@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/boot/compose.ts

@@ -29,8 +29,19 @@ import path from "node:path";
 import type { ConnectRouter, Transport } from "@connectrpc/connect";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 
+import { newBuiltInAuthorizer } from "../authorization/authorizer.js";
+import { newLaneAdmittedAuthorizer } from "../authorization/lane-admission.js";
+import { newBuiltInListReadScope } from "../authorization/list-read-scope.js";
+import { newBuiltInOrganizationDirectory } from "../authorization/organization-directory.js";
+import { authorizationPostureOf } from "../authorization/posture.js";
+import { newBuiltInScheduleFireCaller } from "../authorization/schedule-fire-caller.js";
+import type { Authorizer } from "../extensions/authorizer.js";
+import type { ListReadScope } from "../extensions/list-read-scope.js";
+import type { OrganizationDirectory } from "../extensions/organization-directory.js";
+import type { ScheduleFireCallerMint } from "../extensions/schedule-fire-caller.js";
 import { registerAgentServices } from "../domain/agent/controller.js";
 import {
   newConfigFromEnv,
@@ -99,12 +110,15 @@ import { registerMcpServerServices } from "../domain/mcpserver/controller.js";
 import { registerPlatformServices } from "../domain/platform/controller.js";
 import { registerProjectServices } from "../domain/project/controller.js";
 import { registerSessionServices } from "../domain/session/controller.js";
+import { registerPluginServices } from "../domain/plugin/controller.js";
+import { PLUGIN_ARTIFACT_KEY_PREFIX } from "../domain/plugin/constants.js";
 import { registerSkillServices } from "../domain/skill/controller.js";
 import {
   DEFAULT_SLOT_TTL_MS,
   MAX_ZIP_SIZE,
 } from "../domain/skill/constants.js";
 import { newSkillArtifactStorage } from "../domain/skill/storage/artifact-storage.js";
+import { newContentAddressedArchiveStore } from "../archive/content-store.js";
 import {
   newSkillTransferLane,
   uploadUrl as skillUploadUrl,
@@ -137,7 +151,12 @@ import { operatorIdentitySnapshot } from "../pipeline/steps/defaults.js";
 import { createErrorBoundaryInterceptor } from "../pipeline/interceptors/error-boundary.js";
 import { createRequestMetricsInterceptor } from "../pipeline/interceptors/request-metrics.js";
 import { newPermissiveSingleTeamAuthorizer } from "../pipeline/steps/authorize.js";
+import {
+  isWorkflowBoundRunner,
+  newBuiltInRunnerCredentialProvider,
+} from "../runnerauth/built-in-runner-credential-provider.js";
 import { newExecutionScopedRunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
+import { newRunnerSubjectIdentityVerifier } from "../runnerauth/runner-subject-verifier.js";
 import { RunnerAuthService } from "../runnerauth/runnerauth.js";
 import { PostgresStore } from "../store/postgres/store.js";
 import { SqliteStore } from "../store/sqlite/store.js";
@@ -285,20 +304,6 @@ export async function composeServer(
       units: extensions.unitNames.join(", "),
     });
   }
-  // The ONE composed Authorizer (DD-007 §3): an extension's registration
-  // or the OSS permissive single-team default. Resolved here, handed to
-  // every controller as an explicit dependency — the Authorize step at
-  // position 1 of every chain calls it (O2).
-  const authorizer =
-    extensions.authorizer ?? newPermissiveSingleTeamAuthorizer();
-  // The built-in authorization POSTURE (20260913.01, Q-OR-6), named once:
-  // no unit registered an Authorizer, so the roles open source records
-  // exist to feed the built-in one. Under it — and only under it — the
-  // identity-accounts stage below installs the built-in role lifecycle
-  // and the membership rules; a composition with its own Authorizer has
-  // its own onboarding and gets neither.
-  const builtInAuthorization = extensions.authorizer === undefined;
-
   // Stage: storage — the driver selection seam (DD-010): DATABASE_URL
   // present → Postgres (async connect + advisory-locked migrations), else
   // sqlite on DB_PATH (migrations v1–v7, incl. adopting a Go-created
@@ -331,6 +336,38 @@ export async function composeServer(
   const requireAuthentication =
     authEnabled || extensions.requireAuthentication !== undefined;
 
+  // The AUTHORIZATION posture (authorization/posture.ts), named once and
+  // handed down: a unit's own Authorizer (nothing built in installs);
+  // the built-in posture (no unit Authorizer under an authentication
+  // posture — open source composes its Authorizer, organization directory
+  // and schedule fire caller below, and the roles 2b records are
+  // enforced); or trusted-local (the permissive default: one caller,
+  // nothing to separate). `builtInAuthorization` (20260913.01, Q-OR-6) is
+  // the first two together — the roles exist to feed the built-in
+  // authorizer, so the identity stage installs the built-in role
+  // lifecycle and the membership rules under both; a composition with its
+  // own Authorizer has its own onboarding and gets neither.
+  const authorizationPosture = authorizationPostureOf({
+    unitAuthorizer: extensions.authorizer !== undefined,
+    requireAuthentication,
+  });
+  const builtInAuthorization = authorizationPosture !== "unit-authorizer";
+  // The built-in authorizer declares the open-source kinds and no other
+  // (its registry is pinned set-equal to that tier), so a composition
+  // that serves a wider edition must bring its own Authorizer: every
+  // check on a kind the model does not declare would otherwise fault
+  // INTERNAL per request. Refused at boot, the same class as a
+  // misconfigured registry (DD-006 §2b) and the verifierless posture
+  // below — caught before any side effect.
+  if (
+    authorizationPosture === "built-in" &&
+    extensions.edition !== ServerEdition.oss
+  ) {
+    throw new Error(
+      `the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer — the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`,
+    );
+  }
+
   // Stage: identity accounts (20260911.11) — the first domain whose
   // persistence is a PORT rather than the generic Store. The composed
   // driver (`drivers.identityAccountStore`, Q-IA-9) serves when a unit
@@ -400,6 +437,110 @@ export async function composeServer(
         operatorEmail: operatorIdentity.email,
       })
     : undefined;
+  // Stage: runner credentials (§6c, O5). The concrete service is
+  // constructed and exposed UNCONDITIONALLY — its boot-fatal key posture
+  // is the ratified cross-domain invariant, and the boot/EC-decrypt tests
+  // mint against the server's own key through it. The provider over it is
+  // the edition's whole credential story in one object: a composed
+  // driver; otherwise, under the built-in authorization posture, open
+  // source's built-in provider (runnerauth/built-in-runner-credential-
+  // provider.ts — the execution-scoped default plus the lineage-vouching,
+  // memory-capture and exchange-gating capabilities an enforcing
+  // self-host needs, and the one reading of a runner's binding the
+  // Authorizer below admits a workflow-bound runner on); otherwise the
+  // execution-scoped default, byte-identical to the wiring this seam
+  // replaced. Both open-source providers also mint the RUN credential the
+  // two execution engines put on every dispatch (the engines below take
+  // this object; runnerauth/dispatch-credential.ts) — a composed driver
+  // that leaves that capability undefined dispatches without one, its
+  // runners being credentialed another way. Bound HERE, before the
+  // Authorizer, because the lane admission reads the binding.
+  const runnerAuthService = RunnerAuthService.fromEnv();
+  const runnerCredentials =
+    extensions.drivers.runnerCredentialProvider ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInRunnerCredentialProvider({
+          service: runnerAuthService,
+          store,
+          accounts: identityAccounts,
+        })
+      : newExecutionScopedRunnerCredentialProvider(runnerAuthService));
+  // The ONE composed Authorizer (DD-007 §3), bound here — after the store,
+  // the account port and the IamPolicy port it reads — and handed to every
+  // controller as an explicit dependency; the Authorize step at position 1
+  // of every chain calls it (O2). By posture: an extension's registration;
+  // open source's built-in Authorizer (authorization/authorizer.ts — the
+  // cloud's model evaluated over the tuples the row would have had),
+  // decorated with the lane admission (authorization/lane-admission.ts) so
+  // a runner acting for a WORKFLOW execution passes the run gate on the
+  // child executions its `agent_call` creates — the parent workflow
+  // already passed its own, the cloud's `workflow_sandbox` posture; or
+  // the permissive single-team default. The organization directory and the
+  // schedule fire caller are bound beside it under the same posture, so
+  // `findMyOrganizations` lists what a person may view and a scheduled run
+  // belongs to the person who scheduled it — a fire the internal lane
+  // would otherwise hand to nobody an enforcing evaluator recognizes.
+  const authorizer: Authorizer =
+    extensions.authorizer ??
+    (authorizationPosture === "built-in"
+      ? newLaneAdmittedAuthorizer(
+          newBuiltInAuthorizer({
+            store,
+            policies: iamPolicies,
+            accounts: identityAccounts,
+            edition: extensions.edition,
+            logger,
+          }),
+          (caller) => isWorkflowBoundRunner(runnerAuthService, caller),
+        )
+      : newPermissiveSingleTeamAuthorizer());
+  const organizationDirectory: OrganizationDirectory | undefined =
+    extensions.drivers.organizationDirectory ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInOrganizationDirectory({
+          store,
+          policies: iamPolicies,
+          accounts: identityAccounts,
+        })
+      : undefined);
+  const scheduleFireCaller: ScheduleFireCallerMint | undefined =
+    extensions.drivers.scheduleFireCaller ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInScheduleFireCaller({ store, accounts: identityAccounts })
+      : undefined);
+  // The ONE list read scope (the seam's single-instance point), bound
+  // here under the same posture and handed to every list-shaped consumer
+  // below — the post-scan lanes through restrictListByReadScope, the
+  // search, activity and summary lanes through the enumeration verb. A
+  // unit's driver wins in every posture; the built-in one evaluates the
+  // model per candidate over the facts the candidate carries
+  // (authorization/list-read-scope.ts); trusted-local composes none and
+  // keeps the full scan.
+  const listReadScope: ListReadScope | undefined =
+    extensions.drivers.listReadScope ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInListReadScope({
+          store,
+          policies: iamPolicies,
+          accounts: identityAccounts,
+          logger,
+        })
+      : undefined);
+  logger.info("authorization posture resolved", {
+    posture: authorizationPosture,
+    authorizer:
+      extensions.authorizer !== undefined
+        ? "extension"
+        : authorizationPosture === "built-in"
+          ? "built-in"
+          : "permissive",
+    listReadScope:
+      extensions.drivers.listReadScope !== undefined
+        ? "extension"
+        : authorizationPosture === "built-in"
+          ? "built-in"
+          : "none",
+  });
   const identityAccountPath = {
     accounts: identityAccounts,
     logger,
@@ -456,6 +597,22 @@ export async function composeServer(
       });
     }
   }
+  // The built-in posture's own boot ensure, the sibling of the block
+  // above: the membership rules run at a person's FIRST provisioning, so a
+  // database whose people were provisioned before the rules existed (a
+  // 3.15.x self-host with OIDC on) holds accounts with no role rows — and
+  // the built-in authorizer below would make every one of them an
+  // outsider on every organization, with nobody left who could grant a
+  // way back. Once per database (a bootstrap-state marker; the rules'
+  // header), the same arms run for every person account in creation
+  // order; a fault is a loud boot throw like the storage stage's, and the
+  // next boot converges. Under the built-in posture only: a unit with its
+  // own Authorizer has its own onboarding, and trusted-local has the
+  // operator ensure above and one principal.
+  if (authorizationPosture === "built-in" && membership !== undefined) {
+    await membership.ensureRolesForExistingAccounts();
+    logger.info("built-in posture role reconciliation ensured");
+  }
 
   // Stage: keys — the ratified fail-loud boot ASYMMETRY (D2 cross-domain
   // invariants; Go server.go:277-293):
@@ -510,16 +667,6 @@ export async function composeServer(
       writeVersionValue === "" ? DEFAULT_WRITE_VERSION : writeVersionValue,
     registeredCodecs: [...secretCodecs.keys()].sort(),
   });
-  const runnerAuthService = RunnerAuthService.fromEnv();
-  // The runner-credential seam (§6c, O5): the composed provider, or the
-  // OSS execution-scoped default over the service above. The concrete
-  // service is constructed and exposed UNCONDITIONALLY either way — its
-  // boot-fatal key posture is the ratified cross-domain invariant, and the
-  // boot/EC-decrypt tests mint against the server's own key through it.
-  const runnerCredentials =
-    extensions.drivers.runnerCredentialProvider ??
-    newExecutionScopedRunnerCredentialProvider(runnerAuthService);
-
   // Stage: temporal (#18). Construction is sync and connection-free —
   // initialConnect/startWorkers/startHealthMonitor run in start(), all
   // NON-fatal (Go server.go: the server boots and serves with the engine
@@ -643,9 +790,10 @@ export async function composeServer(
   );
   // Every fire enters the FULL execution create pipeline through the
   // in-process agentexecution client (Go server.go 581: the RunStarter's
-  // ExecutionCreator edge). The composed scheduleFireCaller driver
-  // (stigmer-cloud#572), when present, gives each fire its edition
-  // identity — propagated by the creator's asCaller lane.
+  // ExecutionCreator edge). The scheduleFireCaller driver bound in the
+  // identity stage (stigmer-cloud#572; a unit's, or open source's under
+  // the built-in posture), when present, gives each fire its identity —
+  // propagated by the creator's asCaller lane.
   const scheduleRunStarter = new RunStarter({
     store,
     config: scheduleTemporalConfig,
@@ -656,7 +804,7 @@ export async function composeServer(
           fireCaller,
         ),
     },
-    fireCallerMint: extensions.drivers.scheduleFireCaller,
+    fireCallerMint: scheduleFireCaller,
     logger,
   });
   const scheduleReconciler = new ScheduleReconciler(
@@ -720,6 +868,7 @@ export async function composeServer(
     manager: temporalManager,
     config: temporalConfig,
     store,
+    runnerCredentials,
     logger,
   });
   // The workflow-execution twin: the same provider-is-the-injection
@@ -727,6 +876,7 @@ export async function composeServer(
   const workflowExecutionEngineState = newWorkflowExecutionEngineStateProvider({
     manager: temporalManager,
     config: workflowExecutionTemporalConfig,
+    runnerCredentials,
     logger,
   });
   // The artifact blob store (Go server.go 349: shared by agentexecution
@@ -820,6 +970,14 @@ export async function composeServer(
     );
   })();
   const skillArtifactStorage = newSkillArtifactStorage(skillStorageDriver);
+  // Plugin archives are pushed archives exactly as skills' are, so they
+  // ride the same blob driver and backend selection; the key prefix
+  // (`plugins/`) keeps the two stores apart and the plugin store owns its
+  // keys (src/archive/content-store.ts).
+  const pluginArtifactStorage = newContentAddressedArchiveStore(
+    skillStorageDriver,
+    PLUGIN_ARTIFACT_KEY_PREFIX,
+  );
   const skillTransferLane = newSkillTransferLane(
     skillUploadSlots,
     skillArtifactStorage,
@@ -886,14 +1044,10 @@ export async function composeServer(
   const searchHandler = new SearchHandler(
     searchQueryStore,
     logger,
-    extensions.drivers.listReadScope,
+    listReadScope,
   );
   // The activity recents feed (#14) — pure reads over listResources.
-  const activityHandler = new ActivityHandler(
-    store,
-    logger,
-    extensions.drivers.listReadScope,
-  );
+  const activityHandler = new ActivityHandler(store, logger, listReadScope);
   // The environment runtime-resolution service (#5) — the decrypt-for-
   // execution path the EC builder uses to resolve environment_refs (the
   // RPC surface redacts secret values, oss#405).
@@ -972,10 +1126,10 @@ export async function composeServer(
       logger,
       authorizer,
       gateSteps: extensions.gateSteps,
-      // The role lifecycle (the identity stage): the composed driver, or
-      // open source's owner-row writer under the built-in posture.
+      // The role lifecycle and the directory (the identity stage): the
+      // composed drivers, or open source's under the built-in posture.
       authorizationLifecycle: roleLifecycle,
-      organizationDirectory: extensions.drivers.organizationDirectory,
+      organizationDirectory,
     });
     // ApiKey is the first domain born AFTER the Go port (O3, 20260827.06 —
     // DD-003: the apikey contract is wholly OSS), so it has no Go
@@ -987,7 +1141,7 @@ export async function composeServer(
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     // IdentityAccount (20260911.11): served once by open source in every
     // edition over the store PORT bound in the identity-accounts stage; a
@@ -1028,7 +1182,7 @@ export async function composeServer(
       authorizer,
       secretService,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     // OAuthApp reuses the environment's SecretService instance — Go wires
     // ONE encryption service for both (server.go 302–307).
@@ -1060,7 +1214,7 @@ export async function composeServer(
       authorizer,
       authorizationLifecycle,
       parentAgentLoader: () => requireInProcess().parentAgentLoader,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerSessionServices(router, {
       store,
@@ -1071,7 +1225,7 @@ export async function composeServer(
       gateSteps: extensions.gateSteps,
       sandboxLane,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     // The sharing/channel family registers after the agent family, as in
     // Go server.go (agent 378 → agentshare 384 → agentchannel 391 →
@@ -1083,14 +1237,14 @@ export async function composeServer(
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerAgentChannelServices(router, {
       store,
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       // The SAME domain-owned registry instance the workflow validator
       // and the registry lanes read — the channel model-pin rule
       // (stigmer/stigmer#774) can never drift from the served pickers.
@@ -1124,14 +1278,14 @@ export async function composeServer(
       clock: () => scheduleSyncer,
       runner: () => scheduleRunStarter,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerMemoryServices(router, {
       store,
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       runnerCredentialProvider: runnerCredentials,
     });
     registerAgentExecutionServices(router, {
@@ -1139,7 +1293,7 @@ export async function composeServer(
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       runnerCredentialProvider: runnerCredentials,
       broker: agentExecutionStreamBroker,
       engineState: executionEngineState,
@@ -1182,14 +1336,14 @@ export async function composeServer(
       authorizer,
       authorizationLifecycle,
       parentWorkflowLoader: () => requireInProcess().parentWorkflowLoader,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
     });
     registerWorkflowExecutionServices(router, {
       store,
       logger,
       authorizer,
       authorizationLifecycle,
-      listReadScope: extensions.drivers.listReadScope,
+      listReadScope,
       gateSteps: extensions.gateSteps,
       engineState: workflowExecutionEngineState,
       broker: workflowExecutionStreamBroker,
@@ -1234,8 +1388,8 @@ export async function composeServer(
             requireInProcess().executionEnvironmentReader.getSecretValue(input),
         },
         executionContext: {
-          create: (ec) =>
-            requireInProcess().connectExecutionContextClient.create(ec),
+          create: (ec, caller) =>
+            requireInProcess().connectExecutionContextClient.create(ec, caller),
           delete: (input) =>
             requireInProcess().connectExecutionContextClient.delete(input),
         },
@@ -1263,6 +1417,22 @@ export async function composeServer(
         baseUrl: config.skillTransferBaseUrl,
       },
     });
+    // Plugins materialise their members through the in-process lane as
+    // the installing caller; the lazy provider resolves the clients built
+    // from these same routes after boot. The upload slots are the skill
+    // lane's: one upload surface for every archive.
+    registerPluginServices(router, {
+      store,
+      logger,
+      authorizer,
+      authorizationLifecycle,
+      artifactStorage: pluginArtifactStorage,
+      materializerProvider: () => requireInProcess().pluginMaterializer,
+      transferLane: {
+        slots: skillUploadSlots,
+        baseUrl: config.skillTransferBaseUrl,
+      },
+    });
     // Artifact CRUD shares the ONE blob store with agentexecution's
     // attachment lanes (Go server.go 347–374).
     registerArtifactServices(router, {
@@ -1337,12 +1507,36 @@ export async function composeServer(
   //     port the domain writes through (`identityAccounts`, the
   //     identity-accounts stage — a composed driver included), so a row
   //     provisioning creates resolves on the very next request.
-  // The runner's credential in either posture is an operator-minted API
-  // token via STIGMER_TOKEN (O3 ruling Q3) — no runner-specific verifier.
+  //   - the runner-subject verifier rides the AUTHORIZATION posture
+  //     (`built-in`, beside the Authorizer and the fire caller above): it
+  //     admits the bearer of the server's own execution-scoped runner
+  //     token as the human whose run it is, which only means something
+  //     when the server enforces who may report on a run. Its place in
+  //     the chain is the contract: BETWEEN `apikey` and `oidc`, because
+  //     the OIDC verifier claims any JWT-shaped token and throws on one
+  //     it cannot verify — composed after it, ours would never see its
+  //     own token, and every runner call would fail as the OIDC verifier's
+  //     fault (stigmer#1137). Until 2026-09-16 this comment read "the
+  //     runner's credential in either posture is an operator-minted API
+  //     token via STIGMER_TOKEN — no runner-specific verifier"; that
+  //     described a server whose Authorizer was permissive. The operator's
+  //     key is still the runner's PROCESS credential (bootstrap, registry);
+  //     the run credential is how it acts for each run. A unit with its
+  //     own Authorizer composes none of this — its credential story is its
+  //     own (the cloud's sandbox lanes).
   const identityVerifiers = [
     ...(requireAuthentication
       ? [newApiKeyIdentityVerifier({ store, accounts: identityAccounts })]
       : []),
+    ...(authorizationPosture === "built-in"
+      ? [
+          newRunnerSubjectIdentityVerifier({
+            store,
+            accounts: identityAccounts,
+            credentials: runnerCredentials,
+          }),
+        ]
+      : []),
     ...(authEnabled
       ? [
           newOidcIdentityVerifier({