@stigmer/server 3.14.1 → 3.15.1

package/src/boot/__tests__/auth-enabled-composition.test.ts

@@ -14,9 +14,24 @@
  *      owning user (the runner's credential lane, ruling Q3 — the runner
  *      presents exactly such a key via STIGMER_TOKEN);
  *   4. deleting the key revokes it on the very next request;
- *   5. garbage credentials keep the Q6 unclaimed-token rejection.
+ *   5. garbage credentials keep the Q6 unclaimed-token rejection;
+ *   6. (20260911.11) the identity-account arms: an unprovisioned subject is
+ *      idp-shaped (whoAmI NOT_FOUND, writes stamped with the raw sub);
+ *      provisionMyAccount creates the account under the derived id with
+ *      the issuer's userinfo profile; from then on the verifier resolves
+ *      the subject to the account id and API keys minted before OR after
+ *      provisioning answer whoAmI with the owner's account; no operator
+ *      account exists under the posture;
+ *   7. (20260913.02, sp.console-login) the console the server serves is
+ *      told the posture through /config.json — the issuer and audience
+ *      this composition runs under, with the console client id the
+ *      operator did NOT register here left empty — and the composition
+ *      root WARNs at wiring time that the served console cannot sign in
+ *      (Q-CL-2), the STIGMER_OAUTH_REDIRECT_URI precedent. Proven through
+ *      compose.ts with STIGMER_CONSOLE_DIR at a fixture export, not
+ *      through the lane alone (handler.test.ts covers that).
  */
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { createServer } from "node:http";
@@ -30,8 +45,12 @@ import { SignJWT, exportJWK, generateKeyPair } from "jose";
 import type { GenerateKeyPairResult } from "jose";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
 import { ApiKeyQueryController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/query_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
 import { PlatformQueryController } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import {
   Health,
@@ -42,6 +61,11 @@ import { loadConfig } from "../config.js";
 import { composeServer } from "../compose.js";
 import type { ComposedServer } from "../compose.js";
 import { createLogger } from "../logger.js";
+import {
+  ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
+  USERINFO_UNAVAILABLE_PREFIX,
+  accountIdFor,
+} from "../../domain/identityaccount/constants.js";
 import { AUTHENTICATION_TOKEN_MISSING_MESSAGE } from "../../pipeline/interceptors/auth.js";
 
 const AUDIENCE = "https://api.stigmer.test/";
@@ -50,8 +74,18 @@ let dir: string;
 let issuerServer: Server;
 let issuer: string;
 let privateKey: GenerateKeyPairResult["privateKey"];
+// A lever for the UNAVAILABLE arm: the issuer's /userinfo answers 503 for
+// this subject while set. Undefined = every subject is served.
+let userinfoRefusesSub: string | undefined;
 let server: ComposedServer;
 let port: number;
+// A key minted while its owner was still idp-shaped: its creator stamp is
+// the raw sub. The identity-account arms prove that stamp resolves to the
+// owner's account once one exists (20260911.11 A1's derived id).
+let keyMintedBeforeProvisioning: string;
+// Every WARN the composition root logged while wiring — the console
+// sign-in arm (7) reads it.
+const warnings: string[] = [];
 
 function bearer(token: string): Interceptor {
   return (next) => (request) => {
@@ -88,8 +122,16 @@ beforeAll(async () => {
   };
   issuerServer = createServer((req, res) => {
     if (req.url === "/.well-known/openid-configuration") {
+      // The provisioning lane reads userinfo_endpoint from here (A8) —
+      // never a guessed `<issuer>/userinfo`.
       res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ issuer, jwks_uri: `${issuer}/jwks` }));
+      res.end(
+        JSON.stringify({
+          issuer,
+          jwks_uri: `${issuer}/jwks`,
+          userinfo_endpoint: `${issuer}/userinfo`,
+        }),
+      );
       return;
     }
     if (req.url === "/jwks") {
@@ -97,6 +139,43 @@ beforeAll(async () => {
       res.end(JSON.stringify({ keys: [jwk] }));
       return;
     }
+    if (req.url === "/userinfo") {
+      // The provisioning lane's profile source (20260911.11 A1/Q-IA-2):
+      // answers the bearer's own claims as an IdP would, given_name and
+      // family_name included — the signature was already proven upstream.
+      const header = req.headers.authorization ?? "";
+      const token = header.startsWith("Bearer ")
+        ? header.slice("Bearer ".length)
+        : "";
+      const payloadSegment = token.split(".")[1];
+      if (payloadSegment === undefined) {
+        res.statusCode = 401;
+        res.end();
+        return;
+      }
+      const claims = JSON.parse(
+        Buffer.from(payloadSegment, "base64url").toString("utf8"),
+      ) as { sub?: string; email?: string };
+      if (
+        userinfoRefusesSub !== undefined &&
+        claims.sub === userinfoRefusesSub
+      ) {
+        res.statusCode = 503;
+        res.end();
+        return;
+      }
+      res.setHeader("content-type", "application/json");
+      res.end(
+        JSON.stringify({
+          sub: claims.sub ?? "",
+          email: claims.email ?? "",
+          given_name: "Composed",
+          family_name: "User",
+          picture: `${issuer}/pictures/${encodeURIComponent(claims.sub ?? "")}`,
+        }),
+      );
+      return;
+    }
     res.statusCode = 404;
     res.end();
   });
@@ -109,6 +188,10 @@ beforeAll(async () => {
   issuer = `http://127.0.0.1:${address.port}`;
 
   dir = mkdtempSync(path.join(tmpdir(), "auth-enabled-test-"));
+  // The smallest export the console lane discovers: the app shell alone.
+  const consoleDir = path.join(dir, "console");
+  mkdirSync(consoleDir, { recursive: true });
+  writeFileSync(path.join(consoleDir, "index.html"), "<html>app shell</html>");
   server = await composeServer({
     config: loadConfig({
       STIGMER_MODEL_REGISTRY_REFRESH: "off",
@@ -118,8 +201,18 @@ beforeAll(async () => {
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STIGMER_OIDC_ISSUER: issuer,
       STIGMER_OIDC_AUDIENCE: AUDIENCE,
+      STIGMER_CONSOLE_DIR: consoleDir,
+    }),
+    logger: createLogger({
+      level: "warn",
+      pretty: false,
+      write: (line) => {
+        const entry = JSON.parse(line) as { level?: string; message?: string };
+        if (entry.level === "warn" && entry.message !== undefined) {
+          warnings.push(entry.message);
+        }
+      },
     }),
-    logger: createLogger({ level: "error", pretty: false, write: () => {} }),
     portOverride: 0,
     host: "127.0.0.1",
   });
@@ -168,6 +261,27 @@ describe("the require-authentication posture on the wire", () => {
   });
 });
 
+describe("the console the server serves is told the posture (20260913.02, sp.console-login)", () => {
+  it("/config.json carries the issuer and audience this composition verifies against, with the unregistered console client id empty", async () => {
+    const response = await fetch(`http://127.0.0.1:${port}/config.json`);
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      apiUrl: "",
+      appUrl: "",
+      authMode: "oidc",
+      oidcIssuer: issuer,
+      oidcClientId: "",
+      oidcAudience: AUDIENCE,
+    });
+  });
+
+  it("the composition root WARNs at wiring time that the served console cannot sign in without STIGMER_OIDC_CONSOLE_CLIENT_ID (Q-CL-2)", () => {
+    expect(warnings).toContainEqual(
+      expect.stringContaining("STIGMER_OIDC_CONSOLE_CLIENT_ID"),
+    );
+  });
+});
+
 describe("the full credential loop (OIDC login → API key → revocation)", () => {
   let apiKeyPlaintext: string;
   let apiKeyId: string;
@@ -221,6 +335,7 @@ describe("the full credential loop (OIDC login → API key → revocation)", ()
     expect(second.status?.audit?.specAudit?.createdBy?.id).toBe(
       "auth0|loop-user",
     );
+    keyMintedBeforeProvisioning = second.spec?.keyHash ?? "";
   });
 
   it("deleting the key revokes it on the very next request", async () => {
@@ -243,3 +358,158 @@ describe("the full credential loop (OIDC login → API key → revocation)", ()
     expect(ConnectError.from(error).rawMessage).toBe("invalid token");
   });
 });
+
+describe("identity accounts under the OIDC posture (20260911.11; Q-IA-2, A1, A2)", () => {
+  const SUB = "auth0|loop-user";
+  const accountId = accountIdFor(SUB);
+
+  it("no operator account exists under an authentication posture — the boot-time ensure is trusted-local only", async () => {
+    const rows = await server.store.listResources(
+      ApiResourceKind.identity_account,
+    );
+    expect(rows).toHaveLength(0);
+  });
+
+  it("whoAmI for an unprovisioned subject is NOT_FOUND with the cloud's copy, and its writes stay stamped with the raw sub", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const query = createClient(
+      IdentityAccountQueryController,
+      transportWith(token),
+    );
+    const error = await query.whoAmI({}).catch((e: unknown) => e);
+    expect(ConnectError.from(error).code).toBe(Code.NotFound);
+    expect(ConnectError.from(error).rawMessage).toBe(
+      ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,
+    );
+  });
+
+  it("provisionMyAccount creates the account under the derived id with the userinfo profile", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const account = await command.provisionMyAccount({});
+    expect(account.metadata?.id).toBe(accountId);
+    expect(account.metadata?.name).toBe("loop@example.com");
+    expect(account.spec).toMatchObject({
+      idpId: SUB,
+      email: "loop@example.com",
+      firstName: "Composed",
+      lastName: "User",
+      provisioningMode: IdentityAccountProvisioningMode.direct,
+      isMachineAccount: false,
+    });
+    // The account is created BY the subject it is for: the stamp is the
+    // sub the verifier admitted idp-shaped — no account existed yet.
+    expect(account.status?.audit?.specAudit?.createdBy?.id).toBe(SUB);
+  });
+
+  it("from the next request on, the verifier resolves the subject to the account id — whoAmI answers and writes are stamped with it", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const query = createClient(
+      IdentityAccountQueryController,
+      transportWith(token),
+    );
+    const me = await query.whoAmI({});
+    expect(me.metadata?.id).toBe(accountId);
+
+    const keys = createClient(ApiKeyCommandController, transportWith(token));
+    const key = await keys.create({
+      apiVersion: "iam.stigmer.ai/v1",
+      kind: "ApiKey",
+      metadata: { name: "minted after provisioning", org: "local" },
+      spec: {},
+    });
+    expect(key.status?.audit?.specAudit?.createdBy?.id).toBe(accountId);
+    expect(key.status?.audit?.specAudit?.createdBy?.email).toBe(
+      "loop@example.com",
+    );
+
+    // Over that key, whoAmI is the owner's account — the key is the user.
+    const overKey = createClient(
+      IdentityAccountQueryController,
+      transportWith(key.spec?.keyHash ?? ""),
+    );
+    expect((await overKey.whoAmI({})).metadata?.id).toBe(accountId);
+  });
+
+  it("a key minted BEFORE provisioning still resolves to the owner's account — the raw-sub stamp derives to the same id", async () => {
+    const overLegacyKey = createClient(
+      IdentityAccountQueryController,
+      transportWith(keyMintedBeforeProvisioning),
+    );
+    expect((await overLegacyKey.whoAmI({})).metadata?.id).toBe(accountId);
+  });
+
+  it("provisionMyAccount is idempotent for a provisioned subject", async () => {
+    const token = await mintOidcToken(SUB, "loop@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const before = (
+      await server.store.listResources(ApiResourceKind.identity_account)
+    ).length;
+    const again = await command.provisionMyAccount({});
+    expect(again.metadata?.id).toBe(accountId);
+    expect(
+      (await server.store.listResources(ApiResourceKind.identity_account))
+        .length,
+    ).toBe(before);
+  });
+
+  it("two concurrent first logins for one subject end in exactly one account", async () => {
+    const token = await mintOidcToken("auth0|racer", "racer@example.com");
+    const command = createClient(
+      IdentityAccountCommandController,
+      transportWith(token),
+    );
+    const before = (
+      await server.store.listResources(ApiResourceKind.identity_account)
+    ).length;
+    const [a, b] = await Promise.all([
+      command.provisionMyAccount({}),
+      command.provisionMyAccount({}),
+    ]);
+    expect(a.metadata?.id).toBe(accountIdFor("auth0|racer"));
+    expect(b.metadata?.id).toBe(a.metadata?.id);
+    expect(
+      (await server.store.listResources(ApiResourceKind.identity_account))
+        .length,
+    ).toBe(before + 1);
+  });
+
+  it("a userinfo failure is UNAVAILABLE with the cloud's copy, and no account is created", async () => {
+    // A real token (the verifier must admit it) whose subject the issuer's
+    // /userinfo refuses while the lever is set.
+    const token = await mintOidcToken(
+      "auth0|userinfo-down",
+      "down@example.com",
+    );
+    userinfoRefusesSub = "auth0|userinfo-down";
+    try {
+      const command = createClient(
+        IdentityAccountCommandController,
+        transportWith(token),
+      );
+      const error = await command
+        .provisionMyAccount({})
+        .catch((e: unknown) => e);
+      expect(ConnectError.from(error).code).toBe(Code.Unavailable);
+      expect(
+        ConnectError.from(error).rawMessage.startsWith(
+          USERINFO_UNAVAILABLE_PREFIX,
+        ),
+      ).toBe(true);
+      const query = createClient(
+        IdentityAccountQueryController,
+        transportWith(token),
+      );
+      const missing = await query.whoAmI({}).catch((e: unknown) => e);
+      expect(ConnectError.from(missing).code).toBe(Code.NotFound);
+    } finally {
+      userinfoRefusesSub = undefined;
+    }
+  });
+});

package/src/boot/__tests__/config.test.ts

@@ -59,15 +59,53 @@ describe("loadConfig", () => {
   });
 
   it("reads an explicit ARTIFACT_HTTP_HOST (the container override)", () => {
-    expect(
-      loadConfig({ ARTIFACT_HTTP_HOST: "0.0.0.0" }).artifactHttpHost,
-    ).toBe("0.0.0.0");
+    expect(loadConfig({ ARTIFACT_HTTP_HOST: "0.0.0.0" }).artifactHttpHost).toBe(
+      "0.0.0.0",
+    );
     // Empty string is absent, per the Go getEnvString leniency.
     expect(loadConfig({ ARTIFACT_HTTP_HOST: "" }).artifactHttpHost).toBe(
       "127.0.0.1",
     );
   });
 
+  // 20260913.02 (sp.console-login, Q-CL-1): the console's public PKCE client
+  // id is lenient on purpose — a CLI-only self-host that set the issuer
+  // before this knob existed must keep booting on upgrade, and the served
+  // console reports the gap itself (Q-CL-2).
+  describe("STIGMER_OIDC_CONSOLE_CLIENT_ID (the console's sign-in client)", () => {
+    const OIDC = {
+      STIGMER_OIDC_ISSUER: "https://auth.example.com/realms/main",
+      STIGMER_OIDC_AUDIENCE: "https://stigmer.example.com/",
+    };
+
+    it("is empty when absent, and the issuer alone still boots", () => {
+      expect(loadConfig(OIDC).oidcConsoleClientId).toBe("");
+    });
+
+    it("reads the explicit value", () => {
+      expect(
+        loadConfig({
+          ...OIDC,
+          STIGMER_OIDC_CONSOLE_CLIENT_ID: "stigmer-console",
+        }).oidcConsoleClientId,
+      ).toBe("stigmer-console");
+    });
+
+    it("treats an empty string as absent (Go's getEnvString)", () => {
+      expect(
+        loadConfig({ ...OIDC, STIGMER_OIDC_CONSOLE_CLIENT_ID: "" })
+          .oidcConsoleClientId,
+      ).toBe("");
+    });
+
+    it("is carried even without an issuer — the posture, not this knob, decides whether it is used", () => {
+      expect(
+        loadConfig({ STIGMER_OIDC_CONSOLE_CLIENT_ID: "stigmer-console" })
+          .oidcConsoleClientId,
+      ).toBe("stigmer-console");
+    });
+  });
+
   it("disables the model-registry refresh only for the literal 'off'", () => {
     expect(
       loadConfig({ STIGMER_MODEL_REGISTRY_REFRESH: "off" })

package/src/boot/compose.ts

@@ -28,6 +28,7 @@ import path from "node:path";
 
 import type { ConnectRouter, Transport } from "@connectrpc/connect";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 
 import { registerAgentServices } from "../domain/agent/controller.js";
@@ -64,6 +65,15 @@ import { registerChannelConversationServices } from "../domain/agentchannel/conv
 import { registerChannelMessageServices } from "../domain/agentchannel/message.js";
 import { registerAgentShareServices } from "../domain/agentshare/controller.js";
 import { registerApiKeyServices } from "../domain/apikey/controller.js";
+import {
+  newCreateAccountPath,
+  registerIdentityAccountServices,
+} from "../domain/identityaccount/controller.js";
+import { ensureOperatorAccount } from "../domain/identityaccount/operator.js";
+import { newDirectAccountProvisioner } from "../domain/identityaccount/provisioning.js";
+import { newResourceIdentityAccountStore } from "../domain/identityaccount/resource-store.js";
+import { newIssuerDiscovery } from "../identity/oidc-discovery.js";
+import { newOidcUserInfoClient } from "../identity/oidc-userinfo.js";
 import { newApiKeyIdentityVerifier } from "../domain/apikey/verifier.js";
 import type { IdentityVerifier } from "../extensions/identity.js";
 import { registerArtifactServices } from "../domain/artifact/controller.js";
@@ -117,6 +127,7 @@ import {
 } from "../observability/rpc-metrics.js";
 import { buildInterceptorChain } from "../pipeline/chain.js";
 import { createVerifierChainInterceptor } from "../pipeline/interceptors/auth.js";
+import { operatorIdentitySnapshot } from "../pipeline/steps/defaults.js";
 import { createErrorBoundaryInterceptor } from "../pipeline/interceptors/error-boundary.js";
 import { createRequestMetricsInterceptor } from "../pipeline/interceptors/request-metrics.js";
 import { newPermissiveSingleTeamAuthorizer } from "../pipeline/steps/authorize.js";
@@ -150,7 +161,10 @@ import { newWorkflowExecutionEngineStateProvider } from "../temporal/workflowexe
 import { newWorkflowExecutionWorkerFactory } from "../temporal/workflowexecution/worker.js";
 import { HealthState, registerHealthService } from "../transport/health.js";
 import { resolveConsoleAssets } from "../transport/console/assets.js";
-import { createConsoleLane } from "../transport/console/handler.js";
+import {
+  createConsoleLane,
+  type ConsoleSignInPosture,
+} from "../transport/console/handler.js";
 import { createRegistryLanes } from "../transport/registry/lanes.js";
 import { createUnifiedPortServer } from "../transport/server.js";
 import type { ServerConfig } from "./config.js";
@@ -221,6 +235,13 @@ export interface ComposedServer {
    * them or reorder them, and both are the drift DD-007 rules out.
    */
   identityVerifiers: ReadonlyArray<IdentityVerifier>;
+  /**
+   * The one routes function both routers are built from (exposed for
+   * tests, the `store` posture — the tier-truthfulness invariant
+   * enumerates the services a composition registers through it; the
+   * server registers no reflection service, deliberately).
+   */
+  routes: (router: ConnectRouter) => void;
   /** Completes wiring, flips SERVING, binds the port; returns the bound port. */
   start(): Promise<number>;
   /** NOT_SERVING first, stop background work, drain connections. */
@@ -294,6 +315,75 @@ export async function composeServer(
     });
   }
 
+  // The require-authentication posture has two sources OR'd here: the
+  // OSS OIDC issuer (O3 rulings Q1+Q2) and a composed unit's declaration
+  // (registry point, entry 20260904.02). Neither source = the OSS
+  // trusted-local posture, byte-identical wire behavior. Resolved in the
+  // storage stage because the posture decides a WRITE below (the operator
+  // account); the verifier chain it also governs is built at the end.
+  const authEnabled = config.oidcIssuer !== "";
+  const requireAuthentication =
+    authEnabled || extensions.requireAuthentication !== undefined;
+
+  // Stage: identity accounts (20260911.11) — the first domain whose
+  // persistence is a PORT rather than the generic Store. The composed
+  // driver (`drivers.identityAccountStore`, Q-IA-9) serves when a unit
+  // registers one; otherwise open source's adapter over `store` installs
+  // HERE (the default lives with the consumer, never in the registry).
+  // This ONE binding is what the create path, the provisioner, the
+  // operator ensure and both OSS verifiers read, so a composed driver is
+  // followed everywhere by construction. The domain's one create path is
+  // built once and shared by the create RPC, provisioning and the operator
+  // ensure below.
+  const identityAccounts =
+    extensions.drivers.identityAccountStore ??
+    newResourceIdentityAccountStore(store);
+  const identityAccountPath = {
+    accounts: identityAccounts,
+    logger,
+    authorizer,
+    authorizationLifecycle,
+  };
+  const createIdentityAccount = newCreateAccountPath(
+    identityAccountPath,
+    ApiResourceKind.identity_account,
+  );
+  // ONE issuer discovery for every lane that reads a well-known document
+  // (A8): provisioning's userinfo client here and the OIDC verifier's
+  // JWKS location below share it, so an issuer is discovered once per
+  // process and validated the same way wherever it is consumed. Built in
+  // this stage, not inside routes() (which runs twice) — the same reason
+  // the searchRegistry lives here.
+  const issuerDiscovery = newIssuerDiscovery();
+  // Provisioning reads the caller's profile from the userinfo endpoint of
+  // the issuer that vouched for the token, discovered per issuer and
+  // cached (A8) — so a composition whose own verifiers name their issuer
+  // on the identity needs no knob here.
+  const identityAccountProvisioner = newDirectAccountProvisioner({
+    accounts: identityAccounts,
+    createAccount: createIdentityAccount,
+    userInfo: newOidcUserInfoClient(issuerDiscovery),
+  });
+  // Under the trusted-local posture the server knows its one principal
+  // from the operator seam (the SAME seam the interceptor stamps callers
+  // from — never config directly, so the row and the stamp cannot
+  // disagree; T01_1_review.md A2, A5) and states the fact at boot:
+  // create-if-absent, so preferences set later survive every reboot. A
+  // composition with an authentication posture never creates one — its
+  // users provision themselves on first sign-in. A stage that writes a
+  // resource is new here; it earns its place because it is the truth of
+  // that posture, and a failure is a loud boot throw like the storage
+  // stage's own.
+  if (!requireAuthentication) {
+    const operator = await ensureOperatorAccount(
+      { accounts: identityAccounts, createAccount: createIdentityAccount },
+      operatorIdentitySnapshot(),
+    );
+    logger.info("trusted-local operator account ensured", {
+      accountId: operator.metadata?.id ?? "",
+    });
+  }
+
   // Stage: keys — the ratified fail-loud boot ASYMMETRY (D2 cross-domain
   // invariants; Go server.go:277-293):
   //
@@ -675,11 +765,36 @@ export async function composeServer(
   } else {
     logger.debug("no web console export bundled; console lane disabled");
   }
+  // The console is told how to sign in (20260913.02 sp.console-login): the
+  // OSS issuer arm of the posture, in the console's vocabulary. A composed
+  // unit's own `requireAuthentication` is NOT expressed here — a
+  // composition whose verifiers resolve its users serves its console its
+  // own way (the cloud's container does); the Enterprise console story is
+  // P4's. Issuer set but no console client registered is WARN-degrade, the
+  // STIGMER_OAUTH_REDIRECT_URI posture: the CLI and SDKs keep working with
+  // API keys, and the served console refuses with copy naming the knob.
+  const consoleSignIn: ConsoleSignInPosture = authEnabled
+    ? {
+        posture: "oidc",
+        issuer: config.oidcIssuer,
+        audience: config.oidcAudience,
+        consoleClientId: config.oidcConsoleClientId,
+      }
+    : { posture: "trusted-local" };
+  if (
+    consoleAssets !== undefined &&
+    consoleSignIn.posture === "oidc" &&
+    consoleSignIn.consoleClientId === ""
+  ) {
+    logger.warn(
+      "STIGMER_OIDC_ISSUER is set but STIGMER_OIDC_CONSOLE_CLIENT_ID is not — the web console this server serves cannot sign in; register a public PKCE client for the console at the issuer and set it",
+    );
+  }
   const consoleLane =
     consoleAssets !== undefined
       ? createConsoleLane({
           assets: consoleAssets,
-          grpcPort: options.portOverride ?? config.grpcPort,
+          signIn: consoleSignIn,
           logger,
         })
       : undefined;
@@ -799,6 +914,17 @@ export async function composeServer(
       authorizationLifecycle,
       listReadScope: extensions.drivers.listReadScope,
     });
+    // IdentityAccount (20260911.11): served once by open source in every
+    // edition over the store PORT bound in the identity-accounts stage; a
+    // composition adds what differs per edition through the registry —
+    // the federation capability (the four federated RPC arms) and the
+    // provision slot's gate steps (the cloud's personal organization).
+    registerIdentityAccountServices(router, {
+      ...identityAccountPath,
+      provisioner: identityAccountProvisioner,
+      federation: extensions.drivers.identityFederation,
+      gateSteps: extensions.gateSteps,
+    });
     registerEnvironmentServices(router, {
       store,
       logger,
@@ -1092,14 +1218,8 @@ export async function composeServer(
   const inProcessWiring = createInProcessClients(routes, logger);
   inProcess = inProcessWiring.clients;
 
-  // The require-authentication posture has two sources OR'd here: the
-  // OSS OIDC issuer (O3 rulings Q1+Q2) and a composed unit's declaration
-  // (registry point, entry 20260904.02). Neither source = the OSS
-  // trusted-local posture, byte-identical wire behavior.
-  const authEnabled = config.oidcIssuer !== "";
-  const requireAuthentication =
-    authEnabled || extensions.requireAuthentication !== undefined;
-  // What the posture registers, in Java's ProviderManager order (opaque
+  // What the posture (resolved in the storage stage) registers, in Java's
+  // ProviderManager order (opaque
   // keys first — the cheapest claim — then the JWT lanes), ahead of the
   // extension entries ("OSS entries first", the registry contract):
   //   - the API-key verifier rides the POSTURE, not the issuer
@@ -1108,19 +1228,31 @@ export async function composeServer(
   //     authentication posture must honor the keys it issues. Gating it on
   //     the issuer left a posture-declaring composition minting keys
   //     nothing verified.
-  //   - the OIDC verifier rides the ISSUER alone: it resolves callers to
-  //     the token's `sub`, which is the wrong principal for a composition
-  //     whose own lanes resolve users to their account ids — that is why a
-  //     declared posture never borrows the issuer knob.
+  //   - the OIDC verifier rides the ISSUER alone: it is open source's
+  //     single-issuer lane, and a composition with verifiers of its own
+  //     names their issuers and audiences itself and declares the posture
+  //     instead — so the knob and the extension entries never both claim
+  //     one JWT.
+  //   - both OSS verifiers resolve their subject through the identity-
+  //     account domain (20260911.11 Q-IA-2, A6): a provisioned user is
+  //     stamped with the account id whichever credential they present,
+  //     an unprovisioned one is admitted idp-shaped. They read the SAME
+  //     port the domain writes through (`identityAccounts`, the
+  //     identity-accounts stage — a composed driver included), so a row
+  //     provisioning creates resolves on the very next request.
   // The runner's credential in either posture is an operator-minted API
   // token via STIGMER_TOKEN (O3 ruling Q3) — no runner-specific verifier.
   const identityVerifiers = [
-    ...(requireAuthentication ? [newApiKeyIdentityVerifier(store)] : []),
+    ...(requireAuthentication
+      ? [newApiKeyIdentityVerifier({ store, accounts: identityAccounts })]
+      : []),
     ...(authEnabled
       ? [
           newOidcIdentityVerifier({
             issuer: config.oidcIssuer,
             audience: config.oidcAudience,
+            accounts: identityAccounts,
+            discovery: issuerDiscovery,
           }),
         ]
       : []),
@@ -1203,6 +1335,7 @@ export async function composeServer(
     workflowExecutionStreamBroker,
     inProcessTransport: inProcessWiring.transport,
     identityVerifiers,
+    routes,
 
     async start(): Promise<number> {
       // Temporal boot is NON-fatal end to end (Go server.go): a failed