@stigmer/server 3.15.1 → 3.15.2-dev.20260913223433

package/src/domain/workflowinstance/controller.ts

@@ -748,9 +748,7 @@ async function getByWorkflow(
       ),
     )
     .addStep(newValidateProtoStep())
-    .addStep(
-      newLoadByWorkflowStep(deps.store, deps.logger, deps.listReadScope),
-    )
+    .addStep(newLoadByWorkflowStep(deps.store, deps.logger, deps.listReadScope))
     .build()
     .execute(reqCtx);
 
@@ -794,27 +792,22 @@ function newLoadByWorkflowStep(
           continue;
         }
       }
-      // 20260830.01 census lane 20: the scope narrows the decoded scan;
-      // the org/workflow filters below are contract parity in both editions.
-      const visible = await restrictListByReadScope(
+      // 20260830.01 census lane 20: the org/workflow filters are contract
+      // parity in both editions and run FIRST; the scope narrows the
+      // workflow's instances last (the scope is the last per-row
+      // predicate, stigmer-cloud 20260913.04 T02).
+      const filtered = await restrictListByReadScope(
         listReadScope,
         ctx.callerIdentity,
         ApiResourceKind.workflow_instance,
-        decoded,
+        decoded.filter(
+          (instance) =>
+            instance.spec?.workflowId === workflowId &&
+            (request.org === "" || instance.metadata?.org === request.org),
+        ),
         "",
       );
 
-      const filtered: WorkflowInstance[] = [];
-      for (const instance of visible) {
-        if (instance.spec?.workflowId !== workflowId) {
-          continue;
-        }
-        if (request.org !== "" && instance.metadata?.org !== request.org) {
-          continue;
-        }
-        filtered.push(instance);
-      }
-
       logger.info("found workflow instances for workflow", {
         workflowId,
         count: filtered.length,

package/src/extensions/__tests__/list-read-scope.test.ts

@@ -7,8 +7,11 @@
  *     byte-identity arm the four local conformance rosters also pin);
  *   - a composed scope narrows to the kept ids — and can only narrow:
  *     ids the scope answers that were never offered add nothing;
- *   - the org argument narrows AFTER the scope, only when non-blank
- *     (the Java repos' uniform blank-org posture);
+ *   - the org argument narrows BEFORE the scope, only when non-blank
+ *     (the Java repos' uniform blank-org posture; since stigmer-cloud
+ *     20260913.04 T02 the scope is the last per-row predicate, so it is
+ *     offered the org's rows and never the kind's — the same result set,
+ *     a fraction of the candidates);
  *   - the candidates carry {id, org, labels} — the driver's guest
  *     cookie rule keys on labels;
  *   - a scope failure PROPAGATES — never an empty result (the outage
@@ -76,24 +79,39 @@ describe("restrictListByReadScope", () => {
     expect(kept.map((r) => r.metadata.id)).toEqual(["ses_b"]);
   });
 
-  it("a non-blank org narrows AFTER the scope; blank org does not", async () => {
-    const scoped = scopeKeeping(["ses_a", "ses_c"]);
+  it("a non-blank org narrows BEFORE the scope: the scope is offered the org's rows only; blank org offers them all", async () => {
+    const offered: ReadonlyArray<ListEntryMeta>[] = [];
+    const recording: ListReadScope = {
+      authorizedResourceIds: () => Promise.resolve(new Set<string>()),
+      restrictListEntries: (_caller, _kind, entries) => {
+        offered.push(entries);
+        return Promise.resolve(new Set(["ses_a", "ses_c"]));
+      },
+    };
     const withOrg = await restrictListByReadScope(
-      scoped,
+      recording,
       caller,
       ApiResourceKind.session,
       rows,
       "acme",
     );
     expect(withOrg.map((r) => r.metadata.id)).toEqual(["ses_a"]);
+    // The rival's row was never a candidate: the engine is not asked
+    // about rows the request's own predicate excludes.
+    expect(offered[0]!.map((entry) => entry.id)).toEqual(["ses_a", "ses_b"]);
     const blankOrg = await restrictListByReadScope(
-      scoped,
+      recording,
       caller,
       ApiResourceKind.session,
       rows,
       "",
     );
     expect(blankOrg.map((r) => r.metadata.id)).toEqual(["ses_a", "ses_c"]);
+    expect(offered[1]!.map((entry) => entry.id)).toEqual([
+      "ses_a",
+      "ses_b",
+      "ses_c",
+    ]);
   });
 
   it("an empty kept set is a real answer — the empty list", async () => {
@@ -127,7 +145,11 @@ describe("restrictListByReadScope", () => {
     );
     expect(seenKind).toBe(ApiResourceKind.session);
     expect(seen).toEqual([
-      { id: "ses_a", org: "acme", labels: { "stigmer.ai/guest-cookie-id": "ck_1" } },
+      {
+        id: "ses_a",
+        org: "acme",
+        labels: { "stigmer.ai/guest-cookie-id": "ck_1" },
+      },
       { id: "ses_b", org: "acme", labels: {} },
       { id: "ses_c", org: "rival", labels: {} },
     ]);

package/src/extensions/list-read-scope.ts

@@ -47,6 +47,30 @@
  *     semantics (the Java baseline propagates the original caller
  *     through in-process calls, so a composed driver normally never
  *     sees `internal` on these lanes).
+ *   - THE SCOPE IS THE LAST PER-ROW PREDICATE IN A LANE (stigmer-cloud
+ *     20260913.04 T02, Q-LB-11). Every request predicate a lane applies
+ *     — the request's org, a phase, labels, a parent id, filter criteria
+ *     — is a pure function of one row and the request; the scope is a
+ *     pure function of one row and the caller; an intersection of
+ *     per-row predicates commutes, so the order is free and the cheap
+ *     ones go first: a lane offers the scope ONLY the rows its own
+ *     predicates keep. Sort, page and aggregate are not per-row and stay
+ *     after the scope, where they were. Why it matters: a composed
+ *     driver's cost is proportional to the candidates offered (the cloud
+ *     checks each one against its authorization engine), and the whole
+ *     kind across every tenant is what rolled back on 2026-09-14; the
+ *     request's org is tens of rows. Two idioms carry the rule and both
+ *     keep their reason: a lane whose Go/Java contract org-narrows in
+ *     BOTH editions (environment, memory, schedule, agent-instance,
+ *     agent-share and agent-channel lists; the getBy* parent filters)
+ *     applies its own filter ABOVE the helper call and passes `""`; a lane
+ *     whose contract is cross-org on OSS (`agentExecution.list`,
+ *     `workflowExecution.list`, `listPendingApprovals`) hands the request
+ *     org to the helper, which applies it before the scope ONLY when a
+ *     scope is composed — a scope-less server still returns the input
+ *     untouched with the org unconsulted (the first line above). Two lanes
+ *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
+ *     the kind until P1 entry 12 pages them.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
@@ -112,10 +136,13 @@ export interface ScopedListResource {
  *     `requestOrg` deliberately not consulted — the OSS single-tenant
  *     posture treats the org field as a no-op, and new filtering on a
  *     scope-less server would be a silent wire change);
- *   - scope composed → entries narrowed to the kept ids, then to
- *     `requestOrg` when non-blank (the Java repos' uniform posture:
- *     blank org = permission-bounded across orgs, verified per lane in
- *     the entry's census — lanes Java does not org-narrow pass "").
+ *   - scope composed → entries narrowed to `requestOrg` when non-blank
+ *     FIRST (the Java repos' uniform posture: blank org =
+ *     permission-bounded across orgs, verified per lane in the entry's
+ *     census — lanes Java does not org-narrow pass ""), then to the kept
+ *     ids. The same set either way (both are per-row predicates); the
+ *     order is the header's last contract line: the scope sees the org's
+ *     rows, not the kind's.
  */
 export async function restrictListByReadScope<T extends ScopedListResource>(
   scope: ListReadScope | undefined,
@@ -127,17 +154,15 @@ export async function restrictListByReadScope<T extends ScopedListResource>(
   if (scope === undefined) {
     return [...resources];
   }
-  const entries: ListEntryMeta[] = resources.map((resource) => ({
+  const offered =
+    requestOrg === ""
+      ? resources
+      : resources.filter((resource) => resource.metadata?.org === requestOrg);
+  const entries: ListEntryMeta[] = offered.map((resource) => ({
     id: resource.metadata?.id ?? "",
     org: resource.metadata?.org ?? "",
     labels: resource.metadata?.labels ?? {},
   }));
   const keptIds = await scope.restrictListEntries(caller, kind, entries);
-  let kept = resources.filter((resource) =>
-    keptIds.has(resource.metadata?.id ?? ""),
-  );
-  if (requestOrg !== "") {
-    kept = kept.filter((resource) => resource.metadata?.org === requestOrg);
-  }
-  return kept;
+  return offered.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
 }