@stigmer/server 3.20.0 → 3.22.0

package/src/domain/environment/personal.ts

@@ -0,0 +1,141 @@
+/**
+ * The caller's personal environment as a source of DECLARED variables: the
+ * one lookup that answers "which of these declared keys does the person
+ * have saved" for every lane that runs a tool on the person's behalf.
+ *
+ * Two lanes need it and must agree on it. The MCP connect lane (the
+ * discovery run a person triggers from the console) resolves a server's
+ * declared variables here when no one-time runtime_env was supplied; the
+ * agent-execution ExecutionContext build resolves a SESSION-level MCP
+ * server's declared variables here when the merge chain did not carry them,
+ * because a session's own servers ride no agent instance and so have no
+ * environment_refs of their own. Before the build learned this rule a key
+ * saved through the console's "save for future" reached the connect lane
+ * and never the run.
+ *
+ * Least privilege by construction: only the keys the caller declares are
+ * read, one GetSecretValue per key; nothing here layers a whole
+ * environment onto anything. What a missing personal environment or a
+ * missing required key MEANS is the caller's to decide — connect refuses
+ * (a person asked to connect and cannot without the credential), the
+ * build warns (the run fails at the tool with a clearer error) — so both
+ * outcomes are returned as values, never thrown. A failing list read is
+ * the one infrastructure fault, thrown as Internal.
+ *
+ * Proven by __tests__/personal.test.ts; the connect lane's wire copy over
+ * these outcomes by mcpserver/__tests__/connect.test.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import type { MessageInitShape } from "@bufbuild/protobuf";
+
+import type { EnvironmentList } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import type {
+  EnvironmentSecretValueInputSchema,
+  ListEnvironmentsRequestSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import type {
+  EnvVarDeclaration,
+  EnvironmentValue,
+} from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import type { ExecutionValue } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/spec_pb";
+import { ExecutionValueSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/spec_pb";
+
+import type { Logger } from "../../boot/logger.js";
+import { internalError } from "../../pipeline/errors.js";
+import { PERSONAL_LABEL_KEY, PERSONAL_LABEL_VALUE } from "./constants.js";
+
+/**
+ * The narrow environment read surface this lookup consumes: the list RPC
+ * (to find the personal environment by its label) and the secret read
+ * (decrypted; the ordinary Environment surface redacts, oss#405). Both
+ * consuming domains' in-process edges already satisfy it.
+ */
+export interface PersonalEnvironmentReader {
+  list(
+    request: MessageInitShape<typeof ListEnvironmentsRequestSchema>,
+  ): Promise<EnvironmentList>;
+  getSecretValue(
+    input: MessageInitShape<typeof EnvironmentSecretValueInputSchema>,
+  ): Promise<EnvironmentValue>;
+}
+
+/** What the lookup found; the caller decides what each outcome means. */
+export type PersonalEnvironmentResolution =
+  | { readonly kind: "no-personal-environment" }
+  | {
+      readonly kind: "resolved";
+      /** The declared keys the personal environment held, as execution values. */
+      readonly values: { readonly [key: string]: ExecutionValue };
+      /**
+       * The REQUIRED declared keys the personal environment did not hold
+       * (absent, unreadable, or empty). Optional keys never appear here.
+       */
+      readonly missing: readonly string[];
+    };
+
+/**
+ * Resolves the given declarations against the caller's personal
+ * environment in `org`. A declaration's `is_secret` rides onto the value;
+ * a declared key the environment lacks is skipped when optional and
+ * reported in `missing` when required. A secret read that fails is logged
+ * and treated as absent, the same way for both lanes.
+ */
+export async function resolveDeclaredFromPersonalEnvironment(
+  reader: PersonalEnvironmentReader,
+  logger: Logger,
+  org: string,
+  declarations: { readonly [key: string]: EnvVarDeclaration },
+): Promise<PersonalEnvironmentResolution> {
+  let listResponse: EnvironmentList;
+  try {
+    listResponse = await reader.list({
+      org,
+      labels: { [PERSONAL_LABEL_KEY]: PERSONAL_LABEL_VALUE },
+    });
+  } catch (error) {
+    throw internalError(error, "failed to list personal environments");
+  }
+  if (listResponse.totalCount === 0 || listResponse.items.length === 0) {
+    return { kind: "no-personal-environment" };
+  }
+
+  const personalEnv = listResponse.items[0];
+  const personalEnvId = personalEnv?.metadata?.id ?? "";
+  // The stored keys are present even when their values are redacted, so
+  // existence is checkable before the secret read. Own-key membership
+  // (never the prototype chain): an exotic key name must not read as held.
+  const stored = personalEnv?.spec?.data ?? {};
+
+  const values: { [key: string]: ExecutionValue } = {};
+  const missing: string[] = [];
+  for (const [key, decl] of Object.entries(declarations)) {
+    if (!Object.hasOwn(stored, key)) {
+      if (!decl.optional) missing.push(key);
+      continue;
+    }
+    let secretValue: EnvironmentValue;
+    try {
+      secretValue = await reader.getSecretValue({
+        environmentId: personalEnvId,
+        key,
+      });
+    } catch (error) {
+      logger.warn("Failed to get secret value from personal environment", {
+        key,
+        personal_env_id: personalEnvId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      if (!decl.optional) missing.push(key);
+      continue;
+    }
+    if (secretValue.value === "") {
+      if (!decl.optional) missing.push(key);
+      continue;
+    }
+    values[key] = create(ExecutionValueSchema, {
+      value: secretValue.value,
+      isSecret: decl.isSecret,
+    });
+  }
+  return { kind: "resolved", values, missing };
+}

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -277,6 +277,7 @@ describe("executioncontext domain (encryption + runner auth enabled)", () => {
           () =>
             ts.query.getByReference({
               kind: ApiResourceKind.execution_context,
+              org: created.metadata!.org,
               slug: created.metadata!.slug,
             }),
         ],

package/src/domain/executioncontext/controller.ts

@@ -56,6 +56,10 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import {
@@ -361,6 +365,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ExecutionContextSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ExecutionContextQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const ec = reqCtx.get(TARGET_RESOURCE_KEY) as ExecutionContext;

package/src/domain/executioncontext/steps.ts

@@ -34,6 +34,7 @@ import { isCiphertextShaped } from "../../encryption/encryption.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { EncryptionScope } from "../../encryption/encryption.js";
 import type { Authorizer, AuthzDecision } from "../../extensions/authorizer.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import {
   internalError,
   invalidArgumentError,
@@ -240,7 +241,7 @@ export function newAuthorizeExecutionContextCreateStep(
       ctx: RequestContext<typeof ExecutionContextSchema>,
     ): Promise<void> {
       const caller = ctx.callerIdentity;
-      if (caller.callerClass === "internal" || caller.origin === "in-process") {
+      if (isServerComposedRequest(caller)) {
         return; // authorized upstream — the Java in-process trust arm
       }
       let decision: AuthzDecision;

package/src/domain/mcpserver/connect.ts

@@ -42,6 +42,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { TokenEndpointAuthMethod } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import { resolveDeclaredFromPersonalEnvironment } from "../environment/personal.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import { authorizeDirect } from "../../pipeline/steps/authorize.js";
@@ -150,9 +151,6 @@ export const ASYNC_CONNECT_TIMEOUT: ConnectBudget = {
  */
 export const BEST_EFFORT_CONNECT_GET_BUFFER_MS = 15_000;
 
-/** The label selecting the user's personal environment (connect.go:74). */
-export const PERSONAL_ENV_LABEL = "stigmer.ai/personal";
-
 /**
  * The narrow environment read surface the connect lanes consume for
  * personal-environment resolution — satisfied by the composition root's
@@ -256,13 +254,6 @@ export async function connect(
   input: ConnectInput,
   identity: CallerIdentity,
 ): Promise<McpServer> {
-  const engineState = deps.engineState();
-  if (!engineState.connected) {
-    throw failedPreconditionError(
-      "connect is not available: Temporal not configured",
-    );
-  }
-
   const mcpServerId = input.mcpServerId;
   if (mcpServerId === "") {
     throw invalidArgumentError("mcp_server_id is required");
@@ -282,9 +273,10 @@ export async function connect(
     throw notFoundError("mcp_server", mcpServerId);
   }
 
-  // The annotation's can_connect check AFTER the load — the Java
-  // McpServerConnectHandler order (load-before-authorize, stigmer#224).
-  // C2 Stage 4.
+  // The annotation's can_connect check after the load and BEFORE the engine
+  // check (the Java McpServerConnectHandler load-before-authorize order,
+  // stigmer#224): a caller who may not connect this server learns nothing
+  // about whether the engine is up.
   await authorizeDirect(
     McpServerCommandController.method.connect,
     deps.authorizer,
@@ -292,6 +284,13 @@ export async function connect(
     input,
   );
 
+  const engineState = deps.engineState();
+  if (!engineState.connected) {
+    throw failedPreconditionError(
+      "connect is not available: Temporal not configured",
+    );
+  }
+
   const prepared = await prepareConnect(deps, mcpServer, input, identity);
 
   try {
@@ -687,34 +686,29 @@ async function resolveOAuthVarsFromManagedEnv(
 }
 
 /**
- * Reads environment variables from the user's personal environment
- * (labeled stigmer.ai/personal=true; Go resolveFromPersonalEnvironment).
- * Required variables (optional=false, the default) must be present;
- * optional variables are included when available but silently skipped
- * when missing.
+ * Reads a server's declared variables from the user's personal environment
+ * (Go resolveFromPersonalEnvironment) through the shared lookup in
+ * domain/environment/personal.ts, and gives its outcomes the connect
+ * lane's meaning: a person asked to connect a server and cannot without
+ * the credential, so a missing personal environment and a missing required
+ * key both refuse with FailedPrecondition. Optional variables are included
+ * when available and silently skipped when missing.
  */
 async function resolveFromPersonalEnvironment(
   deps: McpServerConnectDeps,
   org: string,
   envDecls: { [key: string]: EnvVarDeclaration },
 ): Promise<{ [key: string]: ExecutionValue }> {
-  const requiredKeys: string[] = [];
-  for (const [k, decl] of Object.entries(envDecls)) {
-    if (!decl.optional) {
-      requiredKeys.push(k);
-    }
-  }
-
-  let listResponse: EnvironmentList;
-  try {
-    listResponse = await deps.environmentReader.list({
-      org,
-      labels: { [PERSONAL_ENV_LABEL]: "true" },
-    });
-  } catch (error) {
-    throw internalError(error, "failed to list personal environments");
-  }
-  if (listResponse.totalCount === 0 || listResponse.items.length === 0) {
+  const resolution = await resolveDeclaredFromPersonalEnvironment(
+    deps.environmentReader,
+    deps.logger,
+    org,
+    envDecls,
+  );
+  if (resolution.kind === "no-personal-environment") {
+    const requiredKeys = Object.entries(envDecls)
+      .filter(([, decl]) => !decl.optional)
+      .map(([key]) => key);
     if (requiredKeys.length === 0) {
       return {};
     }
@@ -723,66 +717,12 @@ async function resolveFromPersonalEnvironment(
       `personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`,
     );
   }
-
-  const personalEnv = listResponse.items[0];
-  const personalEnvId = personalEnv?.metadata?.id ?? "";
-  const storedKeys = new Set(Object.keys(personalEnv?.spec?.data ?? {}));
-
-  const result: { [key: string]: ExecutionValue } = {};
-  const missing: string[] = [];
-
-  for (const [key, decl] of Object.entries(envDecls)) {
-    if (!storedKeys.has(key)) {
-      if (decl.optional) {
-        deps.logger.debug(
-          "Optional env var not in personal environment — skipping",
-          { key },
-        );
-        continue;
-      }
-      missing.push(key);
-      continue;
-    }
-
-    let secretValue: EnvironmentSpecValue;
-    try {
-      secretValue = await deps.environmentReader.getSecretValue({
-        environmentId: personalEnvId,
-        key,
-      });
-    } catch (error) {
-      deps.logger.warn("Failed to get secret value from personal environment", {
-        key,
-        personal_env_id: personalEnvId,
-        error: error instanceof Error ? error.message : String(error),
-      });
-      if (decl.optional) {
-        continue;
-      }
-      missing.push(key);
-      continue;
-    }
-    if (secretValue.value === "") {
-      if (decl.optional) {
-        continue;
-      }
-      missing.push(key);
-      continue;
-    }
-
-    result[key] = create(ExecutionValueSchema, {
-      value: secretValue.value,
-      isSecret: decl.isSecret,
-    });
-  }
-
-  if (missing.length > 0) {
+  if (resolution.missing.length > 0) {
     throw failedPreconditionError(
-      `missing required credentials in personal environment: [${missing.join(" ")}]`,
+      `missing required credentials in personal environment: [${resolution.missing.join(" ")}]`,
     );
   }
-
-  return result;
+  return { ...resolution.values };
 }
 
 /**

package/src/domain/mcpserver/controller.ts

@@ -53,6 +53,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   newAuthorizeVisibilityTransitionStep,
@@ -207,7 +211,9 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
 }
 
 /** The endpoint-auth step's slice of the deps: the guarded fetch the connect slice holds. */
-function endpointAuthDeps(deps: McpServerControllerDeps): CompleteEndpointAuthDeps {
+function endpointAuthDeps(
+  deps: McpServerControllerDeps,
+): CompleteEndpointAuthDeps {
   return { outboundFetch: deps.connect.outboundFetch, logger: deps.logger };
 }
 
@@ -629,6 +635,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, McpServerSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(McpServerQueryController.method.get),
+      ),
+    )
     .addStep(newEnrichOAuthStatusStep(deps.store, deps.logger))
     .build()
     .execute(reqCtx);

package/src/domain/mcpserver/start-connect.ts

@@ -69,13 +69,6 @@ export async function startConnect(
   input: ConnectInput,
   identity: CallerIdentity,
 ): Promise<McpServer> {
-  const engineState = deps.engineState();
-  if (!engineState.connected) {
-    throw failedPreconditionError(
-      "connect is not available: Temporal not configured",
-    );
-  }
-
   const mcpServerId = input.mcpServerId;
   if (mcpServerId === "") {
     throw invalidArgumentError("mcp_server_id is required");
@@ -95,9 +88,10 @@ export async function startConnect(
     throw notFoundError("mcp_server", mcpServerId);
   }
 
-  // The annotation's can_connect check AFTER the load — the Java
-  // McpServerStartConnectHandler order (the connect handler's shared
-  // load/authorize steps, stigmer#224). C2 Stage 4.
+  // The annotation's can_connect check after the load and BEFORE the engine
+  // check (the Java McpServerStartConnectHandler load-before-authorize order,
+  // stigmer#224): a caller who may not connect this server learns nothing
+  // about whether the engine is up.
   await authorizeDirect(
     McpServerCommandController.method.startConnect,
     deps.authorizer,
@@ -105,6 +99,13 @@ export async function startConnect(
     input,
   );
 
+  const engineState = deps.engineState();
+  if (!engineState.connected) {
+    throw failedPreconditionError(
+      "connect is not available: Temporal not configured",
+    );
+  }
+
   const connectStatus = mcpServer.status?.connectStatus;
   if (connectStatus?.phase === ConnectPhase.connecting) {
     if (
@@ -249,7 +250,12 @@ async function settleConnectAsync(
         outcome.failure,
         ASYNC_CONNECT_TIMEOUT,
       );
-      await persistConnectFailure(deps.store, deps.logger, mcpServerId, failure);
+      await persistConnectFailure(
+        deps.store,
+        deps.logger,
+        mcpServerId,
+        failure,
+      );
       return;
     }
 

package/src/domain/memory/__tests__/create-authorization.test.ts

@@ -0,0 +1,59 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveMemoryCreateTargets): a wire caller asks can_create_session on
+ * metadata.org — whoever may converse in an organization may remember
+ * there — and a server-composed request (internal, or any identity that
+ * entered in-process) asks nothing, as the capture gate before it already
+ * says.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  MEMORY_CREATE_DENIED_MESSAGE,
+  resolveMemoryCreateTargets,
+} from "../steps.js";
+
+function ctxFor(caller: CallerIdentity) {
+  return new RequestContext(
+    MemorySchema,
+    create(MemorySchema, { metadata: { name: "prefers-tea", org: "acme" } }),
+    caller,
+    ApiResourceKind.memory,
+  );
+}
+
+describe("resolveMemoryCreateTargets", () => {
+  it("a wire caller asks can_create_session on the memory's organization", () => {
+    expect(resolveMemoryCreateTargets(ctxFor(testCallerIdentity()))).toEqual([
+      {
+        permission: IamPermission.can_create_session,
+        resourceKind: ApiResourceKind.organization,
+        resourceId: "acme",
+        deniedMessage: MEMORY_CREATE_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a server-composed request asks nothing", () => {
+    expect(
+      resolveMemoryCreateTargets(
+        ctxFor(testCallerIdentity({ callerClass: "internal" })),
+      ),
+    ).toEqual([]);
+    expect(
+      resolveMemoryCreateTargets(
+        ctxFor(
+          testCallerIdentity({ callerClass: "user", origin: "in-process" }),
+        ),
+      ),
+    ).toEqual([]);
+  });
+});

package/src/domain/memory/controller.ts

@@ -77,6 +77,7 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardMemoryCaptureStep } from "../../pipeline/steps/guard-memory-capture.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
@@ -118,6 +119,7 @@ import {
   newResolveMemoryDefaultsStep,
   newTransitionMemoryLifecycleStep,
   newValidateMemoryUpdateStep,
+  resolveMemoryCreateTargets,
 } from "./steps.js";
 
 export interface MemoryControllerDeps {
@@ -194,6 +196,15 @@ async function createMemory(
     .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveMemoryDefaultsStep())
+    // Before the enablement and cap checks, so a refused caller learns
+    // nothing about the organization's settings (steps.ts,
+    // resolveMemoryCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveMemoryCreateTargets,
+      ),
+    )
     .addStep(newCheckMemoryEnablementStep(deps.store))
     .addStep(newCheckMemoryCapStep(deps.store))
     .addStep(newResolveSlugStep())

package/src/domain/memory/steps.ts

@@ -30,6 +30,7 @@ import { MemoryListSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/i
 import { MemoryProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/spec_pb";
 import { MemoryStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/status_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
 import {
@@ -42,6 +43,8 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import {
   generateId,
   setAuditFieldsForUpdate,
@@ -159,6 +162,44 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
   };
 }
 
+/** The deny copy of the create lane's organization bar. */
+export const MEMORY_CREATE_DENIED_MESSAGE =
+  "unauthorized to capture memory in this organization";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after ResolveMemoryDefaults (which requires metadata.org) and BEFORE
+ * CheckMemoryEnablement, so a refused caller learns nothing about the
+ * organization's memory settings. The RPC is is_skip_authorization
+ * because the row does not exist yet and the subject IS the caller
+ * (command.proto); GuardMemoryCapture is the gate that decides WHO may
+ * capture at all, and this question is WHERE: can_create_session on
+ * metadata.org — memory is captured inside a conversation, so whoever may
+ * converse in an organization may remember there.
+ *
+ * The credentialed capture lane is already scoped to the run's
+ * organization by the credential provider (a mismatch is refused inside
+ * GuardMemoryCapture with its own copy); this question closes the plain
+ * path, a person with no run credential naming an organization they hold
+ * nothing in. A server-composed traversal asks nothing, as the gate itself
+ * says: the entry-point request already passed.
+ */
+export function resolveMemoryCreateTargets(
+  ctx: RequestContext<typeof MemorySchema>,
+): ReadonlyArray<AuthorizationTarget> {
+  if (isServerComposedRequest(ctx.callerIdentity)) {
+    return [];
+  }
+  return [
+    {
+      permission: IamPermission.can_create_session,
+      resourceKind: ApiResourceKind.organization,
+      resourceId: ctx.newState.metadata?.org ?? "",
+      deniedMessage: MEMORY_CREATE_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * CheckMemoryEnablement — Go checkMemoryEnablementStep: enforces the
  * org's memory_enabled switch at write time, FAIL-CLOSED (DD-005 D2): a

package/src/domain/oauthapp/controller.ts

@@ -52,6 +52,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
@@ -362,6 +366,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, OAuthAppSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(OAuthAppQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const app = reqCtx.get(TARGET_RESOURCE_KEY) as OAuthApp;