@stigmer/server 3.18.0-dev.20260918103812 → 3.18.0

package/src/domain/platform/__tests__/platform.test.ts

@@ -15,6 +15,9 @@
  *     execution id;
  *   - getRunnerBootstrapConfig echoes the configured Temporal coordinates
  *     with the token fields empty (minting a proxy token is cloud-only);
+ *   - getServerInfo reports the build stamp by default and the release a
+ *     library consumer states through ComposeOptions.version otherwise
+ *     (stigmer#1168: unbundled, the stamp is always "dev");
  *   - getLicenseStatus answers `absent` with no claims and no key when no
  *     provider is composed, and the composed provider's report verbatim
  *     when one is — both stamped with the ONE instant the controller
@@ -229,6 +232,48 @@ describe("platform domain (composed server)", () => {
   });
 });
 
+describe("platform domain (composed with a stated version)", () => {
+  let server: ComposedServer;
+  let client: PlatformClient;
+  let dir: string;
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "platform-domain-version-test-"));
+    vi.stubEnv("STIGMER_ENCRYPTION_KEY", ENC_KEY.toString("base64"));
+    server = await composeServer({
+      config: loadConfig({
+        STIGMER_MODEL_REGISTRY_REFRESH: "off",
+        DB_PATH: path.join(dir, "stigmer.db"),
+        ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
+      }),
+      logger: silentLogger,
+      version: "3.99.0",
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    const port = await server.start();
+    client = createClient(
+      PlatformQueryController,
+      createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` }),
+    );
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+    vi.unstubAllEnvs();
+  });
+
+  it("getServerInfo reports the composition's stated release, not the build stamp", async () => {
+    // A library consumer (the cloud composition) runs no bundle, so the
+    // define is never stamped for it; ComposeOptions.version is how it
+    // states the release it installed. Edition is untouched by it.
+    const info = await client.getServerInfo({});
+    expect(info.version).toBe("3.99.0");
+    expect(info.edition).toBe(ServerEdition.oss);
+  });
+});
+
 describe("platform domain (keyless runner-token service)", () => {
   it("a keyless service answers not-minted — fail-soft, never an error", async () => {
     const transport = createRouterTransport((router) => {
@@ -239,6 +284,7 @@ describe("platform domain (keyless runner-token service)", () => {
           RunnerAuthService.create(undefined),
         ),
         edition: ServerEdition.oss,
+        version: "dev",
         licenseStatus: ABSENT_LICENSE_STATUS,
         now: () => new Date(),
         logger: silentLogger,
@@ -273,6 +319,7 @@ describe("platform domain (license status)", () => {
           RunnerAuthService.create(undefined),
         ),
         edition: ServerEdition.enterprise,
+        version: "dev",
         licenseStatus: provider,
         now: () => instant,
         logger: silentLogger,

package/src/domain/platform/controller.ts

@@ -7,7 +7,7 @@
  * getRunnerBootstrapConfig and getLicenseStatus shapes; getRunnerScopedToken
  * is deliberately excluded there — its arms are exercised mid-execution)
  * and __tests__/platform.test.ts (the fail-soft mint matrix, the license
- * status arms, the #15 composed-server pattern).
+ * status arms, the stated-version arm, the #15 composed-server pattern).
  *
  * getLicenseStatus is the one arm every edition answers from a driver
  * point: a server's license is a fact about the server, like its edition,
@@ -75,7 +75,6 @@ import type {
   RunnerScopedTokenRequest,
 } from "../../runnerauth/runner-credential-provider.js";
 import { TOKEN_TYPE_EXECUTION_SCOPED } from "../../runnerauth/runnerauth.js";
-import { SERVER_VERSION } from "./version.js";
 
 export interface PlatformControllerDeps {
   /**
@@ -100,6 +99,13 @@ export interface PlatformControllerDeps {
    * cloud composition answers `cloud` without forking this controller.
    */
   readonly edition: ServerEdition;
+  /**
+   * The release reported beside the edition. The composition root resolves
+   * it (ComposeOptions.version, else SERVER_VERSION), so this controller
+   * never reads the build stamp itself: a library consumer with no bundle
+   * states its installed release and answers exactly as a bundle would.
+   */
+  readonly version: string;
   /**
    * What license this server holds (extensions/license-status.ts). The
    * composition root installs the built-in `absent` provider when no unit
@@ -130,11 +136,11 @@ export function registerPlatformServices(
   });
 }
 
-/** Go GetServerInfo: the server edition and build version. */
+/** Go GetServerInfo: the server edition and release version. */
 function getServerInfo(deps: PlatformControllerDeps): GetServerInfoOutput {
   return create(GetServerInfoOutputSchema, {
     edition: deps.edition,
-    version: SERVER_VERSION,
+    version: deps.version,
   });
 }
 

package/src/domain/plugin/__tests__/materialize.test.ts

@@ -8,8 +8,10 @@
  * SKILL.md with the plugin's labels on the request, a version the tag
  * pattern rejects becoming a warning, an overlay that redefines the
  * transport refused, the composed agent declaring its tools' variables
- * (OAuth targets excluded, an authored agent left as written), and the
- * convergence and drop rules over members.
+ * (OAuth targets excluded, an authored agent left as written), and each
+ * planned member's system flag read from its overlay and never from a
+ * skill. The member rules themselves (the slug decision, convergence, the
+ * dropped set) are members.test.ts's.
  */
 import { describe, expect, it } from "vitest";
 
@@ -37,6 +39,7 @@ import { openArchive } from "../../../archive/open.js";
 import {
   PLUGIN_LABEL,
   PLUGIN_VERSION_LABEL,
+  SYSTEM_LABEL,
 } from "../../../pipeline/apiresource-labels.js";
 import {
   DEFAULT_AGENT_INSTRUCTIONS_VERSION,
@@ -45,8 +48,6 @@ import {
 import type { PluginIdentity } from "../materialize/identity.js";
 import { McpServerOverlayError } from "../materialize/mcp-servers.js";
 import { planMaterialization } from "../materialize/plan.js";
-import { droppedMembers, membersConverge } from "../members.js";
-import type { Member } from "../members.js";
 
 const IDENTITY: PluginIdentity = {
   org: "acme",
@@ -231,7 +232,10 @@ describe("planMaterialization", () => {
 
   it("declares the servers' variables on the composed agent so a session asks for them", () => {
     expect(plan.agent!.resource.spec?.env).toEqual({
-      GITHUB_TOKEN: expect.objectContaining({ isSecret: true, optional: false }),
+      GITHUB_TOKEN: expect.objectContaining({
+        isSecret: true,
+        optional: false,
+      }),
     });
   });
 
@@ -259,7 +263,9 @@ describe("planMaterialization", () => {
     );
     // The server still declares it (the connect flow reads it there); the
     // agent does not, because the value comes from a managed environment.
-    expect(withOAuth.mcpServers[0]!.resource.spec?.env).toHaveProperty("GITHUB_TOKEN");
+    expect(withOAuth.mcpServers[0]!.resource.spec?.env).toHaveProperty(
+      "GITHUB_TOKEN",
+    );
     expect(withOAuth.agent!.resource.spec?.env).toEqual({});
   });
 
@@ -313,50 +319,39 @@ describe("planMaterialization", () => {
   });
 });
 
-describe("members: convergence and drops", () => {
-  const digest = "d".repeat(64);
-  const stored: Member[] = [
-    {
-      kind: ApiResourceKind.skill,
-      id: "skl_1",
-      slug: "thermo-review",
-      name: "thermo-review",
-      version: digest,
-    },
-    {
-      kind: ApiResourceKind.agent,
-      id: "agt_1",
-      slug: "thermos",
-      name: "thermos",
-      version: digest,
-    },
-  ];
-  const planned = [
-    {
-      kind: ApiResourceKind.skill,
-      slug: "thermo-review",
-      name: "thermo-review",
-    },
-    { kind: ApiResourceKind.agent, slug: "thermos", name: "thermos" },
-  ];
+describe("planned members: the system flag", () => {
+  const pkg = read(thermos);
 
-  it("converges only when every planned member is present and stamped with the digest", () => {
-    expect(membersConverge(stored, planned, digest)).toBe(true);
-    expect(membersConverge(stored, planned, "e".repeat(64))).toBe(false);
-    expect(membersConverge(stored.slice(1), planned, digest)).toBe(false);
-    expect(
-      membersConverge(
-        [...stored, { ...stored[0]!, slug: "extra", id: "skl_2" }],
-        planned,
-        digest,
-      ),
-    ).toBe(false);
+  it("reads system content from the overlay's labels, never from a skill's request", () => {
+    const authored = create(AgentSchema, {
+      metadata: { name: "thermos", labels: { [SYSTEM_LABEL]: "true" } },
+      spec: create(AgentSpecSchema, { instructions: "You read thermostats." }),
+    });
+    const plan = planMaterialization(
+      pkg,
+      inMemoryPluginFiles(thermos),
+      {
+        agent: { path: "ai.stigmer/agent.yaml", resource: authored },
+        workflows: [],
+        mcpServers: [],
+      },
+      IDENTITY,
+      "",
+    );
+    const byKind = new Map(plan.members.map((m) => [m.kind, m.system]));
+    expect(byKind.get(ApiResourceKind.agent)).toBe(true);
+    expect(byKind.get(ApiResourceKind.skill)).toBe(false);
+    expect(byKind.get(ApiResourceKind.mcp_server)).toBe(false);
   });
 
-  it("drops the members the plan no longer names", () => {
-    expect(droppedMembers(stored, planned.slice(1)).map((m) => m.slug)).toEqual(
-      ["thermo-review"],
+  it("plans no system content when no overlay declares it", () => {
+    const plan = planMaterialization(
+      pkg,
+      inMemoryPluginFiles(thermos),
+      { workflows: [], mcpServers: [] },
+      IDENTITY,
+      "",
     );
-    expect(droppedMembers(stored, planned)).toEqual([]);
+    expect(plan.members.every((m) => m.system === false)).toBe(true);
   });
 });

package/src/domain/plugin/__tests__/members.test.ts

@@ -0,0 +1,149 @@
+/**
+ * Pins the member rules on plain values, no store: the slug decision
+ * (`judgeSlug`) in each of its five arms — free, ours, adopt when system
+ * content meets system content, refused for an unmanaged row whenever
+ * either side lacks the label, refused for another plugin's member
+ * whatever labels either side carries — and the convergence and drop rules
+ * over stored and planned members. The same decision through a composed
+ * server, with a real authorizer, is plugin.test.ts's.
+ */
+import { describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { droppedMembers, judgeSlug, membersConverge } from "../members.js";
+import type { Member, PlannedMember, SlugHolder } from "../members.js";
+
+const DIGEST = "d".repeat(64);
+const OURS = "plg_ours";
+const OTHER = "plg_other";
+
+function stored(overrides: Partial<Member> = {}): Member {
+  return {
+    kind: ApiResourceKind.agent,
+    id: "agt_1",
+    slug: "assistant",
+    name: "assistant",
+    version: DIGEST,
+    system: false,
+    ...overrides,
+  };
+}
+
+function planned(overrides: Partial<PlannedMember> = {}): PlannedMember {
+  return {
+    kind: ApiResourceKind.agent,
+    slug: "assistant",
+    name: "assistant",
+    system: false,
+    ...overrides,
+  };
+}
+
+function heldBy(
+  byPlugin: string | undefined,
+  holder: Member = stored(),
+): SlugHolder {
+  return { held: true, byPlugin, holder };
+}
+
+describe("judgeSlug", () => {
+  it("is free when nothing holds the slug", () => {
+    expect(judgeSlug({ held: false }, planned(), OURS)).toEqual({
+      kind: "free",
+    });
+  });
+
+  it("is ours when this plugin already holds it, whatever the labels", () => {
+    const holder = stored({ system: true });
+    expect(judgeSlug(heldBy(OURS, holder), planned(), OURS)).toEqual({
+      kind: "ours",
+      holder,
+    });
+  });
+
+  it("adopts an unmanaged row only when both sides are system content", () => {
+    const holder = stored({ system: true });
+    expect(
+      judgeSlug(heldBy(undefined, holder), planned({ system: true }), OURS),
+    ).toEqual({ kind: "adopt", holder });
+  });
+
+  it("refuses an unmanaged row when either side lacks the system label", () => {
+    const userRow = stored({ system: false });
+    expect(
+      judgeSlug(heldBy(undefined, userRow), planned({ system: true }), OURS),
+    ).toEqual({ kind: "held-unmanaged", holder: userRow });
+
+    const systemRow = stored({ system: true });
+    expect(
+      judgeSlug(heldBy(undefined, systemRow), planned({ system: false }), OURS),
+    ).toEqual({ kind: "held-unmanaged", holder: systemRow });
+
+    expect(
+      judgeSlug(heldBy(undefined, userRow), planned({ system: false }), OURS),
+    ).toEqual({ kind: "held-unmanaged", holder: userRow });
+  });
+
+  it("never transfers another plugin's member, even system content to system content", () => {
+    const holder = stored({ system: true });
+    expect(
+      judgeSlug(heldBy(OTHER, holder), planned({ system: true }), OURS),
+    ).toEqual({ kind: "held-by-plugin", holder, pluginId: OTHER });
+  });
+});
+
+describe("members: convergence and drops", () => {
+  const stored: Member[] = [
+    {
+      kind: ApiResourceKind.skill,
+      id: "skl_1",
+      slug: "thermo-review",
+      name: "thermo-review",
+      version: DIGEST,
+      system: false,
+    },
+    {
+      kind: ApiResourceKind.agent,
+      id: "agt_1",
+      slug: "thermos",
+      name: "thermos",
+      version: DIGEST,
+      system: false,
+    },
+  ];
+  const planned: PlannedMember[] = [
+    {
+      kind: ApiResourceKind.skill,
+      slug: "thermo-review",
+      name: "thermo-review",
+      system: false,
+    },
+    {
+      kind: ApiResourceKind.agent,
+      slug: "thermos",
+      name: "thermos",
+      system: false,
+    },
+  ];
+
+  it("converges only when every planned member is present and stamped with the digest", () => {
+    expect(membersConverge(stored, planned, DIGEST)).toBe(true);
+    expect(membersConverge(stored, planned, "e".repeat(64))).toBe(false);
+    expect(membersConverge(stored.slice(1), planned, DIGEST)).toBe(false);
+    expect(
+      membersConverge(
+        [...stored, { ...stored[0]!, slug: "extra", id: "skl_2" }],
+        planned,
+        DIGEST,
+      ),
+    ).toBe(false);
+  });
+
+  it("drops the members the plan no longer names", () => {
+    expect(droppedMembers(stored, planned.slice(1)).map((m) => m.slug)).toEqual(
+      ["thermo-review"],
+    );
+    expect(droppedMembers(stored, planned)).toEqual([]);
+  });
+});

package/src/domain/plugin/__tests__/plugin.test.ts

@@ -9,10 +9,14 @@
  * delete of a member is refused naming the plugin while the plugin's own
  * upgrade drops what the archive dropped; uninstall removes every member
  * and is refused while a user's own agent still references one; a slug an
- * unmanaged resource holds refuses the install; a bad overlay refuses
- * before any write. A second composition, under an authorizer that denies
- * `can_write_reserved_labels`, pins the reserved-label refusal the
- * open-source posture allows by design.
+ * unmanaged resource holds refuses the install, and a user's row is never
+ * adopted whichever side declares system content; a bad overlay refuses
+ * before any write. A second composition, under an authorizer that decides
+ * `can_write_reserved_labels` per test, pins the reserved-label refusal the
+ * open-source posture allows by design, and the one adoption the platform
+ * makes: an operator's plugin taking over the system-content row it
+ * replaces in place, the row's id and default instance kept, a member's
+ * identical push refused before the slug is judged.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import net from "node:net";
@@ -38,6 +42,7 @@ import {
   AgentSpecSchema,
   McpServerUsageSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import { AgentInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/query_pb";
 import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
 import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
 import { PluginCommandController } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/command_pb";
@@ -59,6 +64,7 @@ import { createLogger } from "../../../boot/logger.js";
 import {
   PLUGIN_LABEL,
   PLUGIN_VERSION_LABEL,
+  SYSTEM_LABEL,
 } from "../../../pipeline/apiresource-labels.js";
 
 const silentLogger = createLogger({
@@ -507,6 +513,66 @@ describe("Plugin members are the plugin's to redefine", () => {
     );
   });
 
+  it("never adopts a user's agent: a same-slug row without the system label is refused even when the plugin declares system content, and a system row is refused by a plugin that does not", async () => {
+    // The open-source authorizer grants reserved-label writes to everyone,
+    // so this is the posture where the label alone would be a weak guard;
+    // the rule needs BOTH sides to carry it.
+    const name = uniqueName("users-own");
+    await agents.create(
+      createMessage(AgentSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "Agent",
+        metadata: createMessage(ApiResourceMetadataSchema, { org: ORG, name }),
+        spec: createMessage(AgentSpecSchema, {
+          instructions: "Mine, written by hand, under my own name.",
+        }),
+      }),
+    );
+    await expectCode(
+      plugins.push({ org: ORG, artifact: archiveOf(systemOverlay(name)) }),
+      Code.AlreadyExists,
+      `'${name}' exists in org '${ORG}' and is not managed by a plugin`,
+    );
+
+    const seeded = uniqueName("seeded-row");
+    await agents.create(
+      createMessage(AgentSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "Agent",
+        metadata: createMessage(ApiResourceMetadataSchema, {
+          org: ORG,
+          name: seeded,
+          labels: { [SYSTEM_LABEL]: "true" },
+        }),
+        spec: createMessage(AgentSpecSchema, {
+          instructions: "System content a plain plugin may not take over.",
+        }),
+      }),
+    );
+    await expectCode(
+      plugins.push({
+        org: ORG,
+        artifact: archiveOf(
+          withFile(
+            thermosLike(seeded),
+            "ai.stigmer/agent.yaml",
+            [
+              "apiVersion: agentic.stigmer.ai/v1",
+              "kind: Agent",
+              "metadata:",
+              `  name: ${seeded}`,
+              "spec:",
+              "  instructions: A plain overlay that declares no system content.",
+              "",
+            ].join("\n"),
+          ),
+        ),
+      }),
+      Code.AlreadyExists,
+      `'${seeded}' exists in org '${ORG}' and is not managed by a plugin`,
+    );
+  });
+
   it("refuses to install a slug another plugin holds, naming that plugin", async () => {
     const first = uniqueName("holder");
     const second = uniqueName("claimant");
@@ -705,7 +771,14 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
   let enforcing: ComposedServer;
   let enforcingPlugins: Client<typeof PluginCommandController>;
   let enforcingQuery: Client<typeof PluginQueryController>;
+  let enforcingAgents: Client<typeof AgentCommandController>;
+  let enforcingAgentQuery: Client<typeof AgentQueryController>;
+  let enforcingInstanceQuery: Client<typeof AgentInstanceQueryController>;
   const observed: AuthzCheck[] = [];
+  // Who the caller is to this authorizer: a member (reserved labels denied,
+  // the hosted default) or the platform operator (granted). The tests flip
+  // it, so one composition shows both sides of every reserved-label rule.
+  let reservedLabels: "deny" | "allow" = "deny";
 
   beforeAll(async () => {
     enforcingDir = mkdtempSync(path.join(tmpdir(), "plugin-domain-enforcing-"));
@@ -714,10 +787,11 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
       authorize(_caller, check) {
         if (check.permission === IamPermission.can_write_reserved_labels) {
           observed.push(check);
-          return Promise.resolve({
-            kind: "deny",
-            reason: "reserved labels are the platform's",
-          });
+          return Promise.resolve(
+            reservedLabels === "allow"
+              ? { kind: "allow" }
+              : { kind: "deny", reason: "reserved labels are the platform's" },
+          );
         }
         return Promise.resolve({ kind: "allow" });
       },
@@ -741,6 +815,12 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
     });
     enforcingPlugins = createClient(PluginCommandController, transport);
     enforcingQuery = createClient(PluginQueryController, transport);
+    enforcingAgents = createClient(AgentCommandController, transport);
+    enforcingAgentQuery = createClient(AgentQueryController, transport);
+    enforcingInstanceQuery = createClient(
+      AgentInstanceQueryController,
+      transport,
+    );
   });
 
   afterAll(async () => {
@@ -799,4 +879,135 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
     });
     expect(members).toHaveLength(3);
   });
+
+  it("adopts a system-content row the operator's plugin replaces: same id, same default instance, the plugin's definition, one warning", async () => {
+    reservedLabels = "allow";
+    const name = uniqueName("plg-adopt");
+    // The row the platform seeded before plugins existed: system content,
+    // no plugin label, a default instance of its own.
+    const seeded = await enforcingAgents.create(
+      createMessage(AgentSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "Agent",
+        metadata: createMessage(ApiResourceMetadataSchema, {
+          org: ORG,
+          name,
+          labels: { [SYSTEM_LABEL]: "true" },
+        }),
+        spec: createMessage(AgentSpecSchema, {
+          instructions: "The instructions the seedpack wrote, long ago.",
+        }),
+      }),
+    );
+    const seededId = seeded.metadata!.id;
+    const seededInstanceId = seeded.status?.defaultInstanceId ?? "";
+    expect(seededInstanceId).not.toBe("");
+
+    const installed = await enforcingPlugins.push({
+      org: ORG,
+      artifact: archiveOf(systemOverlay(name)),
+    });
+    expect(installed.status?.state).toBe(PluginState.READY);
+    const adopted = installed.status!.warnings.filter(
+      (warning) => warning.kind === "member-adopted",
+    );
+    expect(adopted).toHaveLength(1);
+    expect(adopted[0]!.path).toBe("ai.stigmer/agent.yaml");
+    expect(adopted[0]!.message).toContain(`agent '${name}' (${seededId})`);
+    expect(adopted[0]!.message).toContain("conversations continue");
+
+    const after = await enforcingAgentQuery.get({ value: seededId });
+    expect(after.metadata?.labels[PLUGIN_LABEL]).toBe(installed.metadata!.id);
+    expect(after.metadata?.labels[PLUGIN_VERSION_LABEL]).toBe(
+      installed.status!.digest,
+    );
+    expect(after.metadata?.labels[SYSTEM_LABEL]).toBe("true");
+    expect(after.spec?.instructions).toBe(
+      "You are the platform's own agent, re-homed under a plugin.",
+    );
+    expect(after.status?.defaultInstanceId).toBe(seededInstanceId);
+    const instance = await enforcingInstanceQuery.get({
+      value: seededInstanceId,
+    });
+    expect(instance.spec?.agentId).toBe(seededId);
+
+    const { members } = await enforcingQuery.listMembers({
+      value: installed.metadata!.id,
+    });
+    expect(
+      members.find((member) => member.kind === ApiResourceKind.agent)?.id,
+    ).toBe(seededId);
+
+    // The second push of the same archive converges without a write.
+    const again = await enforcingPlugins.push({
+      org: ORG,
+      artifact: archiveOf(systemOverlay(name)),
+    });
+    expect(again.status?.digest).toBe(installed.status?.digest);
+    expect(
+      (await enforcingAgentQuery.get({ value: seededId })).status
+        ?.defaultInstanceId,
+    ).toBe(seededInstanceId);
+    reservedLabels = "deny";
+  });
+
+  it("refuses the same archive from a member before the slug is judged, and leaves the seeded row untouched", async () => {
+    reservedLabels = "allow";
+    const name = uniqueName("plg-member");
+    const seeded = await enforcingAgents.create(
+      createMessage(AgentSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "Agent",
+        metadata: createMessage(ApiResourceMetadataSchema, {
+          org: ORG,
+          name,
+          labels: { [SYSTEM_LABEL]: "true" },
+        }),
+        spec: createMessage(AgentSpecSchema, {
+          instructions: "The instructions the seedpack wrote, long ago.",
+        }),
+      }),
+    );
+    reservedLabels = "deny";
+    const error = await expectCode(
+      enforcingPlugins.push({
+        org: ORG,
+        artifact: archiveOf(systemOverlay(name)),
+      }),
+      Code.InvalidArgument,
+    );
+    expect(error.rawMessage).toContain(
+      `cannot be set by a plugin (ai.stigmer/agent.yaml: ${SYSTEM_LABEL})`,
+    );
+    const untouched = await enforcingAgentQuery.get({
+      value: seeded.metadata!.id,
+    });
+    expect(untouched.metadata?.labels[PLUGIN_LABEL]).toBeUndefined();
+    expect(untouched.spec?.instructions).toBe(
+      "The instructions the seedpack wrote, long ago.",
+    );
+  });
 });
+
+/**
+ * A plugin whose agent overlay declares system content under the given
+ * name: the shape of the official `assistant` plugin, whose agent replaces
+ * the row the retired seedpack wrote under the same slug.
+ */
+function systemOverlay(name: string): PluginFixture {
+  return withFile(
+    thermosLike(name),
+    "ai.stigmer/agent.yaml",
+    [
+      "apiVersion: agentic.stigmer.ai/v1",
+      "kind: Agent",
+      "metadata:",
+      `  name: ${name}`,
+      "  labels:",
+      `    ${SYSTEM_LABEL}: "true"`,
+      "spec:",
+      "  instructions: You are the platform's own agent, re-homed under a plugin.",
+      "",
+    ].join("\n"),
+  );
+}