@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/extensions/__tests__/composed-support.ts

@@ -13,10 +13,22 @@
  * on every other token, so the OSS lanes composed ahead of it keep their
  * claims. Lifted from identity-account-composed.test.ts (20260911.11 slice
  * 3) when a second composed proof needed the same shape (20260913.01 S1).
+ *
+ * `servedServices` reads what a composed server ROUTES without binding a
+ * port: compose.ts hands one `routes` closure to both transports, and
+ * replaying it into a recording router yields the served service
+ * descriptors — the enumeration the tier-truthfulness, annotation and
+ * wire-permission invariants all stand on, kept here so each does not
+ * carry its own recorder.
  */
 import path from "node:path";
 
-import type { Interceptor, Transport } from "@connectrpc/connect";
+import type { DescService } from "@bufbuild/protobuf";
+import type {
+  ConnectRouter,
+  Interceptor,
+  Transport,
+} from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
 
 import { createLogger } from "../../boot/logger.js";
@@ -78,6 +90,25 @@ export function bearer(token: string): Interceptor {
   };
 }
 
+/** Replays a composed server's `routes` closure into a recorder and returns the services it serves. */
+export function servedServices(
+  routes: (router: ConnectRouter) => void,
+): DescService[] {
+  const served: DescService[] = [];
+  const recorder = {
+    handlers: [],
+    service(desc: DescService) {
+      served.push(desc);
+      return recorder;
+    },
+    rpc() {
+      return recorder;
+    },
+  };
+  routes(recorder as unknown as ConnectRouter);
+  return served;
+}
+
 /** A gRPC transport to the composed server on `port`, presenting `token` when given. */
 export function transportFor(port: number, token?: string): Transport {
   return createGrpcTransport({

package/src/extensions/__tests__/extension-composition.test.ts

@@ -573,6 +573,41 @@ describe("extension composition (require-authentication posture)", () => {
       rmSync(orphanDir, { recursive: true, force: true });
     }
   });
+
+  it("a wider edition under the posture with no Authorizer is a boot throw — the built-in authorizer enforces the open-source kinds only", async () => {
+    const enterpriseDir = mkdtempSync(
+      path.join(tmpdir(), "require-auth-edition-"),
+    );
+    try {
+      await expect(
+        composeServer({
+          config: loadConfig({
+            STIGMER_MODEL_REGISTRY_REFRESH: "off",
+            DB_PATH: path.join(enterpriseDir, "stigmer.db"),
+            ARTIFACT_LOCAL_BASE_PATH: path.join(enterpriseDir, "artifacts"),
+          }),
+          logger: createLogger({
+            level: "error",
+            pretty: false,
+            write: () => {},
+          }),
+          extensions: [
+            {
+              ...requiringExtension,
+              name: "enterprise-without-authorizer",
+              edition: ServerEdition.enterprise,
+            },
+          ],
+          portOverride: 0,
+          host: "127.0.0.1",
+        }),
+      ).rejects.toThrowError(
+        /serves edition 'enterprise' under the require-authentication posture but registers no Authorizer/,
+      );
+    } finally {
+      rmSync(enterpriseDir, { recursive: true, force: true });
+    }
+  });
 });
 
 /**

package/src/extensions/__tests__/list-read-scope.test.ts

@@ -13,21 +13,67 @@
  *     offered the org's rows and never the kind's — the same result set,
  *     a fraction of the candidates);
  *   - the candidates carry {id, org, labels} — the driver's guest
- *     cookie rule keys on labels;
+ *     cookie rule keys on labels — and the row's AUTHORIZATION FACTS
+ *     (creator stamp, visibility level, every parent link), read by the
+ *     one structural resolver the built-in authorizer reads a loaded row
+ *     through, so a driver that evaluates the model over a candidate
+ *     needs no second read of the row;
+ *   - a kind whose authorization is its parent's (kind_meta PARENT scope
+ *     + INHERITED owner; agent_execution → session) carries
+ *     `authorizationParent` on every candidate whose spec names it, the
+ *     same ResolvedParentLink the tuple lifecycle wrote and one of the
+ *     candidate's own parent links; every other kind and every parentless
+ *     row carries none (stigmer-cloud 20260913.04 T04);
  *   - a scope failure PROPAGATES — never an empty result (the outage
  *     contract: empty means "authorized to see nothing", outage means
  *     INTERNAL through the caller's sanitized arm).
  */
+import { create } from "@bufbuild/protobuf";
 import { describe, expect, it } from "vitest";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceAuditSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
 
 import { testCallerIdentity } from "../../pipeline/__tests__/support.js";
 import type { ListEntryMeta, ListReadScope } from "../list-read-scope.js";
 import { restrictListByReadScope } from "../list-read-scope.js";
+import type { ResolvedParentLink } from "../resource-authorization.js";
 
 const caller = testCallerIdentity();
 
+function organizationLink(org: string): ResolvedParentLink {
+  return {
+    relation: "organization",
+    parentKind: ApiResourceKind.organization,
+    parentId: org,
+  };
+}
+
+function sessionLink(session: string): ResolvedParentLink {
+  return {
+    relation: "session",
+    parentKind: ApiResourceKind.session,
+    parentId: session,
+  };
+}
+
+/** The candidate a row with no audit and no visibility set becomes. */
+function bareFacts(
+  id: string,
+  org: string,
+  parentLinks: ReadonlyArray<ResolvedParentLink>,
+): ListEntryMeta {
+  return {
+    id,
+    org,
+    labels: {},
+    createdBy: "",
+    visibility: ApiResourceVisibility.api_resource_visibility_unspecified,
+    parentLinks,
+  };
+}
+
 function row(id: string, org: string, labels: Record<string, string> = {}) {
   return { metadata: { id, org, labels } };
 }
@@ -149,12 +195,208 @@ describe("restrictListByReadScope", () => {
         id: "ses_a",
         org: "acme",
         labels: { "stigmer.ai/guest-cookie-id": "ck_1" },
+        createdBy: "",
+        visibility: ApiResourceVisibility.api_resource_visibility_unspecified,
+        parentLinks: [organizationLink("acme")],
+      },
+      {
+        id: "ses_b",
+        org: "acme",
+        labels: {},
+        createdBy: "",
+        visibility: ApiResourceVisibility.api_resource_visibility_unspecified,
+        parentLinks: [organizationLink("acme")],
+      },
+      {
+        id: "ses_c",
+        org: "rival",
+        labels: {},
+        createdBy: "",
+        visibility: ApiResourceVisibility.api_resource_visibility_unspecified,
+        parentLinks: [organizationLink("rival")],
+      },
+    ]);
+  });
+
+  it("a candidate carries the row's authorization facts — the creator stamp, the visibility level and every parent link — read by the one resolver the point-check driver reads through", async () => {
+    let seen: ReadonlyArray<ListEntryMeta> = [];
+    const recording: ListReadScope = {
+      authorizedResourceIds: () => Promise.resolve(new Set<string>()),
+      restrictListEntries: (_caller, _kind, entries) => {
+        seen = entries;
+        return Promise.resolve(new Set<string>());
+      },
+    };
+    await restrictListByReadScope(
+      recording,
+      caller,
+      ApiResourceKind.agent_instance,
+      [
+        {
+          metadata: {
+            id: "ai_1",
+            org: "acme",
+            labels: {},
+            visibility: ApiResourceVisibility.visibility_org,
+          },
+          spec: { agentId: "agt_1" },
+          status: {
+            audit: create(ApiResourceAuditSchema, {
+              specAudit: { createdBy: { id: "ida_carol" } },
+            }),
+          },
+        },
+      ],
+      "",
+    );
+    expect(seen).toEqual([
+      {
+        id: "ai_1",
+        org: "acme",
+        labels: {},
+        createdBy: "ida_carol",
+        visibility: ApiResourceVisibility.visibility_org,
+        parentLinks: [
+          organizationLink("acme"),
+          {
+            relation: "agent",
+            parentKind: ApiResourceKind.agent,
+            parentId: "agt_1",
+          },
+        ],
       },
-      { id: "ses_b", org: "acme", labels: {} },
-      { id: "ses_c", org: "rival", labels: {} },
     ]);
   });
 
+  describe("authorizationParent — the parent a kind's authorization is (20260913.04 T04)", () => {
+    function recordingScope(keep: ReadonlyArray<string>) {
+      const seen: ReadonlyArray<ListEntryMeta>[] = [];
+      const scope: ListReadScope = {
+        authorizedResourceIds: () => Promise.resolve(new Set<string>()),
+        restrictListEntries: (_caller, _kind, entries) => {
+          seen.push(entries);
+          return Promise.resolve(new Set(keep));
+        },
+      };
+      return { scope, seen };
+    }
+
+    it("an agent_execution candidate carries its session as the ResolvedParentLink the tuple lifecycle wrote", async () => {
+      const executions = [
+        {
+          metadata: { id: "aex_1", org: "acme", labels: {} },
+          spec: { sessionId: "ses_a" },
+        },
+        {
+          metadata: { id: "aex_2", org: "acme", labels: {} },
+          spec: { sessionId: "ses_a" },
+        },
+        {
+          metadata: { id: "aex_3", org: "acme", labels: {} },
+          spec: { sessionId: "ses_b" },
+        },
+      ];
+      const { scope, seen } = recordingScope(["aex_1", "aex_3"]);
+      const kept = await restrictListByReadScope(
+        scope,
+        caller,
+        ApiResourceKind.agent_execution,
+        executions,
+        "",
+      );
+      expect(kept.map((r) => r.metadata.id)).toEqual(["aex_1", "aex_3"]);
+      // The parent is one of the row's parent links — resolved once, named
+      // twice: as the link the derivation reads and as the designation a
+      // driver may answer in place of the child.
+      expect(seen[0]).toEqual([
+        {
+          ...bareFacts("aex_1", "acme", [sessionLink("ses_a")]),
+          authorizationParent: sessionLink("ses_a"),
+        },
+        {
+          ...bareFacts("aex_2", "acme", [sessionLink("ses_a")]),
+          authorizationParent: sessionLink("ses_a"),
+        },
+        {
+          ...bareFacts("aex_3", "acme", [sessionLink("ses_b")]),
+          authorizationParent: sessionLink("ses_b"),
+        },
+      ]);
+    });
+
+    it("a row whose spec does not name its parent carries no parent — offered as itself, never dropped", async () => {
+      const executions = [
+        { metadata: { id: "aex_orphan", org: "acme", labels: {} }, spec: {} },
+        { metadata: { id: "aex_specless", org: "acme", labels: {} } },
+      ];
+      const { scope, seen } = recordingScope(["aex_orphan", "aex_specless"]);
+      const kept = await restrictListByReadScope(
+        scope,
+        caller,
+        ApiResourceKind.agent_execution,
+        executions,
+        "",
+      );
+      expect(kept.map((r) => r.metadata.id)).toEqual([
+        "aex_orphan",
+        "aex_specless",
+      ]);
+      expect(seen[0]).toEqual([
+        bareFacts("aex_orphan", "acme", []),
+        bareFacts("aex_specless", "acme", []),
+      ]);
+    });
+
+    it("a kind whose authorization is its own carries no parent even when its spec names one", async () => {
+      // A workflow_execution links its workflow_instance (an additional
+      // parent, partial opt-in inheritance) and owns itself: not the pair.
+      const runs = [
+        {
+          metadata: { id: "wex_1", org: "acme", labels: {} },
+          spec: { workflowInstanceId: "wfi_1" },
+        },
+      ];
+      const { scope, seen } = recordingScope(["wex_1"]);
+      await restrictListByReadScope(
+        scope,
+        caller,
+        ApiResourceKind.workflow_execution,
+        runs,
+        "",
+      );
+      // The instance IS a parent link (the derivation walks
+      // `execution_viewer from workflow_instance` through it); it is not
+      // the parent the kind's authorization is.
+      expect(seen[0]).toEqual([
+        bareFacts("wex_1", "acme", [
+          organizationLink("acme"),
+          {
+            relation: "workflow_instance",
+            parentKind: ApiResourceKind.workflow_instance,
+            parentId: "wfi_1",
+          },
+        ]),
+      ]);
+    });
+
+    it("no scope composed = the input unchanged, the parent never resolved", async () => {
+      const executions = [
+        {
+          metadata: { id: "aex_1", org: "acme", labels: {} },
+          spec: { sessionId: "ses_a" },
+        },
+      ];
+      const kept = await restrictListByReadScope(
+        undefined,
+        caller,
+        ApiResourceKind.agent_execution,
+        executions,
+        "acme",
+      );
+      expect(kept).toEqual(executions);
+    });
+  });
+
   it("a scope failure propagates — never an empty result", async () => {
     const failing: ListReadScope = {
       authorizedResourceIds: () => Promise.reject(new Error("fga down")),

package/src/extensions/__tests__/role-reconciliation-composed.test.ts

@@ -0,0 +1,209 @@
+/**
+ * Pins the built-in posture's boot reconciliation END TO END: a database
+ * whose people were provisioned before organization roles existed (the
+ * 3.15.x self-host with OIDC on) is given, at its first boot under the
+ * enforcing posture, exactly the rows those people's first sign-ins would
+ * have written — once, and never again.
+ *
+ * Three boots over ONE data directory, the shape proven by behaviour over
+ * real boots:
+ *   1. A fresh server: the founder provisions and founds an organization
+ *      (the owner row, 2b's lifecycle), the member provisions afterwards
+ *      (the member row, the hook). Then the 3.15.x shape is made
+ *      literally on the store the server used: every role row deleted and
+ *      the reconciliation marker deleted. Accounts, organization and
+ *      blueprint stay.
+ *   2. The same directory boots again: the rows are back — the founder
+ *      `owner`, the member `member` — each written AS the account it names
+ *      (the audit actor), `findMyOrganizations` answers the organization
+ *      to both, and the marker is set.
+ *   3. The founder revokes everyone, the member first and then themself,
+ *      and the directory boots once more: NO row returns. The marker, not
+ *      "zero rows", is what makes the reconciliation one-shot — a revoked
+ *      founder is not handed the organization back by a reboot.
+ *
+ * The unit vouches for unsigned JWT-shaped tokens and declares the
+ * require-authentication posture with no Authorizer (composed-support.ts;
+ * the open-source OIDC self-host's shape, the same recipe
+ * built-in-authorization-composed.test.ts boots). The per-arm proofs of
+ * the reconciliation (order, the machine account, the fault, the half-run
+ * database) are domain/iampolicy/__tests__/membership.test.ts; this file
+ * is the upgrade's definition of done at the wire.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { fromBinary } from "@bufbuild/protobuf";
+import { createClient } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { IamPolicyCommandController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/command_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
+
+import { loadConfig } from "../../boot/config.js";
+import { composeServer } from "../../boot/compose.js";
+import type { ComposedServer } from "../../boot/compose.js";
+import { ROLES_RECONCILED_KEY } from "../../domain/iampolicy/constants.js";
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import type { Store } from "../../store/interface.js";
+import type { ServerExtension } from "../registry.js";
+import {
+  baseConfig,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "./composed-support.js";
+
+const FOUNDER = "fake|founder";
+const MEMBER = "fake|member";
+const ORG = "reconciled-org";
+
+/** `relation@organization` per principal, sorted — the whole role state of the store in one readable shape. */
+async function rolesIn(store: Store): Promise<ReadonlyArray<string>> {
+  const rows = await store.listResources(ApiResourceKind.iam_policy);
+  return rows
+    .map((bytes) => fromBinary(IamPolicySchema, bytes))
+    .map(
+      (row) =>
+        `${row.spec?.principal?.id}:${row.spec?.relation}@${row.spec?.resource?.id}` +
+        `|by:${row.status?.audit?.specAudit?.createdBy?.id ?? ""}`,
+    )
+    .sort();
+}
+
+describe("role reconciliation (composed server, OIDC with no unit Authorizer, three boots over one directory)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+
+  const unit: ServerExtension = {
+    name: "fake-oidc-only",
+    requireAuthentication: true,
+    identityVerifiers: [fakeVerifier],
+  };
+
+  async function boot(): Promise<void> {
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+  }
+
+  const asFounder = () =>
+    transportFor(port, fakeJwt(FOUNDER, "founder@example.com"));
+  const asMember = () =>
+    transportFor(port, fakeJwt(MEMBER, "member@example.com"));
+
+  const founderId = accountIdFor(FOUNDER);
+  const memberId = accountIdFor(MEMBER);
+  const expectedRows = [
+    `${founderId}:owner@${ORG}|by:${founderId}`,
+    `${memberId}:member@${ORG}|by:${memberId}`,
+  ];
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "role-reconciliation-"));
+    await boot();
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("boot 1: the fresh server writes the rows at sign-in, and the marker is set from the first boot", async () => {
+    await createClient(
+      IdentityAccountCommandController,
+      asFounder(),
+    ).provisionMyAccount({});
+    await createClient(OrganizationCommandController, asFounder()).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: ORG },
+    });
+    await createClient(AgentCommandController, asFounder()).create({
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "Agent",
+      metadata: {
+        name: "shared",
+        org: ORG,
+        visibility: ApiResourceVisibility.visibility_org,
+      },
+      spec: { instructions: "a conformant instruction body" },
+    });
+    await createClient(
+      IdentityAccountCommandController,
+      asMember(),
+    ).provisionMyAccount({});
+
+    expect(await rolesIn(server.store)).toEqual(expectedRows);
+    expect(
+      await server.store.bootstrapState.get(ROLES_RECONCILED_KEY),
+    ).not.toBe("");
+  });
+
+  it("boot 2: over the 3.15.x shape — accounts and no rows, no marker — the rows come back as each person's own, and the marker is set", async () => {
+    // The 3.15.x database, made literally on the store the server used.
+    await server.store.deleteResourcesByKind(ApiResourceKind.iam_policy);
+    await server.store.bootstrapState.delete(ROLES_RECONCILED_KEY);
+    expect(await rolesIn(server.store)).toEqual([]);
+    await server.shutdown();
+
+    await boot();
+
+    expect(await rolesIn(server.store)).toEqual(expectedRows);
+    expect(
+      await server.store.bootstrapState.get(ROLES_RECONCILED_KEY),
+    ).not.toBe("");
+    const founderOrgs = await createClient(
+      OrganizationQueryController,
+      asFounder(),
+    ).findMyOrganizations({});
+    const memberOrgs = await createClient(
+      OrganizationQueryController,
+      asMember(),
+    ).findMyOrganizations({});
+    expect(founderOrgs.entries.map((entry) => entry.metadata?.id)).toEqual([
+      ORG,
+    ]);
+    expect(memberOrgs.entries.map((entry) => entry.metadata?.id)).toEqual([
+      ORG,
+    ]);
+  });
+
+  it("boot 3: every role revoked after the marker stays revoked — a reboot hands nothing back", async () => {
+    const policies = createClient(IamPolicyCommandController, asFounder());
+    await policies.revokeOrgAccess({
+      identityAccountId: memberId,
+      organizationId: ORG,
+    });
+    await policies.revokeOrgAccess({
+      identityAccountId: founderId,
+      organizationId: ORG,
+    });
+    expect(await rolesIn(server.store)).toEqual([]);
+    await server.shutdown();
+
+    await boot();
+
+    expect(await rolesIn(server.store)).toEqual([]);
+    const founderOrgs = await createClient(
+      OrganizationQueryController,
+      asFounder(),
+    ).findMyOrganizations({});
+    expect(founderOrgs.entries).toEqual([]);
+  });
+});

package/src/extensions/__tests__/tier-truthfulness.test.ts

@@ -35,7 +35,6 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
-import type { DescService } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
@@ -49,6 +48,7 @@ import { composeServer } from "../../boot/compose.js";
 import type { ComposedServer } from "../../boot/compose.js";
 import { createLogger } from "../../boot/logger.js";
 import { getKindMeta } from "../../pipeline/apiresource-meta.js";
+import { servedServices } from "./composed-support.js";
 
 /** The registry as the check reads it: every kind with kind_meta, by tier. */
 interface KindEntry {
@@ -134,23 +134,15 @@ function tierViolations(
   return violations;
 }
 
-/** Replays the composed routes into a recorder and returns the served kind segments. */
+/** The kind segments of the services a composed server routes. */
 function servedKindSegments(
   routes: (router: ConnectRouter) => void,
 ): Set<string> {
   const served = new Set<string>();
-  const recorder = {
-    handlers: [],
-    service(desc: DescService) {
-      const segment = kindSegmentOf(desc.typeName);
-      if (segment !== undefined) served.add(segment);
-      return recorder;
-    },
-    rpc() {
-      return recorder;
-    },
-  };
-  routes(recorder as unknown as ConnectRouter);
+  for (const desc of servedServices(routes)) {
+    const segment = kindSegmentOf(desc.typeName);
+    if (segment !== undefined) served.add(segment);
+  }
   return served;
 }
 

package/src/extensions/authorizer.ts

@@ -41,7 +41,9 @@ export interface AuthzCheck {
  * (stigmer#224: a nonexistent id answers NOT_FOUND, never
  * PERMISSION_DENIED). Only meaningful with a known kind and a non-empty
  * resource id — anything else is an authorizer contract bug and surfaces
- * as INTERNAL. The OSS permissive default never emits it.
+ * as INTERNAL. The OSS permissive default never emits it; the built-in
+ * authorizer (authorization/authorizer.ts) emits it for a missing target
+ * of every kind but the ones the cloud never probes.
  */
 export type AuthzDecision =
   | { readonly kind: "allow" }
@@ -54,10 +56,13 @@ export type AuthzDecision =
 
 /**
  * The pure decision interface. Exactly ONE implementation is composed per
- * server (the resolver enforces it): OSS's permissive single-team default
- * (O2) or an extension's (the cloud registers OpenFGA). Write concerns —
- * tuple seeding on create — are NOT authorization checks; they ride the
- * post-persist gate slots (blueprint §5b item 4).
+ * server (the resolver enforces it), selected by the authorization posture
+ * (authorization/posture.ts): an extension's (the cloud registers OpenFGA);
+ * open source's built-in authorizer under an authentication posture (the
+ * cloud's model evaluated over tuples derived from the row); or the
+ * permissive single-team default on the trusted-local laptop (O2). Write
+ * concerns — tuple seeding on create — are NOT authorization checks; they
+ * ride the post-persist gate slots (blueprint §5b item 4).
  */
 export interface Authorizer {
   authorize(caller: CallerIdentity, check: AuthzCheck): Promise<AuthzDecision>;

package/src/extensions/drivers.ts

@@ -128,7 +128,10 @@ export interface ExtensionDrivers {
    * read — the census of docs/authorization-coverage.md — narrows to the
    * caller's authorized rows: post-scan lanes through
    * restrictListByReadScope, the search/activity/summary lanes through
-   * the enumeration verb. When absent, the OSS full scan — byte-identical.
+   * the enumeration verb. When absent under the built-in authorization
+   * posture, open source composes its own (src/authorization/
+   * list-read-scope.ts — the model evaluated per candidate); when absent
+   * under trusted-local, the OSS full scan — byte-identical.
    */
   readonly listReadScope?: ListReadScope;
   /**