@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/boot/inprocess.ts

@@ -70,6 +70,9 @@ import type {
 import type { AgentExecutionApprovalForwarder } from "../domain/workflowexecution/submit-approval.js";
 import type { AgentExecutionFileDecisionForwarder } from "../domain/workflowexecution/submit-file-decision.js";
 import type { ParentWorkflowLoader } from "../domain/workflowinstance/steps.js";
+import type { PluginMaterializer } from "../domain/plugin/materialize/ports.js";
+import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OrphanDeleter } from "../domain/project/reconcile.js";
 import type { ExecutionStatusWriter } from "../temporal/agentexecution/activities.js";
@@ -153,6 +156,17 @@ export interface InProcessClients {
    * minted — exactly like the schedule clock and the reconciler above.
    */
   readonly executionStatusWriter: ExecutionStatusWriter;
+  /**
+   * The plugin controller's materialisation edge: every member a plugin
+   * installs, upgrades, re-levels or removes goes through the owning
+   * domain's FULL chain (skill push, the three applies, updateVisibility,
+   * delete) AS THE INSTALLING CALLER (the asCaller call options), so a
+   * materialised skill is attributed to the user who installed it and
+   * carries the plugin's reserved labels by the in-process origin the
+   * guards pass structurally. The delete routing is the reconciler's
+   * switch, shared.
+   */
+  readonly pluginMaterializer: PluginMaterializer;
 }
 
 /**
@@ -318,8 +332,14 @@ export function createInProcessClients(
     executionContextCreator: {
       create: (ec) => executionContextCommand.create(ec),
     },
+    // The connect lane's ephemeral EC is created AS THE CONNECTING PERSON
+    // (ruling R5's asCaller lane): its creator stamp is what the
+    // runner-subject verifier resolves the connect token's bearer to under
+    // the built-in posture (runnerauth/bound-execution.ts). The delete
+    // stays the server's own act — the row is the lane's, whoever asked.
     connectExecutionContextClient: {
-      create: (ec) => executionContextCommand.create(ec),
+      create: (ec, caller) =>
+        executionContextCommand.create(ec, asCaller(caller)),
       delete: (input) => executionContextCommand.delete(input),
     },
     // The workflowexecution edges: the default-instance self-heal creates
@@ -378,38 +398,102 @@ export function createInProcessClients(
     // delete is attempted, in both editions. Log-only surface: reconcile
     // failures never reach the wire.
     projectOrphanDeleter: {
-      async delete(kind, resourceId) {
-        switch (kind) {
-          case ApiResourceKind.agent:
-            await agentCommand.delete(
-              create(AgentIdSchema, { value: resourceId }),
-            );
-            return;
-          case ApiResourceKind.workflow:
-            await workflowCommand.delete(
-              create(WorkflowIdSchema, { value: resourceId }),
-            );
-            return;
-          case ApiResourceKind.mcp_server:
-            // McpServer's delete input is the commons ApiResourceDeleteInput
-            // (not an id wrapper) — Go's client builds the same message.
-            await mcpServerCommand.delete(
-              create(ApiResourceDeleteInputSchema, { resourceId }),
-            );
-            return;
-          case ApiResourceKind.skill:
-            await skillCommand.delete(
-              create(SkillIdSchema, { value: resourceId }),
-            );
-            return;
-          default:
-            throw new Error(
-              `unsupported resource kind for delete: ${ApiResourceKind[kind] ?? String(kind)}`,
-            );
-        }
-      },
+      delete: (kind, resourceId) => deleteByKind(kind, resourceId),
+    },
+    pluginMaterializer: {
+      pushSkill: (request, caller) =>
+        skillCommand.push(request, asCaller(caller)),
+      applyMcpServer: (server, caller) =>
+        mcpServerCommand.apply(server, asCaller(caller)),
+      applyAgent: (agent, caller) =>
+        agentCommand.apply(agent, asCaller(caller)),
+      applyWorkflow: (workflow, caller) =>
+        workflowCommand.apply(workflow, asCaller(caller)),
+      updateVisibility: (kind, resourceId, visibility, caller) =>
+        updateVisibilityByKind(kind, resourceId, visibility, asCaller(caller)),
+      deleteByKind: (kind, resourceId, caller) =>
+        deleteByKind(kind, resourceId, asCaller(caller)),
     },
   };
 
+  /**
+   * Delete routing for the four reconciled kinds — Go's
+   * ResourceDeleterAdapter.Delete switch (execution_engine.go:75-92),
+   * shared by the project reconciler (internal class, no caller) and the
+   * plugin controller (as the installing caller). Every orphan or member
+   * delete runs the owning domain's FULL pipeline. The unsupported-kind
+   * default is defense-in-depth: both callers refuse unsupported kinds
+   * before any delete is attempted.
+   */
+  async function deleteByKind(
+    kind: ApiResourceKind,
+    resourceId: string,
+    options?: CallOptions,
+  ): Promise<void> {
+    switch (kind) {
+      case ApiResourceKind.agent:
+        await agentCommand.delete(
+          create(AgentIdSchema, { value: resourceId }),
+          options,
+        );
+        return;
+      case ApiResourceKind.workflow:
+        await workflowCommand.delete(
+          create(WorkflowIdSchema, { value: resourceId }),
+          options,
+        );
+        return;
+      case ApiResourceKind.mcp_server:
+        // McpServer's delete input is the commons ApiResourceDeleteInput
+        // (not an id wrapper) — Go's client builds the same message.
+        await mcpServerCommand.delete(
+          create(ApiResourceDeleteInputSchema, { resourceId }),
+          options,
+        );
+        return;
+      case ApiResourceKind.skill:
+        await skillCommand.delete(
+          create(SkillIdSchema, { value: resourceId }),
+          options,
+        );
+        return;
+      default:
+        throw new Error(
+          `unsupported resource kind for delete: ${ApiResourceKind[kind] ?? String(kind)}`,
+        );
+    }
+  }
+
+  /** The one door for a level change on each member kind (metadata.proto). */
+  async function updateVisibilityByKind(
+    kind: ApiResourceKind,
+    resourceId: string,
+    visibility: ApiResourceVisibility,
+    options: CallOptions,
+  ): Promise<void> {
+    const input = create(UpdateVisibilityInputSchema, {
+      resourceId,
+      visibility,
+    });
+    switch (kind) {
+      case ApiResourceKind.agent:
+        await agentCommand.updateVisibility(input, options);
+        return;
+      case ApiResourceKind.workflow:
+        await workflowCommand.updateVisibility(input, options);
+        return;
+      case ApiResourceKind.mcp_server:
+        await mcpServerCommand.updateVisibility(input, options);
+        return;
+      case ApiResourceKind.skill:
+        await skillCommand.updateVisibility(input, options);
+        return;
+      default:
+        throw new Error(
+          `unsupported resource kind for updateVisibility: ${ApiResourceKind[kind] ?? String(kind)}`,
+        );
+    }
+  }
+
   return { clients, transport };
 }

package/src/domain/agent/controller.ts

@@ -64,6 +64,7 @@ import {
   EXISTING_RESOURCE_KEY,
   newLoadExistingStep,
 } from "../../pipeline/steps/load-existing.js";
+import { newGuardPluginManagedStep } from "../../pipeline/steps/guard-plugin-managed.js";
 import {
   SHOULD_CREATE_KEY,
   newLoadForApplyStep,
@@ -216,6 +217,10 @@ async function update(
     .addStep(newValidateProtoStep())
     .addStep(newResolveSlugStep())
     .addStep(newLoadExistingStep(deps.store))
+    // A resource a plugin materialised is the plugin's to redefine; a client
+    // write is refused naming the plugin (GuardPluginManaged, keyed on the
+    // STORED labels and the plugin row's existence).
+    .addStep(newGuardPluginManagedStep(deps.store))
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
@@ -294,6 +299,7 @@ async function deleteAgent(
     .addStep(newValidateProtoStep())
     .addStep(newExtractResourceIdStep())
     .addStep(newLoadExistingForDeleteStep(deps.store, AgentSchema))
+    .addStep(newGuardPluginManagedStep(deps.store))
     .addStep(newCascadeDeleteInstancesStep(deps.store, deps.logger))
     .addStep(newCascadeDeleteSharesStep(deps.store, deps.logger))
     .addStep(newDeleteResourceStep(deps.store))
@@ -349,6 +355,11 @@ async function updateVisibility(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadAgentForVisibilityUpdateStep(deps.store))
+    .addStep(
+      newGuardPluginManagedStep(deps.store, {
+        existingKey: UPDATE_VISIBILITY_AGENT_KEY,
+      }),
+    )
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_AGENT_KEY))
     .addStep(newValidateVisibilityUpdateStep())
     .addStep(

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -36,6 +36,8 @@ import type { Client, Transport } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
 import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
 import { ExecutionContextCommandController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/command_pb";
@@ -53,6 +55,7 @@ import {
 } from "../../../encryption/encryption.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
 import { REDACTED_MARKER } from "../../environment/constants.js";
+import { newConnectExecutionId } from "../../mcpserver/connect-execution-id.js";
 import {
   DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME,
   deleteExecutionContextForExecution,
@@ -419,6 +422,107 @@ describe("executioncontext domain (encryption + runner auth enabled)", () => {
     });
   });
 
+  describe("the run credential on the decrypt lane — validity is the row's", () => {
+    // A no-`exp` token: the row is the only thing that can end it, so the
+    // lane reads the bound execution's liveness for exactly this shape and
+    // keeps the clocked arms above untouched (their ECs name no row).
+    const RUN_ID = "aex_run_credential";
+
+    async function seedRun(
+      phase: ExecutionPhase,
+      completedAt = "",
+    ): Promise<void> {
+      await ts.server.store.saveResource(
+        ApiResourceKind.agent_execution,
+        RUN_ID,
+        AgentExecutionSchema,
+        create(AgentExecutionSchema, {
+          metadata: { id: RUN_ID, name: RUN_ID, org: "test-org" },
+          status: { phase, completedAt },
+        }),
+      );
+    }
+
+    beforeAll(async () => {
+      await ts.command.create(ecInput({ executionId: RUN_ID }));
+    });
+
+    async function readRun(): Promise<ExecutionContext> {
+      const credential = ts.server.runnerAuthService.mintRunCredential(RUN_ID);
+      return await ts.query.getByExecutionId(
+        { executionId: RUN_ID },
+        { headers: bearerHeaders(credential) },
+      );
+    }
+
+    it("decrypts while the run is live", async () => {
+      await seedRun(ExecutionPhase.EXECUTION_IN_PROGRESS);
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        "super-secret-token",
+      );
+    });
+
+    it("still decrypts just after the run ended — the grace covers the writes that trail the terminal stamp", async () => {
+      await seedRun(
+        ExecutionPhase.EXECUTION_COMPLETED,
+        new Date().toISOString(),
+      );
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        "super-secret-token",
+      );
+    });
+
+    it("redacts once the run is over past the grace — a token in Temporal history cannot decrypt a finished run's secrets", async () => {
+      await seedRun(
+        ExecutionPhase.EXECUTION_COMPLETED,
+        new Date(Date.now() - 60 * 60 * 1000).toISOString(),
+      );
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        REDACTED_MARKER,
+      );
+    });
+
+    it("redacts for a terminal run that does not say when it ended — no grace without a timestamp", async () => {
+      await seedRun(ExecutionPhase.EXECUTION_FAILED);
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        REDACTED_MARKER,
+      );
+    });
+
+    it("redacts when the credential names a run this server does not have", async () => {
+      const orphan = "aex_no_such_run";
+      await ts.command.create(ecInput({ executionId: orphan }));
+      const credential = ts.server.runnerAuthService.mintRunCredential(orphan);
+      const ec = await ts.query.getByExecutionId(
+        { executionId: orphan },
+        { headers: bearerHeaders(credential) },
+      );
+      expect(ec.spec!.data["API_TOKEN"]!.value).toBe(REDACTED_MARKER);
+    });
+
+    it("redacts for a clockless token bound to a connect's EC — a connect is not a run, and no mint produces that shape (the verifier refuses it through the same predicate)", async () => {
+      const connectId = newConnectExecutionId("mcps_conn");
+      await ts.command.create(ecInput({ executionId: connectId }));
+      const clockless =
+        ts.server.runnerAuthService.mintRunCredential(connectId);
+      const redacted = await ts.query.getByExecutionId(
+        { executionId: connectId },
+        { headers: bearerHeaders(clockless) },
+      );
+      expect(redacted.spec!.data["API_TOKEN"]!.value).toBe(REDACTED_MARKER);
+      // The connect lane's own CLOCKED token keeps decrypting the same EC:
+      // the clocked arms above are untouched by the run-credential rule.
+      const clocked = ts.server.runnerAuthService.mint(connectId, 300).token;
+      const decrypted = await ts.query.getByExecutionId(
+        { executionId: connectId },
+        { headers: bearerHeaders(clocked) },
+      );
+      expect(decrypted.spec!.data["API_TOKEN"]!.value).toBe(
+        "super-secret-token",
+      );
+    });
+  });
+
   describe("decrypt error doctrine", () => {
     it("tampered stored ciphertext drops the ONE key while the read succeeds; intact keys decrypt", async () => {
       const created = await ts.command.create(

package/src/domain/executioncontext/__tests__/resolve-values-capability.test.ts

@@ -19,6 +19,7 @@ import {
   EncryptionScope,
   SecretService,
 } from "../../../encryption/encryption.js";
+import type { BoundExecutionStore } from "../../../runnerauth/bound-execution.js";
 import { InvalidTokenError } from "../../../runnerauth/runnerauth.js";
 import type { RunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
 import { resolveValuesForCaller } from "../resolve-values-for-caller.js";
@@ -31,6 +32,14 @@ const silentLogger = createLogger({
 
 const secretService = SecretService.create(Buffer.alloc(32, 7));
 
+/** The capability arm never reads the store — a store that proves it. */
+const store: BoundExecutionStore = {
+  getResource: () =>
+    Promise.reject(new Error("the capability arm must not read the store")),
+  findByField: () =>
+    Promise.reject(new Error("the capability arm must not read the store")),
+};
+
 /** A minimal HandlerContext: the resolve path reads only the auth header. */
 function ctxWithBearer(token: string): HandlerContext {
   const headers = new Headers();
@@ -84,7 +93,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     const provider = providerWith(async () => true);
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer("sandbox-token"),
       ec,
     );
@@ -96,7 +110,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     const provider = providerWith(async () => false);
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer("someone-elses-token"),
       ec,
     );
@@ -107,7 +126,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     const provider = providerWith(async () => true);
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer(""),
       ec,
     );
@@ -121,7 +145,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     });
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer("sandbox-token"),
       ec,
     );

package/src/domain/executioncontext/resolve-values-for-caller.ts

@@ -14,21 +14,37 @@
  * distinguishes itself with an execution-scoped token minted by
  * getRunnerScopedToken and presented as a Bearer authorization header
  * (the same header shape a cloud runner uses for its sandbox credential).
- * Decrypt requires the FULL binding: a valid, unexpired token whose
- * execution_id claim equals this EC's spec.execution_id. Everything else
- * — no header, malformed or expired token, or a token minted for a
- * different execution — falls closed to the same redaction
- * get/getByReference apply, as a SUCCESSFUL response, not an error.
+ * Decrypt requires the FULL binding: a valid token whose execution_id
+ * claim equals this EC's spec.execution_id, and — for a RUN credential,
+ * the no-`exp` token the dispatch path hands the runner — a bound
+ * execution that is still live (runnerauth/bound-execution.ts: not
+ * terminal, or ended within the grace). Everything else — no header, a
+ * malformed or expired token, a token minted for a different execution,
+ * a run credential whose run is over — falls closed to the same
+ * redaction get/getByReference apply, as a SUCCESSFUL response, not an
+ * error.
  *
- * Token verification lives HERE, in the domain, not on the identity
- * chassis (O2, 20260827.01): the runner token is a lane discriminator,
- * not a caller identity — the chassis deliberately lets it fall through
- * to the trusted-local identity (ruling Q6), and this is the one RPC
- * that reads the raw header — exactly the consumer the runnerauth module
- * header reserves ("the executioncontext resolve step"). The
- * redaction-as-success contract is pinned by the conformance suites and
- * must survive every future verifier: a runner token is NEVER an
- * authentication credential.
+ * The decrypt decision lives HERE, in the domain, whatever the identity
+ * chassis makes of the token. Under trusted-local no verifier claims it
+ * and this is the one RPC that reads the raw header (the consumer the
+ * runnerauth module header reserves, "the executioncontext resolve
+ * step"). Under the built-in authorization posture the runner-subject
+ * verifier ALSO admits the same token as the run's human at position 1
+ * (runnerauth.ts header, 2026-09-16) — that decides WHO is calling and
+ * whether they may read the row; whether the row's secrets are decrypted
+ * for them is still this lane's binding check, so a person who can view
+ * an execution's context never receives its plaintext by holding a
+ * credential for a different one. The redaction-as-success contract is
+ * pinned by the conformance suites and holds on every arm.
+ *
+ * Why liveness is read only for a no-`exp` token: a clocked token's
+ * validity was decided by `verify` (its clock) and its binding, and the
+ * ExecutionContext it opens need not name an execution row at all — the
+ * connect lane's token opens an EC for an MCP discovery, and the rosters
+ * pin a clocked token decrypting an EC whose execution id names no row.
+ * A run credential has no clock; the row is the only thing that can end
+ * it, and a plaintext token in Temporal history must not decrypt a
+ * finished run's secrets for good.
  *
  * # Decrypt error doctrine (the oss#405 runtime-resolution doctrine,
  * # arms per the two-armed taxonomy in encryption/errors.ts)
@@ -56,8 +72,16 @@ import { EncryptionUnavailableError } from "../../encryption/encryption.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { internalError } from "../../pipeline/errors.js";
 import { parseBearerToken } from "../../pipeline/interceptors/auth.js";
+import {
+  bindsARun,
+  loadBoundExecution,
+} from "../../runnerauth/bound-execution.js";
+import type { BoundExecutionStore } from "../../runnerauth/bound-execution.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
-import { TOKEN_TYPE_EXECUTION_SCOPED } from "../../runnerauth/runnerauth.js";
+import {
+  isClockedToken,
+  TOKEN_TYPE_EXECUTION_SCOPED,
+} from "../../runnerauth/runnerauth.js";
 import { encryptionKeyMissingMessage } from "./constants.js";
 import { redactExecutionContextSecrets } from "./redact.js";
 
@@ -65,6 +89,8 @@ export interface ResolveValuesDeps {
   readonly logger: Logger;
   readonly secretService: SecretService;
   readonly runnerAuthService: RunnerCredentialProvider;
+  /** Where the bound execution lives — read for a run credential's liveness only. */
+  readonly store: BoundExecutionStore;
 }
 
 /**
@@ -123,15 +149,23 @@ async function runnerMayDecrypt(
     }
   }
 
-  const executionId = verifyRunnerToken(deps, ctx, ec);
-  if (executionId !== undefined) {
+  const token = bearerToken(ctx);
+  const executionId = verifyRunnerToken(deps, token, ec);
+  if (executionId === undefined) {
+    return false;
+  }
+  if (!isClockedToken(token) && !(await runIsLive(deps, executionId))) {
     deps.logger.debug(
-      "Scope-bound runner token presented - decrypting execution context secrets",
+      "Run credential presented for a run that is over - redacting execution context secrets",
       { executionId },
     );
-    return true;
+    return false;
   }
-  return false;
+  deps.logger.debug(
+    "Scope-bound runner token presented - decrypting execution context secrets",
+    { executionId },
+  );
+  return true;
 }
 
 /**
@@ -148,10 +182,9 @@ async function runnerMayDecrypt(
  */
 function verifyRunnerToken(
   deps: ResolveValuesDeps,
-  ctx: HandlerContext,
+  token: string,
   ec: ExecutionContext,
 ): string | undefined {
-  const token = bearerToken(ctx);
   if (token === "") {
     return undefined;
   }
@@ -183,6 +216,30 @@ function verifyRunnerToken(
   return tokenExecutionId;
 }
 
+/**
+ * A run credential's liveness: the bound execution exists, IS a run
+ * (`bindsARun` — a clockless token bound to a connect is a shape no mint
+ * produces, refused here and by the verifier through the one predicate)
+ * and is live (runnerauth/bound-execution.ts). A missing row is "not
+ * live" — the credential opens nothing. A store fault is an
+ * infrastructure fault, sanitized here as every direct handler does (the
+ * store-fault doctrine): an outage must not read as a redaction decision,
+ * and the same store just served the row this read is for.
+ */
+async function runIsLive(
+  deps: ResolveValuesDeps,
+  executionId: string,
+): Promise<boolean> {
+  try {
+    const execution = await loadBoundExecution(deps.store, executionId);
+    return (
+      execution !== undefined && bindsARun(execution.kind) && execution.live
+    );
+  } catch (error) {
+    throw internalError(error, "failed to load the run credential's execution");
+  }
+}
+
 /**
  * The Bearer credential from the request's authorization header; empty
  * when absent or differently shaped. The parsing shape (Go's exact