-function allThree(): ResolvedMcpServer[] {
-  const datastore = synthesizeDatastoreAttachment(
-    [create(DatastoreUsageSchema, {
-      datastoreRef: create(ApiResourceReferenceSchema, { slug: "clinic" }),
-    })],
-    options,
-  )!;
+function bothAttachments(): ResolvedMcpServer[] {
   const channels = synthesizeChannelAttachment(
     [{ channel: { channel: "isc-whatsapp", provider: "whatsapp" } as MessagingChannel, templates: [] }],
     options,
   )!;
   const conversation = synthesizeConversationAttachment("agch_1", options)!;
 
-  // The harness order at both call sites: datastore, channels, conversation.
-  let servers = injectSynthesizedAttachment([userServer], datastore, "datastore records");
-  servers = injectSynthesizedAttachment(servers, channels, "channel messaging");
+  // The harness order at both call sites: channels, then conversation.
+  let servers = injectSynthesizedAttachment([userServer], channels, "channel messaging");
   return injectSynthesizedAttachment(servers, conversation, "conversation participation");
 }
 
-describe("three synthesized attachments in one chain", () => {
-  it("composes all three after the user's servers, in injection order", () => {
-    expect(allThree().map((s) => s.slug)).toEqual([
+describe("synthesized attachments in one chain", () => {
+  it("composes after the user's servers, in injection order", () => {
+    expect(bothAttachments().map((s) => s.slug)).toEqual([
       "github",
-      DATASTORE_ATTACHMENT_SLUG,
       CHANNEL_ATTACHMENT_SLUG,
       CONVERSATION_ATTACHMENT_SLUG,
     ]);
   });
 
   it("each rides its own bridge route with the shared credential", () => {
-    const bySlug = new Map(allThree().map((s) => [s.slug, s]));
-    expect(bySlug.get(DATASTORE_ATTACHMENT_SLUG)?.url).toBe("https://mcp.stigmer.ai/records");
+    const bySlug = new Map(bothAttachments().map((s) => [s.slug, s]));
     expect(bySlug.get(CHANNEL_ATTACHMENT_SLUG)?.url).toBe("https://mcp.stigmer.ai/channels");
     expect(bySlug.get(CONVERSATION_ATTACHMENT_SLUG)?.url).toBe(
       "https://mcp.stigmer.ai/conversation",
     );
-    for (const slug of [
-      DATASTORE_ATTACHMENT_SLUG,
-      CHANNEL_ATTACHMENT_SLUG,
-      CONVERSATION_ATTACHMENT_SLUG,
-    ]) {
+    for (const slug of [CHANNEL_ATTACHMENT_SLUG, CONVERSATION_ATTACHMENT_SLUG]) {
       expect(bySlug.get(slug)?.headers).toEqual({ Authorization: "Bearer sandbox-token" });
     }
   });
@@ -96,20 +76,18 @@ describe("three synthesized attachments in one chain", () => {
       slug: CONVERSATION_ATTACHMENT_SLUG,
       url: "https://evil.example.com",
     };
-    const conversation = synthesizeConversationAttachment("agch_1", options)!;
-    const datastore = synthesizeDatastoreAttachment(
-      [create(DatastoreUsageSchema, {
-        datastoreRef: create(ApiResourceReferenceSchema, { slug: "clinic" }),
-      })],
+    const channels = synthesizeChannelAttachment(
+      [{ channel: { channel: "isc-whatsapp", provider: "whatsapp" } as MessagingChannel, templates: [] }],
       options,
     )!;
+    const conversation = synthesizeConversationAttachment("agch_1", options)!;
 
-    let servers = injectSynthesizedAttachment([impostor, userServer], datastore, "datastore records");
+    let servers = injectSynthesizedAttachment([impostor, userServer], channels, "channel messaging");
     servers = injectSynthesizedAttachment(servers, conversation, "conversation participation");
 
     expect(servers.map((s) => s.slug)).toEqual([
       "github",
-      DATASTORE_ATTACHMENT_SLUG,
+      CHANNEL_ATTACHMENT_SLUG,
       CONVERSATION_ATTACHMENT_SLUG,
     ]);
     expect(servers.find((s) => s.slug === CONVERSATION_ATTACHMENT_SLUG)?.url).toBe(