@stigmer/server 3.15.3-dev.20260916211208 → 3.16.1-dev.20260917224426

package/src/domain/mcpserver/start-connect.ts

@@ -118,7 +118,7 @@ export async function startConnect(
     }
   }
 
-  const prepared = await prepareConnect(deps, mcpServer, input);
+  const prepared = await prepareConnect(deps, mcpServer, input, identity);
 
   // Taken before the start so the advisory describes the queue the run is
   // about to join. Warn-only by design: a worker may be booting (the

package/src/domain/platform/__tests__/platform.test.ts

@@ -14,7 +14,10 @@
  *     executioncontext decrypt lane uses, bound to exactly the named
  *     execution id;
  *   - getRunnerBootstrapConfig echoes the configured Temporal coordinates
- *     with the token fields empty (minting a proxy token is cloud-only).
+ *     with the token fields empty (minting a proxy token is cloud-only);
+ *   - getServerInfo reports the build stamp by default and the release a
+ *     library consumer states through ComposeOptions.version otherwise
+ *     (stigmer#1168: unbundled, the stamp is always "dev").
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -178,6 +181,48 @@ describe("platform domain (composed server)", () => {
   });
 });
 
+describe("platform domain (composed with a stated version)", () => {
+  let server: ComposedServer;
+  let client: PlatformClient;
+  let dir: string;
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "platform-domain-version-test-"));
+    vi.stubEnv("STIGMER_ENCRYPTION_KEY", ENC_KEY.toString("base64"));
+    server = await composeServer({
+      config: loadConfig({
+        STIGMER_MODEL_REGISTRY_REFRESH: "off",
+        DB_PATH: path.join(dir, "stigmer.db"),
+        ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
+      }),
+      logger: silentLogger,
+      version: "3.99.0",
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    const port = await server.start();
+    client = createClient(
+      PlatformQueryController,
+      createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` }),
+    );
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+    vi.unstubAllEnvs();
+  });
+
+  it("getServerInfo reports the composition's stated release, not the build stamp", async () => {
+    // A library consumer (the cloud composition) runs no bundle, so the
+    // define is never stamped for it; ComposeOptions.version is how it
+    // states the release it installed. Edition is untouched by it.
+    const info = await client.getServerInfo({});
+    expect(info.version).toBe("3.99.0");
+    expect(info.edition).toBe(ServerEdition.oss);
+  });
+});
+
 describe("platform domain (keyless runner-token service)", () => {
   it("a keyless service answers not-minted — fail-soft, never an error", async () => {
     const transport = createRouterTransport((router) => {
@@ -188,6 +233,7 @@ describe("platform domain (keyless runner-token service)", () => {
           RunnerAuthService.create(undefined),
         ),
         edition: ServerEdition.oss,
+        version: "dev",
         logger: silentLogger,
       });
     });

package/src/domain/platform/controller.ts

@@ -10,21 +10,34 @@
  * composed-server pattern).
  *
  * getRunnerScopedToken is the mint side of the runner-token lane
- * (oss#535) — the seam src/runnerauth/ reserved for this sub-project. OSS
- * has no caller identity, so unlike the cloud exchange there is no
- * credential to verify: any caller naming an execution receives a token
- * for it. On a single-user server the token is the LANE DISCRIMINATOR that
- * lets the EC read RPCs redact by default without breaking the runner, not
- * a trust boundary (DD-004).
+ * (oss#535) — the seam src/runnerauth/. What the token IS depends on the
+ * server's posture, and so does who may obtain one:
+ *
+ *   - Under trusted-local (the laptop: one caller, nothing to separate)
+ *     the arms below mint a clocked token for any caller naming an
+ *     execution. The token is the LANE DISCRIMINATOR that lets the
+ *     ExecutionContext read RPCs redact by default without breaking the
+ *     runner, not a trust boundary — there is no identity for it to
+ *     change.
+ *   - Under the built-in authorization posture the same token is an
+ *     IDENTITY: the runner-subject verifier admits its bearer as the
+ *     human whose run it is (runnerauth/runner-subject-verifier.ts). A
+ *     mint for anyone would be impersonation, so the built-in provider
+ *     defines exchangeScopedToken and this controller delegates to it:
+ *     the run credential is minted for the run's own person and nobody
+ *     else (runnerauth/built-in-runner-credential-provider.ts). Runs get
+ *     their credential from the dispatch itself (the engine clients put
+ *     it on the workflow input); this exchange is the runner's fallback.
  *
  * The C4 capability delegation (20260827.09, gate ruling Q1): when the
  * composed provider defines exchangeScopedToken / bootstrapCredentials,
  * this controller delegates the exchange arms and the bootstrap
- * credential fields to it wholesale — the cloud's per-arm caller-class
- * gating, row authorization, and multi-lane minting are POLICY, not
- * contract, and live behind the seam. With neither defined (the OSS
- * default), every arm below behaves exactly as before; the conformance
- * suites pin that byte-identity.
+ * credential fields to it wholesale — per-arm caller gating, row
+ * authorization, and multi-lane minting are POLICY, not contract, and
+ * live behind the seam (the cloud's four-arm exchange; open source's
+ * built-in gate). With neither defined (the trusted-local default), every
+ * arm below behaves exactly as before; the conformance suites pin that
+ * byte-identity.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create } from "@bufbuild/protobuf";
@@ -50,7 +63,6 @@ import type {
   RunnerScopedTokenRequest,
 } from "../../runnerauth/runner-credential-provider.js";
 import { TOKEN_TYPE_EXECUTION_SCOPED } from "../../runnerauth/runnerauth.js";
-import { SERVER_VERSION } from "./version.js";
 
 export interface PlatformControllerDeps {
   /**
@@ -75,6 +87,13 @@ export interface PlatformControllerDeps {
    * cloud composition answers `cloud` without forking this controller.
    */
   readonly edition: ServerEdition;
+  /**
+   * The release reported beside the edition. The composition root resolves
+   * it (ComposeOptions.version, else SERVER_VERSION), so this controller
+   * never reads the build stamp itself: a library consumer with no bundle
+   * states its installed release and answers exactly as a bundle would.
+   */
+  readonly version: string;
   readonly logger: Logger;
 }
 
@@ -92,11 +111,11 @@ export function registerPlatformServices(
   });
 }
 
-/** Go GetServerInfo: the server edition and build version. */
+/** Go GetServerInfo: the server edition and release version. */
 function getServerInfo(deps: PlatformControllerDeps): GetServerInfoOutput {
   return create(GetServerInfoOutputSchema, {
     edition: deps.edition,
-    version: SERVER_VERSION,
+    version: deps.version,
   });
 }
 

package/src/domain/plugin/__tests__/materialize.test.ts

@@ -7,7 +7,9 @@
  * agent, the `mcpServers` key-to-slug rule, a skill archive rooted at its
  * SKILL.md with the plugin's labels on the request, a version the tag
  * pattern rejects becoming a warning, an overlay that redefines the
- * transport refused, and the convergence and drop rules over members.
+ * transport refused, the composed agent declaring its tools' variables
+ * (OAuth targets excluded, an authored agent left as written), and the
+ * convergence and drop rules over members.
  */
 import { describe, expect, it } from "vitest";
 
@@ -19,8 +21,11 @@ import type { PluginPackage } from "@stigmer/plugin-package";
 import { cursorPlugin, openPlugin } from "@stigmer/plugin-package/testing";
 import type { PluginFixture } from "@stigmer/plugin-package/testing";
 import { create } from "@bufbuild/protobuf";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import {
+  McpServerAuthSchema,
   McpServerSpecSchema,
   StdioServerConfigSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
@@ -224,6 +229,60 @@ describe("planMaterialization", () => {
     expect(builtPlan.skills[0]!.request.tag).toBe("");
   });
 
+  it("declares the servers' variables on the composed agent so a session asks for them", () => {
+    expect(plan.agent!.resource.spec?.env).toEqual({
+      GITHUB_TOKEN: expect.objectContaining({ isSecret: true, optional: false }),
+    });
+  });
+
+  it("leaves an OAuth-managed target out of the agent's declarations", () => {
+    const overlay = create(McpServerSchema, {
+      spec: create(McpServerSpecSchema, {
+        auth: create(McpServerAuthSchema, { targetEnvVar: "GITHUB_TOKEN" }),
+      }),
+    });
+    const withOAuth = planMaterialization(
+      pkg,
+      inMemoryPluginFiles(thermos),
+      {
+        workflows: [],
+        mcpServers: [
+          {
+            path: "ai.stigmer/mcp-servers/my_github.yaml",
+            server: "my_github",
+            resource: overlay,
+          },
+        ],
+      },
+      IDENTITY,
+      "",
+    );
+    // The server still declares it (the connect flow reads it there); the
+    // agent does not, because the value comes from a managed environment.
+    expect(withOAuth.mcpServers[0]!.resource.spec?.env).toHaveProperty("GITHUB_TOKEN");
+    expect(withOAuth.agent!.resource.spec?.env).toEqual({});
+  });
+
+  it("takes an authored agent as written, declarations included", () => {
+    const authored = create(AgentSchema, {
+      spec: create(AgentSpecSchema, {
+        instructions: "The author's own instructions for this agent.",
+      }),
+    });
+    const withOverlay = planMaterialization(
+      pkg,
+      inMemoryPluginFiles(thermos),
+      {
+        agent: { path: "ai.stigmer/agent.yaml", resource: authored },
+        workflows: [],
+        mcpServers: [],
+      },
+      IDENTITY,
+      "",
+    );
+    expect(withOverlay.agent!.resource.spec?.env).toEqual({});
+  });
+
   it("refuses a server overlay that redefines the transport", () => {
     const overlay = create(McpServerSchema, {
       spec: create(McpServerSpecSchema, {

package/src/domain/plugin/__tests__/plugin.test.ts

@@ -10,7 +10,9 @@
  * upgrade drops what the archive dropped; uninstall removes every member
  * and is refused while a user's own agent still references one; a slug an
  * unmanaged resource holds refuses the install; a bad overlay refuses
- * before any write.
+ * before any write. A second composition, under an authorizer that denies
+ * `can_write_reserved_labels`, pins the reserved-label refusal the
+ * open-source posture allows by design.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import net from "node:net";
@@ -46,11 +48,13 @@ import { SkillQueryController } from "@stigmer/protos/ai/stigmer/agentic/skill/v
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import { writeArchive } from "../../../archive/write.js";
 import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
+import type { Authorizer, AuthzCheck } from "../../../extensions/authorizer.js";
 import { createLogger } from "../../../boot/logger.js";
 import {
   PLUGIN_LABEL,
@@ -292,6 +296,12 @@ describe("Plugin push — materialisation", () => {
       isSecret: true,
       optional: false,
     });
+    // The agent declares the same variable, which is what makes a session
+    // ask for it and the execution's least-privilege filter pass it.
+    expect(agent.spec?.env["GITHUB_TOKEN"]).toMatchObject({
+      isSecret: true,
+      optional: false,
+    });
   });
 
   it("installs an MCP-only plugin as its servers and no agent", async () => {
@@ -679,3 +689,114 @@ describe("Plugin push — refusals before any write", () => {
     expect(agent.metadata?.labels[PLUGIN_LABEL]).toBe(installed.metadata?.id);
   });
 });
+
+/**
+ * The reserved-label refusal where an authorizer enforces. The open-source
+ * built-in authorizer allows `can_write_reserved_labels` by design, so the
+ * default composition above cannot show the refusal; this composition
+ * registers an authorizer that denies exactly that permission and allows
+ * everything else, the posture a hosted edition takes. An archive whose
+ * overlay carries a `stigmer.ai/*` label is refused before a byte is
+ * written, and a plain overlay under the same authorizer still installs —
+ * so the sanitiser asks the platform capability and nothing broader.
+ */
+describe("Plugin push under an authorizer that enforces reserved labels", () => {
+  let enforcingDir: string;
+  let enforcing: ComposedServer;
+  let enforcingPlugins: Client<typeof PluginCommandController>;
+  let enforcingQuery: Client<typeof PluginQueryController>;
+  const observed: AuthzCheck[] = [];
+
+  beforeAll(async () => {
+    enforcingDir = mkdtempSync(path.join(tmpdir(), "plugin-domain-enforcing-"));
+    const grpcPort = await reserveFreePort();
+    const authorizer: Authorizer = {
+      authorize(_caller, check) {
+        if (check.permission === IamPermission.can_write_reserved_labels) {
+          observed.push(check);
+          return Promise.resolve({
+            kind: "deny",
+            reason: "reserved labels are the platform's",
+          });
+        }
+        return Promise.resolve({ kind: "allow" });
+      },
+    };
+    enforcing = await composeServer({
+      config: loadConfig({
+        STIGMER_MODEL_REGISTRY_REFRESH: "off",
+        TEMPORAL_HOST_PORT: "127.0.0.1:1",
+        GRPC_PORT: String(grpcPort),
+        DB_PATH: path.join(enforcingDir, "stigmer.db"),
+        ARTIFACT_LOCAL_BASE_PATH: path.join(enforcingDir, "artifacts"),
+        STORAGE_PATH: path.join(enforcingDir, "storage"),
+      }),
+      logger: silentLogger,
+      host: "127.0.0.1",
+      extensions: [{ name: "reserved-labels-enforced", authorizer }],
+    });
+    const port = await enforcing.start();
+    const transport: Transport = createGrpcTransport({
+      baseUrl: `http://127.0.0.1:${port}`,
+    });
+    enforcingPlugins = createClient(PluginCommandController, transport);
+    enforcingQuery = createClient(PluginQueryController, transport);
+  });
+
+  afterAll(async () => {
+    await enforcing.shutdown();
+    rmSync(enforcingDir, { recursive: true, force: true });
+  });
+
+  it("refuses an archive whose overlay carries a reserved label, naming the document and the key, and writes nothing", async () => {
+    const name = uniqueName("plg-forged");
+    const forged = withFile(
+      thermosLike(name),
+      "ai.stigmer/agent.yaml",
+      [
+        "apiVersion: agentic.stigmer.ai/v1",
+        "kind: Agent",
+        "metadata:",
+        `  name: ${name}`,
+        "  labels:",
+        "    stigmer.ai/plugin: plg_somebody_else",
+        "spec:",
+        "  instructions: Long enough instructions for the forged agent.",
+        "",
+      ].join("\n"),
+    );
+    const error = await expectCode(
+      enforcingPlugins.push({ org: ORG, artifact: archiveOf(forged) }),
+      Code.InvalidArgument,
+    );
+    expect(error.rawMessage).toContain(
+      "cannot be set by a plugin (ai.stigmer/agent.yaml: stigmer.ai/plugin)",
+    );
+    expect(observed.map((c) => c.permission)).toEqual([
+      IamPermission.can_write_reserved_labels,
+    ]);
+    await expectCode(
+      enforcingQuery.getByReference(
+        createMessage(ApiResourceReferenceSchema, {
+          org: ORG,
+          kind: ApiResourceKind.plugin,
+          slug: name,
+        }),
+      ),
+      Code.NotFound,
+    );
+  });
+
+  it("installs a plain overlay under the same authorizer: the platform stamps its own labels through the in-process origin", async () => {
+    const name = uniqueName("plg-honest");
+    const installed = await enforcingPlugins.push({
+      org: ORG,
+      artifact: archiveOf(thermosLike(name)),
+    });
+    expect(installed.status?.state).toBe(PluginState.READY);
+    const { members } = await enforcingQuery.listMembers({
+      value: installed.metadata!.id,
+    });
+    expect(members).toHaveLength(3);
+  });
+});

package/src/domain/plugin/__tests__/sanitize.test.ts

@@ -1,7 +1,7 @@
 /**
  * Pins the sanitiser, the one place plugin-provided metadata is judged
  * before it rides the in-process lane: a `stigmer.ai/*` label in an
- * overlay is refused PERMISSION_DENIED naming the document and the keys
+ * overlay is refused INVALID_ARGUMENT naming the document and the keys
  * under a denying authorizer and passes under an allowing one (the
  * open-source posture), the operator check is consulted lazily and only
  * for the platform capability, a preset id and a name that describes
@@ -86,7 +86,7 @@ describe("sanitizeOverlays", () => {
         USER,
       ),
     );
-    expect(error.code).toBe(Code.PermissionDenied);
+    expect(error.code).toBe(Code.InvalidArgument);
     expect(error.rawMessage).toContain(
       "ai.stigmer/agent.yaml: stigmer.ai/default-agent",
     );

package/src/domain/plugin/materialize/agent.ts

@@ -14,6 +14,18 @@
  * `mcp_server_usage`, every `agents/*.md` as a `sub_agent` with access to
  * all the plugin's servers and the skills it asked for.
  *
+ * The composed agent declares in `env` the union of its servers' variables,
+ * OAuth-managed target variables excluded. An execution filters its
+ * environment to the AGENT's declared keys, and every client's session
+ * start asks the user for the AGENT's declared keys, so an agent declaring
+ * nothing over a server declaring `${API_TOKEN}` is never asked for the
+ * token and fails at its first tool call. The declaration on the agent is
+ * what routes the user's values to the execution; the declaration on the
+ * server stays too (the connect flow and the runner's per-server filter
+ * read it there). An OAuth target is excluded because its value is injected
+ * from a managed environment, never asked of the user. An author's
+ * `agent.yaml` is taken as written: they chose what to declare.
+ *
  * Model hints are recorded, never applied: a dialect's `model` becomes a
  * status warning and the sub-agent runs on the session's model. The
  * catalog seam exposes neither family nor cost tier, the runner drops a
@@ -25,6 +37,7 @@
 import { create } from "@bufbuild/protobuf";
 
 import type { PluginPackage, PluginSubAgent } from "@stigmer/plugin-package";
+import type { EnvVarDeclaration } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import {
@@ -47,6 +60,7 @@ import { renderDefaultAgentInstructions } from "./default-agent-instructions.js"
 import { memberMetadata } from "./identity.js";
 import type { PluginIdentity } from "./identity.js";
 import { mcpServerSlugOf } from "./mcp-servers.js";
+import type { PlannedMcpServer } from "./mcp-servers.js";
 import { skillSlugOf } from "./skills.js";
 
 export interface PlannedAgent {
@@ -67,6 +81,7 @@ export function carriesAgent(plugin: PluginPackage): boolean {
 export function planAgent(
   plugin: PluginPackage,
   overlayAgent: Agent | undefined,
+  mcpServers: readonly PlannedMcpServer[],
   identity: PluginIdentity,
   warnings: PluginWarning[],
 ): PlannedAgent | undefined {
@@ -95,6 +110,7 @@ export function planAgent(
   const spec = create(AgentSpecSchema, {
     description: plugin.description ?? "",
     instructions: renderDefaultAgentInstructions(plugin),
+    env: toolVariables(mcpServers),
     skillRefs: [...skillSlugByName.values()].map((slug) =>
       create(ApiResourceReferenceSchema, {
         org: identity.org,
@@ -127,6 +143,28 @@ export function planAgent(
   };
 }
 
+/**
+ * The variables the agent's tools need from the user: every server's
+ * declarations, minus each server's OAuth target. Two servers declaring
+ * one name share one declaration; the first server's wins, and the
+ * library already refuses a plugin whose variables disagree about a name.
+ */
+export function toolVariables(
+  mcpServers: readonly PlannedMcpServer[],
+): Record<string, EnvVarDeclaration> {
+  const declarations: Record<string, EnvVarDeclaration> = {};
+  for (const server of mcpServers) {
+    const spec = server.resource.spec;
+    if (spec === undefined) continue;
+    const oauthTarget = spec.auth?.targetEnvVar ?? "";
+    for (const [name, declaration] of Object.entries(spec.env)) {
+      if (name === oauthTarget || name in declarations) continue;
+      declarations[name] = declaration;
+    }
+  }
+  return declarations;
+}
+
 function planSubAgent(
   subAgent: PluginSubAgent,
   identity: PluginIdentity,

package/src/domain/plugin/materialize/plan.ts

@@ -96,7 +96,13 @@ export function planMaterialization(
     ),
     identity,
   );
-  const agent = planAgent(plugin, overlays.agent?.resource, identity, warnings);
+  const agent = planAgent(
+    plugin,
+    overlays.agent?.resource,
+    mcpServers,
+    identity,
+    warnings,
+  );
   const workflows = planWorkflows(overlays.workflows, identity);
 
   const members: PlannedMember[] = [

package/src/domain/plugin/overlay/sanitize.ts

@@ -13,7 +13,9 @@
  *     `platform:stigmer`, the same check GuardReservedLabels runs and the
  *     same lazy consultation of the one composed Authorizer (the
  *     open-source permissive default allows; an enforcing authorizer
- *     denies with PERMISSION_DENIED naming the keys);
+ *     denies with INVALID_ARGUMENT naming the keys, the code the
+ *     reserved-label guard answers a client mutation with, so one refusal
+ *     class carries one code wherever it is met);
  *   - `metadata.id` is the server's to mint, never an author's;
  *   - the agent overlay's name is the plugin's, a server overlay's name is
  *     its `mcpServers` key, a workflow overlay's name is its file stem: an
@@ -130,7 +132,7 @@ export async function sanitizeOverlays(
       throw new ConnectError(
         `Labels in the reserved '${RESERVED_LABEL_PREFIX}' namespace are platform-managed and ` +
           `cannot be set by a plugin (${listed}). Remove them from the plugin's ai.stigmer/ documents.`,
-        Code.PermissionDenied,
+        Code.InvalidArgument,
       );
     }
     case "unavailable":

package/src/domain/project/__tests__/reconcile.test.ts

@@ -237,10 +237,12 @@ describe("orphan deletion (Go service_test.go)", () => {
     ]);
   });
 
-  it("orphan lookup is slug-only, matching across orgs (pinned Go behavior)", async () => {
-    // Seeded under org "local"; the orphan reference carries a DIFFERENT
-    // org — resolution still matches, because Go's resolveResourceID
-    // filters by slug alone (reconcile/service.go:126).
+  it("orphan lookup is scoped to the reference's org: another org's same-slug resource is never touched", async () => {
+    // Slugs are org-scoped identifiers. Seeded under org "local"; the orphan
+    // reference names a DIFFERENT org, so it must not resolve to this row.
+    // (The Go port matched by slug alone; on a backend with a system org
+    // beside the user's, a prune could then delete the wrong org's
+    // resource — stigmer/stigmer#1151.)
     await seedAgent("agent-id-x", "cross-org-agent");
     const deleter = new RecordingDeleter();
     const previous = [
@@ -251,9 +253,53 @@ describe("orphan deletion (Go service_test.go)", () => {
       }),
     ];
     const result = await service(deleter).reconcile(previous, [], DEFAULT_RECONCILIATION_OPTIONS);
+    expect(result.removed).toHaveLength(0);
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0]?.resourceKey).toBe("agent:cross-org-agent");
+    expect(result.errors[0]?.message).toBe("failed to resolve resource for deletion");
+    expect(deleter.calls).toHaveLength(0);
+  });
+
+  it("orphan lookup picks the reference's org when two orgs hold the slug", async () => {
+    await seedAgent("agent-id-local", "shared-slug");
+    await store.saveResource(
+      ApiResourceKind.agent,
+      "agent-id-other",
+      AgentSchema,
+      create(AgentSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "Agent",
+        metadata: { id: "agent-id-other", name: "shared-slug", slug: "shared-slug", org: "another-org" },
+      }),
+    );
+    const deleter = new RecordingDeleter();
+    const previous = [
+      create(ApiResourceReferenceSchema, {
+        org: "another-org",
+        kind: ApiResourceKind.agent,
+        slug: "shared-slug",
+      }),
+    ];
+    const result = await service(deleter).reconcile(previous, [], DEFAULT_RECONCILIATION_OPTIONS);
+    expect(result.removed).toHaveLength(1);
+    expect(deleter.calls).toEqual([
+      { kind: ApiResourceKind.agent, resourceId: "agent-id-other" },
+    ]);
+  });
+
+  it("a reference without an org keeps the unscoped lookup (a pre-scoping client's project)", async () => {
+    await seedAgent("agent-id-y", "legacy-agent");
+    const deleter = new RecordingDeleter();
+    const previous = [
+      create(ApiResourceReferenceSchema, {
+        kind: ApiResourceKind.agent,
+        slug: "legacy-agent",
+      }),
+    ];
+    const result = await service(deleter).reconcile(previous, [], DEFAULT_RECONCILIATION_OPTIONS);
     expect(result.removed).toHaveLength(1);
     expect(deleter.calls).toEqual([
-      { kind: ApiResourceKind.agent, resourceId: "agent-id-x" },
+      { kind: ApiResourceKind.agent, resourceId: "agent-id-y" },
     ]);
   });
 

package/src/domain/project/reconcile.ts

@@ -37,6 +37,7 @@ import { ReconciliationSummarySchema } from "@stigmer/protos/ai/stigmer/tenancy/
 import type { ReconciliationSummary } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/status_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
 import type { Store } from "../../store/interface.js";
 
@@ -205,28 +206,32 @@ async function deleteOrphans(
 }
 
 /**
- * Resolves an orphan reference to its resource id — Go resolveResourceID:
- * FindByField on metadata.slug, SLUG ONLY, no org filter (the pinned
- * behavior: first match of that kind+slug across all orgs; tolerable in
- * single-tenant OSS).
+ * Resolves an orphan reference to its resource id, within the org the
+ * reference names. Slugs are org-scoped identifiers: a local backend holds
+ * the `stigmer` system org beside the user's, a self-host holds many, and
+ * the same slug may exist in several. The Go port matched by slug alone and
+ * could prune another org's resource (stigmer/stigmer#1151); the CLI has
+ * always stamped `org` on every member reference, so scoping is a change
+ * of lookup, not of contract. A reference without an org (a project written
+ * before members carried one) keeps the unscoped match, the helper's
+ * documented empty-org arm.
  */
 async function resolveResourceId(
   store: Store,
   ref: ApiResourceReference,
 ): Promise<string> {
   const schema = schemaForKind(ref.kind);
-  let resource;
-  try {
-    resource = await store.findByField(
-      ref.kind,
-      "metadata.slug",
-      ref.slug,
-      schema,
-    );
-  } catch (cause) {
+  const resource = await findResourceBySlug(
+    store,
+    ref.kind,
+    schema,
+    ref.slug,
+    ref.org,
+  );
+  if (resource === undefined) {
+    const where = ref.org === "" ? "" : ` in org '${ref.org}'`;
     throw new Error(
-      `resource ${kindName(ref.kind)}/${ref.slug} not found: ${cause instanceof Error ? cause.message : String(cause)}`,
-      { cause },
+      `resource ${kindName(ref.kind)}/${ref.slug} not found${where}`,
     );
   }