@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/extensions/list-read-scope.ts

@@ -32,7 +32,13 @@
  *
  *   - No scope composed = the OSS full scan, byte-identical (the four
  *     local conformance rosters pin it; the org argument is then not
- *     consulted either).
+ *     consulted either). That is the trusted-local posture. Under the
+ *     built-in authorization posture (src/authorization/posture.ts — an
+ *     authentication posture with no unit Authorizer) open source
+ *     composes its own scope (src/authorization/list-read-scope.ts): the
+ *     cloud's model, evaluated per candidate over the facts the candidate
+ *     carries, so a self-host's lists show a person what a `get` would
+ *     let them read. A unit's registered scope wins in every posture.
  *   - A scope only NARROWS. It never reorders, never adds; sort/filter
  *     tails, per-lane org intersection, and empty-set semantics (empty
  *     list, proto default instance, kind-skipped) stay consumer-owned
@@ -71,21 +77,76 @@
  *     untouched with the org unconsulted (the first line above). Two lanes
  *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
  *     the kind until P1 entry 12 pages them.
+ *   - A KIND WHOSE AUTHORIZATION IS ITS PARENT'S CARRIES THAT PARENT ON
+ *     EVERY CANDIDATE (stigmer-cloud 20260913.04 T04, Q-LB-33..36). When
+ *     `kind_meta` declares PARENT scope with INHERITED owner
+ *     (`inheritedAuthorizationParentOf`; today agent_execution → session),
+ *     the helper fills `ListEntryMeta.authorizationParent` from the row's
+ *     spec through the same read the tuple lifecycle wrote the parent link
+ *     with. A driver MAY answer the parent's question in place of the
+ *     child's: by the model's construction the two answers are identical
+ *     (the child's `owner`, `viewer` and `can_view` are all `from` the
+ *     parent), and the parent's resolution is direct tuples where the
+ *     child's walks the parent's whole set (OpenFGA's learned `weight2`
+ *     strategy read the founder's 423 sessions per execution; that is what
+ *     rolled back twice on 2026-09-14). A driver that ignores the field is
+ *     still correct. The one observable difference is stated, not hidden:
+ *     a row whose parent tuple never landed (the create chain's "row
+ *     survives, tuple write failed" state, healed by retry) is hidden by
+ *     the child's check and shown by the parent's — the row's truth, read
+ *     from the field the tuple was derived from, and no widening: nobody
+ *     reaches a parent through it who could not create the row in it.
+ *   - EVERY CANDIDATE CARRIES THE ROW'S AUTHORIZATION FACTS (the
+ *     built-in scope's entry): the creator stamp, the visibility level
+ *     and every parent link the tuple lifecycle would have written — the
+ *     `RowAuthorizationFacts` the row's tuples derive from, read by the
+ *     one structural resolver the built-in authorizer reads a loaded row
+ *     through (pipeline/steps/authorization-facts.ts). A driver that
+ *     evaluates the model over a candidate therefore needs no second
+ *     read of a row the lane already decoded; a driver that asks an
+ *     engine ignores the facts and is byte-neutral. The facts are
+ *     REQUIRED on the candidate, never optional: both are always on the
+ *     row the helper holds, and an optional field would let a driver
+ *     silently skip the check.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import type { ApiResourceAudit } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+
+// The only VALUE imports from extensions/ into pipeline/ (every other
+// crossing is a type): three pure leaf modules that import nothing but
+// protos and each other, so there is no cycle. Deliberate — one resolver
+// for the tuple writer, the point-check driver and the list reader beats
+// a copy in the seam.
+import { inheritedAuthorizationParentOf } from "../pipeline/apiresource-meta.js";
+import { rowAuthorizationFactsOf } from "../pipeline/steps/authorization-facts.js";
 
 import type { CallerIdentity } from "./identity.js";
+import type {
+  ResolvedParentLink,
+  RowAuthorizationFacts,
+} from "./resource-authorization.js";
 
 /**
- * The candidate metadata a post-scan lane offers the scope — the three
- * fields the cloud driver's rules key on (id for the FGA intersection,
- * labels for the guest cookie rule; org rides along for symmetry with
- * the consumer-owned intersection, so a driver can log or assert on it).
+ * The candidate a post-scan lane offers the scope: the row's authorization
+ * facts (the header's last contract line), the labels the cloud driver's
+ * guest cookie rule keys on (org rides along in the facts for symmetry
+ * with the consumer-owned intersection, so a driver can log or assert on
+ * it), and the parent for kinds whose authorization is their parent's.
  */
-export interface ListEntryMeta {
-  readonly id: string;
-  readonly org: string;
+export interface ListEntryMeta extends RowAuthorizationFacts {
   readonly labels: Readonly<Record<string, string>>;
+  /**
+   * OPTIONAL (added 20260913.04 T04): the parent this row's authorization
+   * IS — present only for a kind whose `kind_meta` is PARENT scope with
+   * INHERITED owner (the header's contract line), the same
+   * `ResolvedParentLink` the tuple lifecycle wrote for the row and one of
+   * the candidate's own `parentLinks`, named again as the designation a
+   * driver may answer in place of the child. Absent for every other kind,
+   * and absent when the row's spec does not name its parent — a driver
+   * then asks about the row itself, never drops it.
+   */
+  readonly authorizationParent?: ResolvedParentLink;
 }
 
 /** The scope contract (single-instance point, ExtensionDrivers.listReadScope). */
@@ -117,14 +178,21 @@ export interface ListReadScope {
 
 /**
  * The shape every stored API resource message presents to the shared
- * helper — the metadata fields the scope's candidates are built from.
+ * helper — the metadata fields the scope's candidates are built from, the
+ * spec the parents are read from (structurally, by `kind_meta`'s
+ * `spec_field`; typed loosely because the field differs per kind and the
+ * read is `parentIdOf`'s), and the audit the creator stamp is read from
+ * (the one generated type every kind's status carries it as).
  */
 export interface ScopedListResource {
   metadata?: {
     id?: string;
     org?: string;
     labels?: Record<string, string>;
+    visibility?: ApiResourceVisibility;
   };
+  spec?: object;
+  status?: { audit?: ApiResourceAudit };
 }
 
 /**
@@ -141,8 +209,13 @@ export interface ScopedListResource {
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's last contract line: the scope sees the org's
- *     rows, not the kind's.
+ *     order is the header's second-to-last contract line: the scope sees
+ *     the org's rows, not the kind's;
+ *   - every candidate carries the row's authorization facts, and the
+ *     candidates of a kind whose authorization is its parent's name that
+ *     parent again as `authorizationParent` — one of the facts' parent
+ *     links, picked by the relation `kind_meta` declares, resolved once
+ *     per call and read once per row.
  */
 export async function restrictListByReadScope<T extends ScopedListResource>(
   scope: ListReadScope | undefined,
@@ -158,11 +231,38 @@ export async function restrictListByReadScope<T extends ScopedListResource>(
     requestOrg === ""
       ? resources
       : resources.filter((resource) => resource.metadata?.org === requestOrg);
-  const entries: ListEntryMeta[] = offered.map((resource) => ({
-    id: resource.metadata?.id ?? "",
-    org: resource.metadata?.org ?? "",
-    labels: resource.metadata?.labels ?? {},
-  }));
+  const parentOf = authorizationParentReader(kind);
+  const entries: ListEntryMeta[] = offered.map((resource) => {
+    const entry: ListEntryMeta = {
+      ...rowAuthorizationFactsOf(kind, resource),
+      labels: resource.metadata?.labels ?? {},
+    };
+    const authorizationParent = parentOf(entry.parentLinks);
+    return authorizationParent === undefined
+      ? entry
+      : { ...entry, authorizationParent };
+  });
   const keptIds = await scope.restrictListEntries(caller, kind, entries);
   return offered.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
 }
+
+/**
+ * The per-row parent picker for `kind`: a constant `undefined` for the 27
+ * kinds whose authorization is their own, and for the kind whose
+ * authorization is its parent's, the link among the row's own parent
+ * links that carries the declared relation — or undefined for a row whose
+ * spec does not name it (never a throw: a list is not a create).
+ * `kind_meta` is consulted once per call, not once per row.
+ */
+function authorizationParentReader(
+  kind: ApiResourceKind,
+): (
+  parentLinks: ReadonlyArray<ResolvedParentLink>,
+) => ResolvedParentLink | undefined {
+  const parent = inheritedAuthorizationParentOf(kind);
+  if (parent === undefined) {
+    return () => undefined;
+  }
+  return (parentLinks) =>
+    parentLinks.find((link) => link.relation === parent.relation);
+}

package/src/extensions/organization-directory.ts

@@ -5,19 +5,23 @@
  * conformance capability flags, and this port is their ONE seam:
  *
  *   - `find` (org enumeration; capability `organizationEnumeration`):
- *     single-tenant OSS enumerates freely; the cloud refuses with
- *     UNIMPLEMENTED (tenant isolation — no caller may list orgs it does
- *     not belong to).
- *   - `findMyOrganizations` (capability `multiTenant`): OSS answers ALL
- *     organizations (single-user semantics); the cloud filters to the
- *     caller's authorized set.
+ *     the trusted-local laptop enumerates freely; the cloud — and open
+ *     source under the built-in authorization posture — refuses with
+ *     UNIMPLEMENTED (no caller may list organizations they hold no role
+ *     in; `find` is skip-authorization by annotation, so the refusal is
+ *     the only thing standing between a member and every row).
+ *   - `findMyOrganizations` (capability `multiTenant`): the trusted-local
+ *     laptop answers ALL organizations (single-user semantics); the cloud
+ *     and the built-in directory filter to what the caller may view.
  *   - `getByExternalOrgId` (capability `externalOrgLookup`): deliberately
  *     absent from the OSS partial registration (UNIMPLEMENTED by
  *     construction); the cloud resolves external IdP org ids.
  *
- * No directory composed = the controller's OSS behavior, byte-identical.
- * The controller stays the ONE owner of its chains — the directory
- * answers policy questions and id lookups; it never handles RPCs.
+ * No directory composed = the trusted-local behavior, byte-identical; the
+ * built-in directory (authorization/organization-directory.ts) composes
+ * under the built-in posture, a unit's under its own. The controller stays
+ * the ONE owner of its chains — the directory answers policy questions
+ * and id lookups; it never handles RPCs.
  */
 import type { CallerIdentity } from "./identity.js";
 

package/src/extensions/resource-authorization.ts

@@ -55,6 +55,7 @@
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 
@@ -90,6 +91,39 @@ export interface ResolvedParentLink {
   readonly parentId: string;
 }
 
+/**
+ * The facts a stored row carries that its authorization tuples derive
+ * from — the row-side vocabulary of `kind_meta.authorization`, read back
+ * from a row rather than resolved at its create. The lifecycle derives a
+ * `ResourceCreatedEvent` from the same facts on the way in; a list lane
+ * offers them on every candidate (`ListEntryMeta`, list-read-scope.ts);
+ * the built-in authorizer derives a loaded row's tuples from them. One
+ * shape, read by one structural resolver
+ * (pipeline/steps/authorization-facts.ts), so a driver that evaluates the
+ * model over a candidate needs no second read of the row.
+ *
+ * Read-side facts are lenient where the create-time resolution is strict:
+ * a legacy row that names no organization or no parent carries none (an
+ * empty `org`, a link absent from `parentLinks`) and a stamp that names
+ * nobody is the empty string — a fact about the row, never a fault of the
+ * read.
+ */
+export interface RowAuthorizationFacts {
+  readonly id: string;
+  /** `metadata.org`; "" for kinds outside organization scope and for legacy rows that never named one. */
+  readonly org: string;
+  /** `metadata.visibility` as stored; unspecified when the row never set one. */
+  readonly visibility: ApiResourceVisibility;
+  /** `status.audit.spec_audit.created_by.id` as stamped; "" when absent. Classified by the reader, not here. */
+  readonly createdBy: string;
+  /**
+   * The scope link and every configured additional parent, in the tuple
+   * lifecycle's order, from the row's own fields; a parent the row does
+   * not name is absent, never a fault.
+   */
+  readonly parentLinks: ReadonlyArray<ResolvedParentLink>;
+}
+
 /** Fired synchronously after a resource row is first persisted. */
 export interface ResourceCreatedEvent {
   readonly kind: ApiResourceKind;

package/src/extensions/schedule-fire-caller.ts

@@ -2,32 +2,63 @@
  * The schedule-fire caller seam (stigmer-cloud#572) — WHO a schedule fire
  * acts as when the RunStarter re-enters the execution create pipeline.
  *
- * OSS deliberately has no caller identity on this lane (DD-015 D-G: the
- * single-user edition has no tokens to carry one), so with no driver
- * composed every fire enters as the in-process `internal` class — today's
- * behavior, byte-identical. The cloud edition's Java baseline instead
- * mints a schedule JWT per fire (sub = the org's system-schedule account,
- * claim = the firing Schedule id) so the created session and execution
- * carry real attribution and the schedule's viewer set reaches the run
- * (the FGA model's session#schedule link — "without it a scheduled run is
- * invisible to every human, including the schedule's owner"). This seam
- * lets a composition supply that identity; the fire then propagates it
- * through the R5 caller-propagation header exactly like the other
- * request-origin in-process creates.
+ * With no driver composed a fire enters as the in-process `internal`
+ * class — the trusted-local laptop's lane, where the one caller is the
+ * server's operator and attribution has nobody to separate. Under an
+ * authentication posture that lane is wrong: the internal class carries
+ * the operator's email or `"system"`, which no enforcing evaluator
+ * recognizes as a person, so the fired session would belong to nobody
+ * (the FGA model's own words — "without it a scheduled run is invisible
+ * to every human, including the schedule's owner"). Two drivers answer
+ * it: the cloud edition mints a schedule JWT per fire (sub = the org's
+ * system-schedule account, claim = the firing Schedule id) so the run
+ * reaches the schedule's viewer set through the session#schedule link;
+ * open source, under the built-in authorization posture, makes the fire
+ * act as the schedule's CREATOR (authorization/schedule-fire-caller.ts),
+ * so the run and its session are that person's. The fire then propagates
+ * the identity through the R5 caller-propagation header exactly like the
+ * other request-origin in-process creates.
  *
  * Single-instance point. The mint is per fire — the schedule id is a
- * claim of the minted credential, never a cached field — and a mint
- * failure is an infrastructure fault: the RunStarter lets it propagate,
- * so the tick activity retries (the deterministic execution name absorbs
- * the retry) and a manual trigger surfaces the failure to its caller.
+ * claim of the minted credential, never a cached field. Two failure
+ * shapes, and the RunStarter tells them apart by type, the store-fault
+ * precedent (`ResourceNotFoundError` is checked with `instanceof`; every
+ * other fault is infrastructure):
+ *
+ *   - any other thrown error is an INFRASTRUCTURE fault: the RunStarter
+ *     lets it propagate, so the tick activity retries (the deterministic
+ *     execution name absorbs the retry) and a manual trigger surfaces
+ *     the failure to its caller;
+ *   - `ScheduleFireCallerRefusedError` is a DETERMINISTIC refusal — this
+ *     fire can act as nobody, and no retry will change that (a schedule
+ *     stamped by no person this server knows). The RunStarter answers
+ *     the `refused` outcome the way it answers a launch gate's refusal:
+ *     the failure streak counts it and pauses the schedule with the
+ *     reason, so the person who scheduled it sees why in the console
+ *     instead of a tick failing quietly forever.
  */
 import type { CallerIdentity } from "./identity.js";
 
 export interface ScheduleFireCallerMint {
   /**
    * Mints the caller identity one fire acts as. `rawToken` must carry the
-   * edition's verifiable credential for the identity (compositions read
-   * fire-scoped claims — e.g. the schedule id — from it downstream).
+   * edition's verifiable credential for the identity when the edition
+   * reads fire-scoped claims from it downstream (the cloud does — the
+   * schedule id); an edition that propagates the identity in-process and
+   * reads nothing off the token leaves it empty (open source does).
    */
   mintFireCaller(org: string, scheduleId: string): Promise<CallerIdentity>;
 }
+
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export class ScheduleFireCallerRefusedError extends Error {
+  constructor(reason: string) {
+    super(reason);
+    this.name = "ScheduleFireCallerRefusedError";
+  }
+}

package/src/index.ts

@@ -148,14 +148,64 @@ export type { AuthorizationQueryEngine } from "./extensions/authorization-querie
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+// The built-in authorizer's model seams: the kind
+// declarations (transcripts of the cloud's `.fga` files), the evaluator,
+// and the OpenFGA store-test kit — exported so the cloud's drift test
+// compares the live model against the transcripts and runs its live
+// store tests through the evaluator, both from the published package.
+// The drivers themselves are composed by the root and are not exported.
+export type {
+  DerivedRelation,
+  KindDeclaration,
+  Rewrite,
+  SubjectType,
+} from "./authorization/model/rewrite.js";
+export type { Model } from "./authorization/model/index.js";
+export {
+  builtInModel,
+  declarationFor,
+  newModel,
+} from "./authorization/model/index.js";
+export type {
+  CheckContext,
+  ObjectRef,
+  Person,
+  Subject,
+  Tuple,
+  TupleSource,
+} from "./authorization/tuples.js";
+export type { EvaluationFault } from "./authorization/evaluator.js";
+export {
+  AuthorizationEvaluationError,
+  MAX_RESOLUTION_DEPTH,
+  checkRelation,
+} from "./authorization/evaluator.js";
+export type {
+  StoreTestCase,
+  StoreTestDocument,
+  StoreTestKit,
+  StoreTestSkip,
+  StoreTestSkipReason,
+} from "./authorization/store-test-kit.js";
+export {
+  parseStoreTestDocument,
+  storeTestCases,
+} from "./authorization/store-test-kit.js";
+// The kinds whose missing row the built-in authorizer denies instead of
+// answering not-found — the cloud's probe exemption over the open-source
+// tier; exported so the cloud's drift test pins the two sets equal.
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
 export type {
   ListReadScope,
   ListEntryMeta,
 } from "./extensions/list-read-scope.js";
 // The stigmer-cloud#572 seam: the identity a schedule fire acts as
 // (drivers.scheduleFireCaller) — the composition mints it per fire; the
-// RunStarter propagates it through the R5 in-process header.
+// RunStarter propagates it through the R5 in-process header. A mint that
+// can act as nobody throws the seam's typed refusal, which the RunStarter
+// counts against the schedule instead of retrying.
 export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 // The 20260830.03 seam: the visitor-sanitization policy the serving
 // chain's error boundary consumes (drivers.visitorErrorPolicy) — the
 // composition supplies WHO is on the anonymous surface and WHAT copy

package/src/pipeline/__tests__/inherited-authorization-parent.test.ts

@@ -0,0 +1,51 @@
+/**
+ * Pins `inheritedAuthorizationParentOf` (pipeline/apiresource-meta.ts):
+ * the kind_meta question "is this kind's authorization its parent's
+ * whole?", answered by the PARENT-scope + INHERITED-owner pair and by
+ * nothing else (stigmer-cloud 20260913.04 T04, Q-LB-34).
+ *
+ * The table below is the WHOLE kind enum, on purpose. The list read scope
+ * carries `authorizationParent` for exactly the kinds this function names,
+ * and a composed driver asks its authorization backend about the parent
+ * in the child's place — so a second kind joining the set is a change in
+ * what that driver checks, and must arrive as a reviewed edit of this
+ * table, never as a silent consequence of a kind_meta edit. Kinds with
+ * additional parents whose inheritance is partial (workflow_execution's
+ * opt-in `execution_viewer from workflow_instance`, agent_instance's
+ * `viewer from default_of`) own themselves and are pinned as `undefined`.
+ */
+import { describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { inheritedAuthorizationParentOf } from "../apiresource-meta.js";
+
+describe("inheritedAuthorizationParentOf — the parent a kind's authorization is", () => {
+  it("agent_execution's authorization is its session's: relation `session`, spec field `session_id`", () => {
+    const parent = inheritedAuthorizationParentOf(
+      ApiResourceKind.agent_execution,
+    );
+    expect(parent).toBeDefined();
+    expect(parent?.kind).toBe("session");
+    expect(parent?.relation).toBe("session");
+    expect(parent?.specField).toBe("session_id");
+  });
+
+  it("every other kind's authorization is its own (the whole enum, pinned)", () => {
+    const inherited = Object.values(ApiResourceKind)
+      .filter((value): value is ApiResourceKind => typeof value === "number")
+      .filter((kind) => kind !== ApiResourceKind.api_resource_kind_unknown)
+      .filter((kind) => inheritedAuthorizationParentOf(kind) !== undefined)
+      .map((kind) => ApiResourceKind[kind]);
+    expect(inherited).toEqual(["agent_execution"]);
+  });
+
+  it.each([
+    ApiResourceKind.workflow_execution,
+    ApiResourceKind.agent_instance,
+    ApiResourceKind.workflow_instance,
+    ApiResourceKind.memory,
+  ])("a kind with an additional, partial parent owns itself: %s", (kind) => {
+    expect(inheritedAuthorizationParentOf(kind)).toBeUndefined();
+  });
+});

package/src/pipeline/__tests__/router-transport.test.ts

@@ -157,9 +157,7 @@ describe("R5: caller propagation through the in-process transport", () => {
         },
       },
     );
-    expect(seen).toEqual([
-      { ...caller, origin: "in-process" },
-    ]);
+    expect(seen).toEqual([{ ...caller, origin: "in-process" }]);
   });
 
   it("mints the internal class when nothing was propagated (the daemon default)", async () => {

package/src/pipeline/apiresource-labels.ts

@@ -8,9 +8,12 @@
  * instances) but never to GRANT anything. Where a grant-shaped decision is
  * needed, key it on server-owned state instead (e.g. the parent blueprint's
  * status.default_instance_id, written only by the create/self-heal flows).
- * The cloud edition additionally guards the whole reserved namespace at its
- * write boundaries (GuardReservedLabelsStep); OSS has no such guard, which
- * is one of the reasons OSS predicates must not trust these labels alone.
+ * Every write boundary runs GuardReservedLabels over the namespace
+ * (pipeline/steps/guard-reserved-labels.ts), but the open-source
+ * authorizer's permissive default ALLOWS reserved-label writes by design
+ * (the self-hosted operator owns the store), which is why a restrict-shaped
+ * predicate here still pairs the label with server-owned state: the
+ * plugin-managed guard refuses only beside an existing plugin row.
  */
 import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 
@@ -44,6 +47,31 @@ export const SYSTEM_MANAGED_LABEL = `${RESERVED_LABEL_PREFIX}system-managed`;
  */
 export const RESERVED_LABEL_TRUE = "true";
 
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export const PLUGIN_LABEL = `${RESERVED_LABEL_PREFIX}plugin`;
+
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export const PLUGIN_VERSION_LABEL = `${RESERVED_LABEL_PREFIX}plugin-version`;
+
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export function pluginIdOf(
+  metadata: ApiResourceMetadata | undefined,
+): string | undefined {
+  const value = metadata?.labels[PLUGIN_LABEL];
+  return value === undefined || value === "" ? undefined : value;
+}
+
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/src/pipeline/apiresource-meta.ts

@@ -53,6 +53,11 @@ import {
   kind_meta,
 } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { ApiResourceKindMeta } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import {
+  AuthorizationScopeType,
+  OwnerAttributionType,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { ParentRelationConfig } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 
@@ -65,6 +70,38 @@ export function getKindMeta(kind: ApiResourceKind): ApiResourceKindMeta {
   return getOption(valueDesc, kind_meta);
 }
 
+/**
+ * The parent a kind's authorization IS — the `kind_meta` declaration that
+ * a kind's permissions are its parent's whole, not its own: PARENT scope
+ * (the one structural link is to that parent) AND INHERITED owner (no
+ * owner tuple of its own; `owner from <parent>` in the FGA model).
+ * Undefined for every other kind, including kinds with additional parents
+ * whose inheritance is partial (a workflow_execution's opt-in
+ * `execution_viewer from workflow_instance` sits beside its own owner).
+ *
+ * Today exactly one kind answers: agent_execution → session (its
+ * `can_view` is `viewer or can_view from session`, and `viewer` is the
+ * session's). The list read scope reads this to carry the parent on every
+ * candidate (`ListEntryMeta.authorizationParent`, 20260913.04 T04), so a
+ * composed driver may ask its authorization backend about the parent —
+ * direct tuples — instead of the child, whose resolution walks the
+ * parent's whole set. A second kind declaring the pair gets the behavior
+ * from this declaration alone; the table pin in __tests__ makes that a
+ * reviewed change.
+ */
+export function inheritedAuthorizationParentOf(
+  kind: ApiResourceKind,
+): ParentRelationConfig | undefined {
+  const config = getKindMeta(kind).authorization;
+  if (
+    config?.scopeType !== AuthorizationScopeType.PARENT ||
+    config.ownerType !== OwnerAttributionType.INHERITED
+  ) {
+    return undefined;
+  }
+  return config.parent;
+}
+
 /** Go GetIdPrefix: e.g. agent → "agt". */
 export function getIdPrefix(kind: ApiResourceKind): string {
   return getKindMeta(kind).idPrefix;

package/src/pipeline/errors.ts

@@ -24,7 +24,10 @@ export function invalidArgumentError(message: string): ConnectError {
 
 /** Go AlreadyExistsError: "%s already exists: %s". */
 export function alreadyExistsError(resource: string, id: string): ConnectError {
-  return new ConnectError(`${resource} already exists: ${id}`, Code.AlreadyExists);
+  return new ConnectError(
+    `${resource} already exists: ${id}`,
+    Code.AlreadyExists,
+  );
 }
 
 /**
@@ -109,10 +112,7 @@ export function goWrappedStatusError(
   prefix: string,
   error: ConnectError,
 ): ConnectError {
-  return new ConnectError(
-    `${prefix}: ${goGrpcErrorText(error)}`,
-    error.code,
-  );
+  return new ConnectError(`${prefix}: ${goGrpcErrorText(error)}`, error.code);
 }
 
 /**

package/src/pipeline/steps/__tests__/authorize-annotation-completeness.test.ts

@@ -55,7 +55,6 @@ import path from "node:path";
 
 import { getOption, hasOption } from "@bufbuild/protobuf";
 import type { DescService } from "@bufbuild/protobuf";
-import type { ConnectRouter } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -71,6 +70,7 @@ import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
+import { servedServices } from "../../../extensions/__tests__/composed-support.js";
 
 /** One annotated method as the invariant reads it. */
 interface AnnotationTarget {
@@ -80,25 +80,6 @@ interface AnnotationTarget {
   readonly skipsResolution: boolean;
 }
 
-/** Replays the composed routes into a recorder and returns the served services. */
-function servedServices(
-  routes: (router: ConnectRouter) => void,
-): DescService[] {
-  const served: DescService[] = [];
-  const recorder = {
-    handlers: [],
-    service(desc: DescService) {
-      served.push(desc);
-      return recorder;
-    },
-    rpc() {
-      return recorder;
-    },
-  };
-  routes(recorder as unknown as ConnectRouter);
-  return served;
-}
-
 /** Every `rpc.config`-annotated method of the given services, read once. */
 function annotationTargets(services: DescService[]): AnnotationTarget[] {
   const targets: AnnotationTarget[] = [];