@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/domain/iampolicy/membership.ts

@@ -7,7 +7,8 @@
  * no unit registered an Authorizer); a composition with its own
  * Authorizer has its own onboarding and never constructs this.
  *
- * Two moments:
+ * Three moments, one set of arms (`roleFor`, the pure function the first
+ * and third share):
  *
  *   onAccountCreated(account, caller) — a person's FIRST provisioning, and
  *   only that (the identity-account domain's AccountCreatedHook, run by
@@ -50,6 +51,30 @@
  *   email and name — so its audit actor reads like every other write on
  *   that laptop.
  *
+ *   ensureRolesForExistingAccounts() — the built-in posture's boot
+ *   reconciliation, ONCE per database. The first moment runs only on the
+ *   call that CREATES an account, so a self-host whose people were
+ *   provisioned before the rules existed (3.15.x with OIDC on) holds
+ *   accounts with no role rows, and under an enforcing authorizer every
+ *   one of them would be an outsider on every organization with nobody
+ *   able to grant a way back. At the first boot where the bootstrap-state
+ *   marker (ROLES_RECONCILED_KEY) is absent, the arms above run for every
+ *   PERSON account (`isPersonAccount`: not a machine account, the row-
+ *   level twin of the `user`-class gate), acting as that account, in
+ *   creation order — the order the sign-ins would have run the hook in,
+ *   so arm 4 hands an unclaimed organization to its first sign-in and
+ *   not to whoever sorts first by id — and the marker is written after
+ *   the last account. A fault propagates and the boot fails loudly (the
+ *   storage stage's posture) with the marker unset; the grant path is
+ *   idempotent and an organization already held is skipped, so the next
+ *   boot converges. The marker, not "zero rows", is what makes it
+ *   one-shot: a database whose every role was revoked after the marker is
+ *   never handed back to anyone by a reboot (plan finding 2's reason,
+ *   applied to the whole store). Accounts are read through the generic
+ *   Store as the organizations and blueprints are (Q-S4-5) — the account
+ *   port carries no enumeration, by its own rule that a port does not
+ *   carry a method only one edition calls, and this act is open source's.
+ *
  * What a creator stamp is. The rules read `status.audit.spec_audit
  * .created_by.id` off organizations and blueprints. That stamp is the
  * caller's identityId at the time: a provisioned caller's ACCOUNT id, an
@@ -92,6 +117,8 @@ import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb"
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
@@ -101,8 +128,10 @@ import { SYSTEM_OPERATOR_IDENTITY_ID } from "../../pipeline/interceptors/auth.js
 import { auditOf } from "../../pipeline/steps/defaults.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
 import type { Store } from "../../store/interface.js";
+import { rfc3339Seconds } from "../../store/rfc3339.js";
+import { accountAsCaller } from "../identityaccount/actor.js";
 import type { AccountCreatedHook } from "../identityaccount/provisioning.js";
-import { BLUEPRINT_KINDS } from "./constants.js";
+import { BLUEPRINT_KINDS, ROLES_RECONCILED_KEY } from "./constants.js";
 import type { IamPolicyGrantPath } from "./grant-path.js";
 import { organizationRole, relationOf } from "./specs.js";
 import type { IamPolicyStore } from "./store.js";
@@ -119,6 +148,8 @@ export interface MembershipRulesDeps {
 export interface MembershipRules extends AccountCreatedHook {
   /** The trusted-local boot ensure: `owner` wherever no owner row exists. */
   ensureOperatorOwnership(operator: IdentityAccount): Promise<void>;
+  /** The built-in posture's boot reconciliation: the arms for every person provisioned before the rules existed, once per database. */
+  ensureRolesForExistingAccounts(): Promise<void>;
 }
 
 /**
@@ -142,17 +173,106 @@ const ORGANIZATION = kindEnumName(ApiResourceKind.organization);
 const IDENTITY_ACCOUNT = kindEnumName(ApiResourceKind.identity_account);
 
 /** What the scan keeps of a resource: its id, its organization (blueprints), its creator stamp. */
-interface ScannedResource {
+export interface ScannedResource {
   readonly id: string;
   readonly org: string;
   readonly createdBy: string;
 }
 
-/** A creator stamp that names a person: non-empty and not the unconfigured laptop's placeholder. */
-function isPersonStamp(stamp: string): boolean {
+/**
+ * A creator stamp that names a person: non-empty and not the unconfigured
+ * laptop's placeholder. Exported for the built-in authorizer's derivation
+ * (authorization/derived-tuples.ts), which turns a stamp into an owner or
+ * creator tuple only when this says the stamp is somebody's — the one
+ * predicate, read from the module that owns the doctrine above.
+ */
+export function isPersonStamp(stamp: string): boolean {
   return stamp !== "" && stamp !== SYSTEM_OPERATOR_IDENTITY_ID;
 }
 
+/**
+ * An account row that is a person's — the row-level twin of the hook's
+ * `user`-class gate, for the reconciliation, which has a row and no
+ * caller. A machine account (`is_machine_account`, or the `machine`
+ * provisioning mode) earns no role, exactly as a `machine`-class caller
+ * earns none at the hook.
+ */
+export function isPersonAccount(account: IdentityAccount): boolean {
+  const spec = account.spec;
+  return (
+    spec !== undefined &&
+    !spec.isMachineAccount &&
+    spec.provisioningMode !== IdentityAccountProvisioningMode.machine
+  );
+}
+
+/** One organization's question for one account: everything the five arms read, resolved by the caller. */
+export interface RoleQuestion {
+  readonly accountId: string;
+  /** The account's issuer subject (`spec.idp_id`); a stamp equal to it is the account's own (the alias rule). */
+  readonly subject: string;
+  readonly email: string;
+  /** STIGMER_OPERATOR_EMAIL as configured; "" matches nobody. */
+  readonly operatorEmail: string;
+  readonly organization: ScannedResource;
+  readonly blueprintsInOrganization: ReadonlyArray<ScannedResource>;
+  /** Whether ANY role row exists on the organization — arm 4's "zero rows", read by the caller through the port. */
+  readonly organizationHasRows: boolean;
+}
+
+/**
+ * The five arms in their ruled order, as one pure function over what they
+ * read — the one statement of "which role does this person get here",
+ * shared by the first-sign-in hook and the boot reconciliation so the two
+ * moments cannot drift. Arms 3 and 4 both answer `admin`; 3 comes first
+ * because it is a string compare and 4 needs the rows read.
+ */
+export function roleFor(question: RoleQuestion): IamRole {
+  const {
+    accountId,
+    subject,
+    email,
+    operatorEmail,
+    organization,
+    blueprintsInOrganization,
+    organizationHasRows,
+  } = question;
+  const isMine = (stamp: string): boolean =>
+    stamp !== "" && (stamp === subject || stamp === accountId);
+  if (isMine(organization.createdBy)) {
+    return IamRole.owner;
+  }
+  if (blueprintsInOrganization.some((b) => isMine(b.createdBy))) {
+    return IamRole.admin;
+  }
+  if (operatorEmail !== "" && email === operatorEmail) {
+    return IamRole.admin;
+  }
+  const anotherPersonStamped = [
+    organization.createdBy,
+    ...blueprintsInOrganization.map((b) => b.createdBy),
+  ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp));
+  if (!anotherPersonStamped && !organizationHasRows) {
+    return IamRole.admin;
+  }
+  return IamRole.member;
+}
+
+/** The world one pass of the arms reads: scanned ONCE by the caller, whether for one account or for all. */
+interface ScannedWorld {
+  readonly organizations: ReadonlyArray<ScannedResource>;
+  readonly blueprints: ReadonlyArray<ScannedResource>;
+}
+
+/** `spec_audit.created_at` in epoch milliseconds; a row with no stamp sorts first (it is the oldest thing we know nothing about). */
+function createdAtMillisOf(account: IdentityAccount): number {
+  const stamp = account.status?.audit?.specAudit?.createdAt;
+  if (stamp === undefined) {
+    return Number.NEGATIVE_INFINITY;
+  }
+  return Number(stamp.seconds) * 1000 + Math.floor(stamp.nanos / 1_000_000);
+}
+
 export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
   const { grantPath, policies, store, operatorEmail } = deps;
 
@@ -195,13 +315,79 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
     );
   }
 
+  /** The whole world one pass reads, scanned once: every organization and every blueprint. */
+  async function scanWorld(): Promise<ScannedWorld> {
+    return {
+      organizations: await scan(ApiResourceKind.organization),
+      blueprints: await scanBlueprints(),
+    };
+  }
+
+  /**
+   * The arms for ONE account over a scanned world: a row on every
+   * organization the account holds none on, granted as `caller`. Shared
+   * by the hook (one account, the world scanned for it) and the
+   * reconciliation (the world scanned once for every account).
+   */
+  async function applyRulesTo(
+    account: IdentityAccount,
+    caller: CallerIdentity,
+    world: ScannedWorld,
+  ): Promise<void> {
+    const accountId = account.metadata?.id ?? "";
+    if (accountId === "") {
+      throw new Error("membership rules: the account carries no id");
+    }
+    const subject = account.spec?.idpId ?? "";
+    const email = account.spec?.email ?? "";
+    const held = await organizationsHeldBy(accountId);
+
+    for (const organization of world.organizations) {
+      if (held.has(organization.id)) {
+        continue;
+      }
+      const blueprintsInOrganization = world.blueprints.filter(
+        (blueprint) => blueprint.org === organization.id,
+      );
+      const role = roleFor({
+        accountId,
+        subject,
+        email,
+        operatorEmail,
+        organization,
+        blueprintsInOrganization,
+        organizationHasRows:
+          (await policies.findByResource(ORGANIZATION, organization.id))
+            .length > 0,
+      });
+      await grantPath.grant(
+        organizationRole(accountId, role, organization.id),
+        caller,
+      );
+    }
+  }
+
+  /** Every person account the store holds, oldest first (creation stamp, then id) — the order their sign-ins ran in. */
+  async function scanPersonAccounts(): Promise<IdentityAccount[]> {
+    const rows = await store.listResources(ApiResourceKind.identity_account);
+    return rows
+      .map((bytes) => fromBinary(IdentityAccountSchema, bytes))
+      .filter(isPersonAccount)
+      .sort((a, b) => {
+        const byCreation = createdAtMillisOf(a) - createdAtMillisOf(b);
+        if (byCreation !== 0) {
+          return byCreation;
+        }
+        return (a.metadata?.id ?? "").localeCompare(b.metadata?.id ?? "");
+      });
+  }
+
   return {
     async onAccountCreated(account, caller): Promise<void> {
       if (caller.callerClass !== "user") {
         return;
       }
-      const accountId = account.metadata?.id ?? "";
-      if (accountId === "") {
+      if ((account.metadata?.id ?? "") === "") {
         throw new Error(
           "membership rules: the provisioned account carries no id",
         );
@@ -210,44 +396,33 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
       if (organizations.length === 0) {
         return;
       }
-      const subject = account.spec?.idpId ?? "";
-      const email = account.spec?.email ?? "";
-      const isMine = (stamp: string): boolean =>
-        stamp !== "" && (stamp === subject || stamp === accountId);
-      const held = await organizationsHeldBy(accountId);
-      const blueprints = await scanBlueprints();
+      await applyRulesTo(account, caller, {
+        organizations,
+        blueprints: await scanBlueprints(),
+      });
+    },
 
-      for (const organization of organizations) {
-        if (held.has(organization.id)) {
-          continue;
-        }
-        const inOrganization = blueprints.filter(
-          (blueprint) => blueprint.org === organization.id,
-        );
-        let role: IamRole;
-        if (isMine(organization.createdBy)) {
-          role = IamRole.owner;
-        } else if (inOrganization.some((b) => isMine(b.createdBy))) {
-          role = IamRole.admin;
-        } else if (operatorEmail !== "" && email === operatorEmail) {
-          role = IamRole.admin;
-        } else if (
-          ![
-            organization.createdBy,
-            ...inOrganization.map((b) => b.createdBy),
-          ].some((stamp) => isPersonStamp(stamp) && !isMine(stamp)) &&
-          (await policies.findByResource(ORGANIZATION, organization.id))
-            .length === 0
-        ) {
-          role = IamRole.admin;
-        } else {
-          role = IamRole.member;
+    async ensureRolesForExistingAccounts(): Promise<void> {
+      if ((await store.bootstrapState.get(ROLES_RECONCILED_KEY)) !== "") {
+        return;
+      }
+      const accounts = await scanPersonAccounts();
+      if (accounts.length > 0) {
+        const world = await scanWorld();
+        for (const account of accounts) {
+          // As the account itself (actor.ts, the one construction), so the
+          // row's audit actor reads exactly as the person's own first
+          // sign-in would have stamped it.
+          await applyRulesTo(account, accountAsCaller(account), world);
         }
-        await grantPath.grant(
-          organizationRole(accountId, role, organization.id),
-          caller,
-        );
       }
+      // After the last account, never before: a fault above leaves the
+      // marker unset and the next boot converges (the grant path is
+      // idempotent; an organization already held is skipped).
+      await store.bootstrapState.set(
+        ROLES_RECONCILED_KEY,
+        rfc3339Seconds(new Date()),
+      );
     },
 
     async ensureOperatorOwnership(operator): Promise<void> {
@@ -255,7 +430,10 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
       if (accountId === "") {
         throw new Error("membership rules: the operator account carries no id");
       }
-      const actor = operatorActor(operator, accountId);
+      // The operator acting as its account (domain/identityaccount/actor.ts,
+      // the one construction): the row's audit actor is the account,
+      // named the way every other trusted-local write names it.
+      const actor = accountAsCaller(operator);
       for (const organization of await scan(ApiResourceKind.organization)) {
         const owners = await policies.findByResourceWithRelations(
           ORGANIZATION,
@@ -273,26 +451,3 @@ export function newMembershipRules(deps: MembershipRulesDeps): MembershipRules {
     },
   };
 }
-
-/**
- * The operator acting as its account: the trusted-local identity shape
- * (pipeline/interceptors/auth.ts trustedLocalIdentityFor — no issuer, no
- * token; email and display name only when known) with the account id as
- * the principal, so the row's audit actor is the account, named the way
- * every other trusted-local write names it.
- */
-function operatorActor(
-  operator: IdentityAccount,
-  accountId: string,
-): CallerIdentity {
-  const email = operator.spec?.email ?? "";
-  const displayName = operator.metadata?.name ?? "";
-  return {
-    identityId: accountId,
-    callerClass: "user",
-    issuer: "",
-    rawToken: "",
-    ...(email !== "" ? { email } : {}),
-    ...(displayName !== "" ? { displayName } : {}),
-  };
-}

package/src/domain/identityaccount/__tests__/account-for-stamp.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Pins `accountForStamp` (resolve.ts): the account a row's CREATOR STAMP
+ * names, read the two ways a stamp has been written — as an account id
+ * (rows stamped since 3.15.0) and as the raw issuer subject (rows the
+ * 3.14.x verifiers stamped) — stated ONCE so the schedule fire caller and
+ * the runner-subject verifier, which both make a server lane act as the
+ * person a row names, cannot resolve the same stamp two ways. The read
+ * order is `accountForCaller`'s: by id first, then the direct subject
+ * lookup.
+ *
+ *   - an account-id stamp resolves by that id;
+ *   - a raw-subject stamp resolves through the direct lookup;
+ *   - the empty stamp is `undefined` with NO read — the store is never
+ *     asked about "";
+ *   - a stamp naming nobody (the laptop's `"system"`, a trusted-local
+ *     email, a deleted account) is `undefined` — the CALLER decides what
+ *     that means (the fire caller's deterministic refusal; the verifier's
+ *     liveness sentence); this function never throws for it;
+ *   - a store fault propagates as the same error object.
+ *
+ * Written failing on 2026-09-16, before the export exists; the change that follows
+ * extracts it from the fire caller's inline read (extract, do not copy).
+ */
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it, vi } from "vitest";
+
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import { accountIdFor } from "../constants.js";
+import { accountForStamp } from "../resolve.js";
+import type { AccountsByCaller } from "../resolve.js";
+import { fakeIdentityAccountStore } from "./support.js";
+
+const SUBJECT = "auth0|carol";
+const CAROL = accountIdFor(SUBJECT);
+
+function seeded() {
+  const accounts = fakeIdentityAccountStore();
+  accounts.rows.set(
+    CAROL,
+    create(IdentityAccountSchema, {
+      metadata: { id: CAROL, name: "Carol Danvers" },
+      spec: {
+        idpId: SUBJECT,
+        email: "carol@example.com",
+        provisioningMode: IdentityAccountProvisioningMode.direct,
+      },
+    }),
+  );
+  return accounts;
+}
+
+describe("accountForStamp", () => {
+  it("an account-id stamp resolves by that id", async () => {
+    const account = await accountForStamp(seeded(), CAROL);
+    expect(account?.metadata?.id).toBe(CAROL);
+    expect(account?.spec?.email).toBe("carol@example.com");
+  });
+
+  it("a raw-subject stamp (the 3.14.x shape) resolves through the direct lookup to the same account", async () => {
+    expect((await accountForStamp(seeded(), SUBJECT))?.metadata?.id).toBe(
+      CAROL,
+    );
+  });
+
+  it('the empty stamp is undefined with NO read — the store is never asked about ""', async () => {
+    const findById = vi.fn(async () => undefined);
+    const findDirectByIdpId = vi.fn(async () => undefined);
+    const accounts: AccountsByCaller = { findById, findDirectByIdpId };
+    expect(await accountForStamp(accounts, "")).toBeUndefined();
+    expect(findById).not.toHaveBeenCalled();
+    expect(findDirectByIdpId).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["the laptop's placeholder", "system"],
+    ["a trusted-local email stamp", "operator@example.com"],
+    ["a deleted account", accountIdFor("auth0|gone")],
+  ])(
+    "%s is undefined — the caller decides what nobody means",
+    async (_label, stamp) => {
+      expect(await accountForStamp(seeded(), stamp)).toBeUndefined();
+    },
+  );
+
+  it("reads by id first, then by subject — two primary-key reads at most, in accountForCaller's order", async () => {
+    const calls: string[] = [];
+    const accounts: AccountsByCaller = {
+      findById: async (id) => {
+        calls.push(`id:${id}`);
+        return undefined;
+      },
+      findDirectByIdpId: async (idpId) => {
+        calls.push(`sub:${idpId}`);
+        return undefined;
+      },
+    };
+    await accountForStamp(accounts, SUBJECT);
+    expect(calls).toEqual([`id:${SUBJECT}`, `sub:${SUBJECT}`]);
+  });
+
+  it("a store fault propagates as the same error object, never a credential rejection", async () => {
+    const fault = new Error("connection reset");
+    const accounts: AccountsByCaller = {
+      findById: () => Promise.reject(fault),
+      findDirectByIdpId: async () => undefined,
+    };
+    await expect(accountForStamp(accounts, CAROL)).rejects.toBe(fault);
+  });
+});

package/src/domain/identityaccount/actor.ts

@@ -0,0 +1,84 @@
+/**
+ * An account acting as itself — the ONE place server code builds the
+ * caller identity for a person it has resolved from a row rather than
+ * from the token that person presented. Two constructions, one shape:
+ * the account id is the principal, so the audit actor on every write
+ * names the account the way every other write names it, and email and
+ * display name ride along when the row knows them (the trusted-local
+ * identity's shape, pipeline/interceptors/auth.ts).
+ *
+ * `accountAsCaller(account)` — the IN-PROCESS lane: no issuer, no token,
+ * class `user`. Two consumers: the trusted-local boot ensure, which
+ * grants the operator ownership AS their account
+ * (domain/iampolicy/membership.ts), and the built-in schedule fire
+ * caller, which makes a fire act as the schedule's creator
+ * (authorization/schedule-fire-caller.ts). Both ride the in-process
+ * transport, whose interceptor stamps `origin: "in-process"` on top —
+ * the transport-trust marker is never set here.
+ *
+ * `accountAsRunnerCaller(account, rawToken)` — the WIRE lane: the
+ * runner-subject verifier (runnerauth/runner-subject-verifier.ts) admits
+ * the bearer of a run credential as the human whose run it is. Class
+ * `runner`, because the Authorizer's lane admission and the memory
+ * capture gate must tell a runner acting as a person from the person
+ * (extensions/identity.ts names the class for exactly this), and the
+ * verified token carried, because the provider's capabilities re-read the
+ * binding off `rawToken` (the cloud's own pattern) — one HMAC, no store
+ * read. No issuer: the server signed it.
+ *
+ * Why not a token for the in-process lane: open source mints no
+ * credential for a person the server is composing a request for; the
+ * identity is what the propagation header carries, and every consumer
+ * that reads a subject off the raw token (`idpIdOf`) is reached only
+ * through `accountForCaller`, which resolves this identity by its id
+ * first and never asks the token. The same holds for the runner lane:
+ * our token carries no `sub`, and nothing downstream needs one.
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+
+import type { CallerIdentity } from "../../extensions/identity.js";
+
+export function accountAsCaller(account: IdentityAccount): CallerIdentity {
+  return {
+    ...principalOf(account),
+    callerClass: "user",
+    issuer: "",
+    rawToken: "",
+  };
+}
+
+export function accountAsRunnerCaller(
+  account: IdentityAccount,
+  rawToken: string,
+): CallerIdentity {
+  if (rawToken === "") {
+    throw new Error(
+      "a runner caller carries the credential it presented — refusing to build one with none",
+    );
+  }
+  return {
+    ...principalOf(account),
+    callerClass: "runner",
+    issuer: "",
+    rawToken,
+  };
+}
+
+/** The account id as principal, with the display identity the row knows. */
+function principalOf(
+  account: IdentityAccount,
+): Pick<CallerIdentity, "identityId" | "email" | "displayName"> {
+  const accountId = account.metadata?.id ?? "";
+  if (accountId === "") {
+    throw new Error(
+      "identity account carries no id — refusing to build a caller for an empty principal",
+    );
+  }
+  const email = account.spec?.email ?? "";
+  const displayName = account.metadata?.name ?? "";
+  return {
+    identityId: accountId,
+    ...(email !== "" ? { email } : {}),
+    ...(displayName !== "" ? { displayName } : {}),
+  };
+}

package/src/domain/identityaccount/resolve.ts

@@ -41,6 +41,19 @@
  * cannot answer the same question two ways. A credential naming no
  * subject is `undefined` with no second read: the store is never asked
  * about "".
+ *
+ * The third reading is a ROW's creator stamp, `accountForStamp`: the
+ * account a `created_by.id` names, read the two ways a stamp has been
+ * written — as an account id (rows stamped since 3.15.0) and as the raw
+ * issuer subject (rows the 3.14.x verifiers stamped) — in
+ * `accountForCaller`'s order. Two lanes make the server act as the
+ * person a row names: the built-in schedule fire caller (a fire acts as
+ * the schedule's creator) and the runner-subject verifier (a run
+ * credential admits its bearer as the execution's creator). Stated here
+ * so they cannot resolve one stamp two ways; each decides for itself
+ * what "nobody" means (the fire caller's deterministic refusal, the
+ * verifier's liveness sentence), so this function answers `undefined`
+ * and never throws for it. The empty stamp is `undefined` with no read.
  */
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 
@@ -93,3 +106,21 @@ export async function accountForCaller(
   }
   return accounts.findDirectByIdpId(subject);
 }
+
+/**
+ * The account a row's creator stamp names, or `undefined` when it names
+ * nobody (the laptop's `"system"`, a trusted-local email, a deleted
+ * account, the empty stamp). Faults propagate as they are.
+ */
+export async function accountForStamp(
+  accounts: AccountsByCaller,
+  stamp: string,
+): Promise<IdentityAccount | undefined> {
+  if (stamp === "") {
+    return undefined;
+  }
+  return (
+    (await accounts.findById(stamp)) ??
+    (await accounts.findDirectByIdpId(stamp))
+  );
+}

package/src/domain/mcpserver/__tests__/connect.test.ts

@@ -28,6 +28,7 @@ import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/execu
 
 import { createLogger } from "../../../boot/logger.js";
 import { SecretService } from "../../../encryption/encryption.js";
+import type { CallerIdentity } from "../../../extensions/identity.js";
 import { newExecutionScopedRunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
 import { RunnerAuthService } from "../../../runnerauth/runnerauth.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
@@ -41,6 +42,7 @@ import {
   startBestEffortConnect,
 } from "../connect.js";
 import type { McpServerConnectDeps } from "../connect.js";
+import { isConnectExecutionId } from "../connect-execution-id.js";
 import { ManagedEnvironmentService } from "../oauth/managed-env.js";
 import {
   RUNNER_QUEUE_WARNING,
@@ -115,6 +117,8 @@ interface Harness {
   deps: McpServerConnectDeps;
   engine: FakeEngine;
   ecCreates: number;
+  /** The caller each EC create was handed — the connect's person, never the server (the mcp-connect binding's stamp). */
+  ecCreators: CallerIdentity[];
   ecDeletes: string[];
 }
 
@@ -150,6 +154,7 @@ function makeHarness(options: FakeEngineOptions = {}): Harness {
   const harness: Harness = {
     engine,
     ecCreates: 0,
+    ecCreators: [],
     ecDeletes: [],
     deps: {
       store,
@@ -165,8 +170,9 @@ function makeHarness(options: FakeEngineOptions = {}): Harness {
         },
       },
       executionContext: {
-        create: async () => {
+        create: async (_ec, caller) => {
           harness.ecCreates += 1;
+          harness.ecCreators.push(caller);
           return create(ExecutionContextSchema, {
             metadata: { id: `ectx_${harness.ecCreates}` },
           });
@@ -356,7 +362,7 @@ describe("connect (blocking lane)", () => {
     expect(second.status?.toolApprovals[0]?.toolName).toBe("search");
   });
 
-  it("creates the ephemeral EC from runtime_env, mints the decrypt token, and deletes the EC after settle", async () => {
+  it("creates the ephemeral EC from runtime_env AS THE CALLER, mints the decrypt token, and deletes the EC after settle", async () => {
     const harness = makeHarness();
     const server = await seedServer();
     await connect(
@@ -366,9 +372,16 @@ describe("connect (blocking lane)", () => {
       }),
     );
     expect(harness.ecCreates).toBe(1);
+    // The row's creator stamp is the connect token's person under the
+    // built-in posture (runnerauth/bound-execution.ts), so the connect
+    // hands the client the caller, never the server's own identity.
+    expect(harness.ecCreators).toEqual([testCaller]);
     expect(harness.ecDeletes).toEqual(["ectx_1"]);
     const input = harness.engine.startedInputs[0];
     expect(input?.execution_context_id).toMatch(/^connect-mcps_test_/);
+    // The id is the one shape the runner-credential lane recognizes as a
+    // connect binding — builder and predicate share one module.
+    expect(isConnectExecutionId(input?.execution_context_id ?? "")).toBe(true);
     // oss#535: the decrypt-lane token rides the payload.
     expect(input?.execution_context_token).toBeTruthy();
   });
@@ -584,6 +597,8 @@ describe("startConnect (async lane)", () => {
     );
     expect(result.metadata?.id).toBe(server.metadata!.id);
     expect(harness.ecCreates).toBe(1);
+    // The async lane creates the EC as the caller too — one prepareConnect.
+    expect(harness.ecCreators).toEqual([testCaller]);
     await vi.waitFor(() => expect(harness.ecDeletes).toEqual(["ectx_1"]));
   });
 });