@stigmer/server 3.15.3-dev.20260916211208 → 3.16.0

package/src/domain/executioncontext/resolve-values-for-caller.ts

@@ -14,21 +14,37 @@
  * distinguishes itself with an execution-scoped token minted by
  * getRunnerScopedToken and presented as a Bearer authorization header
  * (the same header shape a cloud runner uses for its sandbox credential).
- * Decrypt requires the FULL binding: a valid, unexpired token whose
- * execution_id claim equals this EC's spec.execution_id. Everything else
- * — no header, malformed or expired token, or a token minted for a
- * different execution — falls closed to the same redaction
- * get/getByReference apply, as a SUCCESSFUL response, not an error.
+ * Decrypt requires the FULL binding: a valid token whose execution_id
+ * claim equals this EC's spec.execution_id, and — for a RUN credential,
+ * the no-`exp` token the dispatch path hands the runner — a bound
+ * execution that is still live (runnerauth/bound-execution.ts: not
+ * terminal, or ended within the grace). Everything else — no header, a
+ * malformed or expired token, a token minted for a different execution,
+ * a run credential whose run is over — falls closed to the same
+ * redaction get/getByReference apply, as a SUCCESSFUL response, not an
+ * error.
  *
- * Token verification lives HERE, in the domain, not on the identity
- * chassis (O2, 20260827.01): the runner token is a lane discriminator,
- * not a caller identity — the chassis deliberately lets it fall through
- * to the trusted-local identity (ruling Q6), and this is the one RPC
- * that reads the raw header — exactly the consumer the runnerauth module
- * header reserves ("the executioncontext resolve step"). The
- * redaction-as-success contract is pinned by the conformance suites and
- * must survive every future verifier: a runner token is NEVER an
- * authentication credential.
+ * The decrypt decision lives HERE, in the domain, whatever the identity
+ * chassis makes of the token. Under trusted-local no verifier claims it
+ * and this is the one RPC that reads the raw header (the consumer the
+ * runnerauth module header reserves, "the executioncontext resolve
+ * step"). Under the built-in authorization posture the runner-subject
+ * verifier ALSO admits the same token as the run's human at position 1
+ * (runnerauth.ts header, 2026-09-16) — that decides WHO is calling and
+ * whether they may read the row; whether the row's secrets are decrypted
+ * for them is still this lane's binding check, so a person who can view
+ * an execution's context never receives its plaintext by holding a
+ * credential for a different one. The redaction-as-success contract is
+ * pinned by the conformance suites and holds on every arm.
+ *
+ * Why liveness is read only for a no-`exp` token: a clocked token's
+ * validity was decided by `verify` (its clock) and its binding, and the
+ * ExecutionContext it opens need not name an execution row at all — the
+ * connect lane's token opens an EC for an MCP discovery, and the rosters
+ * pin a clocked token decrypting an EC whose execution id names no row.
+ * A run credential has no clock; the row is the only thing that can end
+ * it, and a plaintext token in Temporal history must not decrypt a
+ * finished run's secrets for good.
  *
  * # Decrypt error doctrine (the oss#405 runtime-resolution doctrine,
  * # arms per the two-armed taxonomy in encryption/errors.ts)
@@ -56,8 +72,16 @@ import { EncryptionUnavailableError } from "../../encryption/encryption.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { internalError } from "../../pipeline/errors.js";
 import { parseBearerToken } from "../../pipeline/interceptors/auth.js";
+import {
+  bindsARun,
+  loadBoundExecution,
+} from "../../runnerauth/bound-execution.js";
+import type { BoundExecutionStore } from "../../runnerauth/bound-execution.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
-import { TOKEN_TYPE_EXECUTION_SCOPED } from "../../runnerauth/runnerauth.js";
+import {
+  isClockedToken,
+  TOKEN_TYPE_EXECUTION_SCOPED,
+} from "../../runnerauth/runnerauth.js";
 import { encryptionKeyMissingMessage } from "./constants.js";
 import { redactExecutionContextSecrets } from "./redact.js";
 
@@ -65,6 +89,8 @@ export interface ResolveValuesDeps {
   readonly logger: Logger;
   readonly secretService: SecretService;
   readonly runnerAuthService: RunnerCredentialProvider;
+  /** Where the bound execution lives — read for a run credential's liveness only. */
+  readonly store: BoundExecutionStore;
 }
 
 /**
@@ -123,15 +149,23 @@ async function runnerMayDecrypt(
     }
   }
 
-  const executionId = verifyRunnerToken(deps, ctx, ec);
-  if (executionId !== undefined) {
+  const token = bearerToken(ctx);
+  const executionId = verifyRunnerToken(deps, token, ec);
+  if (executionId === undefined) {
+    return false;
+  }
+  if (!isClockedToken(token) && !(await runIsLive(deps, executionId))) {
     deps.logger.debug(
-      "Scope-bound runner token presented - decrypting execution context secrets",
+      "Run credential presented for a run that is over - redacting execution context secrets",
       { executionId },
     );
-    return true;
+    return false;
   }
-  return false;
+  deps.logger.debug(
+    "Scope-bound runner token presented - decrypting execution context secrets",
+    { executionId },
+  );
+  return true;
 }
 
 /**
@@ -148,10 +182,9 @@ async function runnerMayDecrypt(
  */
 function verifyRunnerToken(
   deps: ResolveValuesDeps,
-  ctx: HandlerContext,
+  token: string,
   ec: ExecutionContext,
 ): string | undefined {
-  const token = bearerToken(ctx);
   if (token === "") {
     return undefined;
   }
@@ -183,6 +216,30 @@ function verifyRunnerToken(
   return tokenExecutionId;
 }
 
+/**
+ * A run credential's liveness: the bound execution exists, IS a run
+ * (`bindsARun` — a clockless token bound to a connect is a shape no mint
+ * produces, refused here and by the verifier through the one predicate)
+ * and is live (runnerauth/bound-execution.ts). A missing row is "not
+ * live" — the credential opens nothing. A store fault is an
+ * infrastructure fault, sanitized here as every direct handler does (the
+ * store-fault doctrine): an outage must not read as a redaction decision,
+ * and the same store just served the row this read is for.
+ */
+async function runIsLive(
+  deps: ResolveValuesDeps,
+  executionId: string,
+): Promise<boolean> {
+  try {
+    const execution = await loadBoundExecution(deps.store, executionId);
+    return (
+      execution !== undefined && bindsARun(execution.kind) && execution.live
+    );
+  } catch (error) {
+    throw internalError(error, "failed to load the run credential's execution");
+  }
+}
+
 /**
  * The Bearer credential from the request's authorization header; empty
  * when absent or differently shaped. The parsing shape (Go's exact

package/src/domain/identityaccount/__tests__/account-for-stamp.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Pins `accountForStamp` (resolve.ts): the account a row's CREATOR STAMP
+ * names, read the two ways a stamp has been written — as an account id
+ * (rows stamped since 3.15.0) and as the raw issuer subject (rows the
+ * 3.14.x verifiers stamped) — stated ONCE so the schedule fire caller and
+ * the runner-subject verifier, which both make a server lane act as the
+ * person a row names, cannot resolve the same stamp two ways. The read
+ * order is `accountForCaller`'s: by id first, then the direct subject
+ * lookup.
+ *
+ *   - an account-id stamp resolves by that id;
+ *   - a raw-subject stamp resolves through the direct lookup;
+ *   - the empty stamp is `undefined` with NO read — the store is never
+ *     asked about "";
+ *   - a stamp naming nobody (the laptop's `"system"`, a trusted-local
+ *     email, a deleted account) is `undefined` — the CALLER decides what
+ *     that means (the fire caller's deterministic refusal; the verifier's
+ *     liveness sentence); this function never throws for it;
+ *   - a store fault propagates as the same error object.
+ *
+ * Written failing on 2026-09-16, before the export exists; the change that follows
+ * extracts it from the fire caller's inline read (extract, do not copy).
+ */
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it, vi } from "vitest";
+
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import { accountIdFor } from "../constants.js";
+import { accountForStamp } from "../resolve.js";
+import type { AccountsByCaller } from "../resolve.js";
+import { fakeIdentityAccountStore } from "./support.js";
+
+const SUBJECT = "auth0|carol";
+const CAROL = accountIdFor(SUBJECT);
+
+function seeded() {
+  const accounts = fakeIdentityAccountStore();
+  accounts.rows.set(
+    CAROL,
+    create(IdentityAccountSchema, {
+      metadata: { id: CAROL, name: "Carol Danvers" },
+      spec: {
+        idpId: SUBJECT,
+        email: "carol@example.com",
+        provisioningMode: IdentityAccountProvisioningMode.direct,
+      },
+    }),
+  );
+  return accounts;
+}
+
+describe("accountForStamp", () => {
+  it("an account-id stamp resolves by that id", async () => {
+    const account = await accountForStamp(seeded(), CAROL);
+    expect(account?.metadata?.id).toBe(CAROL);
+    expect(account?.spec?.email).toBe("carol@example.com");
+  });
+
+  it("a raw-subject stamp (the 3.14.x shape) resolves through the direct lookup to the same account", async () => {
+    expect((await accountForStamp(seeded(), SUBJECT))?.metadata?.id).toBe(
+      CAROL,
+    );
+  });
+
+  it('the empty stamp is undefined with NO read — the store is never asked about ""', async () => {
+    const findById = vi.fn(async () => undefined);
+    const findDirectByIdpId = vi.fn(async () => undefined);
+    const accounts: AccountsByCaller = { findById, findDirectByIdpId };
+    expect(await accountForStamp(accounts, "")).toBeUndefined();
+    expect(findById).not.toHaveBeenCalled();
+    expect(findDirectByIdpId).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["the laptop's placeholder", "system"],
+    ["a trusted-local email stamp", "operator@example.com"],
+    ["a deleted account", accountIdFor("auth0|gone")],
+  ])(
+    "%s is undefined — the caller decides what nobody means",
+    async (_label, stamp) => {
+      expect(await accountForStamp(seeded(), stamp)).toBeUndefined();
+    },
+  );
+
+  it("reads by id first, then by subject — two primary-key reads at most, in accountForCaller's order", async () => {
+    const calls: string[] = [];
+    const accounts: AccountsByCaller = {
+      findById: async (id) => {
+        calls.push(`id:${id}`);
+        return undefined;
+      },
+      findDirectByIdpId: async (idpId) => {
+        calls.push(`sub:${idpId}`);
+        return undefined;
+      },
+    };
+    await accountForStamp(accounts, SUBJECT);
+    expect(calls).toEqual([`id:${SUBJECT}`, `sub:${SUBJECT}`]);
+  });
+
+  it("a store fault propagates as the same error object, never a credential rejection", async () => {
+    const fault = new Error("connection reset");
+    const accounts: AccountsByCaller = {
+      findById: () => Promise.reject(fault),
+      findDirectByIdpId: async () => undefined,
+    };
+    await expect(accountForStamp(accounts, CAROL)).rejects.toBe(fault);
+  });
+});

package/src/domain/identityaccount/actor.ts

@@ -1,30 +1,73 @@
 /**
- * An account acting as itself — the ONE construction of the caller
- * identity server code stamps when it acts on a person's behalf without
- * a token in hand. The shape is the trusted-local identity's
- * (pipeline/interceptors/auth.ts trustedLocalIdentityFor: no issuer, no
- * token; email and display name only when known) with the account id as
- * the principal, so the audit actor on every write it makes is the
- * account, named the way every other write names it.
+ * An account acting as itself — the ONE place server code builds the
+ * caller identity for a person it has resolved from a row rather than
+ * from the token that person presented. Two constructions, one shape:
+ * the account id is the principal, so the audit actor on every write
+ * names the account the way every other write names it, and email and
+ * display name ride along when the row knows them (the trusted-local
+ * identity's shape, pipeline/interceptors/auth.ts).
  *
- * Two lanes build it: the trusted-local boot ensure, which grants the
- * operator ownership AS their account (domain/iampolicy/membership.ts),
- * and the built-in schedule fire caller, which makes a fire act as the
- * schedule's creator (authorization/schedule-fire-caller.ts). Both ride
- * the in-process transport, whose interceptor stamps `origin:
- * "in-process"` on top — the transport-trust marker is never set here.
+ * `accountAsCaller(account)` — the IN-PROCESS lane: no issuer, no token,
+ * class `user`. Two consumers: the trusted-local boot ensure, which
+ * grants the operator ownership AS their account
+ * (domain/iampolicy/membership.ts), and the built-in schedule fire
+ * caller, which makes a fire act as the schedule's creator
+ * (authorization/schedule-fire-caller.ts). Both ride the in-process
+ * transport, whose interceptor stamps `origin: "in-process"` on top —
+ * the transport-trust marker is never set here.
  *
- * Why not a token: open source mints no credential for a person the
- * server is composing a request for; the identity is what the
- * propagation header carries, and every consumer that reads a subject off
- * the raw token (`idpIdOf`) is reached only through `accountForCaller`,
- * which resolves this identity by its id first and never asks the token.
+ * `accountAsRunnerCaller(account, rawToken)` — the WIRE lane: the
+ * runner-subject verifier (runnerauth/runner-subject-verifier.ts) admits
+ * the bearer of a run credential as the human whose run it is. Class
+ * `runner`, because the Authorizer's lane admission and the memory
+ * capture gate must tell a runner acting as a person from the person
+ * (extensions/identity.ts names the class for exactly this), and the
+ * verified token carried, because the provider's capabilities re-read the
+ * binding off `rawToken` (the cloud's own pattern) — one HMAC, no store
+ * read. No issuer: the server signed it.
+ *
+ * Why not a token for the in-process lane: open source mints no
+ * credential for a person the server is composing a request for; the
+ * identity is what the propagation header carries, and every consumer
+ * that reads a subject off the raw token (`idpIdOf`) is reached only
+ * through `accountForCaller`, which resolves this identity by its id
+ * first and never asks the token. The same holds for the runner lane:
+ * our token carries no `sub`, and nothing downstream needs one.
  */
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 
 import type { CallerIdentity } from "../../extensions/identity.js";
 
 export function accountAsCaller(account: IdentityAccount): CallerIdentity {
+  return {
+    ...principalOf(account),
+    callerClass: "user",
+    issuer: "",
+    rawToken: "",
+  };
+}
+
+export function accountAsRunnerCaller(
+  account: IdentityAccount,
+  rawToken: string,
+): CallerIdentity {
+  if (rawToken === "") {
+    throw new Error(
+      "a runner caller carries the credential it presented — refusing to build one with none",
+    );
+  }
+  return {
+    ...principalOf(account),
+    callerClass: "runner",
+    issuer: "",
+    rawToken,
+  };
+}
+
+/** The account id as principal, with the display identity the row knows. */
+function principalOf(
+  account: IdentityAccount,
+): Pick<CallerIdentity, "identityId" | "email" | "displayName"> {
   const accountId = account.metadata?.id ?? "";
   if (accountId === "") {
     throw new Error(
@@ -35,9 +78,6 @@ export function accountAsCaller(account: IdentityAccount): CallerIdentity {
   const displayName = account.metadata?.name ?? "";
   return {
     identityId: accountId,
-    callerClass: "user",
-    issuer: "",
-    rawToken: "",
     ...(email !== "" ? { email } : {}),
     ...(displayName !== "" ? { displayName } : {}),
   };

package/src/domain/identityaccount/resolve.ts

@@ -41,6 +41,19 @@
  * cannot answer the same question two ways. A credential naming no
  * subject is `undefined` with no second read: the store is never asked
  * about "".
+ *
+ * The third reading is a ROW's creator stamp, `accountForStamp`: the
+ * account a `created_by.id` names, read the two ways a stamp has been
+ * written — as an account id (rows stamped since 3.15.0) and as the raw
+ * issuer subject (rows the 3.14.x verifiers stamped) — in
+ * `accountForCaller`'s order. Two lanes make the server act as the
+ * person a row names: the built-in schedule fire caller (a fire acts as
+ * the schedule's creator) and the runner-subject verifier (a run
+ * credential admits its bearer as the execution's creator). Stated here
+ * so they cannot resolve one stamp two ways; each decides for itself
+ * what "nobody" means (the fire caller's deterministic refusal, the
+ * verifier's liveness sentence), so this function answers `undefined`
+ * and never throws for it. The empty stamp is `undefined` with no read.
  */
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 
@@ -93,3 +106,21 @@ export async function accountForCaller(
   }
   return accounts.findDirectByIdpId(subject);
 }
+
+/**
+ * The account a row's creator stamp names, or `undefined` when it names
+ * nobody (the laptop's `"system"`, a trusted-local email, a deleted
+ * account, the empty stamp). Faults propagate as they are.
+ */
+export async function accountForStamp(
+  accounts: AccountsByCaller,
+  stamp: string,
+): Promise<IdentityAccount | undefined> {
+  if (stamp === "") {
+    return undefined;
+  }
+  return (
+    (await accounts.findById(stamp)) ??
+    (await accounts.findDirectByIdpId(stamp))
+  );
+}

package/src/domain/mcpserver/__tests__/connect.test.ts

@@ -28,6 +28,7 @@ import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/execu
 
 import { createLogger } from "../../../boot/logger.js";
 import { SecretService } from "../../../encryption/encryption.js";
+import type { CallerIdentity } from "../../../extensions/identity.js";
 import { newExecutionScopedRunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
 import { RunnerAuthService } from "../../../runnerauth/runnerauth.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
@@ -41,6 +42,7 @@ import {
   startBestEffortConnect,
 } from "../connect.js";
 import type { McpServerConnectDeps } from "../connect.js";
+import { isConnectExecutionId } from "../connect-execution-id.js";
 import { ManagedEnvironmentService } from "../oauth/managed-env.js";
 import {
   RUNNER_QUEUE_WARNING,
@@ -115,6 +117,8 @@ interface Harness {
   deps: McpServerConnectDeps;
   engine: FakeEngine;
   ecCreates: number;
+  /** The caller each EC create was handed — the connect's person, never the server (the mcp-connect binding's stamp). */
+  ecCreators: CallerIdentity[];
   ecDeletes: string[];
 }
 
@@ -150,6 +154,7 @@ function makeHarness(options: FakeEngineOptions = {}): Harness {
   const harness: Harness = {
     engine,
     ecCreates: 0,
+    ecCreators: [],
     ecDeletes: [],
     deps: {
       store,
@@ -165,8 +170,9 @@ function makeHarness(options: FakeEngineOptions = {}): Harness {
         },
       },
       executionContext: {
-        create: async () => {
+        create: async (_ec, caller) => {
           harness.ecCreates += 1;
+          harness.ecCreators.push(caller);
           return create(ExecutionContextSchema, {
             metadata: { id: `ectx_${harness.ecCreates}` },
           });
@@ -356,7 +362,7 @@ describe("connect (blocking lane)", () => {
     expect(second.status?.toolApprovals[0]?.toolName).toBe("search");
   });
 
-  it("creates the ephemeral EC from runtime_env, mints the decrypt token, and deletes the EC after settle", async () => {
+  it("creates the ephemeral EC from runtime_env AS THE CALLER, mints the decrypt token, and deletes the EC after settle", async () => {
     const harness = makeHarness();
     const server = await seedServer();
     await connect(
@@ -366,9 +372,16 @@ describe("connect (blocking lane)", () => {
       }),
     );
     expect(harness.ecCreates).toBe(1);
+    // The row's creator stamp is the connect token's person under the
+    // built-in posture (runnerauth/bound-execution.ts), so the connect
+    // hands the client the caller, never the server's own identity.
+    expect(harness.ecCreators).toEqual([testCaller]);
     expect(harness.ecDeletes).toEqual(["ectx_1"]);
     const input = harness.engine.startedInputs[0];
     expect(input?.execution_context_id).toMatch(/^connect-mcps_test_/);
+    // The id is the one shape the runner-credential lane recognizes as a
+    // connect binding — builder and predicate share one module.
+    expect(isConnectExecutionId(input?.execution_context_id ?? "")).toBe(true);
     // oss#535: the decrypt-lane token rides the payload.
     expect(input?.execution_context_token).toBeTruthy();
   });
@@ -584,6 +597,8 @@ describe("startConnect (async lane)", () => {
     );
     expect(result.metadata?.id).toBe(server.metadata!.id);
     expect(harness.ecCreates).toBe(1);
+    // The async lane creates the EC as the caller too — one prepareConnect.
+    expect(harness.ecCreators).toEqual([testCaller]);
     await vi.waitFor(() => expect(harness.ecDeletes).toEqual(["ectx_1"]));
   });
 });

package/src/domain/mcpserver/connect-execution-id.ts

@@ -0,0 +1,34 @@
+/**
+ * The synthetic execution id of an MCP connect — the ONE home for its
+ * shape, built here by the connect lane and recognized here by the
+ * runner-credential lane, so the two can never drift apart.
+ *
+ * A connect is not an execution: it has no AgentExecution or
+ * WorkflowExecution row. What it has is an ephemeral ExecutionContext
+ * (connect.ts `createConnectExecutionContext`) whose `spec.execution_id`
+ * must name SOMETHING for the decrypt lane's binding check
+ * (executioncontext/resolve-values-for-caller.ts: the token's
+ * `execution_id` claim must equal the EC's), and this id is that
+ * something — an id that names no resource kind, so the contract's
+ * `kind_meta` prefix table (pipeline/apiresource-meta.ts) cannot mistake
+ * it for a row. The runner-credential lane reads it the other way round
+ * (runnerauth/bound-execution.ts `boundExecutionKindOf`): an id this
+ * predicate recognizes is a connect binding, resolved through the EC row
+ * whose `spec.execution_id` it is. Keep the builder and the predicate
+ * together; a second copy of the prefix anywhere would be the drift this
+ * module exists to prevent.
+ */
+import { randomUUID } from "node:crypto";
+
+/** The prefix every connect execution id carries — no resource kind's id starts with it. */
+const CONNECT_EXECUTION_ID_PREFIX = "connect-";
+
+/** One connect's execution id: the server it discovers plus eight hex of entropy per attempt. */
+export function newConnectExecutionId(mcpServerId: string): string {
+  return `${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${randomUUID().slice(0, 8)}`;
+}
+
+/** Whether `executionId` is a connect's — the runner-credential lane's recognition of the third binding. */
+export function isConnectExecutionId(executionId: string): boolean {
+  return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX);
+}

package/src/domain/mcpserver/connect.ts

@@ -17,7 +17,6 @@
 import { create } from "@bufbuild/protobuf";
 import type { MessageInitShape } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
-import { randomUUID } from "node:crypto";
 
 import type {
   EnvironmentList,
@@ -62,6 +61,7 @@ import type {
 } from "../../store/interface.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import { resolveOAuthAppRef } from "../oauthapp/refresolution.js";
+import { newConnectExecutionId } from "./connect-execution-id.js";
 import {
   persistConnectFailure,
   persistConnectResult,
@@ -169,10 +169,21 @@ export interface ConnectEnvironmentReader {
 /**
  * The ExecutionContext lifecycle surface for the ephemeral connect EC —
  * Go's downstream executioncontext client (create + delete).
+ *
+ * `create` takes the connecting caller and the composition creates the
+ * row AS THAT PERSON (boot/inprocess.ts, the `asCaller` lane of ruling
+ * R5), never under the internal class: the row's creator stamp is what
+ * the runner-subject verifier resolves the connect's person from when
+ * the runner presents the connect token under the built-in posture
+ * (runnerauth/bound-execution.ts, the `mcp-connect` binding). A row
+ * stamped `internal` would name nobody, and the credentialed connect
+ * would be refused at identity on every enforcing self-host. `delete`
+ * stays the server's own act: the row is the lane's, whoever asked.
  */
 export interface ConnectExecutionContextClient {
   create(
     executionContext: MessageInitShape<typeof ExecutionContextSchema>,
+    caller: CallerIdentity,
   ): Promise<ExecutionContext>;
   delete(
     input: MessageInitShape<typeof ApiResourceDeleteInputSchema>,
@@ -272,7 +283,7 @@ export async function connect(
     input,
   );
 
-  const prepared = await prepareConnect(deps, mcpServer, input);
+  const prepared = await prepareConnect(deps, mcpServer, input, identity);
 
   try {
     let run: ConnectRun;
@@ -385,11 +396,28 @@ export async function connect(
  * read the caller's grant and secrets, which a background task has no
  * request context to do (the same constraint that scopes
  * startBestEffortConnect to env-less servers).
+ *
+ * A connect's discovery runs on the runner with TWO credentials, and the
+ * split is deliberate. The runner's own process credential reads the
+ * McpServer's metadata — under the built-in posture that credential is
+ * the operator's API key, and the operator is an organization admin
+ * (deploy/helm/stigmer: the signed-in operator mints the runner's key),
+ * whom the model makes an owner of every McpServer in the organization
+ * (authorization/model/mcp_server.ts), so a member's private server is
+ * readable. The connect token minted below reads the SECRETS: it is
+ * bound to this connect's ExecutionContext, and under the built-in
+ * posture the runner-subject verifier resolves its bearer to the person
+ * that row was created by — which is why the row is created as `identity`
+ * and not as the server. The end state where every RPC of a discovery
+ * acts as the person (the cloud's connect-sandbox shape) needs a row an
+ * env-less connect would also create; it creates none today, so that is
+ * a design act of its own, not a widening to make here.
  */
 export async function prepareConnect(
   deps: McpServerConnectDeps,
   mcpServer: McpServer,
   input: ConnectInput,
+  identity: CallerIdentity,
 ): Promise<PreparedConnect> {
   const mcpServerId = mcpServer.metadata?.id ?? "";
   const callerOrg = input.org;
@@ -402,7 +430,7 @@ export async function prepareConnect(
     await refreshOAuthTokenIfNeeded(deps, mcpServer, callerOrg);
   }
 
-  const executionId = `connect-${mcpServerId}-${randomUUID().slice(0, 8)}`;
+  const executionId = newConnectExecutionId(mcpServerId);
 
   const ecResourceId = await createConnectExecutionContext(
     deps,
@@ -410,6 +438,7 @@ export async function prepareConnect(
     executionId,
     callerOrg,
     input.runtimeEnv,
+    identity,
   );
 
   const workflowInput: ConnectWorkflowInput = {
@@ -464,6 +493,10 @@ export async function prepareConnect(
  * sources: OAuth-managed variables from the grant's managed environment,
  * the remainder from the user's personal environment. Returns "" when the
  * MCP server has no env declarations and no runtime_env.
+ *
+ * The row is created as `caller`, the person connecting (see the
+ * ConnectExecutionContextClient doc): its creator stamp is the connect
+ * token's person under the built-in posture.
  */
 async function createConnectExecutionContext(
   deps: McpServerConnectDeps,
@@ -471,6 +504,7 @@ async function createConnectExecutionContext(
   executionId: string,
   callerOrg: string,
   runtimeEnv: { [key: string]: ExecutionValue },
+  caller: CallerIdentity,
 ): Promise<string> {
   let ecData: { [key: string]: ExecutionValue };
 
@@ -540,6 +574,7 @@ async function createConnectExecutionContext(
           data: ecData,
         },
       }),
+      caller,
     );
   } catch (error) {
     throw internalError(error, "failed to create connect ExecutionContext");

package/src/domain/mcpserver/engine.ts

@@ -26,9 +26,15 @@
  * read RPC redacts secrets unless the caller presents an execution-scoped
  * runner token, and the discovery activity has no execution of its own to
  * exchange for one — the capability travels with the work item. It is a
- * decrypt-lane discriminator, not a secret value: short-TTL, bound to
- * this connect flow's ephemeral EC (deleted when the handler returns),
- * and useless once either expires.
+ * short-TTL token bound to this connect flow's ephemeral EC (deleted when
+ * the connect settles, on the blocking lane and the async one alike) and
+ * useless once either expires. What it unlocks depends on the posture:
+ * under trusted-local it is a decrypt-lane discriminator and nothing more;
+ * under the built-in authorization posture the same token also admits its
+ * bearer AS THE PERSON who asked for the connect, on every RPC, for as
+ * long as the EC row exists (runnerauth/runnerauth.ts, the two lanes by
+ * posture; runnerauth/bound-execution.ts, the `mcp-connect` binding). It
+ * sits in Temporal history in the clear like every server-written input.
  */
 export interface ConnectWorkflowInput {
   readonly mcp_server_id: string;