@stigmer/server 3.15.3-dev.20260916211208 → 3.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.15.3-dev.20260916211208",
+  "version": "3.16.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,10 +62,10 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/plugin-package": "3.15.3-dev.20260916211208",
-    "@stigmer/protos": "3.15.3-dev.20260916211208",
-    "@stigmer/temporal-codecs": "3.15.3-dev.20260916211208",
-    "@stigmer/zip-structure": "3.15.3-dev.20260916211208",
+    "@stigmer/plugin-package": "3.16.0",
+    "@stigmer/protos": "3.16.0",
+    "@stigmer/temporal-codecs": "3.16.0",
+    "@stigmer/zip-structure": "3.16.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/authorization/__tests__/lane-admission.test.ts

@@ -0,0 +1,115 @@
+/**
+ * Pins the lane-admission decorator (lane-admission.ts): a caller the
+ * predicate names is ADMITTED on the run-gate checks without the inner
+ * Authorizer being consulted, and every other combination — an admitted
+ * lane on a non-run-gate check, any other caller on any check — reaches
+ * the inner Authorizer untouched, its answer returned as-is (deny and
+ * unavailable included, so the decorator can never turn a refusal into
+ * an allow off the run gate). The predicate is the whole policy; this
+ * file proves the decorator's arithmetic with a plain one, and the
+ * built-in provider's tests prove the predicate open source composes.
+ */
+import { describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import type {
+  Authorizer,
+  AuthzCheck,
+  AuthzDecision,
+} from "../../extensions/authorizer.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import { RUN_GATE_CHECKS } from "../../pipeline/steps/authorize-run-target.js";
+import { newLaneAdmittedAuthorizer } from "../lane-admission.js";
+
+const WORKFLOW_RUNNER: CallerIdentity = {
+  identityId: "ida_carol",
+  callerClass: "runner",
+  issuer: "",
+  rawToken: "wex-bound",
+};
+const AGENT_RUNNER: CallerIdentity = {
+  ...WORKFLOW_RUNNER,
+  rawToken: "aex-bound",
+};
+const PERSON: CallerIdentity = {
+  identityId: "ida_carol",
+  callerClass: "user",
+  issuer: "https://issuer.example/",
+  rawToken: "eyJ.person.token",
+};
+
+const isWorkflowRunner = (caller: CallerIdentity): boolean =>
+  caller.callerClass === "runner" && caller.rawToken === "wex-bound";
+
+const runGate: AuthzCheck = { ...RUN_GATE_CHECKS.agent, resourceId: "agt_1" };
+const sessionGate: AuthzCheck = {
+  ...RUN_GATE_CHECKS.session,
+  resourceId: "ses_1",
+};
+const notRunGate: AuthzCheck = {
+  permission: IamPermission.can_edit,
+  resourceKind: ApiResourceKind.agent_execution,
+  resourceId: "aex_1",
+};
+
+function recording(answer: AuthzDecision) {
+  const seen: Array<{ caller: CallerIdentity; check: AuthzCheck }> = [];
+  const inner: Authorizer = {
+    authorize(caller, check) {
+      seen.push({ caller, check });
+      return Promise.resolve(answer);
+    },
+  };
+  return { inner, seen };
+}
+
+describe("newLaneAdmittedAuthorizer", () => {
+  it("an admitted lane on a run-gate check is allowed without consulting the inner Authorizer", async () => {
+    const { inner, seen } = recording({ kind: "deny", reason: "would deny" });
+    const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
+    expect(await authorizer.authorize(WORKFLOW_RUNNER, runGate)).toEqual({
+      kind: "allow",
+    });
+    expect(await authorizer.authorize(WORKFLOW_RUNNER, sessionGate)).toEqual({
+      kind: "allow",
+    });
+    expect(seen).toEqual([]);
+  });
+
+  it("an admitted lane on a NON-run-gate check reaches the inner Authorizer untouched — the reach is the run gate alone", async () => {
+    const { inner, seen } = recording({ kind: "deny", reason: "not yours" });
+    const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
+    expect(await authorizer.authorize(WORKFLOW_RUNNER, notRunGate)).toEqual({
+      kind: "deny",
+      reason: "not yours",
+    });
+    expect(seen).toEqual([{ caller: WORKFLOW_RUNNER, check: notRunGate }]);
+  });
+
+  it.each([
+    ["an agent-bound runner", AGENT_RUNNER],
+    ["a person", PERSON],
+  ])(
+    "%s on a run-gate check is checked by the inner Authorizer as themselves",
+    async (_label, caller) => {
+      const { inner, seen } = recording({ kind: "not-found" });
+      const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
+      expect(await authorizer.authorize(caller, runGate)).toEqual({
+        kind: "not-found",
+      });
+      expect(seen).toEqual([{ caller, check: runGate }]);
+    },
+  );
+
+  it("an unavailable answer off the run gate is returned as-is — the decorator never masks a fault", async () => {
+    const cause = new Error("evaluator down");
+    const { inner } = recording({ kind: "unavailable", cause });
+    const authorizer = newLaneAdmittedAuthorizer(inner, isWorkflowRunner);
+    expect(await authorizer.authorize(PERSON, runGate)).toEqual({
+      kind: "unavailable",
+      cause,
+    });
+  });
+});

package/src/authorization/lane-admission.ts

@@ -0,0 +1,73 @@
+/**
+ * Lane admission over the Authorizer seam — open source's rendering of
+ * the cloud's decorator (stigmer-cloud `authorizer/lane-admission.ts`,
+ * stigmer-cloud#709), composed around the built-in Authorizer under the
+ * built-in authorization posture (boot/compose.ts).
+ *
+ * The OSS AuthorizeRunTarget step asks the Authorizer, for every caller
+ * but the internal class, whether the caller may run what a session or
+ * execution targets — the run-gate checks (`isRunGateCheck`, the
+ * OSS-owned definition of that set: `can_execute` on the blueprints and
+ * instances, `can_create_execution_in` on a session). A runner acting
+ * for a WORKFLOW execution creates the workflow's child agent executions
+ * (the `agent_call` activity), and it does so AS THE HUMAN whose workflow
+ * it is (runnerauth/runner-subject-verifier.ts). Checked as that human,
+ * a member running an organization-visible workflow that calls another
+ * member's private agent would be refused at the child create — but
+ * the parent workflow execution already passed its own run gate, and
+ * the human's visibility of the agents a shared workflow calls is not
+ * the question. The cloud admits its `workflow_sandbox` lane on exactly
+ * these checks for exactly this reason; this decorator gives an
+ * enforcing self-host the same answer, so a workflow behaves the same in
+ * both editions (the parent program's rule: nothing diverges silently).
+ *
+ * Why a predicate and not a class set: the cloud keys its decorator on
+ * `callerClass` because there the class IS the token type. In open
+ * source the class is `runner` for every bound execution, and the
+ * binding's KIND lives in the token, readable by the one function that
+ * interprets runner tokens (`isWorkflowBoundRunner` in
+ * runnerauth/built-in-runner-credential-provider.ts). Handing that
+ * reading in as `isAdmittedLane` keeps this module free of token
+ * knowledge and lets the cloud adopt the same shape later without a
+ * second class name. An AGENT-bound runner is NOT admitted: a subagent
+ * create is checked as the human, the cloud's `sandbox` posture.
+ *
+ * Narrow by construction: an admitted lane on any NON-run-gate check,
+ * and any other caller on any check, delegate untouched. The cloud's
+ * header records one caveat — a human who can view a workflow execution
+ * can exchange for its token and replay it against the run gate. Open
+ * source has no such caveat: under this posture the exchange is a mint
+ * gate that answers only the run's own person (the built-in provider's
+ * exchangeScopedToken, runnerauth/built-in-runner-credential-provider.ts),
+ * so the only human who can hold a workflow's credential is the one whose
+ * workflow it is — and their own run gate already passed.
+ */
+import type { CallerIdentity } from "../extensions/identity.js";
+import type {
+  Authorizer,
+  AuthzCheck,
+  AuthzDecision,
+} from "../extensions/authorizer.js";
+import { isRunGateCheck } from "../pipeline/steps/authorize-run-target.js";
+
+const ADMITTED: AuthzDecision = { kind: "allow" };
+
+/** Whether `caller` is a lane whose admission to CREATE a run was decided upstream. */
+export type LaneAdmissionPredicate = (caller: CallerIdentity) => boolean;
+
+export function newLaneAdmittedAuthorizer(
+  inner: Authorizer,
+  isAdmittedLane: LaneAdmissionPredicate,
+): Authorizer {
+  return {
+    authorize(
+      caller: CallerIdentity,
+      check: AuthzCheck,
+    ): Promise<AuthzDecision> {
+      if (isRunGateCheck(check) && isAdmittedLane(caller)) {
+        return Promise.resolve(ADMITTED);
+      }
+      return inner.authorize(caller, check);
+    },
+  };
+}

package/src/authorization/schedule-fire-caller.ts

@@ -22,10 +22,12 @@
  * client-suppliable schedule-id label is what the cloud explicitly
  * refused.
  *
- * The creator's account is resolved from the row's stamp two ways — as an
- * account id (rows stamped since 3.15.0) and as the raw issuer subject
- * (rows the 3.14.x verifiers stamped) — through the account port, the
- * same two shapes `Person` aliases. A stamp that resolves to no account
+ * The creator's account is resolved from the row's stamp through the
+ * identity-account domain's `accountForStamp` — as an account id (rows
+ * stamped since 3.15.0) and as the raw issuer subject (rows the 3.14.x
+ * verifiers stamped), the same two shapes `Person` aliases and the same
+ * read the runner-subject verifier makes of an execution's stamp. A
+ * stamp that resolves to no account
  * is the seam's DETERMINISTIC refusal (`ScheduleFireCallerRefusedError`):
  * the empty stamp, the laptop's `"system"`, an email from the
  * trusted-local era, a deleted account — no retry will make that schedule
@@ -43,7 +45,8 @@ import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/a
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { accountAsCaller } from "../domain/identityaccount/actor.js";
-import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import { accountForStamp } from "../domain/identityaccount/resolve.js";
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
 import type { ScheduleFireCallerMint } from "../extensions/schedule-fire-caller.js";
 import { ScheduleFireCallerRefusedError } from "../extensions/schedule-fire-caller.js";
 import { auditOf } from "../pipeline/steps/defaults.js";
@@ -52,10 +55,7 @@ import type { Store } from "../store/interface.js";
 export interface BuiltInScheduleFireCallerDeps {
   readonly store: Store;
   /** The account port: the stamp is resolved as an account id, then as a direct subject. */
-  readonly accounts: Pick<
-    IdentityAccountStore,
-    "findById" | "findDirectByIdpId"
-  >;
+  readonly accounts: AccountsByCaller;
 }
 
 /** The refusal's copy — written for the person who scheduled the run (the schedule's status carries it). */
@@ -75,11 +75,7 @@ export function newBuiltInScheduleFireCaller(
       );
       const stamp =
         auditOf(ScheduleSchema, schedule)?.specAudit?.createdBy?.id ?? "";
-      const account =
-        stamp === ""
-          ? undefined
-          : ((await deps.accounts.findById(stamp)) ??
-            (await deps.accounts.findDirectByIdpId(stamp)));
+      const account = await accountForStamp(deps.accounts, stamp);
       if (account === undefined) {
         throw new ScheduleFireCallerRefusedError(
           scheduleHasNoPersonMessage(scheduleId),

package/src/boot/compose.ts

@@ -33,6 +33,7 @@ import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_inf
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 
 import { newBuiltInAuthorizer } from "../authorization/authorizer.js";
+import { newLaneAdmittedAuthorizer } from "../authorization/lane-admission.js";
 import { newBuiltInListReadScope } from "../authorization/list-read-scope.js";
 import { newBuiltInOrganizationDirectory } from "../authorization/organization-directory.js";
 import { authorizationPostureOf } from "../authorization/posture.js";
@@ -150,7 +151,12 @@ import { operatorIdentitySnapshot } from "../pipeline/steps/defaults.js";
 import { createErrorBoundaryInterceptor } from "../pipeline/interceptors/error-boundary.js";
 import { createRequestMetricsInterceptor } from "../pipeline/interceptors/request-metrics.js";
 import { newPermissiveSingleTeamAuthorizer } from "../pipeline/steps/authorize.js";
+import {
+  isWorkflowBoundRunner,
+  newBuiltInRunnerCredentialProvider,
+} from "../runnerauth/built-in-runner-credential-provider.js";
 import { newExecutionScopedRunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
+import { newRunnerSubjectIdentityVerifier } from "../runnerauth/runner-subject-verifier.js";
 import { RunnerAuthService } from "../runnerauth/runnerauth.js";
 import { PostgresStore } from "../store/postgres/store.js";
 import { SqliteStore } from "../store/sqlite/store.js";
@@ -431,12 +437,44 @@ export async function composeServer(
         operatorEmail: operatorIdentity.email,
       })
     : undefined;
+  // Stage: runner credentials (§6c, O5). The concrete service is
+  // constructed and exposed UNCONDITIONALLY — its boot-fatal key posture
+  // is the ratified cross-domain invariant, and the boot/EC-decrypt tests
+  // mint against the server's own key through it. The provider over it is
+  // the edition's whole credential story in one object: a composed
+  // driver; otherwise, under the built-in authorization posture, open
+  // source's built-in provider (runnerauth/built-in-runner-credential-
+  // provider.ts — the execution-scoped default plus the lineage-vouching,
+  // memory-capture and exchange-gating capabilities an enforcing
+  // self-host needs, and the one reading of a runner's binding the
+  // Authorizer below admits a workflow-bound runner on); otherwise the
+  // execution-scoped default, byte-identical to the wiring this seam
+  // replaced. Both open-source providers also mint the RUN credential the
+  // two execution engines put on every dispatch (the engines below take
+  // this object; runnerauth/dispatch-credential.ts) — a composed driver
+  // that leaves that capability undefined dispatches without one, its
+  // runners being credentialed another way. Bound HERE, before the
+  // Authorizer, because the lane admission reads the binding.
+  const runnerAuthService = RunnerAuthService.fromEnv();
+  const runnerCredentials =
+    extensions.drivers.runnerCredentialProvider ??
+    (authorizationPosture === "built-in"
+      ? newBuiltInRunnerCredentialProvider({
+          service: runnerAuthService,
+          store,
+          accounts: identityAccounts,
+        })
+      : newExecutionScopedRunnerCredentialProvider(runnerAuthService));
   // The ONE composed Authorizer (DD-007 §3), bound here — after the store,
   // the account port and the IamPolicy port it reads — and handed to every
   // controller as an explicit dependency; the Authorize step at position 1
   // of every chain calls it (O2). By posture: an extension's registration;
   // open source's built-in Authorizer (authorization/authorizer.ts — the
-  // cloud's model evaluated over the tuples the row would have had); or
+  // cloud's model evaluated over the tuples the row would have had),
+  // decorated with the lane admission (authorization/lane-admission.ts) so
+  // a runner acting for a WORKFLOW execution passes the run gate on the
+  // child executions its `agent_call` creates — the parent workflow
+  // already passed its own, the cloud's `workflow_sandbox` posture; or
   // the permissive single-team default. The organization directory and the
   // schedule fire caller are bound beside it under the same posture, so
   // `findMyOrganizations` lists what a person may view and a scheduled run
@@ -445,13 +483,16 @@ export async function composeServer(
   const authorizer: Authorizer =
     extensions.authorizer ??
     (authorizationPosture === "built-in"
-      ? newBuiltInAuthorizer({
-          store,
-          policies: iamPolicies,
-          accounts: identityAccounts,
-          edition: extensions.edition,
-          logger,
-        })
+      ? newLaneAdmittedAuthorizer(
+          newBuiltInAuthorizer({
+            store,
+            policies: iamPolicies,
+            accounts: identityAccounts,
+            edition: extensions.edition,
+            logger,
+          }),
+          (caller) => isWorkflowBoundRunner(runnerAuthService, caller),
+        )
       : newPermissiveSingleTeamAuthorizer());
   const organizationDirectory: OrganizationDirectory | undefined =
     extensions.drivers.organizationDirectory ??
@@ -626,16 +667,6 @@ export async function composeServer(
       writeVersionValue === "" ? DEFAULT_WRITE_VERSION : writeVersionValue,
     registeredCodecs: [...secretCodecs.keys()].sort(),
   });
-  const runnerAuthService = RunnerAuthService.fromEnv();
-  // The runner-credential seam (§6c, O5): the composed provider, or the
-  // OSS execution-scoped default over the service above. The concrete
-  // service is constructed and exposed UNCONDITIONALLY either way — its
-  // boot-fatal key posture is the ratified cross-domain invariant, and the
-  // boot/EC-decrypt tests mint against the server's own key through it.
-  const runnerCredentials =
-    extensions.drivers.runnerCredentialProvider ??
-    newExecutionScopedRunnerCredentialProvider(runnerAuthService);
-
   // Stage: temporal (#18). Construction is sync and connection-free —
   // initialConnect/startWorkers/startHealthMonitor run in start(), all
   // NON-fatal (Go server.go: the server boots and serves with the engine
@@ -837,6 +868,7 @@ export async function composeServer(
     manager: temporalManager,
     config: temporalConfig,
     store,
+    runnerCredentials,
     logger,
   });
   // The workflow-execution twin: the same provider-is-the-injection
@@ -844,6 +876,7 @@ export async function composeServer(
   const workflowExecutionEngineState = newWorkflowExecutionEngineStateProvider({
     manager: temporalManager,
     config: workflowExecutionTemporalConfig,
+    runnerCredentials,
     logger,
   });
   // The artifact blob store (Go server.go 349: shared by agentexecution
@@ -1355,8 +1388,8 @@ export async function composeServer(
             requireInProcess().executionEnvironmentReader.getSecretValue(input),
         },
         executionContext: {
-          create: (ec) =>
-            requireInProcess().connectExecutionContextClient.create(ec),
+          create: (ec, caller) =>
+            requireInProcess().connectExecutionContextClient.create(ec, caller),
           delete: (input) =>
             requireInProcess().connectExecutionContextClient.delete(input),
         },
@@ -1474,12 +1507,36 @@ export async function composeServer(
   //     port the domain writes through (`identityAccounts`, the
   //     identity-accounts stage — a composed driver included), so a row
   //     provisioning creates resolves on the very next request.
-  // The runner's credential in either posture is an operator-minted API
-  // token via STIGMER_TOKEN (O3 ruling Q3) — no runner-specific verifier.
+  //   - the runner-subject verifier rides the AUTHORIZATION posture
+  //     (`built-in`, beside the Authorizer and the fire caller above): it
+  //     admits the bearer of the server's own execution-scoped runner
+  //     token as the human whose run it is, which only means something
+  //     when the server enforces who may report on a run. Its place in
+  //     the chain is the contract: BETWEEN `apikey` and `oidc`, because
+  //     the OIDC verifier claims any JWT-shaped token and throws on one
+  //     it cannot verify — composed after it, ours would never see its
+  //     own token, and every runner call would fail as the OIDC verifier's
+  //     fault (stigmer#1137). Until 2026-09-16 this comment read "the
+  //     runner's credential in either posture is an operator-minted API
+  //     token via STIGMER_TOKEN — no runner-specific verifier"; that
+  //     described a server whose Authorizer was permissive. The operator's
+  //     key is still the runner's PROCESS credential (bootstrap, registry);
+  //     the run credential is how it acts for each run. A unit with its
+  //     own Authorizer composes none of this — its credential story is its
+  //     own (the cloud's sandbox lanes).
   const identityVerifiers = [
     ...(requireAuthentication
       ? [newApiKeyIdentityVerifier({ store, accounts: identityAccounts })]
       : []),
+    ...(authorizationPosture === "built-in"
+      ? [
+          newRunnerSubjectIdentityVerifier({
+            store,
+            accounts: identityAccounts,
+            credentials: runnerCredentials,
+          }),
+        ]
+      : []),
     ...(authEnabled
       ? [
           newOidcIdentityVerifier({

package/src/boot/inprocess.ts

@@ -332,8 +332,14 @@ export function createInProcessClients(
     executionContextCreator: {
       create: (ec) => executionContextCommand.create(ec),
     },
+    // The connect lane's ephemeral EC is created AS THE CONNECTING PERSON
+    // (ruling R5's asCaller lane): its creator stamp is what the
+    // runner-subject verifier resolves the connect token's bearer to under
+    // the built-in posture (runnerauth/bound-execution.ts). The delete
+    // stays the server's own act — the row is the lane's, whoever asked.
     connectExecutionContextClient: {
-      create: (ec) => executionContextCommand.create(ec),
+      create: (ec, caller) =>
+        executionContextCommand.create(ec, asCaller(caller)),
       delete: (input) => executionContextCommand.delete(input),
     },
     // The workflowexecution edges: the default-instance self-heal creates

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -36,6 +36,8 @@ import type { Client, Transport } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
 import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
 import { ExecutionContextCommandController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/command_pb";
@@ -53,6 +55,7 @@ import {
 } from "../../../encryption/encryption.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
 import { REDACTED_MARKER } from "../../environment/constants.js";
+import { newConnectExecutionId } from "../../mcpserver/connect-execution-id.js";
 import {
   DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME,
   deleteExecutionContextForExecution,
@@ -419,6 +422,107 @@ describe("executioncontext domain (encryption + runner auth enabled)", () => {
     });
   });
 
+  describe("the run credential on the decrypt lane — validity is the row's", () => {
+    // A no-`exp` token: the row is the only thing that can end it, so the
+    // lane reads the bound execution's liveness for exactly this shape and
+    // keeps the clocked arms above untouched (their ECs name no row).
+    const RUN_ID = "aex_run_credential";
+
+    async function seedRun(
+      phase: ExecutionPhase,
+      completedAt = "",
+    ): Promise<void> {
+      await ts.server.store.saveResource(
+        ApiResourceKind.agent_execution,
+        RUN_ID,
+        AgentExecutionSchema,
+        create(AgentExecutionSchema, {
+          metadata: { id: RUN_ID, name: RUN_ID, org: "test-org" },
+          status: { phase, completedAt },
+        }),
+      );
+    }
+
+    beforeAll(async () => {
+      await ts.command.create(ecInput({ executionId: RUN_ID }));
+    });
+
+    async function readRun(): Promise<ExecutionContext> {
+      const credential = ts.server.runnerAuthService.mintRunCredential(RUN_ID);
+      return await ts.query.getByExecutionId(
+        { executionId: RUN_ID },
+        { headers: bearerHeaders(credential) },
+      );
+    }
+
+    it("decrypts while the run is live", async () => {
+      await seedRun(ExecutionPhase.EXECUTION_IN_PROGRESS);
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        "super-secret-token",
+      );
+    });
+
+    it("still decrypts just after the run ended — the grace covers the writes that trail the terminal stamp", async () => {
+      await seedRun(
+        ExecutionPhase.EXECUTION_COMPLETED,
+        new Date().toISOString(),
+      );
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        "super-secret-token",
+      );
+    });
+
+    it("redacts once the run is over past the grace — a token in Temporal history cannot decrypt a finished run's secrets", async () => {
+      await seedRun(
+        ExecutionPhase.EXECUTION_COMPLETED,
+        new Date(Date.now() - 60 * 60 * 1000).toISOString(),
+      );
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        REDACTED_MARKER,
+      );
+    });
+
+    it("redacts for a terminal run that does not say when it ended — no grace without a timestamp", async () => {
+      await seedRun(ExecutionPhase.EXECUTION_FAILED);
+      expect((await readRun()).spec!.data["API_TOKEN"]!.value).toBe(
+        REDACTED_MARKER,
+      );
+    });
+
+    it("redacts when the credential names a run this server does not have", async () => {
+      const orphan = "aex_no_such_run";
+      await ts.command.create(ecInput({ executionId: orphan }));
+      const credential = ts.server.runnerAuthService.mintRunCredential(orphan);
+      const ec = await ts.query.getByExecutionId(
+        { executionId: orphan },
+        { headers: bearerHeaders(credential) },
+      );
+      expect(ec.spec!.data["API_TOKEN"]!.value).toBe(REDACTED_MARKER);
+    });
+
+    it("redacts for a clockless token bound to a connect's EC — a connect is not a run, and no mint produces that shape (the verifier refuses it through the same predicate)", async () => {
+      const connectId = newConnectExecutionId("mcps_conn");
+      await ts.command.create(ecInput({ executionId: connectId }));
+      const clockless =
+        ts.server.runnerAuthService.mintRunCredential(connectId);
+      const redacted = await ts.query.getByExecutionId(
+        { executionId: connectId },
+        { headers: bearerHeaders(clockless) },
+      );
+      expect(redacted.spec!.data["API_TOKEN"]!.value).toBe(REDACTED_MARKER);
+      // The connect lane's own CLOCKED token keeps decrypting the same EC:
+      // the clocked arms above are untouched by the run-credential rule.
+      const clocked = ts.server.runnerAuthService.mint(connectId, 300).token;
+      const decrypted = await ts.query.getByExecutionId(
+        { executionId: connectId },
+        { headers: bearerHeaders(clocked) },
+      );
+      expect(decrypted.spec!.data["API_TOKEN"]!.value).toBe(
+        "super-secret-token",
+      );
+    });
+  });
+
   describe("decrypt error doctrine", () => {
     it("tampered stored ciphertext drops the ONE key while the read succeeds; intact keys decrypt", async () => {
       const created = await ts.command.create(

package/src/domain/executioncontext/__tests__/resolve-values-capability.test.ts

@@ -19,6 +19,7 @@ import {
   EncryptionScope,
   SecretService,
 } from "../../../encryption/encryption.js";
+import type { BoundExecutionStore } from "../../../runnerauth/bound-execution.js";
 import { InvalidTokenError } from "../../../runnerauth/runnerauth.js";
 import type { RunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
 import { resolveValuesForCaller } from "../resolve-values-for-caller.js";
@@ -31,6 +32,14 @@ const silentLogger = createLogger({
 
 const secretService = SecretService.create(Buffer.alloc(32, 7));
 
+/** The capability arm never reads the store — a store that proves it. */
+const store: BoundExecutionStore = {
+  getResource: () =>
+    Promise.reject(new Error("the capability arm must not read the store")),
+  findByField: () =>
+    Promise.reject(new Error("the capability arm must not read the store")),
+};
+
 /** A minimal HandlerContext: the resolve path reads only the auth header. */
 function ctxWithBearer(token: string): HandlerContext {
   const headers = new Headers();
@@ -84,7 +93,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     const provider = providerWith(async () => true);
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer("sandbox-token"),
       ec,
     );
@@ -96,7 +110,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     const provider = providerWith(async () => false);
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer("someone-elses-token"),
       ec,
     );
@@ -107,7 +126,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     const provider = providerWith(async () => true);
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer(""),
       ec,
     );
@@ -121,7 +145,12 @@ describe("resolveValuesForCaller (capability delegation — C4)", () => {
     });
     const ec = await executionContext();
     await resolveValuesForCaller(
-      { logger: silentLogger, secretService, runnerAuthService: provider },
+      {
+        logger: silentLogger,
+        secretService,
+        runnerAuthService: provider,
+        store,
+      },
       ctxWithBearer("sandbox-token"),
       ec,
     );