@stigmer/server 3.21.0 → 3.22.0

package/src/domain/agentshare/__tests__/member-audience.test.ts

@@ -0,0 +1,113 @@
+/**
+ * Pins AuthorizeMemberAudience (steps.ts), the member-profile lane's gate:
+ * membership (can_view on the reference's organization) is asked before
+ * the share is loaded; deny and not-found both answer the lane's one
+ * NOT_FOUND, byte-identical to a missing share, so a share URL teaches a
+ * non-member nothing; unavailable is INTERNAL; an empty org asks nothing
+ * and is left to the loader's INVALID_ARGUMENT; the internal class skips.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import type {
+  Authorizer,
+  AuthzCheck,
+  AuthzDecision,
+} from "../../../extensions/authorizer.js";
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import { AUTHORIZATION_UNAVAILABLE_MESSAGE } from "../../../pipeline/steps/authorize.js";
+import { newAuthorizeMemberAudienceStep, sharedNotFound } from "../steps.js";
+
+function fakeAuthorizer(decision: AuthzDecision): {
+  authorizer: Authorizer;
+  checks: AuthzCheck[];
+} {
+  const checks: AuthzCheck[] = [];
+  return {
+    checks,
+    authorizer: {
+      authorize(_caller, check) {
+        checks.push(check);
+        return Promise.resolve(decision);
+      },
+    },
+  };
+}
+
+function ctxFor(org: string, caller: CallerIdentity = testCallerIdentity()) {
+  return new RequestContext(
+    ApiResourceReferenceSchema,
+    create(ApiResourceReferenceSchema, { org, slug: "helper" }),
+    caller,
+    ApiResourceKind.agent_share,
+  );
+}
+
+async function captureError(
+  run: () => void | Promise<void>,
+): Promise<ConnectError> {
+  try {
+    await run();
+  } catch (error) {
+    return ConnectError.from(error);
+  }
+  throw new Error("expected the step to reject");
+}
+
+describe("AuthorizeMemberAudience", () => {
+  it("asks can_view on the reference's organization and admits an allow", async () => {
+    const { authorizer, checks } = fakeAuthorizer({ kind: "allow" });
+    await newAuthorizeMemberAudienceStep(authorizer).execute(ctxFor("acme"));
+    expect(checks).toEqual([
+      {
+        permission: IamPermission.can_view,
+        resourceKind: ApiResourceKind.organization,
+        resourceId: "acme",
+      },
+    ]);
+  });
+
+  it("deny and not-found both answer the lane's NOT_FOUND, byte-identical to a missing share", async () => {
+    for (const decision of [
+      { kind: "deny", reason: "not a member" },
+      { kind: "not-found" },
+    ] as const) {
+      const { authorizer } = fakeAuthorizer(decision);
+      const error = await captureError(() =>
+        newAuthorizeMemberAudienceStep(authorizer).execute(ctxFor("acme")),
+      );
+      expect(error.code).toBe(Code.NotFound);
+      expect(error.rawMessage).toBe(sharedNotFound("helper").rawMessage);
+    }
+  });
+
+  it("unavailable is INTERNAL, never a refusal", async () => {
+    const { authorizer } = fakeAuthorizer({
+      kind: "unavailable",
+      cause: new Error("backend down"),
+    });
+    const error = await captureError(() =>
+      newAuthorizeMemberAudienceStep(authorizer).execute(ctxFor("acme")),
+    );
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe(AUTHORIZATION_UNAVAILABLE_MESSAGE);
+  });
+
+  it("an empty org asks nothing (the loader's INVALID_ARGUMENT answers), and the internal class skips", async () => {
+    const denying = fakeAuthorizer({ kind: "deny", reason: "" });
+    await newAuthorizeMemberAudienceStep(denying.authorizer).execute(
+      ctxFor(""),
+    );
+    await newAuthorizeMemberAudienceStep(denying.authorizer).execute(
+      ctxFor("acme", testCallerIdentity({ callerClass: "internal" })),
+    );
+    expect(denying.checks).toEqual([]);
+  });
+});

package/src/domain/agentshare/controller.ts

@@ -60,6 +60,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   newBuildNewStateStep,
@@ -109,6 +113,8 @@ import {
   newValidateShareUpdateStep,
   sharedNotFound,
   sharingLinkTokenAllowed,
+  resolveShareCreateTargets,
+  newAuthorizeMemberAudienceStep,
 } from "./steps.js";
 
 export interface AgentShareControllerDeps {
@@ -176,6 +182,13 @@ async function createShare(
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveShareDefaultsStep(deps.store))
+    // Before the duplicate check (steps.ts, resolveShareCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveShareCreateTargets,
+      ),
+    )
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
@@ -491,6 +504,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, AgentShareSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(AgentShareQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as AgentShare;
@@ -797,6 +816,8 @@ async function getSharedProfileForMember(
       ),
     )
     .addStep(newValidateProtoStep())
+    // Membership before existence (steps.ts, AuthorizeMemberAudience).
+    .addStep(newAuthorizeMemberAudienceStep(deps.authorizer))
     .addStep(newLoadShareForMemberProfileStep(deps.store))
     .addStep(newProjectMemberSharedProfileStep(deps.store))
     .build()

package/src/domain/agentshare/steps.ts

@@ -35,6 +35,7 @@ import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb"
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   failedPreconditionError,
@@ -44,6 +45,13 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import {
+  AUTHORIZATION_UNAVAILABLE_MESSAGE,
+  evaluateAuthorizer,
+} from "../../pipeline/steps/authorize.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
+import type { GetByReferenceDesc } from "../../pipeline/steps/authorize-resolved-target.js";
 import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
@@ -61,10 +69,66 @@ type AgentShareDesc = typeof AgentShareSchema;
 /**
  * Context key for the agent resolved from spec.agent_ref during
  * create/apply, so later steps never re-load it — Go referencedAgentKey.
- * Module-private: only ResolveShareDefaults writes it and StampAgentPin
- * reads it, both in this file.
+ * ResolveShareDefaults writes it; the create lane's authorization step and
+ * StampAgentPin read it.
  */
-const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+export const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+
+/** The deny copy of the agent's bar, the Java AgentShareCreateHandler's. */
+export const SHARE_AGENT_DENIED_MESSAGE =
+  "You don't have permission to share this agent";
+
+/** The deny copy of the sharing organization's bar, the Java handler's. */
+export const SHARE_ORGANIZATION_DENIED_MESSAGE =
+  "You don't have permission to create agent shares in this organization";
+
+/**
+ * The create lane's authorization questions, for AuthorizeResolvedTarget
+ * after ResolveShareDefaults: the two-arm consent bar the Java handler
+ * enforced and the model's comment on can_create_agent_share describes.
+ * The RPC is is_skip_authorization because the target is the referenced
+ * agent, resolved from a slug, not a request field.
+ *
+ * A same-org share (spec.agent_ref.org equals metadata.org, after the
+ * resolve step made the reference absolute) asks can_edit on the agent:
+ * sharing puts the agent in front of a wider audience, an editor's act.
+ *
+ * A cross-org share of another organization's public agent asks two
+ * questions, agent first as Java did: can_execute on the agent (whoever may
+ * run it may offer it) and then can_create_agent_share on the SHARING
+ * organization — a public share spends that organization's credits on the
+ * open internet, an admin-level act. The cross-org validity rules (public
+ * agent, no org audience, public dependencies) stay the resolve step's.
+ */
+export function resolveShareCreateTargets(
+  ctx: RequestContext<AgentShareDesc>,
+): ReadonlyArray<AuthorizationTarget> {
+  const agent = ctx.get(REFERENCED_AGENT_KEY) as Agent | undefined;
+  if (agent === undefined) {
+    throw new Error("referenced agent not found in context");
+  }
+  const share = ctx.newState;
+  const shareOrg = share.metadata?.org ?? "";
+  const crossOrg = (share.spec?.agentRef?.org ?? "") !== shareOrg;
+  const agentBar: AuthorizationTarget = {
+    permission: crossOrg ? IamPermission.can_execute : IamPermission.can_edit,
+    resourceKind: ApiResourceKind.agent,
+    resourceId: agent.metadata?.id ?? "",
+    deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
+  };
+  if (!crossOrg) {
+    return [agentBar];
+  }
+  return [
+    agentBar,
+    {
+      permission: IamPermission.can_create_agent_share,
+      resourceKind: ApiResourceKind.organization,
+      resourceId: shareOrg,
+      deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
+    },
+  ];
+}
 
 /**
  * The single refusal for every anonymous/member resolution miss: share
@@ -78,6 +142,71 @@ export function sharedNotFound(slug: string): ConnectError {
   return notFoundError("Agent", slug);
 }
 
+/**
+ * AuthorizeMemberAudience — the member-profile lane's gate, membership
+ * BEFORE existence: the Java AgentShareGetSharedProfileForMemberHandler
+ * order. getSharedProfileForMember is the signed-in resolution path for a
+ * share URL, and the proto pins its contract: a share that does not exist,
+ * is disabled, or is asked for by someone who is not a member of the
+ * sharing organization all answer the SAME NOT_FOUND, so a share URL
+ * teaches a non-member nothing — not even whether the share exists. A
+ * non-member resolving a public share uses the anonymous lane instead.
+ *
+ * The question is can_view on the organization named in the reference (the
+ * viewer set: members and above), asked live on every call so a revoked
+ * member loses access at once; the RPC is is_skip_authorization because
+ * the target is the reference's organization, not a request field the
+ * annotation can key on. This is deliberately NOT the shared
+ * AuthorizeResolvedTarget step: that step answers deny with
+ * PERMISSION_DENIED, and this lane's wire contract is the indistinguishable
+ * NOT_FOUND above, so the lane keeps its own mapping over the same
+ * evaluation (the decision form checkMyPermission uses). An empty org is
+ * left to the loader's INVALID_ARGUMENT, the proto's own copy for it; an
+ * unavailable authorizer is INTERNAL, never softened into a refusal; the
+ * `internal` class is exempt as everywhere.
+ */
+export function newAuthorizeMemberAudienceStep(
+  authorizer: Authorizer,
+): PipelineStep<GetByReferenceDesc> {
+  return {
+    name: "AuthorizeMemberAudience",
+    async execute(ctx: RequestContext<GetByReferenceDesc>): Promise<void> {
+      const ref = ctx.input;
+      if (ref.org === "" || ctx.callerIdentity.callerClass === "internal") {
+        return;
+      }
+      const decision = await evaluateAuthorizer(
+        authorizer,
+        ctx.callerIdentity,
+        {
+          permission: IamPermission.can_view,
+          resourceKind: ApiResourceKind.organization,
+          resourceId: ref.org,
+        },
+      );
+      switch (decision.kind) {
+        case "allow":
+          return;
+        case "deny":
+        case "not-found":
+          throw sharedNotFound(ref.slug);
+        case "unavailable":
+          throw internalError(
+            decision.cause,
+            AUTHORIZATION_UNAVAILABLE_MESSAGE,
+          );
+        default: {
+          const exhaustive: never = decision;
+          throw internalError(
+            new Error(`unknown decision ${JSON.stringify(exhaustive)}`),
+            AUTHORIZATION_UNAVAILABLE_MESSAGE,
+          );
+        }
+      }
+    },
+  };
+}
+
 /**
  * The link-token predicate — Go sharingLinkTokenAllowed, the mirror of the
  * cloud edition's SharingLinkTokenPolicy:
@@ -90,7 +219,10 @@ export function sharedNotFound(slug: string): ConnectError {
  * guard restores Go's semantics; the length of a token is not secret (all
  * server-minted tokens are 27 chars).
  */
-export function sharingLinkTokenAllowed(presented: string, live: string): boolean {
+export function sharingLinkTokenAllowed(
+  presented: string,
+  live: string,
+): boolean {
   if (live === "") {
     return true;
   }
@@ -182,7 +314,9 @@ export async function findShareByOrgAndSlug(
  *      provided neither — the canonical share keeps the agent's hosted URL.
  *      Runs before ResolveSlug, which skips already-set slugs.
  */
-export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentShareDesc> {
+export function newResolveShareDefaultsStep(
+  store: Store,
+): PipelineStep<AgentShareDesc> {
   return {
     name: "ResolveShareDefaults",
     async execute(ctx: RequestContext<AgentShareDesc>): Promise<void> {
@@ -204,7 +338,11 @@ export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentSha
         agentRef!.org = metadata!.org;
       }
 
-      const agent = await findAgentByOrgAndSlug(store, agentRef!.org, agentRef!.slug);
+      const agent = await findAgentByOrgAndSlug(
+        store,
+        agentRef!.org,
+        agentRef!.slug,
+      );
       if (agent === undefined) {
         throw notFoundError("Agent", agentRef!.slug);
       }
@@ -288,7 +426,10 @@ async function findNonPublicDependencies(
 
   const seen = new Set<string>();
   const deps: DepRef[] = [];
-  const add = (kind: ApiResourceKind, ref: ApiResourceReference | undefined): void => {
+  const add = (
+    kind: ApiResourceKind,
+    ref: ApiResourceReference | undefined,
+  ): void => {
     if (ref === undefined || ref.slug === "") {
       return;
     }
@@ -320,8 +461,20 @@ async function findNonPublicDependencies(
       // are the only dependency kinds an agent blueprint declares.
       const resolved =
         dep.kind === ApiResourceKind.skill
-          ? await findResourceBySlug(store, dep.kind, SkillSchema, dep.slug, dep.org)
-          : await findResourceBySlug(store, dep.kind, McpServerSchema, dep.slug, dep.org);
+          ? await findResourceBySlug(
+              store,
+              dep.kind,
+              SkillSchema,
+              dep.slug,
+              dep.org,
+            )
+          : await findResourceBySlug(
+              store,
+              dep.kind,
+              McpServerSchema,
+              dep.slug,
+              dep.org,
+            );
       visibility = resolved?.metadata?.visibility;
     } catch (error) {
       throw internalError(
@@ -396,20 +549,28 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
       // Normalize the input ref's org the same way create does (empty
       // means the share's own org) before comparing.
       const inputOrg =
-        (inputRef?.org ?? "") !== "" ? inputRef!.org : (existing.metadata?.org ?? "");
+        (inputRef?.org ?? "") !== ""
+          ? inputRef!.org
+          : (existing.metadata?.org ?? "");
 
       if (
         (inputRef?.slug ?? "") !== (existingRef?.slug ?? "") ||
         inputOrg !== (existingRef?.org ?? "")
       ) {
         throw failedPreconditionError(
-          agentRefImmutableMessage(existingRef?.org ?? "", existingRef?.slug ?? ""),
+          agentRefImmutableMessage(
+            existingRef?.org ?? "",
+            existingRef?.slug ?? "",
+          ),
         );
       }
 
-      const isCrossOrg = (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
+      const isCrossOrg =
+        (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
       if (isCrossOrg && ctx.input.spec?.audience === AgentShareAudience.org) {
-        throw failedPreconditionError(crossOrgAudienceMessage(existingRef?.org ?? ""));
+        throw failedPreconditionError(
+          crossOrgAudienceMessage(existingRef?.org ?? ""),
+        );
       }
     },
   };
@@ -430,7 +591,11 @@ export async function buildSharedAgentProfile(
   share: AgentShare,
 ): Promise<SharedAgentProfile> {
   const ref = share.spec?.agentRef;
-  const agent = await findAgentByOrgAndSlug(store, ref?.org ?? "", ref?.slug ?? "");
+  const agent = await findAgentByOrgAndSlug(
+    store,
+    ref?.org ?? "",
+    ref?.slug ?? "",
+  );
   if (agent === undefined) {
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
@@ -440,7 +605,8 @@ export async function buildSharedAgentProfile(
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 
-  const isCrossOrg = (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
+  const isCrossOrg =
+    (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
   if (
     isCrossOrg &&
     agent.metadata?.visibility !== ApiResourceVisibility.visibility_public

package/src/domain/artifact/controller.ts

@@ -66,9 +66,9 @@ import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import {
   authorizeDirect,
-  authorizeResolvedResource,
   newAuthorizeStep,
 } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import {
   generateId,
   setAuditFieldsForCreate,
@@ -426,23 +426,18 @@ async function listByExecution(
         }
       },
     })
-    .addStep({
-      name: "AuthorizeParentExecution",
-      async execute(stepCtx): Promise<void> {
-        // The Java ArtifactListByExecutionHandler's hand-rolled gate
-        // (20260830.01 ruling Q8): can_view on the PARENT execution —
-        // "if you can view an execution, you can list its artifacts."
-        // The two-field dispatch (workflow-execution first, the Java
-        // order) is why the declarative annotation cannot express this
-        // lane and the proto carries is_skip_authorization. Deny copy is
-        // the Java handler's byte-pinned error_msg; a nonexistent id
-        // answers NOT_FOUND through the authorizer's probe — the ruled
-        // uniform unknown-id posture (DD-007 addendum), a recorded
-        // divergence from Java's deny-everyone arm on this lane.
-        const input = stepCtx.input;
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
+    // The Java ArtifactListByExecutionHandler's gate: can_view on the PARENT
+    // execution — "if you can view an execution, you can list its
+    // artifacts." The two-field dispatch (workflow-execution first, the Java
+    // order) is why the declarative annotation cannot express this lane and
+    // the proto carries is_skip_authorization. Deny copy is the Java
+    // handler's byte-pinned error_msg; a nonexistent id answers NOT_FOUND
+    // through the authorizer's probe — the ruled uniform unknown-id
+    // posture, a recorded divergence from Java's deny-everyone arm here.
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        ({ input }) => [
           {
             permission: IamPermission.can_view,
             resourceKind:
@@ -453,11 +448,12 @@ async function listByExecution(
               input.workflowExecutionId !== ""
                 ? input.workflowExecutionId
                 : input.agentExecutionId,
+            deniedMessage: "unauthorized to list artifacts for this execution",
           },
-          "unauthorized to list artifacts for this execution",
-        );
-      },
-    })
+        ],
+        "AuthorizeParentExecution",
+      ),
+    )
     .addStep({
       name: "QueryArtifactsByExecution",
       async execute(stepCtx): Promise<void> {

package/src/domain/channelapp/controller.ts

@@ -51,6 +51,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -369,6 +373,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ChannelAppSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ChannelAppQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const app = reqCtx.get(TARGET_RESOURCE_KEY) as ChannelApp;

package/src/domain/environment/controller.ts

@@ -58,6 +58,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import {
@@ -682,6 +686,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, EnvironmentSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(EnvironmentQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const env = reqCtx.get(TARGET_RESOURCE_KEY) as Environment;

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -277,6 +277,7 @@ describe("executioncontext domain (encryption + runner auth enabled)", () => {
           () =>
             ts.query.getByReference({
               kind: ApiResourceKind.execution_context,
+              org: created.metadata!.org,
               slug: created.metadata!.slug,
             }),
         ],

package/src/domain/executioncontext/controller.ts

@@ -56,6 +56,10 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import {
@@ -361,6 +365,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ExecutionContextSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ExecutionContextQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const ec = reqCtx.get(TARGET_RESOURCE_KEY) as ExecutionContext;

package/src/domain/executioncontext/steps.ts

@@ -34,6 +34,7 @@ import { isCiphertextShaped } from "../../encryption/encryption.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { EncryptionScope } from "../../encryption/encryption.js";
 import type { Authorizer, AuthzDecision } from "../../extensions/authorizer.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import {
   internalError,
   invalidArgumentError,
@@ -240,7 +241,7 @@ export function newAuthorizeExecutionContextCreateStep(
       ctx: RequestContext<typeof ExecutionContextSchema>,
     ): Promise<void> {
       const caller = ctx.callerIdentity;
-      if (caller.callerClass === "internal" || caller.origin === "in-process") {
+      if (isServerComposedRequest(caller)) {
         return; // authorized upstream — the Java in-process trust arm
       }
       let decision: AuthzDecision;

package/src/domain/mcpserver/connect.ts

@@ -254,13 +254,6 @@ export async function connect(
   input: ConnectInput,
   identity: CallerIdentity,
 ): Promise<McpServer> {
-  const engineState = deps.engineState();
-  if (!engineState.connected) {
-    throw failedPreconditionError(
-      "connect is not available: Temporal not configured",
-    );
-  }
-
   const mcpServerId = input.mcpServerId;
   if (mcpServerId === "") {
     throw invalidArgumentError("mcp_server_id is required");
@@ -280,9 +273,10 @@ export async function connect(
     throw notFoundError("mcp_server", mcpServerId);
   }
 
-  // The annotation's can_connect check AFTER the load — the Java
-  // McpServerConnectHandler order (load-before-authorize, stigmer#224).
-  // C2 Stage 4.
+  // The annotation's can_connect check after the load and BEFORE the engine
+  // check (the Java McpServerConnectHandler load-before-authorize order,
+  // stigmer#224): a caller who may not connect this server learns nothing
+  // about whether the engine is up.
   await authorizeDirect(
     McpServerCommandController.method.connect,
     deps.authorizer,
@@ -290,6 +284,13 @@ export async function connect(
     input,
   );
 
+  const engineState = deps.engineState();
+  if (!engineState.connected) {
+    throw failedPreconditionError(
+      "connect is not available: Temporal not configured",
+    );
+  }
+
   const prepared = await prepareConnect(deps, mcpServer, input, identity);
 
   try {