@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/domain/agentshare/steps.ts

@@ -1,10 +1,19 @@
 /**
  * AgentShare domain steps — ports pkg/domain/agentshare/controller/steps.go
- * and the get_shared_profile.go helpers: share defaults + the cross-org
- * public-dependency contract (decision 013), the agent-id rebind pin, the
+ * and the get_shared_profile.go helpers: share defaults and the
+ * same-organization invariant on agent_ref, the agent-id rebind pin, the
  * update immutability rules, the uniform-NotFound profile resolution
  * helpers, and the constant-time link-token predicate.
  *
+ * A share's agent lives in the share's own organization. The
+ * cross-organization arm this domain once carried (a share of another
+ * organization's public agent, gated on a public audience and a sweep of
+ * the agent's dependencies for public visibility) left with the public
+ * level; sharing another organization's agent is done by installing the
+ * plugin that carries it and sharing the installed copy. A stored share
+ * whose agent is in another organization — a row from before — fails
+ * closed at the profile like a dangling reference.
+ *
  * OD-1 (deliberate exclusion): Go's boot migration
  * (pkg/domain/agentshare/migration/bootstrap_shares.go — protowire
  * decoding of the REMOVED Agent.spec.sharing fields into AgentShare rows)
@@ -29,12 +38,8 @@ import type { AgentShare } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v
 import { AgentShareStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/status_pb";
 import { SharedAgentProfileSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
 import type { SharedAgentProfile } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
-import { AgentShareAudience } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   failedPreconditionError,
@@ -44,7 +49,13 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
-import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import {
+  AUTHORIZATION_UNAVAILABLE_MESSAGE,
+  evaluateAuthorizer,
+} from "../../pipeline/steps/authorize.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
+import type { GetByReferenceDesc } from "../../pipeline/steps/authorize-resolved-target.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
 import {
@@ -52,8 +63,7 @@ import {
   ORG_REQUIRED_MESSAGE,
   SHARE_LINK_TOKEN_BYTES,
   agentRefImmutableMessage,
-  crossOrgAudienceMessage,
-  crossOrgBlockersMessage,
+  sameOrgInvariantMessage,
 } from "./constants.js";
 
 type AgentShareDesc = typeof AgentShareSchema;
@@ -61,10 +71,52 @@ type AgentShareDesc = typeof AgentShareSchema;
 /**
  * Context key for the agent resolved from spec.agent_ref during
  * create/apply, so later steps never re-load it — Go referencedAgentKey.
- * Module-private: only ResolveShareDefaults writes it and StampAgentPin
- * reads it, both in this file.
+ * ResolveShareDefaults writes it; the create lane's authorization step and
+ * StampAgentPin read it.
  */
-const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+export const REFERENCED_AGENT_KEY = "agentShareReferencedAgent";
+
+/** The deny copy of the agent's bar, the Java AgentShareCreateHandler's. */
+export const SHARE_AGENT_DENIED_MESSAGE =
+  "You don't have permission to share this agent";
+
+/** The deny copy of the sharing organization's bar, the Java handler's. */
+export const SHARE_ORGANIZATION_DENIED_MESSAGE =
+  "You don't have permission to create agent shares in this organization";
+
+/**
+ * The create lane's authorization questions, for AuthorizeResolvedTarget
+ * after ResolveShareDefaults, agent first: can_edit on the agent (sharing
+ * puts it in front of a wider audience, an editor's act) and then
+ * can_create_agent_share on the organization (a share spends the
+ * organization's credits on the open internet, an admin-level act). The
+ * RPC is is_skip_authorization because the target is the referenced agent,
+ * resolved from a slug, not a request field. The resolve step has already
+ * made the reference absolute and refused an agent outside the share's
+ * organization, so the two bars are always the same organization's.
+ */
+export function resolveShareCreateTargets(
+  ctx: RequestContext<AgentShareDesc>,
+): ReadonlyArray<AuthorizationTarget> {
+  const agent = ctx.get(REFERENCED_AGENT_KEY) as Agent | undefined;
+  if (agent === undefined) {
+    throw new Error("referenced agent not found in context");
+  }
+  return [
+    {
+      permission: IamPermission.can_edit,
+      resourceKind: ApiResourceKind.agent,
+      resourceId: agent.metadata?.id ?? "",
+      deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
+    },
+    {
+      permission: IamPermission.can_create_agent_share,
+      resourceKind: ApiResourceKind.organization,
+      resourceId: ctx.newState.metadata?.org ?? "",
+      deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
+    },
+  ];
+}
 
 /**
  * The single refusal for every anonymous/member resolution miss: share
@@ -78,6 +130,71 @@ export function sharedNotFound(slug: string): ConnectError {
   return notFoundError("Agent", slug);
 }
 
+/**
+ * AuthorizeMemberAudience — the member-profile lane's gate, membership
+ * BEFORE existence: the Java AgentShareGetSharedProfileForMemberHandler
+ * order. getSharedProfileForMember is the signed-in resolution path for a
+ * share URL, and the proto pins its contract: a share that does not exist,
+ * is disabled, or is asked for by someone who is not a member of the
+ * sharing organization all answer the SAME NOT_FOUND, so a share URL
+ * teaches a non-member nothing — not even whether the share exists. A
+ * non-member resolving a public share uses the anonymous lane instead.
+ *
+ * The question is can_view on the organization named in the reference (the
+ * viewer set: members and above), asked live on every call so a revoked
+ * member loses access at once; the RPC is is_skip_authorization because
+ * the target is the reference's organization, not a request field the
+ * annotation can key on. This is deliberately NOT the shared
+ * AuthorizeResolvedTarget step: that step answers deny with
+ * PERMISSION_DENIED, and this lane's wire contract is the indistinguishable
+ * NOT_FOUND above, so the lane keeps its own mapping over the same
+ * evaluation (the decision form checkMyPermission uses). An empty org is
+ * left to the loader's INVALID_ARGUMENT, the proto's own copy for it; an
+ * unavailable authorizer is INTERNAL, never softened into a refusal; the
+ * `internal` class is exempt as everywhere.
+ */
+export function newAuthorizeMemberAudienceStep(
+  authorizer: Authorizer,
+): PipelineStep<GetByReferenceDesc> {
+  return {
+    name: "AuthorizeMemberAudience",
+    async execute(ctx: RequestContext<GetByReferenceDesc>): Promise<void> {
+      const ref = ctx.input;
+      if (ref.org === "" || ctx.callerIdentity.callerClass === "internal") {
+        return;
+      }
+      const decision = await evaluateAuthorizer(
+        authorizer,
+        ctx.callerIdentity,
+        {
+          permission: IamPermission.can_view,
+          resourceKind: ApiResourceKind.organization,
+          resourceId: ref.org,
+        },
+      );
+      switch (decision.kind) {
+        case "allow":
+          return;
+        case "deny":
+        case "not-found":
+          throw sharedNotFound(ref.slug);
+        case "unavailable":
+          throw internalError(
+            decision.cause,
+            AUTHORIZATION_UNAVAILABLE_MESSAGE,
+          );
+        default: {
+          const exhaustive: never = decision;
+          throw internalError(
+            new Error(`unknown decision ${JSON.stringify(exhaustive)}`),
+            AUTHORIZATION_UNAVAILABLE_MESSAGE,
+          );
+        }
+      }
+    },
+  };
+}
+
 /**
  * The link-token predicate — Go sharingLinkTokenAllowed, the mirror of the
  * cloud edition's SharingLinkTokenPolicy:
@@ -90,7 +207,10 @@ export function sharedNotFound(slug: string): ConnectError {
  * guard restores Go's semantics; the length of a token is not secret (all
  * server-minted tokens are 27 chars).
  */
-export function sharingLinkTokenAllowed(presented: string, live: string): boolean {
+export function sharingLinkTokenAllowed(
+  presented: string,
+  live: string,
+): boolean {
   if (live === "") {
     return true;
   }
@@ -174,15 +294,19 @@ export async function findShareByOrgAndSlug(
 /**
  * ResolveShareDefaults — Go resolveShareDefaultsStep:
  *   1. Requires metadata.org (URL + billing identity, never inferred).
- *   2. Normalizes spec.agent_ref.org (empty means same-org) and loads the
- *      referenced agent — a nonexistent agent is refused with the same
- *      NOT_FOUND a direct agent lookup would produce.
- *   3. For a CROSS-ORG share, enforces the decision-013 contract.
+ *   2. Normalizes spec.agent_ref.org (empty means same-org) and refuses an
+ *      agent_ref that names another organization (the module header) with
+ *      the same-organization sentence, BEFORE any lookup, so the share
+ *      lane never says whether another organization's slug exists.
+ *   3. Loads the referenced agent — a nonexistent agent is refused with
+ *      the same NOT_FOUND a direct agent lookup would produce.
  *   4. Defaults metadata.slug (and name) from the agent when the caller
  *      provided neither — the canonical share keeps the agent's hosted URL.
  *      Runs before ResolveSlug, which skips already-set slugs.
  */
-export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentShareDesc> {
+export function newResolveShareDefaultsStep(
+  store: Store,
+): PipelineStep<AgentShareDesc> {
   return {
     name: "ResolveShareDefaults",
     async execute(ctx: RequestContext<AgentShareDesc>): Promise<void> {
@@ -203,16 +327,19 @@ export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentSha
       if (agentRef!.org === "") {
         agentRef!.org = metadata!.org;
       }
+      if (agentRef!.org !== metadata!.org) {
+        throw failedPreconditionError(sameOrgInvariantMessage(agentRef!.org));
+      }
 
-      const agent = await findAgentByOrgAndSlug(store, agentRef!.org, agentRef!.slug);
+      const agent = await findAgentByOrgAndSlug(
+        store,
+        agentRef!.org,
+        agentRef!.slug,
+      );
       if (agent === undefined) {
         throw notFoundError("Agent", agentRef!.slug);
       }
 
-      if (agentRef!.org !== metadata!.org) {
-        await validateCrossOrgShare(store, share, agent);
-      }
-
       ctx.set(REFERENCED_AGENT_KEY, agent);
 
       // Canonical-share default: no slug and no name means "share this
@@ -226,118 +353,6 @@ export function newResolveShareDefaultsStep(store: Store): PipelineStep<AgentSha
   };
 }
 
-/**
- * The cross-org share contract (decision 013) — Go validateCrossOrgShare:
- *   - The agent must be marketplace-public; a non-public agent is refused
- *     with the same NOT_FOUND as a missing one (no existence probe for
- *     private slugs).
- *   - The audience must be public — org-audience semantics don't carry
- *     across the org boundary.
- *   - Every declared dependency must itself be public; the refusal names
- *     every blocker (sorted) so the sharing org knows exactly what to ask
- *     the agent's org to publish.
- * Runtime re-enforcement is cloud-side; this create-time sweep is the
- * fail-loud half, mirrored in both editions.
- */
-async function validateCrossOrgShare(
-  store: Store,
-  share: AgentShare,
-  agent: Agent,
-): Promise<void> {
-  const agentMeta = agent.metadata;
-
-  if (agentMeta?.visibility !== ApiResourceVisibility.visibility_public) {
-    throw notFoundError("Agent", agentMeta?.slug ?? "");
-  }
-
-  // protobuf-es strips the shared enum prefix: proto
-  // agent_share_audience_org generates as AgentShareAudience.org.
-  if (share.spec?.audience === AgentShareAudience.org) {
-    throw failedPreconditionError(crossOrgAudienceMessage(agentMeta.org));
-  }
-
-  const blockers = await findNonPublicDependencies(store, agent);
-  if (blockers.length > 0) {
-    throw failedPreconditionError(
-      crossOrgBlockersMessage(agentMeta.org, agentMeta.slug, blockers),
-    );
-  }
-}
-
-/**
- * Sweeps the agent's declared blueprint dependencies — skill_refs
- * (including every sub-agent's) and mcp_server_usages — and returns a
- * deterministic "kind org/slug" entry for each that is missing or not
- * visibility_public — Go findNonPublicDependencies. A reference with an
- * empty org is relative to the AGENT's org (defensive parity with the
- * cloud edition's referenceMatches; agent writes normalize refs to
- * absolute form).
- */
-async function findNonPublicDependencies(
-  store: Store,
-  agent: Agent,
-): Promise<string[]> {
-  const spec = agent.spec;
-  const agentOrg = agent.metadata?.org ?? "";
-
-  interface DepRef {
-    kind: ApiResourceKind;
-    org: string;
-    slug: string;
-  }
-
-  const seen = new Set<string>();
-  const deps: DepRef[] = [];
-  const add = (kind: ApiResourceKind, ref: ApiResourceReference | undefined): void => {
-    if (ref === undefined || ref.slug === "") {
-      return;
-    }
-    const org = ref.org !== "" ? ref.org : agentOrg;
-    const key = `${kind}|${org}|${ref.slug}`;
-    if (!seen.has(key)) {
-      seen.add(key);
-      deps.push({ kind, org, slug: ref.slug });
-    }
-  };
-
-  for (const ref of spec?.skillRefs ?? []) {
-    add(ApiResourceKind.skill, ref);
-  }
-  for (const sub of spec?.subAgents ?? []) {
-    for (const ref of sub.skillRefs) {
-      add(ApiResourceKind.skill, ref);
-    }
-  }
-  for (const usage of spec?.mcpServerUsages ?? []) {
-    add(ApiResourceKind.mcp_server, usage.mcpServerRef);
-  }
-
-  const blockers: string[] = [];
-  for (const dep of deps) {
-    let visibility: ApiResourceVisibility | undefined;
-    try {
-      // Per-kind resolution, exactly Go's switch — skill and mcp_server
-      // are the only dependency kinds an agent blueprint declares.
-      const resolved =
-        dep.kind === ApiResourceKind.skill
-          ? await findResourceBySlug(store, dep.kind, SkillSchema, dep.slug, dep.org)
-          : await findResourceBySlug(store, dep.kind, McpServerSchema, dep.slug, dep.org);
-      visibility = resolved?.metadata?.visibility;
-    } catch (error) {
-      throw internalError(
-        error,
-        `failed to resolve ${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug} while validating cross-org share`,
-      );
-    }
-    if (visibility !== ApiResourceVisibility.visibility_public) {
-      blockers.push(`${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug}`);
-    }
-  }
-
-  blockers.sort();
-  return blockers;
-}
-
 /**
  * StampAgentPin — Go stampAgentPinStep: writes status.agent_id, the
  * server-owned rebind pin (decision 013). agent_ref is org+slug and slugs
@@ -371,10 +386,8 @@ export function newStampAgentPinStep(): PipelineStep<AgentShareDesc> {
 
 /**
  * ValidateShareUpdate — Go validateShareUpdateStep: spec.agent_ref must
- * keep referencing the same agent, and the cross-org public-audience rule
- * must hold on update too (update replaces the spec wholesale and must not
- * open a side door to an org-audience cross-org share). Runs after
- * LoadExisting. metadata.slug/org immutability needs no step — the generic
+ * keep referencing the same agent. Runs after LoadExisting.
+ * metadata.slug/org immutability needs no step — the generic
  * BuildUpdateState preserves both, and status (including the pin and link
  * token) wholesale.
  */
@@ -396,21 +409,21 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
       // Normalize the input ref's org the same way create does (empty
       // means the share's own org) before comparing.
       const inputOrg =
-        (inputRef?.org ?? "") !== "" ? inputRef!.org : (existing.metadata?.org ?? "");
+        (inputRef?.org ?? "") !== ""
+          ? inputRef!.org
+          : (existing.metadata?.org ?? "");
 
       if (
         (inputRef?.slug ?? "") !== (existingRef?.slug ?? "") ||
         inputOrg !== (existingRef?.org ?? "")
       ) {
         throw failedPreconditionError(
-          agentRefImmutableMessage(existingRef?.org ?? "", existingRef?.slug ?? ""),
+          agentRefImmutableMessage(
+            existingRef?.org ?? "",
+            existingRef?.slug ?? "",
+          ),
         );
       }
-
-      const isCrossOrg = (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
-      if (isCrossOrg && ctx.input.spec?.audience === AgentShareAudience.org) {
-        throw failedPreconditionError(crossOrgAudienceMessage(existingRef?.org ?? ""));
-      }
     },
   };
 }
@@ -422,15 +435,19 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
  * SHARE; display fields and default_instance_id from the AGENT. Three
  * misses all fail closed with the uniform refusal, indistinguishable from
  * absence: a dangling agent_ref, a stale agent-id pin (the rebind guard),
- * and a cross-org agent no longer visibility_public (withdrawing public
- * visibility must kill every external channel).
+ * and an agent in another organization (a share written before the
+ * same-organization invariant; this release serves no such share).
  */
 export async function buildSharedAgentProfile(
   store: Store,
   share: AgentShare,
 ): Promise<SharedAgentProfile> {
   const ref = share.spec?.agentRef;
-  const agent = await findAgentByOrgAndSlug(store, ref?.org ?? "", ref?.slug ?? "");
+  const agent = await findAgentByOrgAndSlug(
+    store,
+    ref?.org ?? "",
+    ref?.slug ?? "",
+  );
   if (agent === undefined) {
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
@@ -440,11 +457,7 @@ export async function buildSharedAgentProfile(
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 
-  const isCrossOrg = (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
-  if (
-    isCrossOrg &&
-    agent.metadata?.visibility !== ApiResourceVisibility.visibility_public
-  ) {
+  if ((share.metadata?.org ?? "") !== (agent.metadata?.org ?? "")) {
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 

package/src/domain/artifact/controller.ts

@@ -66,9 +66,9 @@ import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import {
   authorizeDirect,
-  authorizeResolvedResource,
   newAuthorizeStep,
 } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import {
   generateId,
   setAuditFieldsForCreate,
@@ -426,23 +426,18 @@ async function listByExecution(
         }
       },
     })
-    .addStep({
-      name: "AuthorizeParentExecution",
-      async execute(stepCtx): Promise<void> {
-        // The Java ArtifactListByExecutionHandler's hand-rolled gate
-        // (20260830.01 ruling Q8): can_view on the PARENT execution —
-        // "if you can view an execution, you can list its artifacts."
-        // The two-field dispatch (workflow-execution first, the Java
-        // order) is why the declarative annotation cannot express this
-        // lane and the proto carries is_skip_authorization. Deny copy is
-        // the Java handler's byte-pinned error_msg; a nonexistent id
-        // answers NOT_FOUND through the authorizer's probe — the ruled
-        // uniform unknown-id posture (DD-007 addendum), a recorded
-        // divergence from Java's deny-everyone arm on this lane.
-        const input = stepCtx.input;
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
+    // The Java ArtifactListByExecutionHandler's gate: can_view on the PARENT
+    // execution — "if you can view an execution, you can list its
+    // artifacts." The two-field dispatch (workflow-execution first, the Java
+    // order) is why the declarative annotation cannot express this lane and
+    // the proto carries is_skip_authorization. Deny copy is the Java
+    // handler's byte-pinned error_msg; a nonexistent id answers NOT_FOUND
+    // through the authorizer's probe — the ruled uniform unknown-id
+    // posture, a recorded divergence from Java's deny-everyone arm here.
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        ({ input }) => [
           {
             permission: IamPermission.can_view,
             resourceKind:
@@ -453,11 +448,12 @@ async function listByExecution(
               input.workflowExecutionId !== ""
                 ? input.workflowExecutionId
                 : input.agentExecutionId,
+            deniedMessage: "unauthorized to list artifacts for this execution",
           },
-          "unauthorized to list artifacts for this execution",
-        );
-      },
-    })
+        ],
+        "AuthorizeParentExecution",
+      ),
+    )
     .addStep({
       name: "QueryArtifactsByExecution",
       async execute(stepCtx): Promise<void> {

package/src/domain/channelapp/controller.ts

@@ -51,6 +51,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -369,6 +373,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ChannelAppSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ChannelAppQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const app = reqCtx.get(TARGET_RESOURCE_KEY) as ChannelApp;

package/src/domain/environment/controller.ts

@@ -58,8 +58,11 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
-import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import {
   newBuildNewStateStep,
   setAuditFieldsForUpdate,
@@ -93,7 +96,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -240,6 +246,7 @@ async function update(
     .addStep(newPreserveRedactedSecretsStep())
     .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newDestroyDroppedEnvironmentSecretsStep(deps.secretService, deps.logger),
@@ -394,12 +401,6 @@ async function updateVisibility(
     // After load, per the cross-edition error precedence: unknown id +
     // bad level = NOT_FOUND on both editions.
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_ENVIRONMENT_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newValidateEnvironmentShareRestrictionStep())
     .addStep(newSetEnvironmentVisibilityStep())
     .addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store))
@@ -682,6 +683,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, EnvironmentSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(EnvironmentQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const env = reqCtx.get(TARGET_RESOURCE_KEY) as Environment;

package/src/domain/executioncontext/__tests__/executioncontext.test.ts

@@ -277,6 +277,7 @@ describe("executioncontext domain (encryption + runner auth enabled)", () => {
           () =>
             ts.query.getByReference({
               kind: ApiResourceKind.execution_context,
+              org: created.metadata!.org,
               slug: created.metadata!.slug,
             }),
         ],

package/src/domain/executioncontext/controller.ts

@@ -56,6 +56,10 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import {
@@ -78,7 +82,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -182,6 +189,7 @@ async function createExecutionContext(
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
     .addStep(newPersistStep(deps.store))
     .addStep(
@@ -361,6 +369,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ExecutionContextSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ExecutionContextQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const ec = reqCtx.get(TARGET_RESOURCE_KEY) as ExecutionContext;

package/src/domain/executioncontext/steps.ts

@@ -34,6 +34,7 @@ import { isCiphertextShaped } from "../../encryption/encryption.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { EncryptionScope } from "../../encryption/encryption.js";
 import type { Authorizer, AuthzDecision } from "../../extensions/authorizer.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import {
   internalError,
   invalidArgumentError,
@@ -240,7 +241,7 @@ export function newAuthorizeExecutionContextCreateStep(
       ctx: RequestContext<typeof ExecutionContextSchema>,
     ): Promise<void> {
       const caller = ctx.callerIdentity;
-      if (caller.callerClass === "internal" || caller.origin === "in-process") {
+      if (isServerComposedRequest(caller)) {
         return; // authorized upstream — the Java in-process trust arm
       }
       let decision: AuthzDecision;