@stigmer/server 3.14.0-dev.20260910084630

package/src/domain/platform/controller.ts

@@ -0,0 +1,283 @@
+/**
+ * Platform controller — ports pkg/domain/platform: the server's
+ * self-description surface (NOT a resource domain — no store, no
+ * pipelines; three direct handlers on PlatformQueryController).
+ *
+ * Proven by platform.conformance.test.ts (getServerInfo +
+ * getRunnerBootstrapConfig shapes; getRunnerScopedToken is deliberately
+ * excluded there — its arms are exercised mid-execution) and
+ * __tests__/platform.test.ts (the fail-soft mint matrix, the #15
+ * composed-server pattern).
+ *
+ * getRunnerScopedToken is the mint side of the runner-token lane
+ * (oss#535) — the seam src/runnerauth/ reserved for this sub-project. OSS
+ * has no caller identity, so unlike the cloud exchange there is no
+ * credential to verify: any caller naming an execution receives a token
+ * for it. On a single-user server the token is the LANE DISCRIMINATOR that
+ * lets the EC read RPCs redact by default without breaking the runner, not
+ * a trust boundary (DD-004).
+ *
+ * The C4 capability delegation (20260827.09, gate ruling Q1): when the
+ * composed provider defines exchangeScopedToken / bootstrapCredentials,
+ * this controller delegates the exchange arms and the bootstrap
+ * credential fields to it wholesale — the cloud's per-arm caller-class
+ * gating, row authorization, and multi-lane minting are POLICY, not
+ * contract, and live behind the seam. With neither defined (the OSS
+ * default), every arm below behaves exactly as before; the conformance
+ * suites pin that byte-identity.
+ */
+import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+
+import {
+  GetRunnerBootstrapConfigOutputSchema,
+  GetRunnerScopedTokenOutputSchema,
+  GetServerInfoOutputSchema,
+  PlatformQueryController,
+  ServerEdition,
+} from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import type {
+  GetRunnerBootstrapConfigOutput,
+  GetRunnerScopedTokenInput,
+  GetRunnerScopedTokenOutput,
+  GetServerInfoOutput,
+} from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+
+import type { Logger } from "../../boot/logger.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import type {
+  RunnerCredentialProvider,
+  RunnerScopedTokenRequest,
+} from "../../runnerauth/runner-credential-provider.js";
+import { TOKEN_TYPE_EXECUTION_SCOPED } from "../../runnerauth/runnerauth.js";
+import { SERVER_VERSION } from "./version.js";
+
+export interface PlatformControllerDeps {
+  /**
+   * Temporal coordinates this server runs against, published to embedded
+   * runners. In OSS the server and its runners are co-located, so the
+   * address the server itself dials is the one runners should dial too —
+   * no internal/external split (unlike Stigmer Cloud).
+   */
+  readonly temporalHostPort: string;
+  readonly temporalNamespace: string;
+  /**
+   * Mints the execution-scoped tokens getRunnerScopedToken hands to
+   * runners for the ExecutionContext decrypt lane (oss#535). Keyless
+   * yields the presence-based "not minted" response. (Go also tolerates a
+   * nil service in tests; the composition root here always wires one — a
+   * keyless instance is the modeled disabled state.)
+   */
+  readonly runnerAuthService: RunnerCredentialProvider;
+  /**
+   * The served edition, composition-derived (DD-006; blueprint §11 item
+   * 11): the extension registry declares it and defaults to oss, so the
+   * cloud composition answers `cloud` without forking this controller.
+   */
+  readonly edition: ServerEdition;
+  readonly logger: Logger;
+}
+
+/** Registers the platform query service on the router (routes stage). */
+export function registerPlatformServices(
+  router: ConnectRouter,
+  deps: PlatformControllerDeps,
+): void {
+  router.service(PlatformQueryController, {
+    getServerInfo: () => getServerInfo(deps),
+    getRunnerBootstrapConfig: (_input, ctx) =>
+      getRunnerBootstrapConfig(deps, ctx),
+    getRunnerScopedToken: (input, ctx) =>
+      getRunnerScopedToken(deps, input, ctx),
+  });
+}
+
+/** Go GetServerInfo: the server edition and build version. */
+function getServerInfo(deps: PlatformControllerDeps): GetServerInfoOutput {
+  return create(GetServerInfoOutputSchema, {
+    edition: deps.edition,
+    version: SERVER_VERSION,
+  });
+}
+
+/**
+ * Go GetRunnerBootstrapConfig: the Temporal coordinates an embedded runner
+ * should connect to so it can self-bootstrap from a token alone. The
+ * RunnerAccessToken / TokenType / RunnerAccessTokenExpiresInSeconds fields
+ * are intentionally left empty in OSS: minting an iss=stigmer proxy token
+ * is a cloud-only capability (OSS has no Cursor BiDi proxy to authenticate
+ * against), so OSS runners keep using the token they already hold. The
+ * suite pins the presence-based all-or-nothing coupling of those fields.
+ *
+ * A composed provider with the bootstrapCredentials capability populates
+ * the token and payload-key fields (module header); the coordinates are
+ * OSS-owned either way — they describe THIS deployment's Temporal, not a
+ * credential policy. Capability failures degrade to the empty fields and
+ * never fail the bootstrap the coordinates ride on (the Java handler's
+ * best-effort contract).
+ */
+async function getRunnerBootstrapConfig(
+  deps: PlatformControllerDeps,
+  ctx: HandlerContext,
+): Promise<GetRunnerBootstrapConfigOutput> {
+  const output = create(GetRunnerBootstrapConfigOutputSchema, {
+    temporalAddress: deps.temporalHostPort,
+    temporalNamespace: deps.temporalNamespace,
+  });
+  const bootstrapCredentials =
+    deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);
+  if (bootstrapCredentials === undefined) {
+    return output;
+  }
+  try {
+    const credentials = await bootstrapCredentials(callerIdentityOf(ctx));
+    if (credentials.accessToken !== undefined) {
+      output.runnerAccessToken = credentials.accessToken.token;
+      output.tokenType = "Bearer";
+      output.runnerAccessTokenExpiresInSeconds =
+        credentials.accessToken.expiresInSeconds;
+    }
+    if (credentials.payloadKeys !== undefined) {
+      output.payloadEncryptionKey = credentials.payloadKeys.keyBase64;
+      output.payloadEncryptionKeyId = credentials.payloadKeys.keyId;
+      output.payloadEncryptionSecondaryKey =
+        credentials.payloadKeys.secondaryKeyBase64 ?? "";
+      output.payloadEncryptionSecondaryKeyId =
+        credentials.payloadKeys.secondaryKeyId ?? "";
+    }
+  } catch (error) {
+    deps.logger.warn(
+      "Bootstrap credentials unavailable — answering coordinates without them",
+      { error: error instanceof Error ? error.message : String(error) },
+    );
+  }
+  return output;
+}
+
+/**
+ * Go GetRunnerScopedToken (oss#535): mints a token scoped to one unit of
+ * dispatched work, accepted by the ExecutionContext getByExecutionId
+ * decrypt lane.
+ *
+ * Arms:
+ *   - agent_execution_id / workflow_execution_id: minted. Both ids ARE the
+ *     ExecutionContext's spec.execution_id, so the token binds directly to
+ *     the one EC it may decrypt. (Cloud scopes agent tokens to the parent
+ *     session for warm-pool multi-turn reuse; OSS runners exchange
+ *     immediately before each read, so the tighter per-execution binding
+ *     costs nothing.)
+ *   - pool_claim / renewal / unset scope: the presence-based "not minted"
+ *     shape — OSS has no warm pool, and per-read minting makes renewal
+ *     moot.
+ *
+ * FAIL-SOFT is the contract: empty id, keyless service, or a mint error
+ * all answer the empty output rather than a gRPC error — the runner's
+ * no-credential path treats absence as "proceed tokenless", which degrades
+ * to redacted values (a clear downstream signal), while an error here
+ * would abort the activity.
+ *
+ * With the exchangeScopedToken capability composed, EVERY arm delegates
+ * to the provider (module header): its refusals (wrong credential class,
+ * failed authorization) propagate as the gRPC errors it throws — the
+ * cloud exchange's contract — while its keyless degrade keeps the
+ * presence-based empty output.
+ */
+async function getRunnerScopedToken(
+  deps: PlatformControllerDeps,
+  input: GetRunnerScopedTokenInput,
+  ctx: HandlerContext,
+): Promise<GetRunnerScopedTokenOutput> {
+  const exchange = deps.runnerAuthService.exchangeScopedToken?.bind(
+    deps.runnerAuthService,
+  );
+  if (exchange !== undefined) {
+    const minted = await exchange(
+      exchangeRequestOf(input),
+      callerIdentityOf(ctx),
+    );
+    if (!minted.minted) {
+      return create(GetRunnerScopedTokenOutputSchema);
+    }
+    return create(GetRunnerScopedTokenOutputSchema, {
+      runnerScopedToken: minted.token,
+      tokenType: "Bearer",
+      expiresInSeconds: minted.expiresInSeconds,
+    });
+  }
+
+  let executionId: string;
+  switch (input.scope.case) {
+    case "agentExecutionId":
+      executionId = input.scope.value;
+      break;
+    case "workflowExecutionId":
+      executionId = input.scope.value;
+      break;
+    case "poolClaim":
+    case "renewal":
+    case undefined:
+      // pool_claim, renewal, or an unset scope: nothing OSS mints for.
+      return create(GetRunnerScopedTokenOutputSchema);
+    default: {
+      const exhaustive: never = input.scope;
+      throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+
+  if (
+    executionId === "" ||
+    !deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED)
+  ) {
+    return create(GetRunnerScopedTokenOutputSchema);
+  }
+
+  try {
+    const minted = deps.runnerAuthService.mint(
+      TOKEN_TYPE_EXECUTION_SCOPED,
+      executionId,
+      0,
+    );
+    return create(GetRunnerScopedTokenOutputSchema, {
+      runnerScopedToken: minted.token,
+      tokenType: "Bearer",
+      expiresInSeconds: minted.ttlSeconds,
+    });
+  } catch (error) {
+    deps.logger.warn(
+      "failed to mint runner scoped token — answering not-minted",
+      {
+        executionId,
+        error: error instanceof Error ? error.message : String(error),
+      },
+    );
+    return create(GetRunnerScopedTokenOutputSchema);
+  }
+}
+
+/**
+ * The proto oneof, transcribed to the seam's domain shape (the provider
+ * contract deliberately imports no wire types). Every arm maps
+ * one-to-one, INCLUDING unset — the implementation owns the unset
+ * refusal (Java answers INVALID_ARGUMENT there), so this mapping must
+ * never collapse it into a real arm.
+ */
+function exchangeRequestOf(
+  input: GetRunnerScopedTokenInput,
+): RunnerScopedTokenRequest {
+  switch (input.scope.case) {
+    case "agentExecutionId":
+      return { arm: "agent-execution", executionId: input.scope.value };
+    case "workflowExecutionId":
+      return { arm: "workflow-execution", executionId: input.scope.value };
+    case "poolClaim":
+      return { arm: "pool-claim", sessionId: input.scope.value.sessionId };
+    case "renewal":
+      return { arm: "renewal" };
+    case undefined:
+      return { arm: "unset" };
+    default: {
+      const exhaustive: never = input.scope;
+      throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}

package/src/domain/platform/version.ts

@@ -0,0 +1,21 @@
+/**
+ * Server build version — ports the Go platform package's
+ * `var Version = "dev"` (set at build time via -ldflags).
+ *
+ * The TS equivalent of ldflags is an esbuild `define`: release builds
+ * replace the __STIGMER_SERVER_VERSION__ identifier in scripts/
+ * bundle-slim.mjs (owner-ratified at this sub-project's plan gate), so the
+ * bundle carries its version as a compile-time constant — hermetic, no
+ * package.json read at boot. Unbundled runs (tsx dev mode, vitest) leave
+ * the identifier undefined and fall back to "dev", exactly Go's unstamped
+ * default.
+ */
+
+declare const __STIGMER_SERVER_VERSION__: string | undefined;
+
+/** The version getServerInfo reports (Go platform.Version). */
+export const SERVER_VERSION: string =
+  typeof __STIGMER_SERVER_VERSION__ === "string" &&
+  __STIGMER_SERVER_VERSION__ !== ""
+    ? __STIGMER_SERVER_VERSION__
+    : "dev";

package/src/domain/project/__tests__/project.composed.test.ts

@@ -0,0 +1,381 @@
+/**
+ * Pins the project domain against Go's controller tests — through the REAL
+ * stack: a composed server on an ephemeral port, a native gRPC client, the
+ * full interceptor chain, and REAL orphan deletes through the in-process
+ * command clients' full pipelines.
+ *
+ * The load-bearing pins the conformance suite does NOT cover (it never
+ * touches spec.members or last_reconciliation):
+ *   - every successful apply response carries status.last_reconciliation,
+ *     even as a present-but-EMPTY message — and it is NEVER persisted;
+ *   - apply→prune end to end: a dropped member is actually deleted through
+ *     its owning domain's pipeline; an unresolvable member is silently
+ *     absent from `deleted` while apply still succeeds;
+ *   - members referencing nonexistent resources persist silently (no
+ *     ValidateReferences in any project chain);
+ *   - the create/update pipeline ASYMMETRY: ValidateVisibility and
+ *     NormalizeReferences run on create only;
+ *   - project delete never cascades to members.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import type { Client, Transport } from "@connectrpc/connect";
+import { createGrpcTransport } from "@connectrpc/connect-node";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ProjectCommandController } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/command_pb";
+import { ProjectQueryController } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/query_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import { createLogger } from "../../../boot/logger.js";
+
+const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
+
+let dir: string;
+let server: ComposedServer;
+let transport: Transport;
+let command: Client<typeof ProjectCommandController>;
+let query: Client<typeof ProjectQueryController>;
+let agentQuery: Client<typeof AgentQueryController>;
+let mcpServerQuery: Client<typeof McpServerQueryController>;
+
+beforeAll(async () => {
+  dir = mkdtempSync(path.join(tmpdir(), "project-domain-test-"));
+  server = await composeServer({
+    config: loadConfig({
+      STIGMER_MODEL_REGISTRY_REFRESH: "off",
+      // No engine behind composed tests: 127.0.0.1:1 is deterministically
+      // closed, so boots fail the non-fatal connect fast and can never touch
+      // a live local Temporal (the conformance CRUD harness does the same).
+      TEMPORAL_HOST_PORT: "127.0.0.1:1",
+      DB_PATH: path.join(dir, "stigmer.db"),
+      // Everything filesystem-backed stays inside the test dir — the
+      // defaults resolve into ~/.stigmer, which tests must never touch.
+      STORAGE_PATH: path.join(dir, "storage"),
+      ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
+    }),
+    logger: silentLogger,
+    portOverride: 0,
+    host: "127.0.0.1",
+  });
+  const port = await server.start();
+  transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+  command = createClient(ProjectCommandController, transport);
+  query = createClient(ProjectQueryController, transport);
+  agentQuery = createClient(AgentQueryController, transport);
+  mcpServerQuery = createClient(McpServerQueryController, transport);
+});
+
+afterAll(async () => {
+  await server.shutdown();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+const API_VERSION = "tenancy.stigmer.ai/v1";
+const KIND = "Project";
+const ORG = "local";
+
+let seq = 0;
+function uniqueName(prefix: string): string {
+  seq += 1;
+  return `${prefix} ${seq}`;
+}
+
+interface MemberInit {
+  kind: ApiResourceKind;
+  slug: string;
+  org?: string;
+}
+
+function projectInput(
+  name: string,
+  extras?: { members?: MemberInit[]; visibility?: ApiResourceVisibility },
+) {
+  return {
+    apiVersion: API_VERSION,
+    kind: KIND,
+    metadata: {
+      name,
+      org: ORG,
+      ...(extras?.visibility !== undefined ? { visibility: extras.visibility } : {}),
+    },
+    spec: {
+      description: "created by the domain test",
+      members: (extras?.members ?? []).map((m) => ({
+        kind: m.kind,
+        slug: m.slug,
+        org: m.org ?? ORG,
+      })),
+    },
+  };
+}
+
+async function seedAgent(id: string, slug: string): Promise<void> {
+  await server.store.saveResource(
+    ApiResourceKind.agent,
+    id,
+    AgentSchema,
+    create(AgentSchema, {
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "Agent",
+      metadata: { id, name: slug, slug, org: ORG },
+    }),
+  );
+}
+
+async function seedMcpServer(id: string, slug: string): Promise<void> {
+  await server.store.saveResource(
+    ApiResourceKind.mcp_server,
+    id,
+    McpServerSchema,
+    create(McpServerSchema, {
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "McpServer",
+      metadata: { id, name: slug, slug, org: ORG },
+    }),
+  );
+}
+
+async function grpcCode(run: () => Promise<unknown>): Promise<ConnectError> {
+  try {
+    await run();
+    throw new Error("expected the call to fail");
+  } catch (error) {
+    if (error instanceof ConnectError) {
+      return error;
+    }
+    throw error;
+  }
+}
+
+describe("apply reconciliation summary (Go apply_test.go)", () => {
+  it("first apply reports all members as created and the prj_ id shape", async () => {
+    const applied = await command.apply(
+      projectInput(uniqueName("Members Project"), {
+        members: [
+          { kind: ApiResourceKind.agent, slug: "member-a" },
+          { kind: ApiResourceKind.workflow, slug: "member-b" },
+        ],
+      }),
+    );
+
+    expect(applied.metadata?.id).toMatch(/^prj_[0-9a-z]{26}$/);
+    expect(applied.status?.audit?.specAudit?.event).toBe("created");
+    expect(applied.status?.lastReconciliation).toBeDefined();
+    expect(
+      applied.status?.lastReconciliation?.created.map((r) => r.slug),
+    ).toEqual(["member-a", "member-b"]);
+    expect(applied.status?.lastReconciliation?.updated).toEqual([]);
+    expect(applied.status?.lastReconciliation?.deleted).toEqual([]);
+  });
+
+  it("a no-change apply still carries a PRESENT (empty) summary — and it is never persisted", async () => {
+    const name = uniqueName("Summary Presence");
+    const first = await command.apply(projectInput(name));
+    // No members at all: the summary message must still be present.
+    expect(first.status?.lastReconciliation).toBeDefined();
+    expect(first.status?.lastReconciliation?.created).toEqual([]);
+    expect(first.status?.lastReconciliation?.deleted).toEqual([]);
+
+    // Response-only: the persisted resource has NO last_reconciliation.
+    const fetched = await query.get({ value: first.metadata!.id });
+    expect(fetched.status?.lastReconciliation).toBeUndefined();
+
+    // And the second apply's summary is computed fresh from the delta.
+    const second = await command.apply(projectInput(name));
+    expect(second.metadata?.id).toBe(first.metadata?.id);
+    expect(second.status?.audit?.specAudit?.event).toBe("updated");
+    expect(second.status?.lastReconciliation).toBeDefined();
+    expect(second.status?.lastReconciliation?.created).toEqual([]);
+  });
+
+  it("prunes a dropped member FOR REAL through its domain's delete pipeline", async () => {
+    await seedAgent("agt_prune_keep", "prune-keep-agent");
+    await seedMcpServer("mcps_prune_drop", "prune-drop-mcps");
+    const name = uniqueName("Orphan Prune");
+
+    await command.apply(
+      projectInput(name, {
+        members: [
+          { kind: ApiResourceKind.agent, slug: "prune-keep-agent" },
+          { kind: ApiResourceKind.mcp_server, slug: "prune-drop-mcps" },
+        ],
+      }),
+    );
+
+    // The second apply both DROPS the mcpserver and INTRODUCES a new
+    // member, so one wire summary carries created and deleted together.
+    const second = await command.apply(
+      projectInput(name, {
+        members: [
+          { kind: ApiResourceKind.agent, slug: "prune-keep-agent" },
+          { kind: ApiResourceKind.workflow, slug: "prune-new-member" },
+        ],
+      }),
+    );
+
+    expect(
+      second.status?.lastReconciliation?.deleted.map((r) => r.slug),
+    ).toEqual(["prune-drop-mcps"]);
+    expect(
+      second.status?.lastReconciliation?.created.map((r) => r.slug),
+    ).toEqual(["prune-new-member"]);
+
+    // The orphan is GONE (deleted through mcpserver's own pipeline)…
+    const gone = await grpcCode(() =>
+      mcpServerQuery.get({ value: "mcps_prune_drop" }),
+    );
+    expect(gone.code).toBe(Code.NotFound);
+    // …and the retained member is untouched.
+    const kept = await agentQuery.get({ value: "agt_prune_keep" });
+    expect(kept.metadata?.slug).toBe("prune-keep-agent");
+  });
+
+  it("an id-carrying apply captures previous members and prunes on the update path", async () => {
+    await seedAgent("agt_idpath", "idpath-agent");
+    const name = uniqueName("Id Carrying Apply");
+
+    const first = await command.apply(
+      projectInput(name, {
+        members: [{ kind: ApiResourceKind.agent, slug: "idpath-agent" }],
+      }),
+    );
+
+    // Second apply addresses the project by its ID (the CLI's steady-state
+    // shape) with the member dropped — previousMembers must still be
+    // captured from the loaded existing resource.
+    const second = await command.apply({
+      ...projectInput(name),
+      metadata: { id: first.metadata!.id, name, org: ORG },
+    });
+
+    expect(second.metadata?.id).toBe(first.metadata?.id);
+    expect(
+      second.status?.lastReconciliation?.deleted.map((r) => r.slug),
+    ).toEqual(["idpath-agent"]);
+    const gone = await grpcCode(() => agentQuery.get({ value: "agt_idpath" }));
+    expect(gone.code).toBe(Code.NotFound);
+  });
+
+  it("a member dropped via plain UPDATE is stranded — the next apply prunes nothing", async () => {
+    // Update runs NO reconciliation, and apply diffs against the STORED
+    // members: dropping a member through update shrinks the stored list
+    // first, so the later apply computes no orphan and the resource
+    // survives. User-visible Go behavior (update strands, apply prunes).
+    await seedAgent("agt_stranded", "stranded-agent");
+    const name = uniqueName("Update Strands");
+
+    await command.apply(
+      projectInput(name, {
+        members: [{ kind: ApiResourceKind.agent, slug: "stranded-agent" }],
+      }),
+    );
+    await command.update(projectInput(name));
+
+    const applied = await command.apply(projectInput(name));
+    expect(applied.status?.lastReconciliation?.deleted).toEqual([]);
+    const survivor = await agentQuery.get({ value: "agt_stranded" });
+    expect(survivor.metadata?.slug).toBe("stranded-agent");
+  });
+
+  it("an unresolvable orphan is silently absent from deleted; apply still succeeds", async () => {
+    const name = uniqueName("Ghost Member");
+    // No ValidateReferences in any project chain: a member that points at
+    // nothing persists silently (pinned Go behavior).
+    const first = await command.apply(
+      projectInput(name, {
+        members: [{ kind: ApiResourceKind.agent, slug: "ghost-agent" }],
+      }),
+    );
+    expect(first.spec?.members.map((m) => m.slug)).toEqual(["ghost-agent"]);
+
+    const second = await command.apply(projectInput(name));
+    // Resolution failed (nothing to delete) → collected log-only, absent
+    // from the wire's deleted list, and apply SUCCEEDS.
+    expect(second.status?.lastReconciliation).toBeDefined();
+    expect(second.status?.lastReconciliation?.deleted).toEqual([]);
+  });
+});
+
+describe("create/update pipeline asymmetry (create.go vs update.go)", () => {
+  it("create rejects an unsupported visibility level; update IGNORES the carried level", async () => {
+    // Project's kind_meta has no VisibilityConfig → private-only.
+    const rejected = await grpcCode(() =>
+      command.create(
+        projectInput(uniqueName("Visibility Reject"), {
+          visibility: ApiResourceVisibility.visibility_org,
+        }),
+      ),
+    );
+    expect(rejected.code).toBe(Code.InvalidArgument);
+
+    // Update has NO ValidateVisibility step; the carried level is ignored
+    // (visibility is update-immutable, oss#573) — never rejected.
+    const name = uniqueName("Visibility Ignore");
+    const created = await command.create(projectInput(name));
+    const updated = await command.update(
+      projectInput(name, { visibility: ApiResourceVisibility.visibility_org }),
+    );
+    expect(updated.metadata?.id).toBe(created.metadata?.id);
+    expect(updated.metadata?.visibility).toBe(
+      ApiResourceVisibility.visibility_private,
+    );
+  });
+
+  it("create normalizes empty member orgs; update persists them EMPTY", async () => {
+    const name = uniqueName("Normalize Asymmetry");
+    const created = await command.create(
+      projectInput(name, {
+        members: [{ kind: ApiResourceKind.agent, slug: "norm-a", org: "" }],
+      }),
+    );
+    // NormalizeReferences filled the empty org from metadata.org.
+    expect(created.spec?.members[0]?.org).toBe(ORG);
+
+    const updated = await command.update(
+      projectInput(name, {
+        members: [{ kind: ApiResourceKind.agent, slug: "norm-b", org: "" }],
+      }),
+    );
+    // Update runs NO NormalizeReferences: the empty org persists as-is.
+    expect(updated.spec?.members[0]?.slug).toBe("norm-b");
+    expect(updated.spec?.members[0]?.org).toBe("");
+  });
+});
+
+describe("delete has no member cascade (delete.go)", () => {
+  it("returns the pre-delete resource and leaves members untouched", async () => {
+    await seedAgent("agt_cascade_safe", "cascade-safe-agent");
+    const created = await command.create(
+      projectInput(uniqueName("No Cascade"), {
+        members: [{ kind: ApiResourceKind.agent, slug: "cascade-safe-agent" }],
+      }),
+    );
+
+    const deleted = await command.delete({ value: created.metadata!.id });
+    expect(deleted.metadata?.id).toBe(created.metadata?.id);
+    expect(deleted.spec?.members.map((m) => m.slug)).toEqual([
+      "cascade-safe-agent",
+    ]);
+
+    const notFound = await grpcCode(() =>
+      query.get({ value: created.metadata!.id }),
+    );
+    expect(notFound.code).toBe(Code.NotFound);
+    // The member survives: delete removes ONLY the project entity.
+    const survivor = await agentQuery.get({ value: "agt_cascade_safe" });
+    expect(survivor.metadata?.slug).toBe("cascade-safe-agent");
+  });
+});