@stigmer/server 3.19.1-dev.20260920100552 → 3.21.0

package/src/domain/mcpserver/connect.ts

@@ -42,6 +42,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { TokenEndpointAuthMethod } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import { resolveDeclaredFromPersonalEnvironment } from "../environment/personal.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import { authorizeDirect } from "../../pipeline/steps/authorize.js";
@@ -150,9 +151,6 @@ export const ASYNC_CONNECT_TIMEOUT: ConnectBudget = {
  */
 export const BEST_EFFORT_CONNECT_GET_BUFFER_MS = 15_000;
 
-/** The label selecting the user's personal environment (connect.go:74). */
-export const PERSONAL_ENV_LABEL = "stigmer.ai/personal";
-
 /**
  * The narrow environment read surface the connect lanes consume for
  * personal-environment resolution — satisfied by the composition root's
@@ -687,34 +685,29 @@ async function resolveOAuthVarsFromManagedEnv(
 }
 
 /**
- * Reads environment variables from the user's personal environment
- * (labeled stigmer.ai/personal=true; Go resolveFromPersonalEnvironment).
- * Required variables (optional=false, the default) must be present;
- * optional variables are included when available but silently skipped
- * when missing.
+ * Reads a server's declared variables from the user's personal environment
+ * (Go resolveFromPersonalEnvironment) through the shared lookup in
+ * domain/environment/personal.ts, and gives its outcomes the connect
+ * lane's meaning: a person asked to connect a server and cannot without
+ * the credential, so a missing personal environment and a missing required
+ * key both refuse with FailedPrecondition. Optional variables are included
+ * when available and silently skipped when missing.
  */
 async function resolveFromPersonalEnvironment(
   deps: McpServerConnectDeps,
   org: string,
   envDecls: { [key: string]: EnvVarDeclaration },
 ): Promise<{ [key: string]: ExecutionValue }> {
-  const requiredKeys: string[] = [];
-  for (const [k, decl] of Object.entries(envDecls)) {
-    if (!decl.optional) {
-      requiredKeys.push(k);
-    }
-  }
-
-  let listResponse: EnvironmentList;
-  try {
-    listResponse = await deps.environmentReader.list({
-      org,
-      labels: { [PERSONAL_ENV_LABEL]: "true" },
-    });
-  } catch (error) {
-    throw internalError(error, "failed to list personal environments");
-  }
-  if (listResponse.totalCount === 0 || listResponse.items.length === 0) {
+  const resolution = await resolveDeclaredFromPersonalEnvironment(
+    deps.environmentReader,
+    deps.logger,
+    org,
+    envDecls,
+  );
+  if (resolution.kind === "no-personal-environment") {
+    const requiredKeys = Object.entries(envDecls)
+      .filter(([, decl]) => !decl.optional)
+      .map(([key]) => key);
     if (requiredKeys.length === 0) {
       return {};
     }
@@ -723,66 +716,12 @@ async function resolveFromPersonalEnvironment(
       `personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`,
     );
   }
-
-  const personalEnv = listResponse.items[0];
-  const personalEnvId = personalEnv?.metadata?.id ?? "";
-  const storedKeys = new Set(Object.keys(personalEnv?.spec?.data ?? {}));
-
-  const result: { [key: string]: ExecutionValue } = {};
-  const missing: string[] = [];
-
-  for (const [key, decl] of Object.entries(envDecls)) {
-    if (!storedKeys.has(key)) {
-      if (decl.optional) {
-        deps.logger.debug(
-          "Optional env var not in personal environment — skipping",
-          { key },
-        );
-        continue;
-      }
-      missing.push(key);
-      continue;
-    }
-
-    let secretValue: EnvironmentSpecValue;
-    try {
-      secretValue = await deps.environmentReader.getSecretValue({
-        environmentId: personalEnvId,
-        key,
-      });
-    } catch (error) {
-      deps.logger.warn("Failed to get secret value from personal environment", {
-        key,
-        personal_env_id: personalEnvId,
-        error: error instanceof Error ? error.message : String(error),
-      });
-      if (decl.optional) {
-        continue;
-      }
-      missing.push(key);
-      continue;
-    }
-    if (secretValue.value === "") {
-      if (decl.optional) {
-        continue;
-      }
-      missing.push(key);
-      continue;
-    }
-
-    result[key] = create(ExecutionValueSchema, {
-      value: secretValue.value,
-      isSecret: decl.isSecret,
-    });
-  }
-
-  if (missing.length > 0) {
+  if (resolution.missing.length > 0) {
     throw failedPreconditionError(
-      `missing required credentials in personal environment: [${missing.join(" ")}]`,
+      `missing required credentials in personal environment: [${resolution.missing.join(" ")}]`,
     );
   }
-
-  return result;
+  return { ...resolution.values };
 }
 
 /**

package/src/domain/plugin/overlay/sanitize.ts

@@ -5,8 +5,8 @@
  * lane passes GuardReservedLabels structurally (the controller stamps the
  * membership labels by design), so this module is the one place plugin-
  * provided metadata is judged before it can ride that lane. Without it an
- * archive could carry `stigmer.ai/default-agent: "true"` in its agent
- * overlay and become every organization's default agent.
+ * archive could carry any `stigmer.ai/*` label in its overlays and have
+ * the server act on a platform decision the plugin's author made.
  *
  * Four rules, each one sentence with the document's path:
  *   - a `stigmer.ai/*` label costs `can_write_reserved_labels` on

package/src/domain/session/__tests__/run-gate.test.ts

@@ -1,11 +1,11 @@
 /**
  * Pins the run gate's SPLICE in session-create over the real router (P1
- * sp.run-gate): the AuthorizeRunTarget step sits after
- * ResolveDefaultAgentInstance and before Persist, so (1) a denied caller
- * answers PERMISSION_DENIED with the domain's byte-pinned copy and leaves
- * no session row; (2) the check names the instance the CHAIN resolved,
- * not only the one the caller typed — the session-first shape (empty
- * spec) is checked against the platform default agent's default instance;
+ * sp.run-gate): the AuthorizeRunTarget step sits right after Authorize
+ * and before Persist, so (1) a denied caller answers PERMISSION_DENIED
+ * with the domain's byte-pinned copy and leaves no session row; (2) the
+ * built-in-assistant shape (empty spec) makes NO run-gate check and
+ * creates the session even under a denying run-gate authorizer — the
+ * organization's own create permission admitted it in the Authorize step;
  * (3) an allowed caller creates the session exactly as before. The
  * authorizer under test answers only run-gate checks (runGateOnlyAuthorizer),
  * so every refusal here is the run gate's and nobody else's.
@@ -20,11 +20,9 @@ import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
 
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import { loadConfig } from "../../../boot/config.js";
@@ -33,10 +31,6 @@ import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 import type { AuthzDecision } from "../../../extensions/authorizer.js";
 import { runGateOnlyAuthorizer } from "../../../pipeline/__tests__/support.js";
-import {
-  DEFAULT_AGENT_LABEL,
-  DEFAULT_AGENT_LABEL_VALUE,
-} from "../../agent/defaultagent.js";
 import { runAgentInstanceDeniedMessage } from "../constants.js";
 
 const silentLogger = createLogger({
@@ -99,23 +93,6 @@ async function createAgent(name: string): Promise<string> {
   return agent.metadata!.id;
 }
 
-/** The default-agent label is operator-seeded state; stamp it on the row. */
-async function markDefaultAgent(agentId: string): Promise<void> {
-  const stored = await server.store.getResource(
-    ApiResourceKind.agent,
-    agentId,
-    AgentSchema,
-  );
-  stored.metadata!.labels[DEFAULT_AGENT_LABEL] = DEFAULT_AGENT_LABEL_VALUE;
-  stored.metadata!.visibility = ApiResourceVisibility.visibility_public;
-  await server.store.saveResource(
-    ApiResourceKind.agent,
-    agentId,
-    AgentSchema,
-    stored,
-  );
-}
-
 async function captureError(
   run: () => Promise<unknown>,
 ): Promise<ConnectError> {
@@ -154,33 +131,23 @@ describe("session-create run gate (composed server)", () => {
     expect(await sessionCount(), "no row behind a denial").toBe(before);
   });
 
-  it("checks the instance the chain RESOLVED for the session-first shape", async () => {
+  it("makes no check for the built-in assistant (empty spec) and creates the session", async () => {
     decision = { kind: "deny", reason: "" };
     gate.runGateChecks.length = 0;
-    const agentId = await createAgent("Default agent for the run gate");
-    await markDefaultAgent(agentId);
+    const before = await sessionCount();
 
-    const err = await captureError(() =>
-      sessionCommand.create({
-        apiVersion: API_VERSION,
-        kind: "Session",
-        metadata: { name: "Session-first", org: ORG },
-        spec: {},
-      }),
-    );
+    const session = await sessionCommand.create({
+      apiVersion: API_VERSION,
+      kind: "Session",
+      metadata: { name: "Session-first", org: ORG },
+      spec: {},
+    });
 
-    expect(err.code).toBe(Code.PermissionDenied);
-    // ResolveDefaultAgentInstance created (or found) the default agent's
-    // default instance BEFORE the gate — the inherited pre-gate side
-    // effect the slot table records — and the gate names exactly it.
-    const agent = await agentQuery.get({ value: agentId });
-    const resolvedInstanceId = agent.status?.defaultInstanceId ?? "";
-    expect(resolvedInstanceId).not.toBe("");
-    expect(gate.runGateChecks).toHaveLength(1);
-    expect(gate.runGateChecks[0].resourceId).toBe(resolvedInstanceId);
-    expect(err.rawMessage).toBe(
-      runAgentInstanceDeniedMessage(resolvedInstanceId),
-    );
+    // No instance, no blueprint to spend, no target: the gate is silent
+    // and the denying authorizer is never asked.
+    expect(gate.runGateChecks).toHaveLength(0);
+    expect(session.spec?.agentInstanceId).toBe("");
+    expect(await sessionCount()).toBe(before + 1);
   });
 
   it("not-found answers NOT_FOUND naming the instance (the stigmer#224 order)", async () => {

package/src/domain/session/__tests__/session.test.ts

@@ -1,16 +1,13 @@
 /**
  * Pins the session domain against Go's pkg/domain/session tests — through
  * the REAL stack: a composed server on an ephemeral port, a native gRPC
- * client, the full interceptor chain, and the DD-002 in-process
- * agentinstance CREATE edge (session create's default-instance self-heal
- * runs through the router transport).
+ * client, and the full interceptor chain.
  *
  * The load-bearing pins:
- *   - ResolveDefaultAgentInstance fills the session's agent_instance_id
- *     from the platform default agent (newState, not input — the persisted
- *     session carries it); the on-the-fly default-instance creation path
- *     writes the agent's status.default_instance_id; the not-configured /
- *     not-public arms carry Go WrapError's exact double-wrapped copy;
+ *   - an empty agent_instance_id is the built-in assistant: create stores
+ *     it empty (nothing resolves it into an instance), an explicit id is
+ *     kept as given, and a session may gain an agent or drop back to the
+ *     assistant on update — the instance is not an immutable field;
  *   - harness immutability locks only once harness_state_id is non-empty,
  *     with UNSPECIFIED==NATIVE equivalence in both directions and the
  *     exact FAILED_PRECONDITION copy;
@@ -39,11 +36,8 @@ import { createGrpcTransport } from "@connectrpc/connect-node";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { AgentInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/query_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
@@ -53,7 +47,6 @@ import {
   ExecutionTarget,
   Harness,
 } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { loadConfig } from "../../../boot/config.js";
@@ -70,10 +63,6 @@ import {
   ROUTING_GLOBAL,
   newConfigFromEnv,
 } from "../../agentexecution/temporal/config.js";
-import {
-  DEFAULT_AGENT_LABEL,
-  DEFAULT_AGENT_LABEL_VALUE,
-} from "../../agent/defaultagent.js";
 import { newValidateExecutionTargetImmutabilityStep } from "../steps.js";
 
 const silentLogger = createLogger({
@@ -92,7 +81,6 @@ let dir: string;
 let server: ComposedServer;
 let transport: Transport;
 let agentCommand: Client<typeof AgentCommandController>;
-let instanceQuery: Client<typeof AgentInstanceQueryController>;
 let command: Client<typeof SessionCommandController>;
 let query: Client<typeof SessionQueryController>;
 
@@ -120,7 +108,6 @@ beforeAll(async () => {
   const port = await server.start();
   transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
   agentCommand = createClient(AgentCommandController, transport);
-  instanceQuery = createClient(AgentInstanceQueryController, transport);
   command = createClient(SessionCommandController, transport);
   query = createClient(SessionQueryController, transport);
 });
@@ -141,33 +128,6 @@ async function createAgent(name: string) {
   });
 }
 
-/**
- * Stamps the default-agent label (and optionally visibility_public)
- * directly on the stored agent row — the reserved stigmer.ai/* label is
- * operator-seeded state, not something the OSS write path guards, and the
- * direct write keeps the test independent of create-time visibility rules.
- */
-async function markDefaultAgent(
-  agentId: string,
-  opts: { public: boolean },
-): Promise<void> {
-  const stored = await server.store.getResource(
-    ApiResourceKind.agent,
-    agentId,
-    AgentSchema,
-  );
-  stored.metadata!.labels[DEFAULT_AGENT_LABEL] = DEFAULT_AGENT_LABEL_VALUE;
-  if (opts.public) {
-    stored.metadata!.visibility = ApiResourceVisibility.visibility_public;
-  }
-  await server.store.saveResource(
-    ApiResourceKind.agent,
-    agentId,
-    AgentSchema,
-    stored,
-  );
-}
-
 let sessionCounter = 0;
 async function createSession(
   spec: Partial<Omit<SessionSpec, "$typeName">> = {},
@@ -252,108 +212,36 @@ async function grpcError(run: () => Promise<unknown>): Promise<ConnectError> {
   }
 }
 
-// The resolve tests run FIRST: the not-configured arm requires that no
-// agent carries the default-agent label yet, and later tests only create
-// unlabeled agents (or clean their labeled ones up).
-describe("session create — ResolveDefaultAgentInstance", () => {
-  it("rejects a create with no default agent configured (exact NotFound copy, Go's double wrap)", async () => {
-    const error = await grpcError(() => createSession({}));
-    expect(error.code).toBe(Code.NotFound);
-    expect(error.rawMessage).toBe(
-      "No default agent available. Ensure an agent with label " +
-        "stigmer.ai/default-agent=true and visibility_public exists: " +
-        "no default agent available on this platform: " +
-        "no agent labeled stigmer.ai/default-agent=true",
-    );
+describe("session create and update — the built-in assistant", () => {
+  it("stores an empty agent_instance_id as given: no agent is resolved for the session", async () => {
+    const session = await createSession({});
+    expect(session.spec?.agentInstanceId).toBe("");
+    const fetched = await query.get({ value: session.metadata!.id });
+    expect(fetched.spec?.agentInstanceId).toBe("");
+    await command.delete({ value: session.metadata!.id });
   });
 
-  it("rejects when the labeled default agent is not visibility_public (exact FailedPrecondition copy)", async () => {
-    const agent = await createAgent("Non Public Default Agent");
-    await markDefaultAgent(agent.metadata!.id, { public: false });
-    try {
-      const error = await grpcError(() => createSession({}));
-      expect(error.code).toBe(Code.FailedPrecondition);
-      expect(error.rawMessage).toBe(
-        "Default agent exists but is not visibility_public: " +
-          "agents labeled stigmer.ai/default-agent=true exist but none is visibility_public",
-      );
-    } finally {
-      await agentCommand.delete({ value: agent.metadata!.id });
-    }
+  it("keeps an explicit agent_instance_id as given", async () => {
+    const session = await createSession({ agentInstanceId: "ain_explicit" });
+    expect(session.spec?.agentInstanceId).toBe("ain_explicit");
+    await command.delete({ value: session.metadata!.id });
   });
 
-  it("fills the persisted session's agent_instance_id from the default agent's existing default instance", async () => {
-    const agent = await createAgent("Configured Default Agent");
-    const defaultInstanceId = agent.status!.defaultInstanceId;
-    expect(defaultInstanceId).not.toBe("");
-    await markDefaultAgent(agent.metadata!.id, { public: true });
-    try {
-      const session = await createSession({});
-      // The resolve step wrote newState.spec (the clone Persist saves) —
-      // the id survives the round trip to storage.
-      expect(session.spec?.agentInstanceId).toBe(defaultInstanceId);
-      const fetched = await query.get({ value: session.metadata!.id });
-      expect(fetched.spec?.agentInstanceId).toBe(defaultInstanceId);
-      await command.delete({ value: session.metadata!.id });
-    } finally {
-      await agentCommand.delete({ value: agent.metadata!.id });
-    }
-  });
+  it("lets a conversation gain an agent and drop back to the assistant on update", async () => {
+    const session = await createSession({});
 
-  it("creates the default instance on the fly and writes the agent's status.default_instance_id", async () => {
-    // Seeded directly: a labeled public agent with NO default instance —
-    // the legacy shape the self-heal path exists for.
-    const agentId = "agt_sessiontest_selfheal";
-    const seeded = create(AgentSchema, {
-      apiVersion: API_VERSION,
-      kind: "Agent",
-      metadata: {
-        id: agentId,
-        name: "Self Heal Default Agent",
-        slug: "self-heal-default-agent",
-        org: ORG,
-        visibility: ApiResourceVisibility.visibility_public,
-        labels: { [DEFAULT_AGENT_LABEL]: DEFAULT_AGENT_LABEL_VALUE },
-      },
-      spec: { instructions: "seeded for the self-heal path" },
-    });
-    await server.store.saveResource(
-      ApiResourceKind.agent,
-      agentId,
-      AgentSchema,
-      seeded,
+    const withAgent = await command.update(
+      updateInput(session, { agentInstanceId: "ain_picked" }),
     );
-    try {
-      const session = await createSession({});
-      const resolvedId = session.spec?.agentInstanceId ?? "";
-      expect(resolvedId).not.toBe("");
-
-      // The created instance is real (rode the in-process CREATE edge and
-      // its full pipeline) and follows the defaultinstance factory shape.
-      const instance = await instanceQuery.get({ value: resolvedId });
-      expect(instance.spec?.agentId).toBe(agentId);
-      expect(instance.metadata?.slug).toBe("self-heal-default-agent-default");
-
-      // The agent's server-owned pointer was persisted (explicit agent
-      // kind — the pipeline's own ctx kind is session).
-      const storedAgent = await server.store.getResource(
-        ApiResourceKind.agent,
-        agentId,
-        AgentSchema,
-      );
-      expect(storedAgent.status?.defaultInstanceId).toBe(resolvedId);
+    expect(withAgent.spec?.agentInstanceId).toBe("ain_picked");
 
-      await command.delete({ value: session.metadata!.id });
-    } finally {
-      await agentCommand.delete({ value: agentId });
-    }
-  });
+    const dropped = await command.update(
+      updateInput(withAgent, { agentInstanceId: "" }),
+    );
+    expect(dropped.spec?.agentInstanceId).toBe("");
+    const fetched = await query.get({ value: session.metadata!.id });
+    expect(fetched.spec?.agentInstanceId).toBe("");
 
-  it("is a no-op when agent_instance_id is provided (no default agent needed)", async () => {
-    // No labeled agent exists at this point; an explicit id must not
-    // trigger resolution.
-    const session = await createSession({ agentInstanceId: "ain_explicit" });
-    expect(session.spec?.agentInstanceId).toBe("ain_explicit");
     await command.delete({ value: session.metadata!.id });
   });
 });
@@ -716,67 +604,3 @@ describe("session delete — active-execution guard and cascade", () => {
     await command.delete({ value: survivor.metadata!.id });
   });
 });
-
-describe("session create — CreateAsSystem failure wire contract (oss#852)", () => {
-  it("answers the inner code with Go's %w-wrapped transport-formatted message", async () => {
-    // A labeled public default agent with NO status.default_instance_id
-    // (the self-heal shape) whose deterministic default-instance slug is
-    // already occupied: the in-process CreateAsSystem hits CheckDuplicate's
-    // AlreadyExists. Go wraps that error with fmt.Errorf("%w"), so the
-    // wire message embeds grpc-go's `rpc error: code = X desc = ...`
-    // rendering of the inner error — the leak filed as stigmer/stigmer#852,
-    // mirrored byte-for-byte until the both-editions post-cutover fix.
-    const agentId = "agt_wrap_session";
-    const seeded = create(AgentSchema, {
-      apiVersion: API_VERSION,
-      kind: "Agent",
-      metadata: {
-        id: agentId,
-        name: "Wrap Mirror Default Agent",
-        slug: "wrap-mirror-default-agent",
-        org: ORG,
-        visibility: ApiResourceVisibility.visibility_public,
-        labels: { [DEFAULT_AGENT_LABEL]: DEFAULT_AGENT_LABEL_VALUE },
-      },
-      spec: { instructions: "seeded for the wrapped-error mirror test" },
-    });
-    await server.store.saveResource(
-      ApiResourceKind.agent,
-      agentId,
-      AgentSchema,
-      seeded,
-    );
-    const occupier = create(AgentInstanceSchema, {
-      apiVersion: API_VERSION,
-      kind: "AgentInstance",
-      metadata: {
-        id: "ain_wrap_occupied",
-        name: "wrap-mirror-default-agent-default",
-        slug: "wrap-mirror-default-agent-default",
-        org: ORG,
-      },
-      spec: { agentId },
-    });
-    await server.store.saveResource(
-      ApiResourceKind.agent_instance,
-      "ain_wrap_occupied",
-      AgentInstanceSchema,
-      occupier,
-    );
-
-    try {
-      const error = await grpcError(() => createSession({}));
-      expect(error.code).toBe(Code.AlreadyExists);
-      expect(error.rawMessage).toBe(
-        "failed to create default instance for default agent: rpc error: " +
-          "code = AlreadyExists desc = AgentInstance already exists: slug " +
-          "'wrap-mirror-default-agent-default' in org 'acme' " +
-          "(id: ain_wrap_occupied)",
-      );
-    } finally {
-      // The cascade sweeps the occupying instance (spec.agent_id match)
-      // and removes the default-agent label with the agent.
-      await agentCommand.delete({ value: agentId });
-    }
-  });
-});

package/src/domain/session/controller.ts

@@ -110,11 +110,9 @@ import {
   newListAllSessionsStep,
   newRecordHarnessStateHistoryStep,
   newRejectDeleteWithActiveExecutionsStep,
-  newResolveDefaultAgentInstanceStep,
   newValidateExecutionTargetImmutabilityStep,
   newValidateHarnessImmutabilityStep,
 } from "./steps.js";
-import type { AgentInstanceCreatorProvider } from "./steps.js";
 
 export interface SessionControllerDeps {
   readonly store: Store;
@@ -129,12 +127,6 @@ export interface SessionControllerDeps {
    * same deployment default dispatch uses (oss#397).
    */
   readonly temporalConfig: AgentExecutionTemporalConfig;
-  /**
-   * The agentinstance in-process CREATE edge — a lazy provider because the
-   * routes↔clients definition cycle resolves at request time (the ratified
-   * DI story, DD-002).
-   */
-  readonly agentInstanceCreator: AgentInstanceCreatorProvider;
   /** The composed slot registrations — this domain's create slot (O4). */
   readonly gateSteps: ResolvedGateSteps;
   /**
@@ -177,23 +169,19 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
 }
 
 /**
- * Create — chain per Go buildCreatePipeline. ResolveDefaultAgentInstance
- * runs BEFORE ValidateProto: when agent_instance_id is omitted, the
- * resolution fills it in before validation sees the spec.
- *
- * AuthorizeRunTarget (the run gate, P1 sp.run-gate) follows it directly:
- * the first step after the instance the session binds to is known, so a
- * caller who may not run that instance is refused before validation reads
- * anything further and before any step the chain owns side-effects. The
- * default-instance creation INSIDE the resolution step still precedes it —
- * the inherited pre-gate side effect recorded below, unchanged here.
+ * Create — chain per Go buildCreatePipeline. AuthorizeRunTarget (the run
+ * gate, P1 sp.run-gate) runs right after Authorize: the instance the
+ * session binds to is the caller's own spec, so a caller who may not run
+ * that instance is refused before validation reads anything further and
+ * before any step the chain owns side-effects. An empty agent_instance_id
+ * is the built-in assistant, for which the gate makes no target check:
+ * Authorize's can_create_session on the organization already admitted the
+ * conversation (sessionRunTarget's header).
  *
  * The pre-side-effect gate slot splices before Persist, after the last
  * pure step (O4 plan-gate ruling Q2, mirroring the Java baseline's
- * post-resolution gate position). The default-instance resolution above
- * it side-effects PRE-gate in BOTH editions — a gate refusal can leave a
- * created default instance behind; inherited Java semantics, not a new
- * compromise.
+ * post-resolution gate position). Every step above it is pure, so a gate
+ * refusal leaves nothing behind.
  */
 async function createSession(
   deps: SessionControllerDeps,
@@ -213,14 +201,6 @@ async function createSession(
     .addStep(
       newAuthorizeStep(SessionCommandController.method.create, deps.authorizer),
     )
-    .addStep(
-      newResolveDefaultAgentInstanceStep(
-        deps.store,
-        deps.agentInstanceCreator,
-        deps.logger,
-        deps.authorizationLifecycle,
-      ),
-    )
     .addStep(newAuthorizeRunTargetStep(deps.authorizer, sessionRunTarget))
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())