@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/boot/compose.ts

@@ -29,8 +29,18 @@ import path from "node:path";
 import type { ConnectRouter, Transport } from "@connectrpc/connect";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 
+import { newBuiltInAuthorizer } from "../authorization/authorizer.js";
+import { newBuiltInListReadScope } from "../authorization/list-read-scope.js";
+import { newBuiltInOrganizationDirectory } from "../authorization/organization-directory.js";
+import { authorizationPostureOf } from "../authorization/posture.js";
+import { newBuiltInScheduleFireCaller } from "../authorization/schedule-fire-caller.js";
+import type { Authorizer } from "../extensions/authorizer.js";
+import type { ListReadScope } from "../extensions/list-read-scope.js";
+import type { OrganizationDirectory } from "../extensions/organization-directory.js";
+import type { ScheduleFireCallerMint } from "../extensions/schedule-fire-caller.js";
 import { registerAgentServices } from "../domain/agent/controller.js";
 import {
   newConfigFromEnv,
@@ -99,12 +109,15 @@ import { registerMcpServerServices } from "../domain/mcpserver/controller.js";
 import { registerPlatformServices } from "../domain/platform/controller.js";
 import { registerProjectServices } from "../domain/project/controller.js";
 import { registerSessionServices } from "../domain/session/controller.js";
+import { registerPluginServices } from "../domain/plugin/controller.js";
+import { PLUGIN_ARTIFACT_KEY_PREFIX } from "../domain/plugin/constants.js";
 import { registerSkillServices } from "../domain/skill/controller.js";
 import {
   DEFAULT_SLOT_TTL_MS,
   MAX_ZIP_SIZE,
 } from "../domain/skill/constants.js";
 import { newSkillArtifactStorage } from "../domain/skill/storage/artifact-storage.js";
+import { newContentAddressedArchiveStore } from "../archive/content-store.js";
 import {
   newSkillTransferLane,
   uploadUrl as skillUploadUrl,
@@ -285,20 +298,6 @@ export async function composeServer(
       units: extensions.unitNames.join(", "),
     });
   }
-  // The ONE composed Authorizer (DD-007 §3): an extension's registration
-  // or the OSS permissive single-team default. Resolved here, handed to
-  // every controller as an explicit dependency — the Authorize step at
-  // position 1 of every chain calls it (O2).
-  const authorizer =
-    extensions.authorizer ?? newPermissiveSingleTeamAuthorizer();
-  // The built-in authorization POSTURE (20260913.01, Q-OR-6), named once:
-  // no unit registered an Authorizer, so the roles open source records
-  // exist to feed the built-in one. Under it — and only under it — the
-  // identity-accounts stage below installs the built-in role lifecycle
-  // and the membership rules; a composition with its own Authorizer has
-  // its own onboarding and gets neither.
-  const builtInAuthorization = extensions.authorizer === undefined;
-
   // Stage: storage — the driver selection seam (DD-010): DATABASE_URL
   // present → Postgres (async connect + advisory-locked migrations), else
   // sqlite on DB_PATH (migrations v1–v7, incl. adopting a Go-created
@@ -331,6 +330,38 @@ export async function composeServer(
   const requireAuthentication =
     authEnabled || extensions.requireAuthentication !== undefined;
 
+  // The AUTHORIZATION posture (authorization/posture.ts), named once and
+  // handed down: a unit's own Authorizer (nothing built in installs);
+  // the built-in posture (no unit Authorizer under an authentication
+  // posture — open source composes its Authorizer, organization directory
+  // and schedule fire caller below, and the roles 2b records are
+  // enforced); or trusted-local (the permissive default: one caller,
+  // nothing to separate). `builtInAuthorization` (20260913.01, Q-OR-6) is
+  // the first two together — the roles exist to feed the built-in
+  // authorizer, so the identity stage installs the built-in role
+  // lifecycle and the membership rules under both; a composition with its
+  // own Authorizer has its own onboarding and gets neither.
+  const authorizationPosture = authorizationPostureOf({
+    unitAuthorizer: extensions.authorizer !== undefined,
+    requireAuthentication,
+  });
+  const builtInAuthorization = authorizationPosture !== "unit-authorizer";
+  // The built-in authorizer declares the open-source kinds and no other
+  // (its registry is pinned set-equal to that tier), so a composition
+  // that serves a wider edition must bring its own Authorizer: every
+  // check on a kind the model does not declare would otherwise fault
+  // INTERNAL per request. Refused at boot, the same class as a
+  // misconfigured registry (DD-006 §2b) and the verifierless posture
+  // below — caught before any side effect.
+  if (
+    authorizationPosture === "built-in" &&
+    extensions.edition !== ServerEdition.oss
+  ) {
+    throw new Error(
+      `the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer — the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`,
+    );
+  }
+
   // Stage: identity accounts (20260911.11) — the first domain whose
   // persistence is a PORT rather than the generic Store. The composed
   // driver (`drivers.identityAccountStore`, Q-IA-9) serves when a unit
@@ -400,6 +431,75 @@ export async function composeServer(
         operatorEmail: operatorIdentity.email,
       })
     : undefined;
+  // The ONE composed Authorizer (DD-007 §3), bound here — after the store,
+  // the account port and the IamPolicy port it reads — and handed to every
+  // controller as an explicit dependency; the Authorize step at position 1
+  // of every chain calls it (O2). By posture: an extension's registration;
+  // open source's built-in Authorizer (authorization/authorizer.ts — the
+  // cloud's model evaluated over the tuples the row would have had); or
+  // the permissive single-team default. The organization directory and the
+  // schedule fire caller are bound beside it under the same posture, so
+  // `findMyOrganizations` lists what a person may view and a scheduled run
+  // belongs to the person who scheduled it — a fire the internal lane
+  // would otherwise hand to nobody an enforcing evaluator recognizes.
+  const authorizer: Authorizer =
+    extensions.authorizer ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInAuthorizer({
+          store,
+          policies: iamPolicies,
+          accounts: identityAccounts,
+          edition: extensions.edition,
+          logger,
+        })
+      : newPermissiveSingleTeamAuthorizer());
+  const organizationDirectory: OrganizationDirectory | undefined =
+    extensions.drivers.organizationDirectory ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInOrganizationDirectory({
+          store,
+          policies: iamPolicies,
+          accounts: identityAccounts,
+        })
+      : undefined);
+  const scheduleFireCaller: ScheduleFireCallerMint | undefined =
+    extensions.drivers.scheduleFireCaller ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInScheduleFireCaller({ store, accounts: identityAccounts })
+      : undefined);
+  // The ONE list read scope (the seam's single-instance point), bound
+  // here under the same posture and handed to every list-shaped consumer
+  // below — the post-scan lanes through restrictListByReadScope, the
+  // search, activity and summary lanes through the enumeration verb. A
+  // unit's driver wins in every posture; the built-in one evaluates the
+  // model per candidate over the facts the candidate carries
+  // (authorization/list-read-scope.ts); trusted-local composes none and
+  // keeps the full scan.
+  const listReadScope: ListReadScope | undefined =
+    extensions.drivers.listReadScope ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInListReadScope({
+          store,
+          policies: iamPolicies,
+          accounts: identityAccounts,
+          logger,
+        })
+      : undefined);
+  logger.info("authorization posture resolved", {
+    posture: authorizationPosture,
+    authorizer:
+      extensions.authorizer !== undefined
+        ? "extension"
+        : authorizationPosture === "built-in"
+          ? "built-in"
+          : "permissive",
+    listReadScope:
+      extensions.drivers.listReadScope !== undefined
+        ? "extension"
+        : authorizationPosture === "built-in"
+          ? "built-in"
+          : "none",
+  });
   const identityAccountPath = {
     accounts: identityAccounts,
     logger,
@@ -456,6 +556,22 @@ export async function composeServer(
       });
     }
   }
+  // The built-in posture's own boot ensure, the sibling of the block
+  // above: the membership rules run at a person's FIRST provisioning, so a
+  // database whose people were provisioned before the rules existed (a
+  // 3.15.x self-host with OIDC on) holds accounts with no role rows — and
+  // the built-in authorizer below would make every one of them an
+  // outsider on every organization, with nobody left who could grant a
+  // way back. Once per database (a bootstrap-state marker; the rules'
+  // header), the same arms run for every person account in creation
+  // order; a fault is a loud boot throw like the storage stage's, and the
+  // next boot converges. Under the built-in posture only: a unit with its
+  // own Authorizer has its own onboarding, and trusted-local has the
+  // operator ensure above and one principal.
+  if (authorizationPosture === "built-in" && membership !== undefined) {
+    await membership.ensureRolesForExistingAccounts();
+    logger.info("built-in posture role reconciliation ensured");
+  }
 
   // Stage: keys — the ratified fail-loud boot ASYMMETRY (D2 cross-domain
   // invariants; Go server.go:277-293):
@@ -643,9 +759,10 @@ export async function composeServer(
   );
   // Every fire enters the FULL execution create pipeline through the
   // in-process agentexecution client (Go server.go 581: the RunStarter's
-  // ExecutionCreator edge). The composed scheduleFireCaller driver
-  // (stigmer-cloud#572), when present, gives each fire its edition
-  // identity — propagated by the creator's asCaller lane.
+  // ExecutionCreator edge). The scheduleFireCaller driver bound in the
+  // identity stage (stigmer-cloud#572; a unit's, or open source's under
+  // the built-in posture), when present, gives each fire its identity —
+  // propagated by the creator's asCaller lane.
   const scheduleRunStarter = new RunStarter({
     store,
     config: scheduleTemporalConfig,
@@ -656,7 +773,7 @@ export async function composeServer(
           fireCaller,
         ),
     },
-    fireCallerMint: extensions.drivers.scheduleFireCaller,
+    fireCallerMint: scheduleFireCaller,
     logger,
   });
   const scheduleReconciler = new ScheduleReconciler(
@@ -820,6 +937,14 @@ export async function composeServer(
     );
   })();
   const skillArtifactStorage = newSkillArtifactStorage(skillStorageDriver);
+  // Plugin archives are pushed archives exactly as skills' are, so they
+  // ride the same blob driver and backend selection; the key prefix
+  // (`plugins/`) keeps the two stores apart and the plugin store owns its
+  // keys (src/archive/content-store.ts).
+  const pluginArtifactStorage = newContentAddressedArchiveStore(
+    skillStorageDriver,
+    PLUGIN_ARTIFACT_KEY_PREFIX,
+  );
   const skillTransferLane = newSkillTransferLane(
     skillUploadSlots,
     skillArtifactStorage,
@@ -886,14 +1011,10 @@ export async function composeServer(
   const searchHandler = new SearchHandler(
     searchQueryStore,
     logger,
-    extensions.drivers.listReadScope,
+    listReadScope,
   );
   // The activity recents feed (#14) — pure reads over listResources.
-  const activityHandler = new ActivityHandler(
-    store,
-    logger,
-    extensions.drivers.listReadScope,
-  );
+  const activityHandler = new ActivityHandler(store, logger, listReadScope);
   // The environment runtime-resolution service (#5) — the decrypt-for-
   // execution path the EC builder uses to resolve environment_refs (the
   // RPC surface redacts secret values, oss#405).
@@ -972,10 +1093,10 @@ export async function composeServer(
       logger,
       authorizer,
       gateSteps: extensions.gateSteps,
-      // The role lifecycle (the identity stage): the composed driver, or
-      // open source's owner-row writer under the built-in posture.
+      // The role lifecycle and the directory (the identity stage): the
+      // composed drivers, or open source's under the built-in posture.
       authorizationLifecycle: roleLifecycle,
-      organizationDirectory: extensions.drivers.organizationDirectory,
+      organizationDirectory,
     });
     // ApiKey is the first domain born AFTER the Go port (O3, 20260827.06 —
     // DD-003: the apikey contract is wholly OSS), so it has no Go
@@ -987,7 +1108,7 @@ export async function composeServer(
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     // IdentityAccount (20260911.11): served once by open source in every
     // edition over the store PORT bound in the identity-accounts stage; a
@@ -1028,7 +1149,7 @@ export async function composeServer(
       authorizer,
       secretService,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     // OAuthApp reuses the environment's SecretService instance — Go wires
     // ONE encryption service for both (server.go 302–307).
@@ -1060,7 +1181,7 @@ export async function composeServer(
       authorizer,
       authorizationLifecycle,
       parentAgentLoader: () => requireInProcess().parentAgentLoader,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerSessionServices(router, {
       store,
@@ -1071,7 +1192,7 @@ export async function composeServer(
       gateSteps: extensions.gateSteps,
       sandboxLane,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     // The sharing/channel family registers after the agent family, as in
     // Go server.go (agent 378 → agentshare 384 → agentchannel 391 →
@@ -1083,14 +1204,14 @@ export async function composeServer(
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerAgentChannelServices(router, {
       store,
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       // The SAME domain-owned registry instance the workflow validator
       // and the registry lanes read — the channel model-pin rule
       // (stigmer/stigmer#774) can never drift from the served pickers.
@@ -1124,14 +1245,14 @@ export async function composeServer(
       clock: () => scheduleSyncer,
       runner: () => scheduleRunStarter,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerMemoryServices(router, {
       store,
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       runnerCredentialProvider: runnerCredentials,
     });
     registerAgentExecutionServices(router, {
@@ -1139,7 +1260,7 @@ export async function composeServer(
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       runnerCredentialProvider: runnerCredentials,
       broker: agentExecutionStreamBroker,
       engineState: executionEngineState,
@@ -1182,14 +1303,14 @@ export async function composeServer(
       authorizer,
       authorizationLifecycle,
       parentWorkflowLoader: () => requireInProcess().parentWorkflowLoader,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerWorkflowExecutionServices(router, {
       store,
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       gateSteps: extensions.gateSteps,
       engineState: workflowExecutionEngineState,
       broker: workflowExecutionStreamBroker,
@@ -1263,6 +1384,22 @@ export async function composeServer(
         baseUrl: config.skillTransferBaseUrl,
       },
     });
+    // Plugins materialise their members through the in-process lane as
+    // the installing caller; the lazy provider resolves the clients built
+    // from these same routes after boot. The upload slots are the skill
+    // lane's: one upload surface for every archive.
+    registerPluginServices(router, {
+      store,
+      logger,
+      authorizer,
+      authorizationLifecycle,
+      artifactStorage: pluginArtifactStorage,
+      materializerProvider: () => requireInProcess().pluginMaterializer,
+      transferLane: {
+        slots: skillUploadSlots,
+        baseUrl: config.skillTransferBaseUrl,
+      },
+    });
     // Artifact CRUD shares the ONE blob store with agentexecution's
     // attachment lanes (Go server.go 347–374).
     registerArtifactServices(router, {

package/src/boot/inprocess.ts

@@ -70,6 +70,9 @@ import type {
 import type { AgentExecutionApprovalForwarder } from "../domain/workflowexecution/submit-approval.js";
 import type { AgentExecutionFileDecisionForwarder } from "../domain/workflowexecution/submit-file-decision.js";
 import type { ParentWorkflowLoader } from "../domain/workflowinstance/steps.js";
+import type { PluginMaterializer } from "../domain/plugin/materialize/ports.js";
+import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OrphanDeleter } from "../domain/project/reconcile.js";
 import type { ExecutionStatusWriter } from "../temporal/agentexecution/activities.js";
@@ -153,6 +156,17 @@ export interface InProcessClients {
    * minted — exactly like the schedule clock and the reconciler above.
    */
   readonly executionStatusWriter: ExecutionStatusWriter;
+  /**
+   * The plugin controller's materialisation edge: every member a plugin
+   * installs, upgrades, re-levels or removes goes through the owning
+   * domain's FULL chain (skill push, the three applies, updateVisibility,
+   * delete) AS THE INSTALLING CALLER (the asCaller call options), so a
+   * materialised skill is attributed to the user who installed it and
+   * carries the plugin's reserved labels by the in-process origin the
+   * guards pass structurally. The delete routing is the reconciler's
+   * switch, shared.
+   */
+  readonly pluginMaterializer: PluginMaterializer;
 }
 
 /**
@@ -378,38 +392,102 @@ export function createInProcessClients(
     // delete is attempted, in both editions. Log-only surface: reconcile
     // failures never reach the wire.
     projectOrphanDeleter: {
-      async delete(kind, resourceId) {
-        switch (kind) {
-          case ApiResourceKind.agent:
-            await agentCommand.delete(
-              create(AgentIdSchema, { value: resourceId }),
-            );
-            return;
-          case ApiResourceKind.workflow:
-            await workflowCommand.delete(
-              create(WorkflowIdSchema, { value: resourceId }),
-            );
-            return;
-          case ApiResourceKind.mcp_server:
-            // McpServer's delete input is the commons ApiResourceDeleteInput
-            // (not an id wrapper) — Go's client builds the same message.
-            await mcpServerCommand.delete(
-              create(ApiResourceDeleteInputSchema, { resourceId }),
-            );
-            return;
-          case ApiResourceKind.skill:
-            await skillCommand.delete(
-              create(SkillIdSchema, { value: resourceId }),
-            );
-            return;
-          default:
-            throw new Error(
-              `unsupported resource kind for delete: ${ApiResourceKind[kind] ?? String(kind)}`,
-            );
-        }
-      },
+      delete: (kind, resourceId) => deleteByKind(kind, resourceId),
+    },
+    pluginMaterializer: {
+      pushSkill: (request, caller) =>
+        skillCommand.push(request, asCaller(caller)),
+      applyMcpServer: (server, caller) =>
+        mcpServerCommand.apply(server, asCaller(caller)),
+      applyAgent: (agent, caller) =>
+        agentCommand.apply(agent, asCaller(caller)),
+      applyWorkflow: (workflow, caller) =>
+        workflowCommand.apply(workflow, asCaller(caller)),
+      updateVisibility: (kind, resourceId, visibility, caller) =>
+        updateVisibilityByKind(kind, resourceId, visibility, asCaller(caller)),
+      deleteByKind: (kind, resourceId, caller) =>
+        deleteByKind(kind, resourceId, asCaller(caller)),
     },
   };
 
+  /**
+   * Delete routing for the four reconciled kinds — Go's
+   * ResourceDeleterAdapter.Delete switch (execution_engine.go:75-92),
+   * shared by the project reconciler (internal class, no caller) and the
+   * plugin controller (as the installing caller). Every orphan or member
+   * delete runs the owning domain's FULL pipeline. The unsupported-kind
+   * default is defense-in-depth: both callers refuse unsupported kinds
+   * before any delete is attempted.
+   */
+  async function deleteByKind(
+    kind: ApiResourceKind,
+    resourceId: string,
+    options?: CallOptions,
+  ): Promise<void> {
+    switch (kind) {
+      case ApiResourceKind.agent:
+        await agentCommand.delete(
+          create(AgentIdSchema, { value: resourceId }),
+          options,
+        );
+        return;
+      case ApiResourceKind.workflow:
+        await workflowCommand.delete(
+          create(WorkflowIdSchema, { value: resourceId }),
+          options,
+        );
+        return;
+      case ApiResourceKind.mcp_server:
+        // McpServer's delete input is the commons ApiResourceDeleteInput
+        // (not an id wrapper) — Go's client builds the same message.
+        await mcpServerCommand.delete(
+          create(ApiResourceDeleteInputSchema, { resourceId }),
+          options,
+        );
+        return;
+      case ApiResourceKind.skill:
+        await skillCommand.delete(
+          create(SkillIdSchema, { value: resourceId }),
+          options,
+        );
+        return;
+      default:
+        throw new Error(
+          `unsupported resource kind for delete: ${ApiResourceKind[kind] ?? String(kind)}`,
+        );
+    }
+  }
+
+  /** The one door for a level change on each member kind (metadata.proto). */
+  async function updateVisibilityByKind(
+    kind: ApiResourceKind,
+    resourceId: string,
+    visibility: ApiResourceVisibility,
+    options: CallOptions,
+  ): Promise<void> {
+    const input = create(UpdateVisibilityInputSchema, {
+      resourceId,
+      visibility,
+    });
+    switch (kind) {
+      case ApiResourceKind.agent:
+        await agentCommand.updateVisibility(input, options);
+        return;
+      case ApiResourceKind.workflow:
+        await workflowCommand.updateVisibility(input, options);
+        return;
+      case ApiResourceKind.mcp_server:
+        await mcpServerCommand.updateVisibility(input, options);
+        return;
+      case ApiResourceKind.skill:
+        await skillCommand.updateVisibility(input, options);
+        return;
+      default:
+        throw new Error(
+          `unsupported resource kind for updateVisibility: ${ApiResourceKind[kind] ?? String(kind)}`,
+        );
+    }
+  }
+
   return { clients, transport };
 }

package/src/domain/agent/controller.ts

@@ -64,6 +64,7 @@ import {
   EXISTING_RESOURCE_KEY,
   newLoadExistingStep,
 } from "../../pipeline/steps/load-existing.js";
+import { newGuardPluginManagedStep } from "../../pipeline/steps/guard-plugin-managed.js";
 import {
   SHOULD_CREATE_KEY,
   newLoadForApplyStep,
@@ -216,6 +217,10 @@ async function update(
     .addStep(newValidateProtoStep())
     .addStep(newResolveSlugStep())
     .addStep(newLoadExistingStep(deps.store))
+    // A resource a plugin materialised is the plugin's to redefine; a client
+    // write is refused naming the plugin (GuardPluginManaged, keyed on the
+    // STORED labels and the plugin row's existence).
+    .addStep(newGuardPluginManagedStep(deps.store))
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
@@ -294,6 +299,7 @@ async function deleteAgent(
     .addStep(newValidateProtoStep())
     .addStep(newExtractResourceIdStep())
     .addStep(newLoadExistingForDeleteStep(deps.store, AgentSchema))
+    .addStep(newGuardPluginManagedStep(deps.store))
     .addStep(newCascadeDeleteInstancesStep(deps.store, deps.logger))
     .addStep(newCascadeDeleteSharesStep(deps.store, deps.logger))
     .addStep(newDeleteResourceStep(deps.store))
@@ -349,6 +355,11 @@ async function updateVisibility(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadAgentForVisibilityUpdateStep(deps.store))
+    .addStep(
+      newGuardPluginManagedStep(deps.store, {
+        existingKey: UPDATE_VISIBILITY_AGENT_KEY,
+      }),
+    )
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_AGENT_KEY))
     .addStep(newValidateVisibilityUpdateStep())
     .addStep(