@stigmer/server 3.18.0-dev.20260918103812 → 3.18.1-dev.20260919070736

package/src/sandbox/steps.ts

@@ -50,7 +50,6 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 
 import type { Logger } from "../boot/logger.js";
 import type { AgentExecutionTemporalConfig } from "../domain/agentexecution/temporal/config.js";
-import type { CallerIdentity } from "../extensions/identity.js";
 import {
   WORKFLOW_ROUTING_EXECUTION,
   type WorkflowExecutionTemporalConfig,
@@ -73,17 +72,6 @@ import { mintSandboxToken, type SandboxLane } from "./lane.js";
 export const SANDBOX_PROVISIONING_FAILED_PREFIX =
   "Sandbox provisioning failed: ";
 
-/**
- * The two facts about the requesting caller a sandbox ensure carries, cut
- * from the chain's CallerIdentity (the domain/identityaccount/actor.ts
- * shape): the id rides into the credential mint, so the session token is
- * minted FOR the caller; the class rides onto the driver's environment,
- * so a driver can decide the workspace's durability by who asked. A step
- * hands `ctx.callerIdentity` in whole; the pick keeps a test's fixture to
- * the two fields the body reads.
- */
-export type SandboxCaller = Pick<CallerIdentity, "identityId" | "callerClass">;
-
 type AgentExecutionCreateDesc = typeof AgentExecutionSchema;
 
 export interface EnsureSessionSandboxDeps {
@@ -113,7 +101,7 @@ export function newEnsureSessionSandboxStep(
       await ensureSessionSandboxForExecution(
         deps,
         ctx.newState,
-        ctx.callerIdentity,
+        ctx.callerIdentity.identityId,
       );
     },
   };
@@ -126,18 +114,15 @@ export function newEnsureSessionSandboxStep(
  * chains' differing context shapes (newState vs loaded execution) meet
  * at this seam instead.
  *
- * The caller splits two ways (SandboxCaller): `identityId` rides into the
- * credential mint (lane.ts) — the Java ensure step mints session tokens
- * FOR the requesting caller, so the capability mint needs the identity
- * the OSS execution-scoped mint never did — and `callerClass` rides onto
- * the driver's environment as the one request fact a driver may decide
- * durability by. The chain always has a caller: the in-process transport
- * mints `internal` for the server's own calls.
+ * `callerIdentityId` rides into the credential mint (lane.ts): the Java
+ * ensure step mints session tokens FOR the requesting caller, so the
+ * capability mint needs the identity the OSS execution-scoped mint never
+ * did. Empty when the invoking site has no caller.
  */
 export async function ensureSessionSandboxForExecution(
   deps: EnsureSessionSandboxDeps,
   execution: AgentExecution,
-  caller: SandboxCaller,
+  callerIdentityId: string,
 ): Promise<void> {
   if (!deps.lane.enabled) {
     return;
@@ -182,11 +167,10 @@ export async function ensureSessionSandboxForExecution(
           sessionId,
           executionId,
           org: execution.metadata?.org ?? "",
-          callerIdentityId: caller.identityId,
+          callerIdentityId,
         },
         deps.logger,
       ),
-      callerClass: caller.callerClass,
     });
   } catch (error) {
     // Non-critical: never fail the launch — but never silent either
@@ -263,7 +247,7 @@ export function newEnsureWorkflowSandboxStep(
       await ensureWorkflowSandboxForExecution(
         deps,
         ctx.newState,
-        ctx.callerIdentity,
+        ctx.callerIdentity.identityId,
       );
     },
   };
@@ -274,13 +258,13 @@ export function newEnsureWorkflowSandboxStep(
  * re-provision (lifecycle.ts — the previous sandbox was deprovisioned at
  * the terminal FAILED, so a recovered execution needs a fresh one before
  * its fresh workflow starts). Throws Unavailable on provisioning failure
- * — the critical posture in both chains. The caller splits exactly as on
- * the session body: id to the mint, class to the environment.
+ * — the critical posture in both chains. `callerIdentityId` rides into
+ * the credential mint exactly as on the session body.
  */
 export async function ensureWorkflowSandboxForExecution(
   deps: EnsureWorkflowSandboxDeps,
   execution: WorkflowExecution,
-  caller: SandboxCaller,
+  callerIdentityId: string,
 ): Promise<void> {
   if (!deps.lane.enabled) {
     return;
@@ -312,11 +296,10 @@ export async function ensureWorkflowSandboxForExecution(
           sessionId: "",
           executionId,
           org: execution.metadata?.org ?? "",
-          callerIdentityId: caller.identityId,
+          callerIdentityId,
         },
         deps.logger,
       ),
-      callerClass: caller.callerClass,
     });
   } catch (error) {
     deps.logger.error(

package/src/store/interface.ts

@@ -217,8 +217,12 @@ export interface SearchIndexQueryResult {
 // =============================================================================
 
 /**
- * Key-value state for idempotent seedpack bootstrap. Common keys:
- * "seedpack_version", "bootstrap_status", "skill:<name>", "agent:<name>".
+ * Key-value state for one-shot boot work that must run once per database.
+ * The one writer today is the membership rules' reconciliation
+ * (`iampolicy/constants.ts` ROLES_RECONCILED_KEY). A database migrated
+ * from the Go server carries that server's bootstrap keys too; the
+ * migration preserves them (see sqlite/__tests__/migrations.test.ts) and
+ * nothing reads them.
  */
 export interface BootstrapStateStore {
   /** Returns "" (not an error) when the key does not exist — Go's contract. */