@stigmer/server 3.14.1 → 3.15.0

package/src/extensions/__tests__/identity-account-points.test.ts

@@ -0,0 +1,129 @@
+/**
+ * Pins the two registry points the identity-account domain adds
+ * (20260911.11, Q-IA-9), in the O5 driver-point shape the registry already
+ * enforces for organizationDirectory and listReadScope:
+ *
+ *   - `drivers.identityAccountStore` — the store driver (the cloud serves
+ *     the domain over cloud.iam_identity_account through it); single
+ *     instance; absent = the OSS adapter over the generic Store;
+ *   - `drivers.identityFederation` — the four federation RPC arms plus
+ *     providerExists; single instance; absent = the four RPCs refuse
+ *     UNIMPLEMENTED with the edition reason (the domain suite pins the
+ *     refusal; this file pins the registry);
+ *   - the slot `identity-account-provision:post-persist` is declared and
+ *     empty with no extensions (registry.test.ts pins the full slot roster).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+
+import type { IdentityAccountStore } from "../../domain/identityaccount/store.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import { DECLARED_GATE_SLOTS } from "../gate-slots.js";
+import type { GateSlotName } from "../gate-slots.js";
+import type { IdentityFederation } from "../identity-federation.js";
+import { resolveExtensions } from "../registry.js";
+
+const unimplemented = () => Promise.reject(new Error("not exercised here"));
+
+const store: IdentityAccountStore = {
+  save: unimplemented,
+  update: unimplemented,
+  deleteById: unimplemented,
+  findById: unimplemented,
+  findByIdpId: unimplemented,
+  findDirectByIdpId: unimplemented,
+  findDirectByEmail: unimplemented,
+  findByIds: unimplemented,
+};
+
+const federation: IdentityFederation = {
+  createFederatedAccount: unimplemented,
+  updateFederatedAccount: unimplemented,
+  deprovisionFederatedAccount: unimplemented,
+  getByExternalSub: unimplemented,
+  providerExists: unimplemented,
+};
+
+describe("the identityAccountStore driver point", () => {
+  it("is undefined with no extensions — the OSS adapter serves", () => {
+    expect(resolveExtensions([]).drivers.identityAccountStore).toBeUndefined();
+  });
+
+  it("carries the one registered instance through", () => {
+    const resolved = resolveExtensions([
+      { name: "cloud-iam", drivers: { identityAccountStore: store } },
+    ]);
+    expect(resolved.drivers.identityAccountStore).toBe(store);
+  });
+
+  it("throws on a second registration, naming both units", () => {
+    expect(() =>
+      resolveExtensions([
+        { name: "store-a", drivers: { identityAccountStore: store } },
+        { name: "store-b", drivers: { identityAccountStore: store } },
+      ]),
+    ).toThrowError(
+      /extension 'store-b' registers an IdentityAccountStore, but 'store-a' already did/,
+    );
+  });
+});
+
+describe("the identityFederation capability point", () => {
+  it("is undefined with no extensions — the four RPCs refuse", () => {
+    expect(resolveExtensions([]).drivers.identityFederation).toBeUndefined();
+  });
+
+  it("carries the one registered instance through", () => {
+    const resolved = resolveExtensions([
+      { name: "cloud-iam", drivers: { identityFederation: federation } },
+    ]);
+    expect(resolved.drivers.identityFederation).toBe(federation);
+  });
+
+  it("throws on a second registration, naming both units", () => {
+    expect(() =>
+      resolveExtensions([
+        { name: "fed-a", drivers: { identityFederation: federation } },
+        { name: "fed-b", drivers: { identityFederation: federation } },
+      ]),
+    ).toThrowError(
+      /extension 'fed-b' registers an IdentityFederation, but 'fed-a' already did/,
+    );
+  });
+});
+
+describe("the identity-account-provision:post-persist slot", () => {
+  it("is declared vocabulary and empty with no extensions", () => {
+    expect(
+      DECLARED_GATE_SLOTS.has("identity-account-provision:post-persist"),
+    ).toBe(true);
+    expect(
+      resolveExtensions([]).gateSteps.get(
+        "identity-account-provision:post-persist",
+      ),
+    ).toBeUndefined();
+  });
+
+  it("accepts a gate step from a unit and keeps unit order", () => {
+    const step = (name: string): PipelineStep<DescMessage> => ({
+      name,
+      execute: () => Promise.resolve(),
+    });
+    const resolved = resolveExtensions([
+      {
+        name: "cloud-iam",
+        gateSteps: new Map<GateSlotName, PipelineStep<DescMessage>[]>([
+          [
+            "identity-account-provision:post-persist",
+            [step("EnsurePersonalOrganization")],
+          ],
+        ]),
+      },
+    ]);
+    expect(
+      resolved.gateSteps
+        .get("identity-account-provision:post-persist")
+        ?.map((s) => s.name),
+    ).toEqual(["EnsurePersonalOrganization"]);
+  });
+});

package/src/extensions/__tests__/registry.test.ts

@@ -477,6 +477,10 @@ describe("resolveExtensions — loud-fail throws (DD-006 §2b)", () => {
       "agent-execution-create:pre-side-effect-gate",
       "agent-execution-recover:pre-side-effect-gate",
       "agent-execution-submit-approval:gate",
+      // 20260911.11 Q-IA-9: the seventh ratified slot — after the account
+      // persists inside provisionMyAccount, before the reply (the cloud's
+      // personal-organization ensure and backfill ride it).
+      "identity-account-provision:post-persist",
       "org-create:post-persist",
       "sandbox-acquisition:gate",
       "session-create:pre-side-effect-gate",

package/src/extensions/__tests__/tier-truthfulness.test.ts

@@ -0,0 +1,299 @@
+/**
+ * The tier-truthfulness invariant (editions program 20260911.03 DD-001;
+ * P0 review finding 4; landed with the first tier flip, 20260911.11
+ * Q-IA-6): a kind's `kind_meta.tier` states what the edition's server
+ * SERVES, not a plan. The SDK reads a tier as "available now"
+ * (sdk/typescript/src/resource-availability.ts), so a tier that runs ahead
+ * of the server turns hidden hooks into UNIMPLEMENTED errors, and a tier
+ * that lags hides a served kind.
+ *
+ * Proven against the EMPTY composition (no extension units — the
+ * open-source server as shipped): every `open_source` kind has a routed
+ * service and no `enterprise` or `cloud_only` kind does. Services are
+ * enumerated by replaying the composed `routes` closure into a recording
+ * router (compose.ts hands the same closure to both transports); a service
+ * maps to its kind by the package's kind segment, which equals
+ * `kind_meta.name` lowercased for every kind in the registry (checked at
+ * the gate against all 28 entries).
+ *
+ * Two exceptions were ruled at the P1 gate (20260911.04 T01_1_review.md,
+ * "Placements taken at the gate"). Under this check they take two shapes:
+ *   - platform is a lie the ruling exempts by name: served by every
+ *     edition (getServerInfo is is_public and every console reads it)
+ *     while the tier names the platform#operator seat an Enterprise
+ *     deployment sells. Its service lives at `ai.stigmer.platform.v1`, the
+ *     one package where the kind IS the group;
+ *   - api_resource_version is a record kind with no service in any
+ *     edition; tiered cloud_only and unserved it tells no lie, so it needs
+ *     no exemption — its own arm pins that it stays unserved.
+ * A third exemption can only join by the same recorded act.
+ *
+ * The mutation arms prove the check bites: the same function over a
+ * registry with one tier flipped reports the lie.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import type { DescService } from "@bufbuild/protobuf";
+import type { ConnectRouter } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import {
+  ApiResourceKind,
+  ResourceTier,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { loadConfig } from "../../boot/config.js";
+import { composeServer } from "../../boot/compose.js";
+import type { ComposedServer } from "../../boot/compose.js";
+import { createLogger } from "../../boot/logger.js";
+import { getKindMeta } from "../../pipeline/apiresource-meta.js";
+
+/** The registry as the check reads it: every kind with kind_meta, by tier. */
+interface KindEntry {
+  readonly kind: ApiResourceKind;
+  readonly name: string;
+  readonly tier: ResourceTier;
+}
+
+/** The pre-ruled exemption, by name, with the ruling that exempts it. */
+const RULED_EXCEPTIONS: ReadonlyMap<ApiResourceKind, string> = new Map([
+  [
+    ApiResourceKind.platform,
+    "served by every edition; the tier names the platform#operator seat (P1 gate, placements)",
+  ],
+]);
+
+function registryEntries(): KindEntry[] {
+  return Object.values(ApiResourceKind)
+    .filter((value): value is ApiResourceKind => typeof value === "number")
+    .filter((kind) => kind !== ApiResourceKind.api_resource_kind_unknown)
+    .map((kind) => {
+      const meta = getKindMeta(kind);
+      return { kind, name: meta.name, tier: meta.tier };
+    });
+}
+
+/**
+ * The kind segment of a service's fully-qualified name:
+ * `ai.stigmer.<group>.<kind>.v1.<Service>` → `<kind>`, and for the one
+ * package where the kind is the group, `ai.stigmer.<group>.v1.<Service>` →
+ * `<group>` (platform). Services outside the registry's shape (health,
+ * third-party, kind-less groups like search) yield a segment that matches
+ * no kind and fall out of the comparison.
+ */
+function kindSegmentOf(serviceTypeName: string): string | undefined {
+  const parts = serviceTypeName.split(".");
+  if (parts[0] !== "ai" || parts[1] !== "stigmer") return undefined;
+  if (parts.length === 5) return parts[2];
+  if (parts.length >= 6) return parts[3];
+  return undefined;
+}
+
+/**
+ * The invariant as a pure function. Returns one sentence per lie so the
+ * failure names the kind and the direction.
+ */
+function tierViolations(
+  entries: ReadonlyArray<KindEntry>,
+  servedKindSegments: ReadonlySet<string>,
+  exceptions: ReadonlyMap<ApiResourceKind, string>,
+): string[] {
+  const violations: string[] = [];
+  for (const entry of entries) {
+    if (exceptions.has(entry.kind)) continue;
+    const served = servedKindSegments.has(entry.name.toLowerCase());
+    switch (entry.tier) {
+      case ResourceTier.open_source:
+        if (!served) {
+          violations.push(
+            `${entry.name} is tiered open_source but the empty composition routes no service for it`,
+          );
+        }
+        break;
+      case ResourceTier.enterprise:
+      case ResourceTier.cloud_only:
+        if (served) {
+          violations.push(
+            `${entry.name} is tiered ${ResourceTier[entry.tier]} but the empty composition serves it — the tier lags the server`,
+          );
+        }
+        break;
+      case ResourceTier.resource_tier_unspecified:
+        violations.push(
+          `${entry.name} has no tier — every kind_meta must declare one`,
+        );
+        break;
+      default: {
+        const exhaustive: never = entry.tier;
+        throw new Error(`unknown tier ${String(exhaustive)}`);
+      }
+    }
+  }
+  return violations;
+}
+
+/** Replays the composed routes into a recorder and returns the served kind segments. */
+function servedKindSegments(
+  routes: (router: ConnectRouter) => void,
+): Set<string> {
+  const served = new Set<string>();
+  const recorder = {
+    handlers: [],
+    service(desc: DescService) {
+      const segment = kindSegmentOf(desc.typeName);
+      if (segment !== undefined) served.add(segment);
+      return recorder;
+    },
+    rpc() {
+      return recorder;
+    },
+  };
+  routes(recorder as unknown as ConnectRouter);
+  return served;
+}
+
+describe("tier truthfulness against the empty composition", () => {
+  let dir: string;
+  let server: ComposedServer;
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "tier-truthfulness-test-"));
+    server = await composeServer({
+      config: loadConfig({
+        STIGMER_MODEL_REGISTRY_REFRESH: "off",
+        TEMPORAL_HOST_PORT: "127.0.0.1:1",
+        DB_PATH: path.join(dir, "stigmer.db"),
+        STORAGE_PATH: path.join(dir, "storage"),
+        ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
+      }),
+      logger: createLogger({ level: "error", pretty: false, write: () => {} }),
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("every kind's tier states what the open-source server serves (two ruled exceptions)", () => {
+    const served = servedKindSegments(server.routes);
+    expect(served.size).toBeGreaterThan(10);
+    expect(tierViolations(registryEntries(), served, RULED_EXCEPTIONS)).toEqual(
+      [],
+    );
+  });
+
+  it("the ruled exemption is exactly the lie the registry tells today, no fewer", () => {
+    // If platform stops being a lie (its tier becomes open_source), it must
+    // leave the exemption by a recorded act rather than linger as dead
+    // vocabulary.
+    const served = servedKindSegments(server.routes);
+    const withoutExceptions = tierViolations(
+      registryEntries(),
+      served,
+      new Map(),
+    );
+    const exceptionNames = [...RULED_EXCEPTIONS.keys()]
+      .map((kind) => getKindMeta(kind).name)
+      .sort();
+    const lyingNames = withoutExceptions
+      .map((sentence) => sentence.split(" ")[0] ?? "")
+      .sort();
+    expect(lyingNames).toEqual(exceptionNames);
+  });
+
+  it("api_resource_version stays a record kind with no service (the P1 gate's second placement)", () => {
+    const served = servedKindSegments(server.routes);
+    expect(served.has("apiresourceversion")).toBe(false);
+  });
+
+  it("identity_account is open_source and served — the flip and the serving PR are one change (Q-EC-2b)", () => {
+    const served = servedKindSegments(server.routes);
+    expect(getKindMeta(ApiResourceKind.identity_account).tier).toBe(
+      ResourceTier.open_source,
+    );
+    expect(served.has("identityaccount")).toBe(true);
+  });
+});
+
+describe("the check bites (mutation proofs over the same function)", () => {
+  const served = new Set(["agent", "apikey", "identityaccount"]);
+  const entries: KindEntry[] = [
+    {
+      kind: ApiResourceKind.agent,
+      name: "Agent",
+      tier: ResourceTier.open_source,
+    },
+    {
+      kind: ApiResourceKind.api_key,
+      name: "ApiKey",
+      tier: ResourceTier.open_source,
+    },
+    {
+      kind: ApiResourceKind.identity_account,
+      name: "IdentityAccount",
+      tier: ResourceTier.open_source,
+    },
+    {
+      kind: ApiResourceKind.invitation,
+      name: "Invitation",
+      tier: ResourceTier.cloud_only,
+    },
+  ];
+
+  it("passes a truthful registry", () => {
+    expect(tierViolations(entries, served, new Map())).toEqual([]);
+  });
+
+  it("a tier that runs ahead of the server (open_source, unserved) is named", () => {
+    const ahead = entries.map((entry) =>
+      entry.kind === ApiResourceKind.invitation
+        ? { ...entry, tier: ResourceTier.open_source }
+        : entry,
+    );
+    expect(tierViolations(ahead, served, new Map())).toEqual([
+      "Invitation is tiered open_source but the empty composition routes no service for it",
+    ]);
+  });
+
+  it("a tier that lags the server (cloud_only, served) is named — reverting the flip fails here", () => {
+    const lagging = entries.map((entry) =>
+      entry.kind === ApiResourceKind.identity_account
+        ? { ...entry, tier: ResourceTier.cloud_only }
+        : entry,
+    );
+    expect(tierViolations(lagging, served, new Map())).toEqual([
+      "IdentityAccount is tiered cloud_only but the empty composition serves it — the tier lags the server",
+    ]);
+  });
+
+  it("a kind with no tier is a lie of omission", () => {
+    const untiered = [
+      ...entries,
+      {
+        kind: ApiResourceKind.memory,
+        name: "Memory",
+        tier: ResourceTier.resource_tier_unspecified,
+      },
+    ];
+    expect(tierViolations(untiered, served, new Map())).toEqual([
+      "Memory has no tier — every kind_meta must declare one",
+    ]);
+  });
+
+  it("an exception is honoured only by name", () => {
+    const lagging = entries.map((entry) =>
+      entry.kind === ApiResourceKind.identity_account
+        ? { ...entry, tier: ResourceTier.cloud_only }
+        : entry,
+    );
+    const exceptions = new Map([
+      [ApiResourceKind.identity_account, "a test-only exemption"],
+    ]);
+    expect(tierViolations(lagging, served, exceptions)).toEqual([]);
+  });
+});

package/src/extensions/drivers.ts

@@ -23,6 +23,9 @@
  *   - schedule-fire caller (who a schedule fire acts as) — landed with
  *     the stigmer-cloud#572 fix (the Java schedule-token mechanism's
  *     seam; ruled 2026-09-01)
+ *   - identity-account store + identity federation (the first domain
+ *     whose persistence is a PORT, and the four federated RPC arms only
+ *     one edition serves) — landed with 20260911.11, gate ruling Q-IA-9
  *
  * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
  * provider kinds are single-instance points — a second declaring unit is
@@ -36,11 +39,13 @@
  */
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
+import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { OrganizationDirectory } from "./organization-directory.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
@@ -143,4 +148,25 @@ export interface ExtensionDrivers {
    * the `internal` class — OSS behavior byte-identical.
    */
   readonly scheduleFireCaller?: ScheduleFireCallerMint;
+  /**
+   * The identity-account store driver (20260911.11, Q-IA-9;
+   * single-instance point). The identity-account domain is the first
+   * whose persistence is a PORT rather than the generic Store: when
+   * composed, the domain's every read and write — the create path, the
+   * provisioner, the boot-time operator ensure and BOTH OSS verifiers'
+   * subject resolution — goes through this driver (the cloud serves the
+   * domain over its own `cloud.iam_identity_account` table this way).
+   * When absent, the OSS adapter over the generic Store installs at the
+   * compose.ts consumption site — OSS behavior byte-identical.
+   */
+  readonly identityAccountStore?: IdentityAccountStore;
+  /**
+   * The identity-federation capability (20260911.11, Q-IA-9;
+   * single-instance point): the four federated-account RPC arms plus the
+   * IdP-exists probe their shared precondition rides. When composed, the
+   * identity-account controller dispatches to it after its own shared
+   * checks; when absent, the four RPCs refuse UNIMPLEMENTED with the
+   * edition reason — the organizationDirectory absent-method shape.
+   */
+  readonly identityFederation?: IdentityFederation;
 }

package/src/extensions/gate-slots.ts

@@ -19,6 +19,21 @@
  * splice — its capacity gates ride the two declared agent-execution
  * slots, whose positions coincide exactly with the Java session gate.
  *
+ * 20260911.11 (Q-IA-9) declares the seventh,
+ * `identity-account-provision:post-persist`: inside provisionMyAccount,
+ * after the provisioner has answered the caller's row — created on this
+ * call or found by the idempotent early return — and before the reply,
+ * with the caller RE-STAMPED as the account (the position-1 identity was
+ * idp-shaped because no row existed when the verifier ran). It fires on
+ * EVERY provisionMyAccount, not only the creating one: the cloud's
+ * personal-organization step backfills accounts that predate personal
+ * organizations on the idempotent path, which is exactly why a slot was
+ * chosen over the tuple lifecycle's onResourceCreated (never fired for a
+ * row that already exists). Never on the create RPC and never at the
+ * boot-time operator ensure, which take the create path, not this one.
+ * Non-transactional in the `org-create:post-persist` sense: a gate
+ * failure fails the request, the row survives, the next call heals.
+ *
  * Two enforcement layers, deliberately redundant, both derived from the
  * ONE literal tuple below (lockstep by construction):
  *   - GateSlotName (compile time): the union of declared slot literals.
@@ -55,6 +70,7 @@ export const GATE_SLOT_NAMES = [
   "session-create:pre-side-effect-gate",
   "org-create:post-persist",
   "sandbox-acquisition:gate",
+  "identity-account-provision:post-persist",
 ] as const;
 
 /** The declared slot-name union — a registration outside it fails tsc. */

package/src/extensions/identity-federation.ts

@@ -0,0 +1,58 @@
+/**
+ * The identity-federation capability (20260911.11, Q-IA-9): the four
+ * federated-account RPC arms the identity-account controller dispatches
+ * to when a composed unit provides them, plus the identity-provider
+ * existence check their shared precondition rides. Single instance,
+ * registered as `drivers.identityFederation` (the organizationDirectory
+ * shape: a driver point that is byte-identical OSS behaviour when absent).
+ *
+ * Absent, the controller refuses the four RPCs UNIMPLEMENTED with the
+ * edition reason (domain/identityaccount/constants.ts) — never INTERNAL,
+ * the organization directory's absent-method precedent. Present, the
+ * controller still owns what is shared: the annotation's Authorize step
+ * on the organization, the ref-with-slug and org-match checks, and the
+ * IdP-exists refusal through `providerExists`; the arm receives the
+ * RESOLVED ref (org filled from the input when the ref left it empty)
+ * and the authenticated caller, and owns only what differs per edition —
+ * the natural-key lookups and writes on the federated rows.
+ *
+ * The federated natural key (provider ref + external subject) and its
+ * lookups stay on the unit's own store: the IdentityAccountStore port
+ * carries direct-account methods only, because a port does not carry
+ * methods only one edition calls.
+ */
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type {
+  CreateFederatedAccountInput,
+  DeprovisionFederatedAccountInput,
+  ExternalSubLookup,
+  UpdateFederatedAccountInput,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
+
+import type { CallerIdentity } from "./identity.js";
+
+export interface IdentityFederation {
+  createFederatedAccount(
+    input: CreateFederatedAccountInput,
+    ref: ApiResourceReference,
+    caller: CallerIdentity,
+  ): Promise<IdentityAccount>;
+  updateFederatedAccount(
+    input: UpdateFederatedAccountInput,
+    ref: ApiResourceReference,
+    caller: CallerIdentity,
+  ): Promise<IdentityAccount>;
+  deprovisionFederatedAccount(
+    input: DeprovisionFederatedAccountInput,
+    ref: ApiResourceReference,
+    caller: CallerIdentity,
+  ): Promise<IdentityAccount>;
+  getByExternalSub(
+    lookup: ExternalSubLookup,
+    ref: ApiResourceReference,
+    caller: CallerIdentity,
+  ): Promise<IdentityAccount>;
+  /** Whether the IdentityProvider `org/slug` exists — the arms' shared precondition. */
+  providerExists(org: string, slug: string): Promise<boolean>;
+}

package/src/extensions/registry.ts

@@ -30,7 +30,11 @@
  * provider) and O6's sandbox provisioners are consumed at their
  * compose.ts construction sites; the require-authentication posture
  * (20260904.02) is consumed where compose.ts builds the serving chain's
- * identity source, OR'd with the OIDC-issuer arm.
+ * identity source, OR'd with the OIDC-issuer arm; the identity-account
+ * points (20260911.11) at the identity-accounts stage (the store driver,
+ * ahead of the boot-time operator ensure) and the routes stage (the
+ * federation capability and the provision slot's steps, into the
+ * identity-account controller).
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
@@ -40,8 +44,10 @@ import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_inf
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
 import { BUILT_IN_STORAGE_TYPES } from "../artifactstorage/artifact-storage.js";
 import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { SecretCodec } from "../encryption/codec.js";
 import { V1_VERSION } from "../encryption/v1-codec.js";
+import type { IdentityFederation } from "./identity-federation.js";
 import type { ListReadScope } from "./list-read-scope.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
@@ -233,6 +239,17 @@ export interface ResolvedExtensionDrivers {
    * codec in and resolves the write version fail-fast.
    */
   readonly secretCodecs: ReadonlyMap<string, SecretCodec>;
+  /**
+   * The 20260911.11 identity-account store driver — undefined = the
+   * compose.ts identity-accounts stage installs the OSS adapter over the
+   * generic Store, OSS behavior byte-identical.
+   */
+  readonly identityAccountStore: IdentityAccountStore | undefined;
+  /**
+   * The 20260911.11 identity-federation capability — undefined = the
+   * four federated RPCs refuse UNIMPLEMENTED with the edition reason.
+   */
+  readonly identityFederation: IdentityFederation | undefined;
 }
 
 /**
@@ -276,6 +293,10 @@ export function resolveExtensions(
   let visitorErrorPolicyDeclaredBy: string | undefined;
   let scheduleFireCaller: ScheduleFireCallerMint | undefined;
   let scheduleFireCallerDeclaredBy: string | undefined;
+  let identityAccountStore: IdentityAccountStore | undefined;
+  let identityAccountStoreDeclaredBy: string | undefined;
+  let identityFederation: IdentityFederation | undefined;
+  let identityFederationDeclaredBy: string | undefined;
   const artifactStorageDrivers = new Map<
     string,
     ArtifactStorageDriverFactory
@@ -417,6 +438,26 @@ export function resolveExtensions(
       scheduleFireCallerDeclaredBy = unit.name;
     }
 
+    if (unit.drivers?.identityAccountStore !== undefined) {
+      if (identityAccountStoreDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers an IdentityAccountStore, but '${identityAccountStoreDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      identityAccountStore = unit.drivers.identityAccountStore;
+      identityAccountStoreDeclaredBy = unit.name;
+    }
+
+    if (unit.drivers?.identityFederation !== undefined) {
+      if (identityFederationDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers an IdentityFederation, but '${identityFederationDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      identityFederation = unit.drivers.identityFederation;
+      identityFederationDeclaredBy = unit.name;
+    }
+
     if (unit.drivers?.artifactStorageDrivers !== undefined) {
       for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
         if ((BUILT_IN_STORAGE_TYPES as ReadonlyArray<string>).includes(name)) {
@@ -537,6 +578,8 @@ export function resolveExtensions(
       visitorErrorPolicy,
       secretCodecs,
       scheduleFireCaller,
+      identityAccountStore,
+      identityFederation,
     },
     services,
     workers,