@stigmer/server 3.20.0 → 3.22.0

package/src/domain/workflow/controller.ts

@@ -45,7 +45,6 @@ import {
   ApiResourceKind,
   ApiResourceKindSchema,
 } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import type {
   ApiResourceReference,
   UpdateVisibilityInput,
@@ -71,9 +70,13 @@ import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import {
   authorizeDirect,
-  authorizeResolvedResource,
   newAuthorizeStep,
 } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
+import { versionHistoryTarget } from "../../pipeline/steps/version-history.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   newAuthorizeVisibilityTransitionStep,
@@ -90,10 +93,7 @@ import {
   newExtractResourceIdStep,
   newLoadExistingForDeleteStep,
 } from "../../pipeline/steps/delete.js";
-import {
-  findResourceBySlug,
-  requireOrgForReference,
-} from "../../pipeline/steps/helpers.js";
+import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import {
   newDeleteSearchIndexStep,
   newIndexSearchStep,
@@ -150,6 +150,7 @@ import {
   newValidateWorkflowSpecStep,
   truncateHash,
 } from "./steps.js";
+import { newLoadWorkflowByReferenceStep } from "./version-resolution.js";
 import type { WorkflowInstanceCreatorProvider } from "./steps.js";
 
 export interface WorkflowControllerDeps {
@@ -192,7 +193,7 @@ export function registerWorkflowServices(
   });
   router.service(WorkflowQueryController, {
     get: (id, ctx) => get(deps, id, ctx),
-    getByReference: (ref) => getByReference(deps, ref),
+    getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
     listVersions: (input, ctx) => listVersions(deps, input, ctx),
     getVersion: (input, ctx) => getVersion(deps, input, callerIdentityOf(ctx)),
   });
@@ -831,130 +832,47 @@ async function get(
   return reqCtx.get(TARGET_RESOURCE_KEY) as Workflow;
 }
 
-/** A 64-hex value is an exact content hash; anything else is a tag. */
-const WORKFLOW_HASH_PATTERN = /^[a-f0-9]{64}$/;
-
 /**
- * getByReference — query.go: slug/org resolution plus version resolution.
- * Empty/"latest" → the current head; a version matching the head's hash or
- * tag → the head; otherwise the audit store by hash or tag, with the
- * snapshot's tag overlaid from the audit column (the source of truth) so
- * callers never see a stale embedded tag after a tag move. Like
- * validateSpec, this branching read flow reads more honestly written
- * directly than as a pipeline (Go's own note).
+ * getByReference — the slug/org read plus the version ladder, as a chain:
+ * Authorize (a no-op under the lane's skip annotation) → ValidateProto →
+ * LoadWorkflowByReference (the ladder, version-resolution.ts) →
+ * AuthorizeResolvedTarget, which asks of the loaded head's id exactly what
+ * `get` asks by id, so a slug reveals nothing a member could not read
+ * through the id. The archived snapshot shares the head's id, so the check
+ * on a versioned read is the check on the head.
  */
 async function getByReference(
   deps: WorkflowControllerDeps,
   ref: ApiResourceReference,
+  ctx: HandlerContext,
 ): Promise<Workflow> {
-  if (ref.slug === "") {
-    throw invalidArgumentError("slug is required in reference");
-  }
-
-  // Workflow is org-scoped: its slug is unique only within an org, so an
-  // empty-org reference is under-specified.
-  requireOrgForReference(ApiResourceKind.workflow, ref.org);
-
-  if (
-    ref.kind !== ApiResourceKind.api_resource_kind_unknown &&
-    ref.kind !== ApiResourceKind.workflow
-  ) {
-    // Go renders both sides with .String(): the NAME for defined values and
-    // the bare NUMBER for unknown ones (proto3 open enums preserve them, and
-    // ref.kind carries no defined_only rule) — enumToJson would throw on the
-    // unknown arm (panel finding).
-    const got = ApiResourceKind[ref.kind] ?? String(ref.kind);
-    throw invalidArgumentError(
-      `kind mismatch: expected ${ApiResourceKind[ApiResourceKind.workflow]}, got ${got}`,
-    );
-  }
-
-  let mainWorkflow: Workflow | undefined;
-  try {
-    mainWorkflow = await findResourceBySlug(
-      deps.store,
-      ApiResourceKind.workflow,
-      WorkflowSchema,
-      ref.slug,
-      ref.org,
-    );
-  } catch (error) {
-    // Go wraps the slug scan's store failure (query.go:110) — without this
-    // the raw storage error would cross the wire as Unknown (panel finding).
-    throw internalError(error, "failed to list workflows");
-  }
-  if (mainWorkflow === undefined) {
-    throw notFoundError("workflow", ref.slug);
-  }
-
-  const version = ref.version.trim();
-  if (version === "" || version === "latest") {
-    return mainWorkflow;
-  }
-
-  if (workflowMatchesVersion(mainWorkflow, version)) {
-    return mainWorkflow;
-  }
-
-  const archived = await findAuditWorkflowByVersion(
-    deps.store,
-    mainWorkflow.metadata!.id,
-    version,
+  const reqCtx = new RequestContext(
+    WorkflowQueryController.method.getByReference.input,
+    ref,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
   );
-  if (archived === undefined) {
-    throw notFoundError("workflow version", `${ref.slug}:${version}`);
-  }
-  return archived;
-}
-
-function workflowMatchesVersion(wf: Workflow, version: string): boolean {
-  if (wf.status === undefined) {
-    return false;
-  }
-  if (WORKFLOW_HASH_PATTERN.test(version)) {
-    return wf.status.versionHash === version;
-  }
-  return wf.metadata?.version?.tag === version;
-}
-
-async function findAuditWorkflowByVersion(
-  store: Store,
-  workflowId: string,
-  version: string,
-): Promise<Workflow | undefined> {
-  let rec: AuditRecord;
-  try {
-    rec = WORKFLOW_HASH_PATTERN.test(version)
-      ? await store.getAuditRecordByHash(
-          ApiResourceKind.workflow,
-          workflowId,
-          version,
-        )
-      : await store.getAuditRecordByTag(
-          ApiResourceKind.workflow,
-          workflowId,
-          version,
-        );
-  } catch (error) {
-    if (error instanceof AuditNotFoundError) {
-      return undefined;
-    }
-    throw internalError(error, "failed to query workflow audit by version");
-  }
-
-  let wf: Workflow;
-  try {
-    wf = fromBinary(WorkflowSchema, rec.data);
-  } catch (error) {
-    throw internalError(error, "failed to decode archived workflow version");
-  }
-  // Overlay the authoritative tag (audit column) onto the snapshot's
-  // metadata.version.tag — the snapshot's embedded tag is only correct as
-  // of archival time.
-  wf.metadata ??= create(ApiResourceMetadataSchema);
-  wf.metadata.version ??= create(ApiResourceMetadataVersionSchema);
-  wf.metadata.version.tag = rec.tag;
-  return wf;
+  await newPipeline<typeof WorkflowQueryController.method.getByReference.input>(
+    "workflow-get-by-reference",
+    deps.logger,
+  )
+    .addStep(
+      newAuthorizeStep(
+        WorkflowQueryController.method.getByReference,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    .addStep(newLoadWorkflowByReferenceStep(deps.store))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(WorkflowQueryController.method.get),
+      ),
+    )
+    .build()
+    .execute(reqCtx);
+  return reqCtx.get(TARGET_RESOURCE_KEY) as Workflow;
 }
 
 // ---------------------------------------------------------------------------
@@ -996,28 +914,23 @@ async function listVersions(
     )
     .addStep(newValidateProtoStep())
     .addStep(newResolveWorkflowBySlugStep(deps.store))
-    .addStep({
-      name: "AuthorizeResolvedWorkflow",
-      async execute(stepCtx): Promise<void> {
-        // The Java WorkflowListVersionsHandler's mid-chain can_view on the
-        // RESOLVED workflow id (20260830.01 ruling Q8 — the DD-007 pattern
-        // "the two traced ListVersions handlers port onto"; the skip
-        // annotation exists because the target resolves from org+slug, not
-        // a request field). Deny copy is the Java handler's byte-pinned
-        // error_msg. The resolve step above already answered NOT_FOUND for
-        // an unknown slug, the load-first order both editions share.
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.workflow,
-            resourceId: stepCtx.get(LIST_VERSIONS_WORKFLOW_ID_KEY) as string,
-          },
+    // The Java WorkflowListVersionsHandler's mid-chain can_view on the
+    // RESOLVED workflow id (the skip annotation exists because the target
+    // resolves from org+slug, not a request field); the copy is the Java
+    // handler's byte-pinned error_msg, and the resolve step above already
+    // answered NOT_FOUND for an unknown slug, the load-first order both
+    // editions share.
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        versionHistoryTarget(
+          ApiResourceKind.workflow,
           "unauthorized to view workflow version history",
-        );
-      },
-    })
+          LIST_VERSIONS_WORKFLOW_ID_KEY,
+        ),
+        "AuthorizeResolvedWorkflow",
+      ),
+    )
     .addStep(newLoadAndMapWorkflowVersionsStep(deps.store))
     .build()
     .execute(reqCtx);

package/src/domain/workflow/version-resolution.ts

@@ -0,0 +1,166 @@
+/**
+ * Workflow version resolution — the getByReference ladder as a pipeline
+ * step, so the lane can carry the resolved-target authorization the
+ * position-1 annotation cannot express (the target is a slug, not a field).
+ *
+ * The ladder is the Go query.go read, moved here from the direct handler
+ * without a behaviour change: slug required; org required (a workflow's slug
+ * is unique only within an org); kind mismatch refused with Go's rendering
+ * (the NAME for defined values, the bare NUMBER for unknown ones, because
+ * ref.kind carries no defined_only rule and enumToJson would throw on the
+ * unknown arm); the slug scan's store failure wrapped so a raw storage error
+ * never crosses the wire as Unknown; empty or "latest" is the current head;
+ * a version matching the head's hash or tag is the head; otherwise the
+ * audit store by hash or tag, with the snapshot's tag overlaid from the
+ * audit column (the source of truth) so callers never see a stale embedded
+ * tag after a tag move. The resolved row lands under TARGET_RESOURCE_KEY,
+ * the loader contract every getByReference chain shares.
+ *
+ * Deliberately NOT the shared ladder in pipeline/steps/version-history.ts:
+ * that one decodes through the typed audit reads and carries no tag
+ * overlay, so folding the two would change what one of them returns for a
+ * moved tag. Consolidating them is a separate change with its own proof.
+ *
+ * Proven by __tests__/workflow.test.ts's getByReference block and the
+ * conformance suite's workflow reference arms.
+ */
+import { create, fromBinary } from "@bufbuild/protobuf";
+
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import {
+  ApiResourceMetadataSchema,
+  ApiResourceMetadataVersionSchema,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import {
+  internalError,
+  invalidArgumentError,
+  notFoundError,
+} from "../../pipeline/errors.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { RequestContext } from "../../pipeline/request-context.js";
+import type { GetByReferenceDesc } from "../../pipeline/steps/authorize-resolved-target.js";
+import {
+  findResourceBySlug,
+  requireOrgForReference,
+} from "../../pipeline/steps/helpers.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { AuditNotFoundError } from "../../store/interface.js";
+import type { AuditRecord, Store } from "../../store/interface.js";
+
+/** A 64-hex value is an exact content hash; anything else is a tag. */
+const WORKFLOW_HASH_PATTERN = /^[a-f0-9]{64}$/;
+
+export function newLoadWorkflowByReferenceStep(
+  store: Store,
+): PipelineStep<GetByReferenceDesc> {
+  return {
+    name: "LoadWorkflowByReference",
+    async execute(ctx: RequestContext<GetByReferenceDesc>): Promise<void> {
+      const ref = ctx.input;
+      if (ref.slug === "") {
+        throw invalidArgumentError("slug is required in reference");
+      }
+
+      requireOrgForReference(ApiResourceKind.workflow, ref.org);
+
+      if (
+        ref.kind !== ApiResourceKind.api_resource_kind_unknown &&
+        ref.kind !== ApiResourceKind.workflow
+      ) {
+        const got = ApiResourceKind[ref.kind] ?? String(ref.kind);
+        throw invalidArgumentError(
+          `kind mismatch: expected ${ApiResourceKind[ApiResourceKind.workflow]}, got ${got}`,
+        );
+      }
+
+      let mainWorkflow: Workflow | undefined;
+      try {
+        mainWorkflow = await findResourceBySlug(
+          store,
+          ApiResourceKind.workflow,
+          WorkflowSchema,
+          ref.slug,
+          ref.org,
+        );
+      } catch (error) {
+        throw internalError(error, "failed to list workflows");
+      }
+      if (mainWorkflow === undefined) {
+        throw notFoundError("workflow", ref.slug);
+      }
+
+      const version = ref.version.trim();
+      if (
+        version === "" ||
+        version === "latest" ||
+        workflowMatchesVersion(mainWorkflow, version)
+      ) {
+        ctx.set(TARGET_RESOURCE_KEY, mainWorkflow);
+        return;
+      }
+
+      const archived = await findAuditWorkflowByVersion(
+        store,
+        mainWorkflow.metadata!.id,
+        version,
+      );
+      if (archived === undefined) {
+        throw notFoundError("workflow version", `${ref.slug}:${version}`);
+      }
+      ctx.set(TARGET_RESOURCE_KEY, archived);
+    },
+  };
+}
+
+function workflowMatchesVersion(wf: Workflow, version: string): boolean {
+  if (wf.status === undefined) {
+    return false;
+  }
+  if (WORKFLOW_HASH_PATTERN.test(version)) {
+    return wf.status.versionHash === version;
+  }
+  return wf.metadata?.version?.tag === version;
+}
+
+async function findAuditWorkflowByVersion(
+  store: Store,
+  workflowId: string,
+  version: string,
+): Promise<Workflow | undefined> {
+  let rec: AuditRecord;
+  try {
+    rec = WORKFLOW_HASH_PATTERN.test(version)
+      ? await store.getAuditRecordByHash(
+          ApiResourceKind.workflow,
+          workflowId,
+          version,
+        )
+      : await store.getAuditRecordByTag(
+          ApiResourceKind.workflow,
+          workflowId,
+          version,
+        );
+  } catch (error) {
+    if (error instanceof AuditNotFoundError) {
+      return undefined;
+    }
+    throw internalError(error, "failed to query workflow audit by version");
+  }
+
+  let wf: Workflow;
+  try {
+    wf = fromBinary(WorkflowSchema, rec.data);
+  } catch (error) {
+    throw internalError(error, "failed to decode archived workflow version");
+  }
+  // Overlay the authoritative tag (audit column) onto the snapshot's
+  // metadata.version.tag — the snapshot's embedded tag is only correct as
+  // of archival time.
+  wf.metadata ??= create(ApiResourceMetadataSchema);
+  wf.metadata.version ??= create(ApiResourceMetadataVersionSchema);
+  wf.metadata.version.tag = rec.tag;
+  return wf;
+}

package/src/domain/workflowexecution/create-steps.ts

@@ -62,9 +62,10 @@ export type ExecutionWorkflowInstanceCreatorProvider =
 /**
  * ValidateWorkflowOrInstance — at least one of workflow_id /
  * workflow_instance_id must be provided. Matches the cloud
- * WorkflowExecutionCreateHandler. AgentExecution differs: it has a
- * ResolveDefaultAgent step, so its guard is an unreachable invariant
- * (Internal), not reachable InvalidArgument validation (issue #196).
+ * WorkflowExecutionCreateHandler. AgentExecution differs on purpose: its
+ * all-empty shape is legal (the built-in assistant), so it has no such
+ * step; a workflow execution has no built-in workflow to fall back to
+ * (issue #196).
  */
 export function newValidateWorkflowOrInstanceStep(): PipelineStep<ExecutionDesc> {
   return {

package/src/domain/workflowinstance/__tests__/create-authorization.test.ts

@@ -0,0 +1,109 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveWorkflowInstanceCreateTargets): a personal instance asks
+ * can_execute on the parent workflow with the Java handler's copy; a
+ * default instance the server composed in-process for the parent's
+ * organization asks nothing; the same label from the wire or for another
+ * organization takes the bar; a missing parent throws.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import {
+  DEFAULT_INSTANCE_LABEL,
+  RESERVED_LABEL_TRUE,
+} from "../../../pipeline/apiresource-labels.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  PARENT_WORKFLOW_KEY,
+  WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE,
+  resolveWorkflowInstanceCreateTargets,
+} from "../steps.js";
+
+const parent = create(WorkflowSchema, {
+  metadata: { id: "wf_01parent", name: "nightly", org: "acme" },
+});
+
+function ctxFor(
+  org: string,
+  caller: CallerIdentity,
+  labels: Record<string, string> = {},
+  stashParent = true,
+) {
+  const ctx = new RequestContext(
+    WorkflowInstanceSchema,
+    create(WorkflowInstanceSchema, {
+      metadata: { name: "mine", org, labels },
+      spec: { workflowId: parent.metadata!.id },
+    }),
+    caller,
+    ApiResourceKind.workflow_instance,
+  );
+  if (stashParent) {
+    ctx.set(PARENT_WORKFLOW_KEY, parent);
+  }
+  return ctx;
+}
+
+const DEFAULT_LABELS = { [DEFAULT_INSTANCE_LABEL]: RESERVED_LABEL_TRUE };
+
+describe("resolveWorkflowInstanceCreateTargets", () => {
+  it("a personal instance asks can_execute on the parent workflow", () => {
+    expect(
+      resolveWorkflowInstanceCreateTargets(
+        ctxFor("acme", testCallerIdentity()),
+      ),
+    ).toEqual([
+      {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.workflow,
+        resourceId: "wf_01parent",
+        deniedMessage: WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a default instance the server composed in-process for the parent's organization asks nothing", () => {
+    expect(
+      resolveWorkflowInstanceCreateTargets(
+        ctxFor(
+          "acme",
+          testCallerIdentity({ callerClass: "user", origin: "in-process" }),
+          DEFAULT_LABELS,
+        ),
+      ),
+    ).toEqual([]);
+  });
+
+  it("the label from the wire, or for another organization, takes the bar", () => {
+    expect(
+      resolveWorkflowInstanceCreateTargets(
+        ctxFor("acme", testCallerIdentity(), DEFAULT_LABELS),
+      ),
+    ).toHaveLength(1);
+    expect(
+      resolveWorkflowInstanceCreateTargets(
+        ctxFor(
+          "other-org",
+          testCallerIdentity({ callerClass: "user", origin: "in-process" }),
+          DEFAULT_LABELS,
+        ),
+      ),
+    ).toHaveLength(1);
+  });
+
+  it("a missing parent is a broken chain invariant and throws", () => {
+    expect(() =>
+      resolveWorkflowInstanceCreateTargets(
+        ctxFor("acme", testCallerIdentity(), {}, false),
+      ),
+    ).toThrow("parent workflow not found in context");
+  });
+});

package/src/domain/workflowinstance/controller.ts

@@ -53,6 +53,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   newAuthorizeVisibilityTransitionStep,
@@ -108,6 +112,7 @@ import {
   newRejectDefaultWorkflowInstanceVisibilityUpdateStep,
   newValidateInstanceUpdateStep,
   newValidateSameOrgBusinessRuleStep,
+  resolveWorkflowInstanceCreateTargets,
 } from "./steps.js";
 import type { ParentWorkflowLoaderProvider } from "./steps.js";
 
@@ -182,6 +187,14 @@ async function createInstance(
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveSlugStep())
     .addStep(newLoadParentWorkflowStep(deps.parentWorkflowLoader, deps.logger))
+    // Before the same-org rule, whose refusal names the parent's organization
+    // (steps.ts, resolveWorkflowInstanceCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveWorkflowInstanceCreateTargets,
+      ),
+    )
     .addStep(newValidateSameOrgBusinessRuleStep(deps.logger))
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
@@ -707,6 +720,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, WorkflowInstanceSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(WorkflowInstanceQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as WorkflowInstance;

package/src/domain/workflowinstance/steps.ts

@@ -16,8 +16,10 @@ import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/ap
 import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import type { WorkflowInstance } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { isDefaultInstance } from "../../pipeline/apiresource-labels.js";
 import {
   failedPreconditionError,
@@ -27,6 +29,7 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { rejectDefaultInstanceVisibilityUpdate } from "../../pipeline/steps/validate-visibility.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
@@ -72,7 +75,8 @@ export function newLoadParentWorkflowStep(
         parent = await loaderProvider().get(workflowId);
       } catch (error) {
         logger.warn("Parent workflow not found", {
-          error: error instanceof ConnectError ? error.rawMessage : String(error),
+          error:
+            error instanceof ConnectError ? error.rawMessage : String(error),
           workflowId,
         });
         throw notFoundError("Workflow", workflowId);
@@ -83,6 +87,50 @@ export function newLoadParentWorkflowStep(
   };
 }
 
+/** The deny copy of the parent's bar, the Java WorkflowInstanceCreateHandler's. */
+export const WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE =
+  "You don't have permission to create instances of this workflow";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after LoadParentWorkflow and BEFORE ValidateSameOrgBusinessRule (whose
+ * refusal names the parent's organization, which a refused caller should
+ * not learn). The RPC is is_skip_authorization because its target is the
+ * PARENT, loaded from spec.workflow_id, not a request field.
+ *
+ * One question: may the caller run this workflow (can_execute on the
+ * parent, the relation the run gate asks; the same-org rule already binds
+ * the instance's organization to the workflow's, so there is no separate
+ * organization bar). A DEFAULT instance asks nothing, for the reason its
+ * agent twin gives (agentinstance/steps.ts): it is the workflow's row,
+ * composed by the server for the run's human, keyed on the in-process
+ * origin, the reserved label and the parent's organization together.
+ */
+export function resolveWorkflowInstanceCreateTargets(
+  ctx: RequestContext<InstanceDesc>,
+): ReadonlyArray<AuthorizationTarget> {
+  const parent = ctx.get(PARENT_WORKFLOW_KEY) as Workflow | undefined;
+  if (parent === undefined) {
+    throw new Error("parent workflow not found in context");
+  }
+  const metadata = ctx.newState.metadata;
+  if (
+    isDefaultInstance(metadata) &&
+    isServerComposedRequest(ctx.callerIdentity) &&
+    (metadata?.org ?? "") === (parent.metadata?.org ?? "")
+  ) {
+    return [];
+  }
+  return [
+    {
+      permission: IamPermission.can_execute,
+      resourceKind: ApiResourceKind.workflow,
+      resourceId: parent.metadata?.id ?? "",
+      deniedMessage: WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * ValidateSameOrgBusinessRule — create.go: instances must live in the same
  * organization as the parent workflow; cross-org instances could leak