@stigmer/server 3.21.0 → 3.22.0

package/src/domain/mcpserver/controller.ts

@@ -53,6 +53,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   newAuthorizeVisibilityTransitionStep,
@@ -207,7 +211,9 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
 }
 
 /** The endpoint-auth step's slice of the deps: the guarded fetch the connect slice holds. */
-function endpointAuthDeps(deps: McpServerControllerDeps): CompleteEndpointAuthDeps {
+function endpointAuthDeps(
+  deps: McpServerControllerDeps,
+): CompleteEndpointAuthDeps {
   return { outboundFetch: deps.connect.outboundFetch, logger: deps.logger };
 }
 
@@ -629,6 +635,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, McpServerSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(McpServerQueryController.method.get),
+      ),
+    )
     .addStep(newEnrichOAuthStatusStep(deps.store, deps.logger))
     .build()
     .execute(reqCtx);

package/src/domain/mcpserver/start-connect.ts

@@ -69,13 +69,6 @@ export async function startConnect(
   input: ConnectInput,
   identity: CallerIdentity,
 ): Promise<McpServer> {
-  const engineState = deps.engineState();
-  if (!engineState.connected) {
-    throw failedPreconditionError(
-      "connect is not available: Temporal not configured",
-    );
-  }
-
   const mcpServerId = input.mcpServerId;
   if (mcpServerId === "") {
     throw invalidArgumentError("mcp_server_id is required");
@@ -95,9 +88,10 @@ export async function startConnect(
     throw notFoundError("mcp_server", mcpServerId);
   }
 
-  // The annotation's can_connect check AFTER the load — the Java
-  // McpServerStartConnectHandler order (the connect handler's shared
-  // load/authorize steps, stigmer#224). C2 Stage 4.
+  // The annotation's can_connect check after the load and BEFORE the engine
+  // check (the Java McpServerStartConnectHandler load-before-authorize order,
+  // stigmer#224): a caller who may not connect this server learns nothing
+  // about whether the engine is up.
   await authorizeDirect(
     McpServerCommandController.method.startConnect,
     deps.authorizer,
@@ -105,6 +99,13 @@ export async function startConnect(
     input,
   );
 
+  const engineState = deps.engineState();
+  if (!engineState.connected) {
+    throw failedPreconditionError(
+      "connect is not available: Temporal not configured",
+    );
+  }
+
   const connectStatus = mcpServer.status?.connectStatus;
   if (connectStatus?.phase === ConnectPhase.connecting) {
     if (
@@ -249,7 +250,12 @@ async function settleConnectAsync(
         outcome.failure,
         ASYNC_CONNECT_TIMEOUT,
       );
-      await persistConnectFailure(deps.store, deps.logger, mcpServerId, failure);
+      await persistConnectFailure(
+        deps.store,
+        deps.logger,
+        mcpServerId,
+        failure,
+      );
       return;
     }
 

package/src/domain/memory/__tests__/create-authorization.test.ts

@@ -0,0 +1,59 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveMemoryCreateTargets): a wire caller asks can_create_session on
+ * metadata.org — whoever may converse in an organization may remember
+ * there — and a server-composed request (internal, or any identity that
+ * entered in-process) asks nothing, as the capture gate before it already
+ * says.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  MEMORY_CREATE_DENIED_MESSAGE,
+  resolveMemoryCreateTargets,
+} from "../steps.js";
+
+function ctxFor(caller: CallerIdentity) {
+  return new RequestContext(
+    MemorySchema,
+    create(MemorySchema, { metadata: { name: "prefers-tea", org: "acme" } }),
+    caller,
+    ApiResourceKind.memory,
+  );
+}
+
+describe("resolveMemoryCreateTargets", () => {
+  it("a wire caller asks can_create_session on the memory's organization", () => {
+    expect(resolveMemoryCreateTargets(ctxFor(testCallerIdentity()))).toEqual([
+      {
+        permission: IamPermission.can_create_session,
+        resourceKind: ApiResourceKind.organization,
+        resourceId: "acme",
+        deniedMessage: MEMORY_CREATE_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a server-composed request asks nothing", () => {
+    expect(
+      resolveMemoryCreateTargets(
+        ctxFor(testCallerIdentity({ callerClass: "internal" })),
+      ),
+    ).toEqual([]);
+    expect(
+      resolveMemoryCreateTargets(
+        ctxFor(
+          testCallerIdentity({ callerClass: "user", origin: "in-process" }),
+        ),
+      ),
+    ).toEqual([]);
+  });
+});

package/src/domain/memory/controller.ts

@@ -77,6 +77,7 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardMemoryCaptureStep } from "../../pipeline/steps/guard-memory-capture.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
@@ -118,6 +119,7 @@ import {
   newResolveMemoryDefaultsStep,
   newTransitionMemoryLifecycleStep,
   newValidateMemoryUpdateStep,
+  resolveMemoryCreateTargets,
 } from "./steps.js";
 
 export interface MemoryControllerDeps {
@@ -194,6 +196,15 @@ async function createMemory(
     .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveMemoryDefaultsStep())
+    // Before the enablement and cap checks, so a refused caller learns
+    // nothing about the organization's settings (steps.ts,
+    // resolveMemoryCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveMemoryCreateTargets,
+      ),
+    )
     .addStep(newCheckMemoryEnablementStep(deps.store))
     .addStep(newCheckMemoryCapStep(deps.store))
     .addStep(newResolveSlugStep())

package/src/domain/memory/steps.ts

@@ -30,6 +30,7 @@ import { MemoryListSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/i
 import { MemoryProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/spec_pb";
 import { MemoryStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/status_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
 import {
@@ -42,6 +43,8 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import {
   generateId,
   setAuditFieldsForUpdate,
@@ -159,6 +162,44 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
   };
 }
 
+/** The deny copy of the create lane's organization bar. */
+export const MEMORY_CREATE_DENIED_MESSAGE =
+  "unauthorized to capture memory in this organization";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after ResolveMemoryDefaults (which requires metadata.org) and BEFORE
+ * CheckMemoryEnablement, so a refused caller learns nothing about the
+ * organization's memory settings. The RPC is is_skip_authorization
+ * because the row does not exist yet and the subject IS the caller
+ * (command.proto); GuardMemoryCapture is the gate that decides WHO may
+ * capture at all, and this question is WHERE: can_create_session on
+ * metadata.org — memory is captured inside a conversation, so whoever may
+ * converse in an organization may remember there.
+ *
+ * The credentialed capture lane is already scoped to the run's
+ * organization by the credential provider (a mismatch is refused inside
+ * GuardMemoryCapture with its own copy); this question closes the plain
+ * path, a person with no run credential naming an organization they hold
+ * nothing in. A server-composed traversal asks nothing, as the gate itself
+ * says: the entry-point request already passed.
+ */
+export function resolveMemoryCreateTargets(
+  ctx: RequestContext<typeof MemorySchema>,
+): ReadonlyArray<AuthorizationTarget> {
+  if (isServerComposedRequest(ctx.callerIdentity)) {
+    return [];
+  }
+  return [
+    {
+      permission: IamPermission.can_create_session,
+      resourceKind: ApiResourceKind.organization,
+      resourceId: ctx.newState.metadata?.org ?? "",
+      deniedMessage: MEMORY_CREATE_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * CheckMemoryEnablement — Go checkMemoryEnablementStep: enforces the
  * org's memory_enabled switch at write time, FAIL-CLOSED (DD-005 D2): a

package/src/domain/oauthapp/controller.ts

@@ -52,6 +52,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
@@ -362,6 +366,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, OAuthAppSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(OAuthAppQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const app = reqCtx.get(TARGET_RESOURCE_KEY) as OAuthApp;

package/src/domain/plugin/controller.ts

@@ -51,7 +51,6 @@ import type {
   ApiResourceReference,
   UpdateVisibilityInput,
 } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { ContentAddressedArchiveStore } from "../../archive/content-store.js";
 import { MAX_ZIP_SIZE } from "../../archive/limits.js";
@@ -74,10 +73,7 @@ import {
   newRecordVisibilityBeforeUpdateStep,
   newUpdateVisibilityTuplesStep,
 } from "../../pipeline/steps/authorization-tuples.js";
-import {
-  authorizeResolvedResource,
-  newAuthorizeStep,
-} from "../../pipeline/steps/authorize.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
 import { setAuditFieldsForUpdate } from "../../pipeline/steps/defaults.js";
 import {
   newDeleteResourceStep,
@@ -96,12 +92,16 @@ import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityUpdateStep } from "../../pipeline/steps/validate-visibility.js";
 import { newDeleteVersionArchivesStep } from "../../pipeline/steps/version-archive.js";
 import {
-  LIST_VERSIONS_RESOURCE_ID_KEY,
   LIST_VERSIONS_RESPONSE_KEY,
   newLoadAndMapVersionsStep,
   newLoadByReferenceWithVersionStep,
   newResolveBySlugForVersionsStep,
+  versionHistoryTarget,
 } from "../../pipeline/steps/version-history.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import type { VersionHistoryBinding } from "../../pipeline/steps/version-history.js";
 import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
@@ -718,22 +718,13 @@ async function getByReference(
         "LoadPluginByReference",
       ),
     )
-    .addStep({
-      name: "AuthorizeResolvedPlugin",
-      async execute(stepCtx): Promise<void> {
-        const resolved = stepCtx.get(TARGET_RESOURCE_KEY) as Plugin;
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.plugin,
-            resourceId: resolved.metadata?.id ?? "",
-          },
-          "unauthorized to get plugin",
-        );
-      },
-    })
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(PluginQueryController.method.get),
+        "AuthorizeResolvedPlugin",
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as Plugin;
@@ -817,21 +808,16 @@ async function listVersions(
         "ResolvePluginBySlug",
       ),
     )
-    .addStep({
-      name: "AuthorizeResolvedPlugin",
-      async execute(stepCtx): Promise<void> {
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.plugin,
-            resourceId: stepCtx.get(LIST_VERSIONS_RESOURCE_ID_KEY) as string,
-          },
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        versionHistoryTarget(
+          ApiResourceKind.plugin,
           "unauthorized to view plugin version history",
-        );
-      },
-    })
+        ),
+        "AuthorizeResolvedPlugin",
+      ),
+    )
     .addStep(
       newLoadAndMapVersionsStep(
         deps.store,

package/src/domain/schedule/__tests__/create-authorization.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveScheduleCreateTargets): can_edit on the REFERENCED AGENT with the
+ * Java handler's copy, and nothing on the organization (the same-org
+ * invariant already binds the schedule to the agent's); a missing
+ * referenced agent throws.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  REFERENCED_AGENT_KEY,
+  SCHEDULE_CREATE_DENIED_MESSAGE,
+  resolveScheduleCreateTargets,
+} from "../steps.js";
+
+const agent = create(AgentSchema, {
+  metadata: { id: "agt_01target", name: "helper", org: "acme" },
+});
+
+function ctxFor(stash = true) {
+  const ctx = new RequestContext(
+    ScheduleSchema,
+    create(ScheduleSchema, { metadata: { name: "nightly", org: "acme" } }),
+    testCallerIdentity(),
+    ApiResourceKind.schedule,
+  );
+  if (stash) {
+    ctx.set(REFERENCED_AGENT_KEY, agent);
+  }
+  return ctx;
+}
+
+describe("resolveScheduleCreateTargets", () => {
+  it("asks can_edit on the referenced agent and nothing else", () => {
+    expect(resolveScheduleCreateTargets(ctxFor())).toEqual([
+      {
+        permission: IamPermission.can_edit,
+        resourceKind: ApiResourceKind.agent,
+        resourceId: "agt_01target",
+        deniedMessage: SCHEDULE_CREATE_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a missing referenced agent is a broken chain invariant and throws", () => {
+    expect(() => resolveScheduleCreateTargets(ctxFor(false))).toThrow(
+      "referenced agent not found in context",
+    );
+  });
+});

package/src/domain/schedule/controller.ts

@@ -62,6 +62,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -116,6 +120,7 @@ import { newClearSchedulePauseStep } from "./resume.js";
 import {
   newResolveScheduleDefaultsStep,
   newValidateScheduleUpdateStep,
+  resolveScheduleCreateTargets,
 } from "./steps.js";
 import {
   TRIGGER_RESULT_KEY,
@@ -201,6 +206,15 @@ async function createSchedule(
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveScheduleDefaultsStep(deps))
+    // Before the duplicate check and before ArmSchedule: a refused caller
+    // learns nothing about existing slugs and costs no Temporal schedule
+    // (steps.ts, resolveScheduleCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveScheduleCreateTargets,
+      ),
+    )
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
@@ -477,6 +491,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ScheduleSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ScheduleQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as Schedule;

package/src/domain/schedule/steps.ts

@@ -8,10 +8,12 @@
  * __tests__/schedule.composed.test.ts.
  */
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { ScheduleSpec } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   failedPreconditionError,
@@ -21,6 +23,7 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
@@ -128,10 +131,47 @@ export function newResolveScheduleDefaultsStep(
       if (agentRef !== undefined) {
         agentRef.org = refOrg;
       }
+      ctx.set(REFERENCED_AGENT_KEY, found);
     },
   };
 }
 
+/**
+ * Context key for the agent ResolveScheduleDefaults resolved from
+ * spec.agent.agent_ref, read by the create lane's authorization step.
+ */
+export const REFERENCED_AGENT_KEY = "scheduleReferencedAgent";
+
+/** The deny copy of the create bar, the Java ScheduleCreateHandler's. */
+export const SCHEDULE_CREATE_DENIED_MESSAGE =
+  "You don't have permission to schedule this agent";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after ResolveScheduleDefaults: can_edit on the REFERENCED AGENT. The RPC
+ * is is_skip_authorization because its target is that agent, resolved from
+ * a slug, not a request field; and there is deliberately no organization
+ * bar — a schedule is unattended spend on an agent, an editor's act, and
+ * the same-org invariant the resolve step enforces already binds the
+ * schedule's organization to the agent's (command.proto).
+ */
+export function resolveScheduleCreateTargets(
+  ctx: RequestContext<typeof ScheduleSchema>,
+): ReadonlyArray<AuthorizationTarget> {
+  const agent = ctx.get(REFERENCED_AGENT_KEY) as Agent | undefined;
+  if (agent === undefined) {
+    throw new Error("referenced agent not found in context");
+  }
+  return [
+    {
+      permission: IamPermission.can_edit,
+      resourceKind: ApiResourceKind.agent,
+      resourceId: agent.metadata?.id ?? "",
+      deniedMessage: SCHEDULE_CREATE_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * Enforces the schedule-specific workspace constraint on the shared
  * AgentInvocation (DD-018 D-3): every workspace entry must be a git_repo
@@ -140,7 +180,9 @@ export function newResolveScheduleDefaultsStep(
  * deterministic provisioning failure at 3 AM. Copy is cross-edition
  * contract (Go validateScheduleWorkspace).
  */
-export function validateScheduleWorkspace(spec: ScheduleSpec | undefined): void {
+export function validateScheduleWorkspace(
+  spec: ScheduleSpec | undefined,
+): void {
   const entries =
     spec?.target.case === "agent" ? spec.target.value.workspaceEntries : [];
   for (const [i, entry] of entries.entries()) {
@@ -174,7 +216,8 @@ export function validateScheduleModelPinning(
   if (presence !== "") {
     throw invalidArgumentError(presence);
   }
-  const invocation = spec?.target.case === "agent" ? spec.target.value : undefined;
+  const invocation =
+    spec?.target.case === "agent" ? spec.target.value : undefined;
   const existence = unknownModelPinRefusal(
     modelRegistry,
     "spec.agent.run_config.model_name",

package/src/domain/session/steps.ts

@@ -44,7 +44,7 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
-import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
 import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
 import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
@@ -533,41 +533,33 @@ export function newFilterByAgentInstanceStep(
 
 /**
  * AuthorizeChannelAccess — the Java SessionListByChannelHandler's
- * two-stage authorization, stage one (census lane 3's extra arm,
- * 20260830.01 ruling Q8): an explicit can_view check on the TARGET
- * agent_channel before any session work, so a caller without channel
- * access learns nothing about the channel's sessions. The mid-chain
- * resolved-id evaluation (the is_skip_authorization annotation makes the
- * position-1 step a no-op on this lane); deny copy is the Java handler's
- * byte-pinned "unauthorized to list channel conversations". The blank-id
- * refusal stays FilterByChannel's (the step behind this gate) — the gate
- * checks only a named channel.
+ * two-stage authorization, stage one: an explicit can_view check on the
+ * TARGET agent_channel before any session work, so a caller without
+ * channel access learns nothing about the channel's sessions. The
+ * mid-chain resolved-target evaluation (the is_skip_authorization
+ * annotation makes the position-1 step a no-op on this lane); deny copy is
+ * the Java handler's byte-pinned "unauthorized to list channel
+ * conversations". The blank-id refusal stays FilterByChannel's (the step
+ * behind this gate) — the gate asks nothing when no channel is named.
  */
 export function newAuthorizeChannelAccessStep(
   authorizer: Authorizer,
 ): PipelineStep<typeof SessionQueryController.method.listByChannel.input> {
-  return {
-    name: "AuthorizeChannelAccess",
-    async execute(
-      ctx: RequestContext<
-        typeof SessionQueryController.method.listByChannel.input
-      >,
-    ): Promise<void> {
-      if (ctx.input.channelId === "") {
-        return;
-      }
-      await authorizeResolvedResource(
-        authorizer,
-        ctx.callerIdentity,
-        {
-          permission: IamPermission.can_view,
-          resourceKind: ApiResourceKind.agent_channel,
-          resourceId: ctx.input.channelId,
-        },
-        "unauthorized to list channel conversations",
-      );
-    },
-  };
+  return newAuthorizeResolvedTargetStep(
+    authorizer,
+    ({ input }) =>
+      input.channelId === ""
+        ? []
+        : [
+            {
+              permission: IamPermission.can_view,
+              resourceKind: ApiResourceKind.agent_channel,
+              resourceId: input.channelId,
+              deniedMessage: "unauthorized to list channel conversations",
+            },
+          ],
+    "AuthorizeChannelAccess",
+  );
 }
 
 /**