@stigmer/server 3.14.0 → 3.15.0

package/dist/query/search/criteria.js

@@ -5,7 +5,7 @@
  * discover).
  *
  * The searchable-kind set is DERIVED from the proto kind_meta extension
- * (not_search_indexed: false, tier != cloud_only) — Go's
+ * (not_search_indexed: false, tier == open_source) — Go's
  * SearchIndexedKinds() posture since stigmer/stigmer#439, where hand-copied
  * kind lists drifted from the proto and from each other. Go still carries a
  * hand map (SearchableKinds) pinned to the derivation by an invariant test;
@@ -13,6 +13,13 @@
  * registry unit test pins the registered extractors against this same
  * derivation (the #439 invariant's TS home).
  *
+ * The tier clause admits open_source alone, not "anything but cloud_only":
+ * the index is the core's, and a kind tiered enterprise (editions program,
+ * DD-001) must not enter it by accident. This derivation is edition-blind
+ * by design (the same code runs in every composition); an edition-aware
+ * derivation is a design act with a named trigger — the first searchable
+ * kind above open_source.
+ *
  * kinds are kept VERBATIM from the request; filtering to the searchable set
  * happens in effectiveKinds(). Keeping the raw request is what
  * distinguishes "no kinds requested" (discover mode) from "kinds requested
@@ -37,8 +44,8 @@ let searchIndexedKindsCache;
 let searchableKindSetCache;
 /**
  * Go SearchIndexedKinds(): every kind this edition's search read side
- * serves — kind_meta declares it search-indexed and servable outside the
- * cloud. Sorted ascending by enum value, exactly Go's sort. Kinds whose
+ * serves — kind_meta declares it search-indexed and open_source-tier.
+ * Sorted ascending by enum value, exactly Go's sort. Kinds whose
  * kind_meta cannot be read are skipped (Go's contract; the registry unit
  * test separately fails on such a defect).
  */
@@ -57,7 +64,7 @@ export function searchIndexedKinds() {
             catch {
                 continue;
             }
-            if (meta.notSearchIndexed || meta.tier === ResourceTier.cloud_only) {
+            if (meta.notSearchIndexed || meta.tier !== ResourceTier.open_source) {
                 continue;
             }
             kinds.push(kind);

package/dist/query/search/criteria.js.map

@@ -1 +1 @@
-{"version":3,"file":"criteria.js","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,sBAAsB;AACtB,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,IAAI,uBAA+D,CAAC;AACpE,IAAI,sBAAgE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC7C,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,uBAAuB,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACxB,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACzC,sBAAsB,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,cAA0C,EAC1C,SAAiB,EACjB,cAAsB,EACtB,iBAA0B,EAC1B,kBAA2B,EAC3B,eAAuB,EACvB,aAAqB;QANrB,mBAAc,GAAd,cAAc,CAA4B;QAC1C,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QACtB,sBAAiB,GAAjB,iBAAiB,CAAS;QAC1B,uBAAkB,GAAlB,kBAAkB,CAAS;QAC3B,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAiC,EACjC,KAAa,EACb,SAAiB,EACjB,aAAsB,EACtB,cAAuB,EACvB,UAAkB,EAClB,QAAgB;QAEhB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,0CAA0C,gBAAgB,aAAa,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,cAAc,CACvB,CAAC,GAAG,KAAK,CAAC,EACV,eAAe,EACf,WAAW,CAAC,SAAS,CAAC,EACtB,aAAa,EACb,cAAc,EACd,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC/B,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,iEAAiE;IACjE,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,wDAAwD;IACxD,MAAM;QACJ,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"criteria.js","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,sBAAsB;AACtB,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,IAAI,uBAA+D,CAAC;AACpE,IAAI,sBAAgE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC7C,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,uBAAuB,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACxB,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACzC,sBAAsB,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,cAA0C,EAC1C,SAAiB,EACjB,cAAsB,EACtB,iBAA0B,EAC1B,kBAA2B,EAC3B,eAAuB,EACvB,aAAqB;QANrB,mBAAc,GAAd,cAAc,CAA4B;QAC1C,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QACtB,sBAAiB,GAAjB,iBAAiB,CAAS;QAC1B,uBAAkB,GAAlB,kBAAkB,CAAS;QAC3B,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAiC,EACjC,KAAa,EACb,SAAiB,EACjB,aAAsB,EACtB,cAAuB,EACvB,UAAkB,EAClB,QAAgB;QAEhB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,0CAA0C,gBAAgB,aAAa,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,cAAc,CACvB,CAAC,GAAG,KAAK,CAAC,EACV,eAAe,EACf,WAAW,CAAC,SAAS,CAAC,EACtB,aAAa,EACb,cAAc,EACd,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC/B,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,iEAAiE;IACjE,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,wDAAwD;IACxD,MAAM;QACJ,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACzD,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.14.0",
+  "version": "3.15.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,9 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/protos": "3.14.0",
-    "@stigmer/temporal-codecs": "3.14.0",
-    "@stigmer/zip-structure": "3.14.0",
+    "@stigmer/protos": "3.15.0",
+    "@stigmer/temporal-codecs": "3.15.0",
+    "@stigmer/zip-structure": "3.15.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/__tests__/auth-enabled-composition.test.ts

@@ -14,7 +14,14 @@
  *      owning user (the runner's credential lane, ruling Q3 — the runner
  *      presents exactly such a key via STIGMER_TOKEN);
  *   4. deleting the key revokes it on the very next request;
- *   5. garbage credentials keep the Q6 unclaimed-token rejection.
+ *   5. garbage credentials keep the Q6 unclaimed-token rejection;
+ *   6. (20260911.11) the identity-account arms: an unprovisioned subject is
+ *      idp-shaped (whoAmI NOT_FOUND, writes stamped with the raw sub);
+ *      provisionMyAccount creates the account under the derived id with
+ *      the issuer's userinfo profile; from then on the verifier resolves
+ *      the subject to the account id and API keys minted before OR after
+ *      provisioning answer whoAmI with the owner's account; no operator
+ *      account exists under the posture.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -30,8 +37,12 @@ import { SignJWT, exportJWK, generateKeyPair } from "jose";
 import type { GenerateKeyPairResult } from "jose";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
 import { ApiKeyQueryController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/query_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
 import { PlatformQueryController } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import {
   Health,
@@ -42,6 +53,11 @@ import { loadConfig } from "../config.js";
 import { composeServer } from "../compose.js";
 import type { ComposedServer } from "../compose.js";
 import { createLogger } from "../logger.js";
+import {
+  ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
+  USERINFO_UNAVAILABLE_PREFIX,
+  accountIdFor,
+} from "../../domain/identityaccount/constants.js";
 import { AUTHENTICATION_TOKEN_MISSING_MESSAGE } from "../../pipeline/interceptors/auth.js";
 
 const AUDIENCE = "https://api.stigmer.test/";
@@ -50,8 +66,15 @@ let dir: string;
 let issuerServer: Server;
 let issuer: string;
 let privateKey: GenerateKeyPairResult["privateKey"];
+// A lever for the UNAVAILABLE arm: the issuer's /userinfo answers 503 for
+// this subject while set. Undefined = every subject is served.
+let userinfoRefusesSub: string | undefined;
 let server: ComposedServer;
 let port: number;
+// A key minted while its owner was still idp-shaped: its creator stamp is
+// the raw sub. The identity-account arms prove that stamp resolves to the
+// owner's account once one exists (20260911.11 A1's derived id).
+let keyMintedBeforeProvisioning: string;
 
 function bearer(token: string): Interceptor {
   return (next) => (request) => {
@@ -88,8 +111,16 @@ beforeAll(async () => {
   };
   issuerServer = createServer((req, res) => {
     if (req.url === "/.well-known/openid-configuration") {
+      // The provisioning lane reads userinfo_endpoint from here (A8) —
+      // never a guessed `<issuer>/userinfo`.
       res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ issuer, jwks_uri: `${issuer}/jwks` }));
+      res.end(
+        JSON.stringify({
+          issuer,
+          jwks_uri: `${issuer}/jwks`,
+          userinfo_endpoint: `${issuer}/userinfo`,
+        }),
+      );
       return;
     }
     if (req.url === "/jwks") {
@@ -97,6 +128,43 @@ beforeAll(async () => {
       res.end(JSON.stringify({ keys: [jwk] }));
       return;
     }
+    if (req.url === "/userinfo") {
+      // The provisioning lane's profile source (20260911.11 A1/Q-IA-2):
+      // answers the bearer's own claims as an IdP would, given_name and
+      // family_name included — the signature was already proven upstream.
+      const header = req.headers.authorization ?? "";
+      const token = header.startsWith("Bearer ")
+        ? header.slice("Bearer ".length)
+        : "";
+      const payloadSegment = token.split(".")[1];
+      if (payloadSegment === undefined) {
+        res.statusCode = 401;
+        res.end();
+        return;
+      }
+      const claims = JSON.parse(
+        Buffer.from(payloadSegment, "base64url").toString("utf8"),
+      ) as { sub?: string; email?: string };
+      if (
+        userinfoRefusesSub !== undefined &&
+        claims.sub === userinfoRefusesSub
+      ) {
+        res.statusCode = 503;
+        res.end();
+        return;
+      }
+      res.setHeader("content-type", "application/json");
+      res.end(
+        JSON.stringify({
+          sub: claims.sub ?? "",
+          email: claims.email ?? "",
+          given_name: "Composed",
+          family_name: "User",
+          picture: `${issuer}/pictures/${encodeURIComponent(claims.sub ?? "")}`,
+        }),
+      );
+      return;
+    }
     res.statusCode = 404;
     res.end();
   });
@@ -221,6 +289,7 @@ describe("the full credential loop (OIDC login → API key → revocation)", ()
     expect(second.status?.audit?.specAudit?.createdBy?.id).toBe(
       "auth0|loop-user",
     );
+    keyMintedBeforeProvisioning = second.spec?.keyHash ?? "";
   });
 
   it("deleting the key revokes it on the very next request", async () => {
@@ -243,3 +312,158 @@ describe("the full credential loop (OIDC login → API key → revocation)", ()
     expect(ConnectError.from(error).rawMessage).toBe("invalid token");
   });
 });
+
+describe("identity accounts under the OIDC posture (20260911.11; Q-IA-2, A1, A2)", () => {
+  const SUB = "auth0|loop-user";
+  const accountId = accountIdFor(SUB);
+
+  it("no operator account exists under an authentication posture — the boot-time ensure is trusted-local only", async () => {
+    const rows = await server.store.listResources(
+      ApiResourceKind.identity_account,
+    );
+    expect(rows).toHaveLength(0);
+  });
+
+  it("whoAmI for an unprovisioned subject is NOT_FOUND with the cloud's copy, and its writes stay stamped with the raw sub", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const query = createClient(
+      IdentityAccountQueryController,
+      transportWith(token),
+    );
+    const error = await query.whoAmI({}).catch((e: unknown) => e);
+    expect(ConnectError.from(error).code).toBe(Code.NotFound);
+    expect(ConnectError.from(error).rawMessage).toBe(
+      ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
+    );
+  });
+
+  it("provisionMyAccount creates the account under the derived id with the userinfo profile", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const account = await command.provisionMyAccount({});
+    expect(account.metadata?.id).toBe(accountId);
+    expect(account.metadata?.name).toBe("loop@example.com");
+    expect(account.spec).toMatchObject({
+      idpId: SUB,
+      email: "loop@example.com",
+      firstName: "Composed",
+      lastName: "User",
+      provisioningMode: IdentityAccountProvisioningMode.direct,
+      isMachineAccount: false,
+    });
+    // The account is created BY the subject it is for: the stamp is the
+    // sub the verifier admitted idp-shaped — no account existed yet.
+    expect(account.status?.audit?.specAudit?.createdBy?.id).toBe(SUB);
+  });
+
+  it("from the next request on, the verifier resolves the subject to the account id — whoAmI answers and writes are stamped with it", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const query = createClient(
+      IdentityAccountQueryController,
+      transportWith(token),
+    );
+    const me = await query.whoAmI({});
+    expect(me.metadata?.id).toBe(accountId);
+
+    const keys = createClient(ApiKeyCommandController, transportWith(token));
+    const key = await keys.create({
+      apiVersion: "iam.stigmer.ai/v1",
+      kind: "ApiKey",
+      metadata: { name: "minted after provisioning", org: "local" },
+      spec: {},
+    });
+    expect(key.status?.audit?.specAudit?.createdBy?.id).toBe(accountId);
+    expect(key.status?.audit?.specAudit?.createdBy?.email).toBe(
+      "loop@example.com",
+    );
+
+    // Over that key, whoAmI is the owner's account — the key is the user.
+    const overKey = createClient(
+      IdentityAccountQueryController,
+      transportWith(key.spec?.keyHash ?? ""),
+    );
+    expect((await overKey.whoAmI({})).metadata?.id).toBe(accountId);
+  });
+
+  it("a key minted BEFORE provisioning still resolves to the owner's account — the raw-sub stamp derives to the same id", async () => {
+    const overLegacyKey = createClient(
+      IdentityAccountQueryController,
+      transportWith(keyMintedBeforeProvisioning),
+    );
+    expect((await overLegacyKey.whoAmI({})).metadata?.id).toBe(accountId);
+  });
+
+  it("provisionMyAccount is idempotent for a provisioned subject", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const before = (
+      await server.store.listResources(ApiResourceKind.identity_account)
+    ).length;
+    const again = await command.provisionMyAccount({});
+    expect(again.metadata?.id).toBe(accountId);
+    expect(
+      (await server.store.listResources(ApiResourceKind.identity_account))
+        .length,
+    ).toBe(before);
+  });
+
+  it("two concurrent first logins for one subject end in exactly one account", async () => {
+    const token = await mintOidcToken("auth0|racer", "racer@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const before = (
+      await server.store.listResources(ApiResourceKind.identity_account)
+    ).length;
+    const [a, b] = await Promise.all([
+      command.provisionMyAccount({}),
+      command.provisionMyAccount({}),
+    ]);
+    expect(a.metadata?.id).toBe(accountIdFor("auth0|racer"));
+    expect(b.metadata?.id).toBe(a.metadata?.id);
+    expect(
+      (await server.store.listResources(ApiResourceKind.identity_account))
+        .length,
+    ).toBe(before + 1);
+  });
+
+  it("a userinfo failure is UNAVAILABLE with the cloud's copy, and no account is created", async () => {
+    // A real token (the verifier must admit it) whose subject the issuer's
+    // /userinfo refuses while the lever is set.
+    const token = await mintOidcToken(
+      "auth0|userinfo-down",
+      "down@example.com",
+    );
+    userinfoRefusesSub = "auth0|userinfo-down";
+    try {
+      const command = createClient(
+        IdentityAccountCommandController,
+        transportWith(token),
+      );
+      const error = await command
+        .provisionMyAccount({})
+        .catch((e: unknown) => e);
+      expect(ConnectError.from(error).code).toBe(Code.Unavailable);
+      expect(
+        ConnectError.from(error).rawMessage.startsWith(
+          USERINFO_UNAVAILABLE_PREFIX,
+        ),
+      ).toBe(true);
+      const query = createClient(
+        IdentityAccountQueryController,
+        transportWith(token),
+      );
+      const missing = await query.whoAmI({}).catch((e: unknown) => e);
+      expect(ConnectError.from(missing).code).toBe(Code.NotFound);
+    } finally {
+      userinfoRefusesSub = undefined;
+    }
+  });
+});

package/src/boot/compose.ts

@@ -28,6 +28,7 @@ import path from "node:path";
 
 import type { ConnectRouter, Transport } from "@connectrpc/connect";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 
 import { registerAgentServices } from "../domain/agent/controller.js";
@@ -64,6 +65,15 @@ import { registerChannelConversationServices } from "../domain/agentchannel/conv
 import { registerChannelMessageServices } from "../domain/agentchannel/message.js";
 import { registerAgentShareServices } from "../domain/agentshare/controller.js";
 import { registerApiKeyServices } from "../domain/apikey/controller.js";
+import {
+  newCreateAccountPath,
+  registerIdentityAccountServices,
+} from "../domain/identityaccount/controller.js";
+import { ensureOperatorAccount } from "../domain/identityaccount/operator.js";
+import { newDirectAccountProvisioner } from "../domain/identityaccount/provisioning.js";
+import { newResourceIdentityAccountStore } from "../domain/identityaccount/resource-store.js";
+import { newIssuerDiscovery } from "../identity/oidc-discovery.js";
+import { newOidcUserInfoClient } from "../identity/oidc-userinfo.js";
 import { newApiKeyIdentityVerifier } from "../domain/apikey/verifier.js";
 import type { IdentityVerifier } from "../extensions/identity.js";
 import { registerArtifactServices } from "../domain/artifact/controller.js";
@@ -117,6 +127,7 @@ import {
 } from "../observability/rpc-metrics.js";
 import { buildInterceptorChain } from "../pipeline/chain.js";
 import { createVerifierChainInterceptor } from "../pipeline/interceptors/auth.js";
+import { operatorIdentitySnapshot } from "../pipeline/steps/defaults.js";
 import { createErrorBoundaryInterceptor } from "../pipeline/interceptors/error-boundary.js";
 import { createRequestMetricsInterceptor } from "../pipeline/interceptors/request-metrics.js";
 import { newPermissiveSingleTeamAuthorizer } from "../pipeline/steps/authorize.js";
@@ -221,6 +232,13 @@ export interface ComposedServer {
    * them or reorder them, and both are the drift DD-007 rules out.
    */
   identityVerifiers: ReadonlyArray<IdentityVerifier>;
+  /**
+   * The one routes function both routers are built from (exposed for
+   * tests, the `store` posture — the tier-truthfulness invariant
+   * enumerates the services a composition registers through it; the
+   * server registers no reflection service, deliberately).
+   */
+  routes: (router: ConnectRouter) => void;
   /** Completes wiring, flips SERVING, binds the port; returns the bound port. */
   start(): Promise<number>;
   /** NOT_SERVING first, stop background work, drain connections. */
@@ -294,6 +312,75 @@ export async function composeServer(
     });
   }
 
+  // The require-authentication posture has two sources OR'd here: the
+  // OSS OIDC issuer (O3 rulings Q1+Q2) and a composed unit's declaration
+  // (registry point, entry 20260904.02). Neither source = the OSS
+  // trusted-local posture, byte-identical wire behavior. Resolved in the
+  // storage stage because the posture decides a WRITE below (the operator
+  // account); the verifier chain it also governs is built at the end.
+  const authEnabled = config.oidcIssuer !== "";
+  const requireAuthentication =
+    authEnabled || extensions.requireAuthentication !== undefined;
+
+  // Stage: identity accounts (20260911.11) — the first domain whose
+  // persistence is a PORT rather than the generic Store. The composed
+  // driver (`drivers.identityAccountStore`, Q-IA-9) serves when a unit
+  // registers one; otherwise open source's adapter over `store` installs
+  // HERE (the default lives with the consumer, never in the registry).
+  // This ONE binding is what the create path, the provisioner, the
+  // operator ensure and both OSS verifiers read, so a composed driver is
+  // followed everywhere by construction. The domain's one create path is
+  // built once and shared by the create RPC, provisioning and the operator
+  // ensure below.
+  const identityAccounts =
+    extensions.drivers.identityAccountStore ??
+    newResourceIdentityAccountStore(store);
+  const identityAccountPath = {
+    accounts: identityAccounts,
+    logger,
+    authorizer,
+    authorizationLifecycle,
+  };
+  const createIdentityAccount = newCreateAccountPath(
+    identityAccountPath,
+    ApiResourceKind.identity_account,
+  );
+  // ONE issuer discovery for every lane that reads a well-known document
+  // (A8): provisioning's userinfo client here and the OIDC verifier's
+  // JWKS location below share it, so an issuer is discovered once per
+  // process and validated the same way wherever it is consumed. Built in
+  // this stage, not inside routes() (which runs twice) — the same reason
+  // the searchRegistry lives here.
+  const issuerDiscovery = newIssuerDiscovery();
+  // Provisioning reads the caller's profile from the userinfo endpoint of
+  // the issuer that vouched for the token, discovered per issuer and
+  // cached (A8) — so a composition whose own verifiers name their issuer
+  // on the identity needs no knob here.
+  const identityAccountProvisioner = newDirectAccountProvisioner({
+    accounts: identityAccounts,
+    createAccount: createIdentityAccount,
+    userInfo: newOidcUserInfoClient(issuerDiscovery),
+  });
+  // Under the trusted-local posture the server knows its one principal
+  // from the operator seam (the SAME seam the interceptor stamps callers
+  // from — never config directly, so the row and the stamp cannot
+  // disagree; T01_1_review.md A2, A5) and states the fact at boot:
+  // create-if-absent, so preferences set later survive every reboot. A
+  // composition with an authentication posture never creates one — its
+  // users provision themselves on first sign-in. A stage that writes a
+  // resource is new here; it earns its place because it is the truth of
+  // that posture, and a failure is a loud boot throw like the storage
+  // stage's own.
+  if (!requireAuthentication) {
+    const operator = await ensureOperatorAccount(
+      { accounts: identityAccounts, createAccount: createIdentityAccount },
+      operatorIdentitySnapshot(),
+    );
+    logger.info("trusted-local operator account ensured", {
+      accountId: operator.metadata?.id ?? "",
+    });
+  }
+
   // Stage: keys — the ratified fail-loud boot ASYMMETRY (D2 cross-domain
   // invariants; Go server.go:277-293):
   //
@@ -799,6 +886,17 @@ export async function composeServer(
       authorizationLifecycle,
       listReadScope: extensions.drivers.listReadScope,
     });
+    // IdentityAccount (20260911.11): served once by open source in every
+    // edition over the store PORT bound in the identity-accounts stage; a
+    // composition adds what differs per edition through the registry —
+    // the federation capability (the four federated RPC arms) and the
+    // provision slot's gate steps (the cloud's personal organization).
+    registerIdentityAccountServices(router, {
+      ...identityAccountPath,
+      provisioner: identityAccountProvisioner,
+      federation: extensions.drivers.identityFederation,
+      gateSteps: extensions.gateSteps,
+    });
     registerEnvironmentServices(router, {
       store,
       logger,
@@ -1092,14 +1190,8 @@ export async function composeServer(
   const inProcessWiring = createInProcessClients(routes, logger);
   inProcess = inProcessWiring.clients;
 
-  // The require-authentication posture has two sources OR'd here: the
-  // OSS OIDC issuer (O3 rulings Q1+Q2) and a composed unit's declaration
-  // (registry point, entry 20260904.02). Neither source = the OSS
-  // trusted-local posture, byte-identical wire behavior.
-  const authEnabled = config.oidcIssuer !== "";
-  const requireAuthentication =
-    authEnabled || extensions.requireAuthentication !== undefined;
-  // What the posture registers, in Java's ProviderManager order (opaque
+  // What the posture (resolved in the storage stage) registers, in Java's
+  // ProviderManager order (opaque
   // keys first — the cheapest claim — then the JWT lanes), ahead of the
   // extension entries ("OSS entries first", the registry contract):
   //   - the API-key verifier rides the POSTURE, not the issuer
@@ -1108,19 +1200,31 @@ export async function composeServer(
   //     authentication posture must honor the keys it issues. Gating it on
   //     the issuer left a posture-declaring composition minting keys
   //     nothing verified.
-  //   - the OIDC verifier rides the ISSUER alone: it resolves callers to
-  //     the token's `sub`, which is the wrong principal for a composition
-  //     whose own lanes resolve users to their account ids — that is why a
-  //     declared posture never borrows the issuer knob.
+  //   - the OIDC verifier rides the ISSUER alone: it is open source's
+  //     single-issuer lane, and a composition with verifiers of its own
+  //     names their issuers and audiences itself and declares the posture
+  //     instead — so the knob and the extension entries never both claim
+  //     one JWT.
+  //   - both OSS verifiers resolve their subject through the identity-
+  //     account domain (20260911.11 Q-IA-2, A6): a provisioned user is
+  //     stamped with the account id whichever credential they present,
+  //     an unprovisioned one is admitted idp-shaped. They read the SAME
+  //     port the domain writes through (`identityAccounts`, the
+  //     identity-accounts stage — a composed driver included), so a row
+  //     provisioning creates resolves on the very next request.
   // The runner's credential in either posture is an operator-minted API
   // token via STIGMER_TOKEN (O3 ruling Q3) — no runner-specific verifier.
   const identityVerifiers = [
-    ...(requireAuthentication ? [newApiKeyIdentityVerifier(store)] : []),
+    ...(requireAuthentication
+      ? [newApiKeyIdentityVerifier({ store, accounts: identityAccounts })]
+      : []),
     ...(authEnabled
       ? [
           newOidcIdentityVerifier({
             issuer: config.oidcIssuer,
             audience: config.oidcAudience,
+            accounts: identityAccounts,
+            discovery: issuerDiscovery,
           }),
         ]
       : []),
@@ -1203,6 +1307,7 @@ export async function composeServer(
     workflowExecutionStreamBroker,
     inProcessTransport: inProcessWiring.transport,
     identityVerifiers,
+    routes,
 
     async start(): Promise<number> {
       // Temporal boot is NON-fatal end to end (Go server.go): a failed