@stigmer/server 3.15.2 → 3.15.3-dev.20260914121148

package/src/domain/iampolicy/__tests__/membership.test.ts

@@ -0,0 +1,447 @@
+/**
+ * Pins the open-source membership rules (T01_0_plan.md §3a
+ * "membership.ts"; T01_1_review.md Q-OR-6b and Q-OR-6c) over a seeded
+ * generic store, a fake account port and the real grant path:
+ *
+ *   onAccountCreated(account, caller), per organization the account holds
+ *   no row on:
+ *   - `owner` when the account's subject (its idp_id) or its id is the
+ *     organization's own creator;
+ *   - `admin` when it created any BLUEPRINT in that organization (and only
+ *     a blueprint: a session's creator stays a member — DD-002 rule 2
+ *     keeps personal things by created_by with no role);
+ *   - `admin` when the organization has ZERO role rows and no PERSON other
+ *     than this account created the organization or any blueprint in it
+ *     (slice 4 ruling Q-S4-7: the founder's stamp counts) — the
+ *     fresh-install and the trusted-local-turned-OIDC first caller. "Zero
+ *     rows", never "no admin now": revoking every admin of a bootstrapped
+ *     organization must not hand it to the next stranger;
+ *   - `admin` when the account's email is STIGMER_OPERATOR_EMAIL (and that
+ *     email is configured — an empty one matches nobody);
+ *   - `member` otherwise;
+ *   - nothing for a non-`user` caller class; nothing on an organization
+ *     the account already holds a row on (idempotent by construction), so
+ *     a run that faulted midway converges on the next.
+ *
+ *   ensureOperatorOwnership(operator): `owner` on every organization that
+ *   has NO owner row (Q-S4-3: a boot-time write never overrides a recorded
+ *   human grant); a second boot writes nothing; the row's audit actor is
+ *   the operator's account — id, email and display name — like every
+ *   other trusted-local write.
+ *
+ * The creator stamps the rules read are `status.audit.spec_audit.created_by
+ * .id`, which for a legacy self-host is the raw issuer subject and for a
+ * provisioned caller is the account id (P1 gate Q2c; 2a handoff 2), so
+ * both spellings are seeded and both must match. A stamp is a PERSON when
+ * it is non-empty and not the unconfigured laptop's "system" placeholder;
+ * the rules classify stamps by shape and consult no account store.
+ *
+ * The rules read policy rows through the IamPolicyStore PORT (`policies`,
+ * the same instance the grant path writes through), never around it.
+ */
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { create } from "@bufbuild/protobuf";
+import { TimestampSchema } from "@bufbuild/protobuf/wkt";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { tempStore } from "../../../store/sqlite/__tests__/support.js";
+import type { Store } from "../../../store/interface.js";
+import { accountIdFor } from "../../identityaccount/constants.js";
+import { BLUEPRINT_KINDS } from "../constants.js";
+import { newIamPolicyGrantPath } from "../grant-path.js";
+import type { IamPolicyGrantPath } from "../grant-path.js";
+import { CREATOR_SCAN_SCHEMAS, newMembershipRules } from "../membership.js";
+import type { MembershipRules } from "../membership.js";
+import type { IamPolicyStore } from "../store.js";
+import { fakeIamPolicyStore } from "./support.js";
+import type { FakeIamPolicyStore } from "./support.js";
+
+const OPERATOR_EMAIL = "operator@example.com";
+const silentLogger = { debug() {}, info() {}, warn() {}, error() {} };
+
+function userCaller(identityId: string, email?: string): CallerIdentity {
+  return {
+    identityId,
+    callerClass: "user",
+    issuer: "https://issuer.example.com",
+    rawToken: "",
+    email,
+  };
+}
+
+function account(sub: string, email: string): IdentityAccount {
+  return create(IdentityAccountSchema, {
+    apiVersion: "iam.stigmer.ai/v1",
+    kind: "IdentityAccount",
+    metadata: { id: accountIdFor(sub), name: email },
+    spec: {
+      idpId: sub,
+      email,
+      provisioningMode: IdentityAccountProvisioningMode.direct,
+    },
+  });
+}
+
+describe("membership rules", () => {
+  let temp: ReturnType<typeof tempStore>;
+  let store: Store;
+  let policies: FakeIamPolicyStore;
+  let grantPath: IamPolicyGrantPath;
+  let rules: MembershipRules;
+
+  /** Rules over the shared store and a policy port of the test's choosing (the grant path is built over the same port). */
+  function rulesOver(
+    port: IamPolicyStore,
+    operatorEmail: string = OPERATOR_EMAIL,
+  ): MembershipRules {
+    return newMembershipRules({
+      grantPath: newIamPolicyGrantPath({
+        policies: port,
+        lifecycle: undefined,
+        logger: silentLogger,
+      }),
+      policies: port,
+      store,
+      operatorEmail,
+    });
+  }
+
+  beforeEach(() => {
+    temp = tempStore();
+    store = temp.store;
+    policies = fakeIamPolicyStore();
+    grantPath = newIamPolicyGrantPath({
+      policies,
+      lifecycle: undefined,
+      logger: silentLogger,
+    });
+    rules = newMembershipRules({
+      grantPath,
+      policies,
+      store,
+      operatorEmail: OPERATOR_EMAIL,
+    });
+  });
+
+  afterEach(async () => {
+    await temp.cleanup();
+  });
+
+  /** Seeds an organization row whose creator stamp is `createdBy` (a subject or an account id). */
+  async function seedOrg(slug: string, createdBy: string): Promise<void> {
+    const org = create(OrganizationSchema, {
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { id: slug, slug, name: slug },
+      spec: { description: slug },
+      status: {
+        audit: {
+          specAudit: {
+            createdBy: { id: createdBy },
+            createdAt: create(TimestampSchema),
+          },
+        },
+      },
+    });
+    await store.saveResource(
+      ApiResourceKind.organization,
+      slug,
+      OrganizationSchema,
+      org,
+    );
+  }
+
+  async function seedAgent(
+    id: string,
+    org: string,
+    createdBy: string,
+  ): Promise<void> {
+    const agent = create(AgentSchema, {
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "Agent",
+      metadata: { id, org, name: id, slug: id },
+      status: {
+        audit: {
+          specAudit: {
+            createdBy: { id: createdBy },
+            createdAt: create(TimestampSchema),
+          },
+        },
+      },
+    });
+    await store.saveResource(ApiResourceKind.agent, id, AgentSchema, agent);
+  }
+
+  async function seedSession(
+    id: string,
+    org: string,
+    createdBy: string,
+  ): Promise<void> {
+    const session = create(SessionSchema, {
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "Session",
+      metadata: { id, org, name: id },
+      status: {
+        audit: {
+          specAudit: {
+            createdBy: { id: createdBy },
+            createdAt: create(TimestampSchema),
+          },
+        },
+      },
+    });
+    await store.saveResource(
+      ApiResourceKind.session,
+      id,
+      SessionSchema,
+      session,
+    );
+  }
+
+  function rolesOf(accountId: string): ReadonlyArray<string> {
+    return [...policies.rows.values()]
+      .filter((p) => p.spec?.principal?.id === accountId)
+      .map((p) => `${p.spec?.relation}@${p.spec?.resource?.id}`)
+      .sort();
+  }
+
+  describe("onAccountCreated", () => {
+    it("the organization's creator, stamped by raw subject before provisioning, becomes its owner", async () => {
+      await seedOrg("acme", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      expect(rolesOf(alice.metadata!.id)).toEqual(["owner@acme"]);
+    });
+
+    it("the organization's creator, stamped by account id, becomes its owner too", async () => {
+      const alice = account("auth0|alice", "alice@example.com");
+      await seedOrg("acme", alice.metadata!.id);
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      expect(rolesOf(alice.metadata!.id)).toEqual(["owner@acme"]);
+    });
+
+    it("a blueprint's creator in someone else's organization becomes admin there; a session's creator does not", async () => {
+      await seedOrg("acme", "auth0|alice");
+      await seedAgent("agt_bob", "acme", "auth0|bob");
+      await seedOrg("globex", "auth0|alice");
+      await seedSession("ses_bob", "globex", "auth0|bob");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      const bob = account("auth0|bob", "bob@example.com");
+
+      await rules.onAccountCreated(bob, userCaller(bob.metadata!.id));
+
+      expect(rolesOf(bob.metadata!.id)).toEqual([
+        "admin@acme",
+        "member@globex",
+      ]);
+    });
+
+    it("an organization with zero role rows and no other user-class blueprint creator makes the first caller admin (the trusted-local-turned-OIDC install)", async () => {
+      await seedOrg("acme", "system");
+      await seedAgent("agt_1", "acme", "system");
+      const carol = account("auth0|carol", "carol@example.com");
+
+      await rules.onAccountCreated(carol, userCaller(carol.metadata!.id));
+
+      expect(rolesOf(carol.metadata!.id)).toEqual(["admin@acme"]);
+    });
+
+    it("an organization whose rows were all revoked is NOT handed to the next stranger — zero rows, never no-admin-now", async () => {
+      await seedOrg("acme", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      // The organization was bootstrapped; its owner is then revoked.
+      await grantPath.revokeOrgAccess(alice.metadata!.id, "acme");
+      expect(policies.rows.size).toBe(0);
+      // A second creator stamp keeps the "no other person created anything here" arm from firing on its own.
+      await seedAgent("agt_alice", "acme", alice.metadata!.id);
+      const mallory = account("auth0|mallory", "mallory@example.com");
+
+      await rules.onAccountCreated(mallory, userCaller(mallory.metadata!.id));
+
+      expect(rolesOf(mallory.metadata!.id)).toEqual(["member@acme"]);
+    });
+
+    it("the founder's own stamp counts as another person — a revoked founder's empty organization is NOT handed to the next stranger (Q-S4-7)", async () => {
+      await seedOrg("acme", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      await grantPath.revokeOrgAccess(alice.metadata!.id, "acme");
+      expect(policies.rows.size).toBe(0);
+      // No blueprint at all: only the organization's own creator stamp stands between mallory and admin.
+      const mallory = account("auth0|mallory", "mallory@example.com");
+
+      await rules.onAccountCreated(mallory, userCaller(mallory.metadata!.id));
+
+      expect(rolesOf(mallory.metadata!.id)).toEqual(["member@acme"]);
+    });
+
+    it("an unconfigured operator email matches nobody — an account with an empty email is a member, never admin", async () => {
+      await seedOrg("acme", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      const unconfigured = rulesOver(policies, "");
+      const nobody = account("auth0|nobody", "");
+
+      await unconfigured.onAccountCreated(
+        nobody,
+        userCaller(nobody.metadata!.id, ""),
+      );
+
+      expect(rolesOf(nobody.metadata!.id)).toEqual(["member@acme"]);
+    });
+
+    it("a store fault mid-scan propagates, and the next run converges with no duplicate row", async () => {
+      await seedOrg("acme", "auth0|alice");
+      await seedOrg("globex", "auth0|alice");
+      let faultsLeft = 1;
+      const healthy = fakeIamPolicyStore();
+      const flaky: IamPolicyStore = {
+        ...healthy,
+        async save(policy) {
+          // The first organization's row lands; the second save fails once.
+          if (healthy.rows.size === 1 && faultsLeft > 0) {
+            faultsLeft -= 1;
+            throw new Error("disk full");
+          }
+          await healthy.save(policy);
+        },
+      };
+      const flakyRules = rulesOver(flaky);
+      const dave = account("auth0|dave", "dave@example.com");
+
+      await expect(
+        flakyRules.onAccountCreated(dave, userCaller(dave.metadata!.id)),
+      ).rejects.toThrow("disk full");
+      expect(healthy.rows.size).toBe(1);
+
+      await flakyRules.onAccountCreated(dave, userCaller(dave.metadata!.id));
+
+      expect(
+        [...healthy.rows.values()]
+          .map((p) => `${p.spec?.relation}@${p.spec?.resource?.id}`)
+          .sort(),
+      ).toEqual(["member@acme", "member@globex"]);
+    });
+
+    it("the operator email becomes admin of every organization it does not own", async () => {
+      await seedOrg("acme", "auth0|alice");
+      await seedOrg("globex", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      const operator = account("auth0|operator", OPERATOR_EMAIL);
+
+      await rules.onAccountCreated(
+        operator,
+        userCaller(operator.metadata!.id, OPERATOR_EMAIL),
+      );
+
+      expect(rolesOf(operator.metadata!.id)).toEqual([
+        "admin@acme",
+        "admin@globex",
+      ]);
+    });
+
+    it("everyone else is a member of every existing organization", async () => {
+      await seedOrg("acme", "auth0|alice");
+      await seedOrg("globex", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      const dave = account("auth0|dave", "dave@example.com");
+
+      await rules.onAccountCreated(dave, userCaller(dave.metadata!.id));
+
+      expect(rolesOf(dave.metadata!.id)).toEqual([
+        "member@acme",
+        "member@globex",
+      ]);
+    });
+
+    it("with no organization yet, writes nothing — the creator rule runs when the organization is created", async () => {
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      expect(policies.rows.size).toBe(0);
+    });
+
+    it("never grants a runner, machine or internal caller a role", async () => {
+      await seedOrg("acme", "system");
+      const bot = account("@clients|bot", "");
+      for (const callerClass of ["runner", "machine", "internal"] as const) {
+        await rules.onAccountCreated(bot, {
+          ...userCaller(bot.metadata!.id),
+          callerClass,
+        });
+      }
+      expect(policies.rows.size).toBe(0);
+    });
+
+    it("skips an organization the account already holds a row on — a second run writes nothing new", async () => {
+      await seedOrg("acme", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      const before = [...policies.rows.keys()];
+
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+
+      expect([...policies.rows.keys()]).toEqual(before);
+    });
+  });
+
+  describe("ensureOperatorOwnership", () => {
+    it("makes the operator owner of every organization, and a second boot writes nothing", async () => {
+      await seedOrg("acme", "system");
+      await seedOrg("globex", OPERATOR_EMAIL);
+      const operator = account(`local|${OPERATOR_EMAIL}`, OPERATOR_EMAIL);
+      const operatorId = operator.metadata!.id;
+
+      await rules.ensureOperatorOwnership(operator);
+      const after = [...policies.rows.keys()].sort();
+      await rules.ensureOperatorOwnership(operator);
+
+      expect(rolesOf(operatorId)).toEqual(["owner@acme", "owner@globex"]);
+      expect([...policies.rows.keys()].sort()).toEqual(after);
+    });
+
+    it("leaves an organization that already has an owner alone", async () => {
+      await seedOrg("acme", "auth0|alice");
+      const alice = account("auth0|alice", "alice@example.com");
+      await rules.onAccountCreated(alice, userCaller(alice.metadata!.id));
+      const operator = account("local|system", "");
+
+      await rules.ensureOperatorOwnership(operator);
+
+      expect(rolesOf(operator.metadata!.id)).toEqual([]);
+    });
+
+    it("stamps the owner row's audit actor as the operator's account — id, email and display name, like every other trusted-local write", async () => {
+      await seedOrg("acme", "system");
+      const operator = account(`local|${OPERATOR_EMAIL}`, OPERATOR_EMAIL);
+      operator.metadata!.name = "The Operator";
+
+      await rules.ensureOperatorOwnership(operator);
+
+      const [row] = [...policies.rows.values()];
+      const actor = row?.status?.audit?.specAudit?.createdBy;
+      expect(actor?.id).toBe(operator.metadata!.id);
+      expect(actor?.email).toBe(OPERATOR_EMAIL);
+      expect(actor?.displayName).toBe("The Operator");
+    });
+  });
+
+  describe("the creator scan", () => {
+    it("decodes exactly the organization and BLUEPRINT_KINDS — a kind added to the constant without a schema fails here", () => {
+      expect([...CREATOR_SCAN_SCHEMAS.keys()].sort()).toEqual(
+        [ApiResourceKind.organization, ...BLUEPRINT_KINDS].sort(),
+      );
+    });
+  });
+});

package/src/domain/iampolicy/__tests__/permissions.test.ts

@@ -0,0 +1,41 @@
+/**
+ * Pins permissions.ts (20260913.01 slice 5, Q-S5-3): the relation string a
+ * checkMyPermission caller sends is admitted only when it is an
+ * IamPermission member name — the Authorizer's AuthzCheck carries the
+ * enum, and the wire carries its name. The zero value is not a
+ * permission; a Map (never the TS enum's reverse index) keeps prototype
+ * keys and numeric spellings from resolving to anything (the
+ * kindsByEnumName precedent in pipeline/apiresource-meta.ts).
+ */
+import { describe, expect, it } from "vitest";
+
+import {
+  IamPermission,
+  IamPermissionSchema,
+} from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import { permissionByEnumName } from "../permissions.js";
+
+describe("permissionByEnumName", () => {
+  it("resolves every member but the zero value by its exact proto name", () => {
+    for (const value of IamPermissionSchema.values) {
+      if (value.number === IamPermission.unspecified) continue;
+      expect(permissionByEnumName(value.name), value.name).toBe(value.number);
+    }
+  });
+
+  for (const garbage of [
+    "unspecified",
+    "",
+    "CAN_VIEW",
+    "can-view",
+    "constructor",
+    "__proto__",
+    "4",
+    "admin",
+  ]) {
+    it(`answers undefined for ${JSON.stringify(garbage)}`, () => {
+      expect(permissionByEnumName(garbage)).toBeUndefined();
+    });
+  }
+});

package/src/domain/iampolicy/__tests__/resource-store.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Runs the IamPolicyStore port-contract kit (../store-contract.ts) over the
+ * OSS adapter (../resource-store.ts) on both drivers through the drivers'
+ * own fixtures (sqlite always; Postgres under TEST_DATABASE_URL), and pins
+ * the one behaviour that is the OSS adapter's rather than the port's
+ * (T01_1_review.md Q-OR-9): save refuses a policy whose id is not the
+ * triple's derived id, the invariant that makes "one row per triple" the
+ * primary key's job in open source.
+ *
+ * The kit's case list is pinned by name so a case cannot drop out unnoticed:
+ * the cloud driver's test iterates the same export over `cloud.iam_policy`
+ * and would silently prove less (the 2a A11 discipline). The corners A12
+ * taught are cases from the start: every relation on a pair; distinct
+ * principals, not rows; the scope-tuple exclusions verbatim; unknown-id
+ * delete a no-op; a held triple refused.
+ */
+import { create } from "@bufbuild/protobuf";
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+
+import type { Store } from "../../../store/interface.js";
+import { PostgresStore } from "../../../store/postgres/store.js";
+import {
+  createTestDatabase,
+  testDatabaseAdminUrl,
+  type TestDatabase,
+} from "../../../store/postgres/__tests__/support.js";
+import { tempStore } from "../../../store/sqlite/__tests__/support.js";
+import {
+  IAM_POLICY_API_VERSION,
+  IAM_POLICY_KIND,
+  policyIdFor,
+} from "../constants.js";
+import { newResourceIamPolicyStore } from "../resource-store.js";
+import type { IamPolicyStoreContractFixture } from "../store-contract.js";
+import { iamPolicyStoreContract } from "../store-contract.js";
+import { orgRole } from "./support.js";
+
+/** The kit's contract lines, pinned: a dropped or renamed case is a visible diff here. */
+const CONTRACT_CASE_NAMES = [
+  "save then findById round-trips the policy",
+  "a second save under a held triple is DuplicatePolicyError, and the first row stands",
+  "findByPrincipalAndResource answers every relation on the pair and nothing on another",
+  "findByPrincipal and findByResource answer each side of a row",
+  "findByResourceWithRelations filters to the allowlist; an empty allowlist matches nothing",
+  "countDistinctPrincipalsByResource counts (kind, id) pairs, not rows, optionally by principal kind",
+  "findScopeTuple skips identity_account and team principals and owner and creator relations",
+  "deleteById removes the row; the triple is free to be granted again",
+  "deleteById of an unknown id resolves",
+  "a disconnected store is an infrastructure fault, never 'not found'",
+  "two concurrent saves of one triple end in one row and DuplicatePolicyErrors only",
+] as const;
+
+interface OpenedStore {
+  readonly store: Store;
+  close(): Promise<void>;
+}
+
+interface DriverFixture {
+  readonly name: string;
+  readonly skip: boolean;
+  open(): Promise<OpenedStore>;
+}
+
+const sqliteFixture: DriverFixture = {
+  name: "sqlite",
+  skip: false,
+  async open() {
+    const temp = tempStore();
+    return { store: temp.store, close: () => temp.cleanup() };
+  },
+};
+
+let postgresDatabase: TestDatabase | undefined;
+const postgresFixture: DriverFixture = {
+  name: "postgres",
+  skip: testDatabaseAdminUrl() === undefined,
+  async open() {
+    if (postgresDatabase === undefined) {
+      postgresDatabase = await createTestDatabase();
+    }
+    const store = await PostgresStore.open(postgresDatabase.databaseUrl);
+    await store.deleteResourcesByKind(ApiResourceKind.iam_policy);
+    return { store, close: () => store.close() };
+  },
+};
+
+afterAll(async () => {
+  await postgresDatabase?.drop();
+});
+
+describe.each([sqliteFixture, postgresFixture])(
+  "IamPolicyStore over the OSS adapter ($name)",
+  (fixture) => {
+    describe.skipIf(fixture.skip)("the port-contract kit", () => {
+      const cases = iamPolicyStoreContract(
+        async (): Promise<IamPolicyStoreContractFixture> => {
+          const opened = await fixture.open();
+          return {
+            store: newResourceIamPolicyStore(opened.store),
+            disconnect: () => opened.store.close(),
+            cleanup: () => opened.close(),
+          };
+        },
+      );
+
+      it("carries every contract line, by name", () => {
+        expect(cases.map((contractCase) => contractCase.name)).toEqual(
+          CONTRACT_CASE_NAMES,
+        );
+      });
+
+      for (const contractCase of cases) {
+        it(contractCase.name, contractCase.run);
+      }
+    });
+
+    describe.skipIf(fixture.skip)("the OSS adapter's own invariant", () => {
+      let opened: OpenedStore;
+
+      beforeEach(async () => {
+        opened = await fixture.open();
+      });
+
+      afterEach(async () => {
+        await opened.close();
+      });
+
+      it("refuses to save a policy whose id is not its triple's derived id", async () => {
+        const policies = newResourceIamPolicyStore(opened.store);
+        const spec = orgRole("ida_wtr3jcf281yfk9xx61kj59fsme", "admin", "acme");
+        const stray = create(IamPolicySchema, {
+          apiVersion: IAM_POLICY_API_VERSION,
+          kind: IAM_POLICY_KIND,
+          metadata: create(ApiResourceMetadataSchema, {
+            id: "iamp_01hzzzzzzzzzzzzzzzzzzzzzzz",
+          }),
+          spec,
+        });
+        await expect(policies.save(stray)).rejects.toThrow(
+          "policy id must be derived from its triple",
+        );
+        expect(
+          await opened.store.listResources(ApiResourceKind.iam_policy),
+        ).toHaveLength(0);
+
+        const derived = create(IamPolicySchema, {
+          apiVersion: IAM_POLICY_API_VERSION,
+          kind: IAM_POLICY_KIND,
+          metadata: create(ApiResourceMetadataSchema, {
+            id: policyIdFor(spec),
+          }),
+          spec,
+        });
+        await policies.save(derived);
+        expect((await policies.findById(policyIdFor(spec)))?.spec).toEqual(
+          spec,
+        );
+      });
+    });
+  },
+);