@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/org-admin-owner-inheritance.fga.yaml
-# as changed by stigmer-cloud#757 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for org-admin owner inheritance (T08).
@@ -131,8 +131,6 @@ tests:
     check:
       - user: identity_account:ana
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -169,8 +167,6 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: skill:carols-notes
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -178,8 +174,6 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: workflow:carols-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -197,8 +191,6 @@ tests:
     check:
       - user: identity_account:root
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_edit: true
           can_delete: true
@@ -218,8 +210,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -250,8 +240,6 @@ tests:
     check:
       - user: identity_account:zara
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -266,8 +254,6 @@ tests:
     check:
       - user: identity_account:ana
         object: agent_instance:carols-instance
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -297,8 +283,6 @@ tests:
     check:
       - user: identity_account:carol
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -309,8 +293,6 @@ tests:
     list_objects:
       - user: identity_account:ana
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:carols-bot
@@ -318,8 +300,6 @@ tests:
             - agent:carols-bot
       - user: identity_account:ana
         type: agent_instance
-        context:
-          allow: false
         assertions:
           can_view: []
       - user: identity_account:ana

package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/platform-visibility.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for platform visibility (visibility_platform).
@@ -102,8 +102,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -112,8 +110,6 @@ tests:
           can_delete: false
       - user: identity_account:bob
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -122,8 +118,6 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -133,8 +127,6 @@ tests:
     check:
       - user: identity_account:priya
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -144,8 +136,6 @@ tests:
       # narrower: platform_user resolves member-from-managed_org.)
       - user: identity_account:veda
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: false
@@ -154,8 +144,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:internal-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -163,8 +151,6 @@ tests:
       # without an explicit visibility tuple.
       - user: identity_account:priya
         object: agent:internal-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -173,8 +159,6 @@ tests:
     check:
       - user: identity_account:alice
         object: skill:research
-        context:
-          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -184,8 +168,6 @@ tests:
     check:
       - user: identity_account:alice
         object: workflow:onboarding
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -194,8 +176,6 @@ tests:
     check:
       - user: identity_account:alice
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -205,8 +185,6 @@ tests:
     check:
       - user: identity_account:swarup
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -216,8 +194,6 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:sara

package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/workflow-execution-sharing.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for workflow_execution sharing and run observability.
@@ -173,8 +173,6 @@ tests:
       # never alice's run history.
       - user: identity_account:vera
         object: workflow_instance:inst1
-        context:
-          allow: false
         assertions:
           can_view: true
       - user: identity_account:vera

package/src/authorization/__tests__/list-read-scope.test.ts

@@ -1,15 +1,15 @@
 /**
  * Pins the built-in list read scope on both store drivers as the twin of
  * the cloud's driver (stigmer-cloud iam/list-read-scope.ts): every
- * candidate a list lane offers is answered by `can_view` under the
- * LISTING context (`allow: false`, the public wildcard suppressed) through
- * the same evaluator the Authorizer uses, over tuples derived from the
- * facts the candidate carries — no candidate row is read twice.
+ * candidate a list lane offers is answered by `can_view` through the same
+ * evaluator the Authorizer uses, over tuples derived from the facts the
+ * candidate carries — no candidate row is read twice.
  *
  * The adversarial cells come first, because until slice 5's sibling
  * cells this file and the composed proof are the only proof that a
- * member's list is a member's list: the outsider sees nothing (a legacy
- * PUBLIC row included); the viewer rung sees the org-visible blueprints
+ * member's list is a member's list: the outsider sees nothing (a row
+ * still carrying the retired public level included); the viewer rung sees
+ * the org-visible blueprints
  * and nothing personal; the founder — an admin — sees the organization's
  * blueprints and NOT its members' sessions, keys, environments or
  * memories (the model's own line, now list-visible); an execution is its session's and
@@ -17,7 +17,9 @@
  * org-observable reaches the organization's viewers; a memory with no
  * subject is nobody's; an instance reaches whoever reads its blueprint
  * only when it is the default. Then the contract: a scope only narrows
- * and never reorders; the `internal` class is the in-process skip; an
+ * and never reorders; the `internal` class is the in-process skip on the
+ * enumeration verb and a loud consumer bug on the restrict verb (the
+ * shared helper answers the class before any driver, stigmer#1207); an
  * unprovisioned subject is their raw subject (the 3.14 verifiers' stamp); a
  * fault throws and is never an empty answer; an undeclared kind is a
  * consumer bug, loud; the enumeration verb equals the restrict verb over
@@ -278,9 +280,10 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           await grant(orgRole(VIEWER, "viewer", ORG));
 
           // Blueprints: the founder's private and org-visible agents, a
-          // member's private one, a legacy PUBLIC one (nobody can set public
-          // under the built-in posture; a row from before it can carry it),
-          // and one stamped by the 3.14 verifiers' raw subject.
+          // member's private one, one still carrying the retired public
+          // level (a row the store migration has not met, which derives no
+          // viewer grant and so reads as its owner's alone), and one
+          // stamped by the 3.14 verifiers' raw subject.
           await save("agent", {
             id: "agt_private",
             org: ORG,
@@ -425,7 +428,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
         });
 
         describe("the adversarial cells", () => {
-          it("an OUTSIDER lists nothing of the organization's — not even the legacy PUBLIC blueprint, which the listing context suppresses", async () => {
+          it("an OUTSIDER lists nothing of the organization's — a row still carrying the retired public level included", async () => {
             for (const kind of SEEDED_KINDS.filter(
               (k) =>
                 k !== ApiResourceKind.iam_policy &&
@@ -439,13 +442,13 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             }
           });
 
-          it("a VIEWER lists the org-visible and the public blueprints and nothing private; a MEMBER adds their own private one", async () => {
+          it("a VIEWER lists the org-visible blueprint and nothing private; a MEMBER adds their own private one; the retired level grants neither anything", async () => {
             expect(
               await listAs(resolved(VIEWER), ApiResourceKind.agent),
-            ).toEqual(["agt_org", "agt_public"]);
+            ).toEqual(["agt_org"]);
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent),
-            ).toEqual(["agt_org", "agt_member_private", "agt_public"]);
+            ).toEqual(["agt_org", "agt_member_private"]);
           });
 
           it("the FOUNDER and the ADMIN list every blueprint (`owner: … or admin from organization`), including a member's private one", async () => {
@@ -540,7 +543,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             const offered = [
               entryOf(
                 ApiResourceKind.agent,
-                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
               ),
               entryOf(
                 ApiResourceKind.agent,
@@ -560,15 +563,15 @@ describe.each(driverFixtures(SEEDED_KINDS))(
               ApiResourceKind.agent,
               offered,
             );
-            expect([...kept]).toEqual(["agt_public", "agt_org"]);
+            expect([...kept]).toEqual(["agt_member_private", "agt_org"]);
             // The lane's order is the lane's: the helper filters its own
             // array by the kept set.
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent, [
-                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
                 rows.get(ApiResourceKind.agent)!.get("agt_org")!,
               ]),
-            ).toEqual(["agt_public", "agt_org"]);
+            ).toEqual(["agt_member_private", "agt_org"]);
           });
 
           it("no candidates: the empty set, with no read of any kind", async () => {
@@ -583,17 +586,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             expect(accountReads).toBe(0);
           });
 
-          it("the `internal` class — the server acting as itself — keeps every offered id and enumerates every id of the kind: the in-process authorization skip, with no account even asked for", async () => {
-            const offered = rowsOf(ApiResourceKind.agent).map((row) =>
-              entryOf(ApiResourceKind.agent, row),
-            );
-            expect([
-              ...(await scope().restrictListEntries(
-                INTERNAL,
-                ApiResourceKind.agent,
-                offered,
-              )),
-            ]).toEqual(offered.map((entry) => entry.id));
+          it("the `internal` class on the enumeration verb — the server acting as itself — is every id of the kind, with no account even asked for (the in-process skip; no helper stands before this verb)", async () => {
             expect(
               [
                 ...(await scope().authorizedResourceIds(
@@ -605,6 +598,25 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             expect(accountReads).toBe(0);
           });
 
+          it("the `internal` class on the restrict verb is a consumer bug, loud: the shared helper answers that class before any driver, so a driver offered it was reached around the idiom", async () => {
+            const offered = rowsOf(ApiResourceKind.agent).map((row) =>
+              entryOf(ApiResourceKind.agent, row),
+            );
+            const refusal = await scope()
+              .restrictListEntries(INTERNAL, ApiResourceKind.agent, offered)
+              .then(
+                () => undefined,
+                (error: unknown) => error,
+              );
+            expect(refusal).toBeInstanceOf(AuthorizationEvaluationError);
+            expect((refusal as AuthorizationEvaluationError).reason).toBe(
+              "internal-caller-offered",
+            );
+            // Refused before any read: the server was never evaluated as a person.
+            expect(accountReads).toBe(0);
+            expect(storeReads).toEqual({ rows: 0, scans: 0 });
+          });
+
           it("an unprovisioned subject is their raw subject and nothing else: the 3.14-stamped row is theirs, the organization's rows are not", async () => {
             // `agt_legacy` is stamped with LEGACY's raw subject; a caller
             // who IS that subject and holds no account reaches it through

package/src/authorization/__tests__/skip-lane-inventory.test.ts

@@ -0,0 +1,160 @@
+/**
+ * Pins the coverage inventory's own rule for `is_skip_authorization` lanes
+ * (docs/authorization-coverage.md, "How to read the tables"): a skip lane
+ * reaches no Authorizer in either edition, so what guards it is whatever
+ * its Handler cell names — and a cell that names nothing is a lane open to
+ * every authenticated caller that nobody has said so about. Two things are
+ * held here, so the doc cannot drift from the server it describes:
+ *
+ *   1. The set of skip-annotated methods the open-source server SERVES
+ *      (the empty composition's routes replayed into a recorder, a method
+ *      counted only when its service's implementation map carries it — a
+ *      partially implemented service lists more on its descriptor than it
+ *      serves) equals the set of skip rows in the doc, service by method.
+ *      A new skip lane without a row, or a row for a lane that is no
+ *      longer a skip, fails here.
+ *   2. Every skip row's Handler cell carries one of the three markers the
+ *      doc defines — `guard: <Name>`, `driver: <Seam>`,
+ *      `by design: <reason>` — and every `guard:` names a pipeline step or
+ *      a handler's guard function that exists by that name in `src/`
+ *      outside the tests, so a renamed or removed guard cannot leave the
+ *      doc pointing at nothing.
+ *
+ * The rule lives in the doc; this test only enforces it. The doc is the
+ * one inventory (the package guide mandates updating it with every
+ * annotation change), and a second list here would be the drift this
+ * test exists to prevent.
+ */
+import {
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { getOption } from "@bufbuild/protobuf";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { is_skip_authorization } from "@stigmer/protos/ai/stigmer/commons/rpc/method_options_pb";
+
+import { loadConfig } from "../../boot/config.js";
+import { composeServer } from "../../boot/compose.js";
+import type { ComposedServer } from "../../boot/compose.js";
+import {
+  baseConfig,
+  servedMethods,
+  silentLogger,
+} from "../../extensions/__tests__/composed-support.js";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PACKAGE_ROOT = path.resolve(HERE, "../../..");
+const COVERAGE_DOC = path.join(PACKAGE_ROOT, "docs/authorization-coverage.md");
+const SRC = path.join(PACKAGE_ROOT, "src");
+
+/** A skip row: `| Service.method | is_skip_authorization | <handler cell> |`. */
+const SKIP_ROW =
+  /^\| ([A-Za-z]+)\.([A-Za-z]+) \| is_skip_authorization \| (.*) \|$/;
+
+const MARKERS = ["guard:", "driver:", "by design:"] as const;
+
+interface SkipRow {
+  readonly method: string;
+  readonly handler: string;
+}
+
+function skipRowsOf(doc: string): SkipRow[] {
+  const rows: SkipRow[] = [];
+  for (const line of doc.split("\n")) {
+    const m = SKIP_ROW.exec(line);
+    if (m !== null) {
+      rows.push({ method: `${m[1]}.${m[2]}`, handler: m[3] ?? "" });
+    }
+  }
+  return rows;
+}
+
+/** Every `guard: <Name>` a handler cell names. */
+function guardsOf(handler: string): string[] {
+  return [...handler.matchAll(/guard: ([A-Za-z]+)/g)].map((m) => m[1] ?? "");
+}
+
+/** Every non-test `.ts` source under `src/`, read once. */
+function sourceText(): string {
+  const parts: string[] = [];
+  const walk = (dir: string): void => {
+    for (const entry of readdirSync(dir)) {
+      const full = path.join(dir, entry);
+      if (statSync(full).isDirectory()) {
+        if (entry !== "__tests__") {
+          walk(full);
+        }
+      } else if (full.endsWith(".ts") && !full.endsWith(".test.ts")) {
+        parts.push(readFileSync(full, "utf8"));
+      }
+    }
+  };
+  walk(SRC);
+  return parts.join("\n");
+}
+
+describe("the skip-lane inventory (docs/authorization-coverage.md) is true to the served server", () => {
+  let dir: string;
+  let server: ComposedServer;
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "skip-lane-inventory-test-"));
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("the doc's skip rows are exactly the skip-annotated methods the server serves", () => {
+    const served = new Set<string>();
+    for (const method of servedMethods(server.routes)) {
+      if (getOption(method, is_skip_authorization)) {
+        const serviceName = method.parent.typeName.split(".").at(-1) ?? "";
+        served.add(`${serviceName}.${method.name}`);
+      }
+    }
+    const documented = new Set(
+      skipRowsOf(readFileSync(COVERAGE_DOC, "utf8")).map((r) => r.method),
+    );
+    expect([...served].sort()).toEqual([...documented].sort());
+  });
+
+  it("every skip row names its guard, its driver or says the lane is open by design", () => {
+    const bare = skipRowsOf(readFileSync(COVERAGE_DOC, "utf8"))
+      .filter((r) => !MARKERS.some((marker) => r.handler.includes(marker)))
+      .map((r) => r.method);
+    expect(bare).toEqual([]);
+  });
+
+  it("every guard a skip row names is a step or a guard function that exists by that name in src/", () => {
+    const source = sourceText();
+    const dangling: string[] = [];
+    for (const row of skipRowsOf(readFileSync(COVERAGE_DOC, "utf8"))) {
+      for (const guard of guardsOf(row.handler)) {
+        // A step is registered by its quoted name; a guard function by its
+        // declaration.
+        const isStep = source.includes(`"${guard}"`);
+        const isFunction = new RegExp(`function ${guard}\\(`).test(source);
+        if (!isStep && !isFunction) {
+          dangling.push(`${row.method} names guard ${guard}`);
+        }
+      }
+    }
+    expect(dangling).toEqual([]);
+  });
+});

package/src/authorization/__tests__/store-tests.test.ts

@@ -56,14 +56,12 @@ const DOCUMENTS = [
   "channel-app-owner.fga.yaml",
   "channel-participation.fga.yaml",
   "channel-session-visibility.fga.yaml",
-  "cross-org-share-creation.fga.yaml",
   "default-instance-inheritance.fga.yaml",
   "memory-subject-only.fga.yaml",
   "org-admin-owner-inheritance.fga.yaml",
   "org-shared-environment.fga.yaml",
   "platform-visibility.fga.yaml",
   "provider-standing-viewer.fga.yaml",
-  "public-visibility-setter.fga.yaml",
   "reserved-label-writer.fga.yaml",
   "schedule-owner.fga.yaml",
   "schedule-session-visibility.fga.yaml",
@@ -100,7 +98,7 @@ const SKIPPED_PINNED: ReadonlyArray<string> = [
   "artifact-org-and-owner :: listing reflects org inheritance plus creator ownership :: identity_account:eve <artifact> :: list-objects",
   "artifact-org-and-owner :: listing reflects org inheritance plus creator ownership :: identity_account:victor <artifact> :: list-objects",
   "blueprint-private-visibility :: org admin's listable agents include private ones (T08) :: identity_account:oscar <agent> :: list-objects",
-  "blueprint-private-visibility :: org member's listable agents exclude private ones (wildcard suppressed) :: identity_account:dave <agent> :: list-objects",
+  "blueprint-private-visibility :: org member's listable agents exclude private ones :: identity_account:dave <agent> :: list-objects",
   "blueprint-private-visibility :: org viewer's listable agents are exactly the viewer-shaped org-visible ones :: identity_account:vera <agent> :: list-objects",
   "blueprint-private-visibility :: owner's listable agents include everything they authored :: identity_account:carol <agent> :: list-objects",
   "channel-app-owner :: listing channel apps reflects ownership and grants, not membership :: identity_account:alice <channel_app> :: list-objects",
@@ -130,9 +128,6 @@ const SKIPPED_PINNED: ReadonlyArray<string> = [
   // undeclared-kind: platform
   "provider-standing-viewer :: operator may view provider standing, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
   "provider-standing-viewer :: operator may view provider standing, tenants may not :: identity_account:opal platform:stigmer :: undeclared-kind",
-  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:machine platform:stigmer :: undeclared-kind",
-  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
-  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:opal platform:stigmer :: undeclared-kind",
   "reserved-label-writer :: operator may write reserved labels, tenants may not :: identity_account:machine platform:stigmer :: undeclared-kind",
   "reserved-label-writer :: operator may write reserved labels, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
   // undeclared-subject-type: identity_provider#platform_user

package/src/authorization/__tests__/tuples.test.ts

@@ -13,7 +13,7 @@ import {
 } from "../tuples.js";
 
 describe("the string notation", () => {
-  it("parses an object, a userset and the wildcard, and an id may carry a colon (issuer subjects do)", () => {
+  it("parses an object and a userset, and an id may carry a colon (issuer subjects do)", () => {
     expect(parseObjectRef("agent:agt_1")).toEqual({
       type: "agent",
       id: "agt_1",
@@ -27,11 +27,6 @@ describe("the string notation", () => {
       object: { type: "organization", id: "acme" },
       relation: "viewer",
     });
-    expect(parseSubject("identity_account:*")).toEqual({
-      form: "wildcard",
-      type: "identity_account",
-      condition: undefined,
-    });
     expect(parseSubject("identity_account:ida_x")).toEqual({
       form: "object",
       object: { type: "identity_account", id: "ida_x" },
@@ -43,18 +38,24 @@ describe("the string notation", () => {
     expect(() => parseObjectRef(":id")).toThrow("not an object reference");
   });
 
-  it("formats a tuple in the proto's notation, the condition spelled after `with`", () => {
+  it("refuses the wildcard notation — no line of the model admits one", () => {
+    expect(() => parseSubject("identity_account:*")).toThrow(
+      "wildcard subject 'identity_account:*' is not admitted",
+    );
+  });
+
+  it("formats a tuple in the proto's notation", () => {
     expect(
       formatTuple({
         object: parseObjectRef("agent:a"),
         relation: "viewer",
         subject: {
-          form: "wildcard",
-          type: "identity_account",
-          condition: "allow_public",
+          form: "userset",
+          object: { type: "organization", id: "acme" },
+          relation: "viewer",
         },
       }),
-    ).toBe("agent:a#viewer@identity_account:* with allow_public");
+    ).toBe("agent:a#viewer@organization:acme#viewer");
     expect(formatSubject(parseSubject("organization:acme#member"))).toBe(
       "organization:acme#member",
     );

package/src/authorization/__tests__/wire-permissions.test.ts

@@ -117,12 +117,11 @@ describe("every static (kind, permission) the served RPCs ask about is a declare
     expect(undeclared).toEqual([]);
   });
 
-  it("asks about every served kind the model declares except the two no RPC targets statically", () => {
+  it("asks about every served kind the model declares except the one no RPC targets statically", () => {
     // iam_policy's RPCs target the policy's RESOURCE (`resource_kind_path`
-    // or the load-then-authorize `get`); execution_context's RPCs are
-    // `is_skip_authorization` lanes (or unannotated) whose handlers gate on
-    // the runner's execution-scoped token. Every other declared kind is
-    // asked about by at least one static annotation.
+    // or the load-then-authorize `get`). Every other declared kind is asked
+    // about by at least one static annotation — execution_context through
+    // its `get` and `delete`; its runner-token lane stays a skip.
     const asked = new Set(wireQuestions().map((q) => kindEnumName(q.kind)));
     expect([...asked].sort()).toEqual(
       [
@@ -135,6 +134,7 @@ describe("every static (kind, permission) the served RPCs ask about is a declare
         "artifact",
         "channel_app",
         "environment",
+        "execution_context",
         "identity_account",
         "mcp_server",
         "memory",

package/src/authorization/authorizer.ts

@@ -17,9 +17,7 @@
  *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
  *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
  *      and the server agree by construction). `platform` is the one that
- *      arrives, through `can_set_public_visibility` — under the built-in
- *      posture nobody sets public visibility, the model's own reason for
- *      making it a platform operator's act.
+ *      can arrive, through an operator capability no self-host holds.
  *   3. The caller as a person (person.ts) and one derived tuple source for
  *      them; the target loaded ONCE through the source's memoised loader,
  *      so the read that decides not-found is the read the derivation
@@ -31,11 +29,9 @@
  *      member cannot learn which account ids exist. Present or exempt, the
  *      row is then evaluated: the cloud asks OpenFGA whether or not the row
  *      exists, and so does this driver.
- *   5. `checkRelation` with the point-check context (`allow: true`: a
- *      public resource reads for any authenticated caller, the cloud's
- *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
- *      the method annotation's byte-pinned `error_msg` wins on the wire,
- *      exactly the cloud's genuine-denial path.
+ *   5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
+ *      reason, so the method annotation's byte-pinned `error_msg` wins on
+ *      the wire, exactly the cloud's genuine-denial path.
  *
  * Faults. Everything past the pre-checks runs under one guard: a store
  * fault, a person that names nobody (`personFor`), an evaluation fault
@@ -179,7 +175,6 @@ export function newBuiltInAuthorizer(deps: BuiltInAuthorizerDeps): Authorizer {
           object,
           relation,
           person,
-          { allow: true },
         );
         if (allowed) {
           return { kind: "allow" };