@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/domain/mcpserver/__tests__/mcpserver.test.ts

@@ -41,7 +41,11 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 
-const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
 
 const API_VERSION = "agentic.stigmer.ai/v1";
 const KIND = "McpServer";
@@ -128,7 +132,11 @@ function serverInput(overrides?: {
   };
 }
 
-async function expectCode(promise: Promise<unknown>, code: Code, arm: string): Promise<ConnectError> {
+async function expectCode(
+  promise: Promise<unknown>,
+  code: Code,
+  arm: string,
+): Promise<ConnectError> {
   try {
     await promise;
   } catch (error) {
@@ -157,7 +165,10 @@ async function seedCapabilities(
     serverId,
     McpServerSchema,
   );
-  const patched = fromBinary(McpServerSchema, toBinary(McpServerSchema, stored));
+  const patched = fromBinary(
+    McpServerSchema,
+    toBinary(McpServerSchema, stored),
+  );
   patched.status ??= create(McpServerStatusSchema, {});
   patched.status.discoveredCapabilities = create(DiscoveredCapabilitiesSchema, {
     tools: tools.map((name) => ({ name })),
@@ -176,13 +187,19 @@ describe("CRUD", () => {
     const created = await command.create(serverInput({ name: "GitHub Tools" }));
     expect(created.metadata?.id).toMatch(/^mcp_[0-9a-z]{26}$/);
     expect(created.metadata?.slug).toBe("github-tools");
-    expect(created.metadata?.visibility).toBe(ApiResourceVisibility.visibility_org);
+    expect(created.metadata?.visibility).toBe(
+      ApiResourceVisibility.visibility_org,
+    );
   });
 
   it("rejects a duplicate create by slug within the org; a different org reuses the slug", async () => {
     const name = `Dup Target ${++counter}`;
     await command.create(serverInput({ name }));
-    await expectCode(command.create(serverInput({ name })), Code.AlreadyExists, "duplicate create");
+    await expectCode(
+      command.create(serverInput({ name })),
+      Code.AlreadyExists,
+      "duplicate create",
+    );
     const other = await command.create(serverInput({ name, org: "other-org" }));
     expect(other.metadata?.org).toBe("other-org");
   });
@@ -201,10 +218,17 @@ describe("CRUD", () => {
   it("get and getByReference resolve the same resource; unknowns answer NotFound", async () => {
     const created = await command.create(serverInput());
     const byId = await query.get({ value: created.metadata!.id });
-    const byRef = await query.getByReference({ org: ORG, slug: created.metadata!.slug });
+    const byRef = await query.getByReference({
+      org: ORG,
+      slug: created.metadata!.slug,
+    });
     expect(byId.metadata?.id).toBe(created.metadata?.id);
     expect(byRef.metadata?.id).toBe(created.metadata?.id);
-    await expectCode(query.get({ value: "mcps_missing" }), Code.NotFound, "get unknown");
+    await expectCode(
+      query.get({ value: "mcps_missing" }),
+      Code.NotFound,
+      "get unknown",
+    );
     await expectCode(
       query.getByReference({ org: ORG, slug: "never-created" }),
       Code.NotFound,
@@ -216,7 +240,11 @@ describe("CRUD", () => {
     const created = await command.create(serverInput());
     const deleted = await command.delete({ resourceId: created.metadata!.id });
     expect(deleted.metadata?.id).toBe(created.metadata?.id);
-    await expectCode(query.get({ value: created.metadata!.id }), Code.NotFound, "get after delete");
+    await expectCode(
+      query.get({ value: created.metadata!.id }),
+      Code.NotFound,
+      "get after delete",
+    );
   });
 
   it("update of a non-existent server and delete of a non-existent server answer NotFound; delete with an empty id is InvalidArgument", async () => {
@@ -233,7 +261,11 @@ describe("CRUD", () => {
       Code.NotFound,
       "delete non-existent",
     );
-    await expectCode(command.delete({}), Code.InvalidArgument, "delete empty id");
+    await expectCode(
+      command.delete({}),
+      Code.InvalidArgument,
+      "delete empty id",
+    );
   });
 });
 
@@ -244,13 +276,17 @@ describe("updateVisibility (no conformance coverage for this domain — the D4-d
       resourceId: created.metadata!.id,
       visibility: ApiResourceVisibility.visibility_private,
     });
-    expect(updated.metadata?.visibility).toBe(ApiResourceVisibility.visibility_private);
+    expect(updated.metadata?.visibility).toBe(
+      ApiResourceVisibility.visibility_private,
+    );
     expect(updated.spec?.description).toBe(created.spec?.description);
     // A visibility change is a STATUS mutation: status_audit re-stamped
     // (updated event, fresh timestamp bounds are creation-or-later),
     // spec_audit byte-untouched.
     expect(updated.status?.audit?.statusAudit?.event).toBe("updated");
-    expect(updated.status?.audit?.specAudit).toEqual(created.status?.audit?.specAudit);
+    expect(updated.status?.audit?.specAudit).toEqual(
+      created.status?.audit?.specAudit,
+    );
   });
 
   it("answers NotFound for an unknown id", async () => {
@@ -296,7 +332,9 @@ describe("ValidateDefaultEnabledTools (#402)", () => {
   it("accepts names the server exposes; skips when the list is empty or the server never connected", async () => {
     // Never connected: any names pass (no authoritative toolset yet).
     const fresh = await command.create(serverInput());
-    const freshUpdate = await command.update(updateInput(fresh, ["anything-goes"]));
+    const freshUpdate = await command.update(
+      updateInput(fresh, ["anything-goes"]),
+    );
     expect(freshUpdate.spec?.defaultEnabledTools).toEqual(["anything-goes"]);
 
     // Connected: valid names pass.
@@ -308,7 +346,11 @@ describe("ValidateDefaultEnabledTools (#402)", () => {
 
   it("rejects unknown tools and resource templates with the byte-pinned teaching copy", async () => {
     const created = await command.create(serverInput());
-    await seedCapabilities(created.metadata!.id, ["search", "fetch"], ["files"]);
+    await seedCapabilities(
+      created.metadata!.id,
+      ["search", "fetch"],
+      ["files"],
+    );
 
     const err = await expectCode(
       command.update(updateInput(created, ["serch", "files"])),
@@ -334,7 +376,10 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
       OAuthAppSchema,
       create(OAuthAppSchema, {
         metadata: { id, org: ORG, slug, name: slug },
-        spec: { vendorApprovalStatus: approval, vendorApprovalDocsUrl: docsUrl },
+        spec: {
+          vendorApprovalStatus: approval,
+          vendorApprovalDocsUrl: docsUrl,
+        },
       }),
     );
   }
@@ -346,14 +391,25 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   });
 
   it("a missing OAuthApp skips enrichment (the initiate path owns refusing)", async () => {
-    const created = await command.create(serverInput({ oauthAppSlug: "never-applied" }));
+    // The app must exist when the server is written (the reference rule);
+    // a reference dangles when its target leaves afterwards.
+    await seedOAuthApp("never-applied", VendorApprovalStatus.UNSPECIFIED, "");
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "never-applied" }),
+    );
+    await server.store.deleteResource(
+      ApiResourceKind.oauth_app,
+      "oaa_neverapplied",
+    );
     const got = await query.get({ value: created.metadata!.id });
     expect(got.status?.oauthStatus).toBeUndefined();
   });
 
   it("nothing-to-report means ABSENT — presence itself is the SDK's signal", async () => {
     await seedOAuthApp("plain-app", VendorApprovalStatus.UNSPECIFIED, "");
-    const created = await command.create(serverInput({ oauthAppSlug: "plain-app" }));
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "plain-app" }),
+    );
     const got = await query.get({ value: created.metadata!.id });
     expect(got.status?.oauthStatus).toBeUndefined();
   });
@@ -363,24 +419,42 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   // alone must enrich (Go enrich_oauth_status_test.go's docs-only and
   // status-only arms — the executable spec of the #523 shared contract).
   it("a docs URL ALONE enriches, even with an UNSPECIFIED approval status", async () => {
-    await seedOAuthApp("docs-only-app", VendorApprovalStatus.UNSPECIFIED, "https://vendor.example/setup");
-    const created = await command.create(serverInput({ oauthAppSlug: "docs-only-app" }));
+    await seedOAuthApp(
+      "docs-only-app",
+      VendorApprovalStatus.UNSPECIFIED,
+      "https://vendor.example/setup",
+    );
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "docs-only-app" }),
+    );
     const got = await query.get({ value: created.metadata!.id });
-    expect(got.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.UNSPECIFIED);
-    expect(got.status?.oauthStatus?.vendorApprovalDocsUrl).toBe("https://vendor.example/setup");
+    expect(got.status?.oauthStatus?.vendorApprovalStatus).toBe(
+      VendorApprovalStatus.UNSPECIFIED,
+    );
+    expect(got.status?.oauthStatus?.vendorApprovalDocsUrl).toBe(
+      "https://vendor.example/setup",
+    );
   });
 
   it("a non-default approval status ALONE enriches — REJECTED and even APPROVED are reported", async () => {
     await seedOAuthApp("rejected-app", VendorApprovalStatus.REJECTED, "");
-    const rejected = await command.create(serverInput({ oauthAppSlug: "rejected-app" }));
+    const rejected = await command.create(
+      serverInput({ oauthAppSlug: "rejected-app" }),
+    );
     const gotRejected = await query.get({ value: rejected.metadata!.id });
-    expect(gotRejected.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.REJECTED);
+    expect(gotRejected.status?.oauthStatus?.vendorApprovalStatus).toBe(
+      VendorApprovalStatus.REJECTED,
+    );
     expect(gotRejected.status?.oauthStatus?.vendorApprovalDocsUrl).toBe("");
 
     await seedOAuthApp("approved-app", VendorApprovalStatus.APPROVED, "");
-    const approved = await command.create(serverInput({ oauthAppSlug: "approved-app" }));
+    const approved = await command.create(
+      serverInput({ oauthAppSlug: "approved-app" }),
+    );
     const gotApproved = await query.get({ value: approved.metadata!.id });
-    expect(gotApproved.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.APPROVED);
+    expect(gotApproved.status?.oauthStatus?.vendorApprovalStatus).toBe(
+      VendorApprovalStatus.APPROVED,
+    );
   });
 
   it("an auth block WITHOUT an oauth_app_ref (the DCR arm) is untouched", async () => {
@@ -391,8 +465,14 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   });
 
   it("a gating approval status or docs URL enriches BOTH read paths, response-only", async () => {
-    await seedOAuthApp("gated-app", VendorApprovalStatus.PENDING, "https://vendor.example/approval");
-    const created = await command.create(serverInput({ oauthAppSlug: "gated-app" }));
+    await seedOAuthApp(
+      "gated-app",
+      VendorApprovalStatus.PENDING,
+      "https://vendor.example/approval",
+    );
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "gated-app" }),
+    );
 
     for (const loaded of [
       await query.get({ value: created.metadata!.id }),
@@ -430,7 +510,12 @@ describe("org-OAuth-app surface — UNIMPLEMENTED by design (#558, DD-019)", ()
     expect(getErr.rawMessage).toBe("method GetOrgOAuthApp not implemented");
 
     const setErr = await expectCode(
-      command.setOrgOAuthApp({ resourceId: "mcps_test", org: ORG, clientId: "x", clientSecret: "y" }),
+      command.setOrgOAuthApp({
+        resourceId: "mcps_test",
+        org: ORG,
+        clientId: "x",
+        clientSecret: "y",
+      }),
       Code.Unimplemented,
       "setOrgOAuthApp",
     );
@@ -441,6 +526,8 @@ describe("org-OAuth-app surface — UNIMPLEMENTED by design (#558, DD-019)", ()
       Code.Unimplemented,
       "deleteOrgOAuthApp",
     );
-    expect(deleteErr.rawMessage).toBe("method DeleteOrgOAuthApp not implemented");
+    expect(deleteErr.rawMessage).toBe(
+      "method DeleteOrgOAuthApp not implemented",
+    );
   });
 });

package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts

@@ -41,7 +41,11 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 
-const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
 
 const REDIRECT_URI = "http://127.0.0.1:8234/auth/oauth/callback";
 const ORG = "acme";
@@ -368,20 +372,30 @@ describe("initiateOAuthConnect", () => {
       "OAuth sign-in is unavailable: the platform's OAuth app for 'exampleco' is pending approval by the vendor. This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.",
     ],
   ];
-  it.each(refusals)("vendor arm refuses %s", async (_label, status, oauthOnly, copy) => {
-    const slug = `vendor-${status}-${oauthOnly ? "only" : "manual"}`;
-    await seedOAuthApp(slug, status);
-    const id = await applyServer({ vendorSlug: slug, oauthOnly });
-    const error = await expectCode(
-      command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
-      Code.FailedPrecondition,
-      copy,
-    );
-    expect(error.rawMessage).toBe(copy);
-  });
+  it.each(refusals)(
+    "vendor arm refuses %s",
+    async (_label, status, oauthOnly, copy) => {
+      const slug = `vendor-${status}-${oauthOnly ? "only" : "manual"}`;
+      await seedOAuthApp(slug, status);
+      const id = await applyServer({ vendorSlug: slug, oauthOnly });
+      const error = await expectCode(
+        command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
+        Code.FailedPrecondition,
+        copy,
+      );
+      expect(error.rawMessage).toBe(copy);
+    },
+  );
 
   it("vendor arm answers NotFound for an unresolvable oauth_app_ref", async () => {
+    // The app must exist when the server is written (the reference rule);
+    // the reference becomes unresolvable when its target leaves afterwards.
+    await seedOAuthApp("no-such-app", VendorApprovalStatus.APPROVED);
     const id = await applyServer({ vendorSlug: "no-such-app" });
+    await server.store.deleteResource(
+      ApiResourceKind.oauth_app,
+      "oap_no-such-app",
+    );
     await expectCode(
       command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
       Code.NotFound,
@@ -406,17 +420,29 @@ describe("initiateOAuthConnect", () => {
 describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", () => {
   it("guards its inputs (proto rules answer first, exactly as on Go)", async () => {
     await expectCode(
-      command.completeOAuthConnect({ mcpServerId: "", state: "s", authorizationCode: "c" }),
+      command.completeOAuthConnect({
+        mcpServerId: "",
+        state: "s",
+        authorizationCode: "c",
+      }),
       Code.InvalidArgument,
       "mcp_server_id: value is required [required]",
     );
     await expectCode(
-      command.completeOAuthConnect({ mcpServerId: "m", state: "", authorizationCode: "c" }),
+      command.completeOAuthConnect({
+        mcpServerId: "m",
+        state: "",
+        authorizationCode: "c",
+      }),
       Code.InvalidArgument,
       "state:",
     );
     await expectCode(
-      command.completeOAuthConnect({ mcpServerId: "m", state: "s", authorizationCode: "" }),
+      command.completeOAuthConnect({
+        mcpServerId: "m",
+        state: "s",
+        authorizationCode: "",
+      }),
       Code.InvalidArgument,
       "authorization_code:",
     );
@@ -500,7 +526,10 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
 
     // The grant is queryable and HEALTHY; the refresh-token env var is
     // stamped unconditionally (oss#863's precondition, ported as-is).
-    const status = await query.getOAuthGrantStatus({ resourceId: id, org: ORG });
+    const status = await query.getOAuthGrantStatus({
+      resourceId: id,
+      org: ORG,
+    });
     expect(status.connected).toBe(true);
     expect(status.targetEnvVar).toBe("EXAMPLE_TOKEN");
     expect(status.authMethod).toBe("mcp_oauth");
@@ -514,7 +543,10 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
     expect(firstEnvId).not.toBe("");
 
     // Re-connect reuses the managed environment.
-    const again = await command.initiateOAuthConnect({ mcpServerId: id, org: ORG });
+    const again = await command.initiateOAuthConnect({
+      mcpServerId: id,
+      org: ORG,
+    });
     await command.completeOAuthConnect({
       mcpServerId: id,
       state: again.state,
@@ -525,7 +557,10 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
 
     // Disconnect tears down grant + environment; a second disconnect is
     // the idempotent no-grant arm.
-    const disconnected = await command.disconnectOAuth({ resourceId: id, org: ORG });
+    const disconnected = await command.disconnectOAuth({
+      resourceId: id,
+      org: ORG,
+    });
     expect(disconnected.disconnected).toBe(true);
     expect(await server.store.oauthGrants.find("", id, ORG)).toBeUndefined();
     const againDisconnected = await command.disconnectOAuth({

package/src/domain/mcpserver/connect.ts

@@ -254,13 +254,6 @@ export async function connect(
   input: ConnectInput,
   identity: CallerIdentity,
 ): Promise<McpServer> {
-  const engineState = deps.engineState();
-  if (!engineState.connected) {
-    throw failedPreconditionError(
-      "connect is not available: Temporal not configured",
-    );
-  }
-
   const mcpServerId = input.mcpServerId;
   if (mcpServerId === "") {
     throw invalidArgumentError("mcp_server_id is required");
@@ -280,9 +273,10 @@ export async function connect(
     throw notFoundError("mcp_server", mcpServerId);
   }
 
-  // The annotation's can_connect check AFTER the load — the Java
-  // McpServerConnectHandler order (load-before-authorize, stigmer#224).
-  // C2 Stage 4.
+  // The annotation's can_connect check after the load and BEFORE the engine
+  // check (the Java McpServerConnectHandler load-before-authorize order,
+  // stigmer#224): a caller who may not connect this server learns nothing
+  // about whether the engine is up.
   await authorizeDirect(
     McpServerCommandController.method.connect,
     deps.authorizer,
@@ -290,6 +284,13 @@ export async function connect(
     input,
   );
 
+  const engineState = deps.engineState();
+  if (!engineState.connected) {
+    throw failedPreconditionError(
+      "connect is not available: Temporal not configured",
+    );
+  }
+
   const prepared = await prepareConnect(deps, mcpServer, input, identity);
 
   try {

package/src/domain/mcpserver/controller.ts

@@ -53,11 +53,11 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
-import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
-  newAuthorizeVisibilityTransitionStep,
-  newGuardPublicVisibilityStep,
-} from "../../pipeline/steps/visibility-gates.js";
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   setAuditFieldsForUpdate,
   newBuildNewStateStep,
@@ -88,7 +88,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -207,7 +210,9 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
 }
 
 /** The endpoint-auth step's slice of the deps: the guarded fetch the connect slice holds. */
-function endpointAuthDeps(deps: McpServerControllerDeps): CompleteEndpointAuthDeps {
+function endpointAuthDeps(
+  deps: McpServerControllerDeps,
+): CompleteEndpointAuthDeps {
   return { outboundFetch: deps.connect.outboundFetch, logger: deps.logger };
 }
 
@@ -235,13 +240,13 @@ async function createMcpServer(
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
-    .addStep(newGuardPublicVisibilityStep(deps.authorizer))
     // A URL-only server is asked once whether it wants OAuth and completed
     // when it does; immediately before GuardReservedLabels because the
     // provenance label it stamps is one the guard diffs.
     .addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps)))
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -294,6 +299,7 @@ async function update(
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newValidateDefaultEnabledToolsStep())
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newIndexSearchStep(deps.store, mcpServerSearchExtractor, deps.logger),
@@ -457,12 +463,6 @@ async function updateVisibility(
       newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY),
     )
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_MCP_SERVER_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newSetMcpServerVisibilityStep())
     .addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store))
     .addStep(
@@ -629,6 +629,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, McpServerSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(McpServerQueryController.method.get),
+      ),
+    )
     .addStep(newEnrichOAuthStatusStep(deps.store, deps.logger))
     .build()
     .execute(reqCtx);

package/src/domain/mcpserver/start-connect.ts

@@ -69,13 +69,6 @@ export async function startConnect(
   input: ConnectInput,
   identity: CallerIdentity,
 ): Promise<McpServer> {
-  const engineState = deps.engineState();
-  if (!engineState.connected) {
-    throw failedPreconditionError(
-      "connect is not available: Temporal not configured",
-    );
-  }
-
   const mcpServerId = input.mcpServerId;
   if (mcpServerId === "") {
     throw invalidArgumentError("mcp_server_id is required");
@@ -95,9 +88,10 @@ export async function startConnect(
     throw notFoundError("mcp_server", mcpServerId);
   }
 
-  // The annotation's can_connect check AFTER the load — the Java
-  // McpServerStartConnectHandler order (the connect handler's shared
-  // load/authorize steps, stigmer#224). C2 Stage 4.
+  // The annotation's can_connect check after the load and BEFORE the engine
+  // check (the Java McpServerStartConnectHandler load-before-authorize order,
+  // stigmer#224): a caller who may not connect this server learns nothing
+  // about whether the engine is up.
   await authorizeDirect(
     McpServerCommandController.method.startConnect,
     deps.authorizer,
@@ -105,6 +99,13 @@ export async function startConnect(
     input,
   );
 
+  const engineState = deps.engineState();
+  if (!engineState.connected) {
+    throw failedPreconditionError(
+      "connect is not available: Temporal not configured",
+    );
+  }
+
   const connectStatus = mcpServer.status?.connectStatus;
   if (connectStatus?.phase === ConnectPhase.connecting) {
     if (
@@ -249,7 +250,12 @@ async function settleConnectAsync(
         outcome.failure,
         ASYNC_CONNECT_TIMEOUT,
       );
-      await persistConnectFailure(deps.store, deps.logger, mcpServerId, failure);
+      await persistConnectFailure(
+        deps.store,
+        deps.logger,
+        mcpServerId,
+        failure,
+      );
       return;
     }
 

package/src/domain/memory/__tests__/create-authorization.test.ts

@@ -0,0 +1,59 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveMemoryCreateTargets): a wire caller asks can_create_session on
+ * metadata.org — whoever may converse in an organization may remember
+ * there — and a server-composed request (internal, or any identity that
+ * entered in-process) asks nothing, as the capture gate before it already
+ * says.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  MEMORY_CREATE_DENIED_MESSAGE,
+  resolveMemoryCreateTargets,
+} from "../steps.js";
+
+function ctxFor(caller: CallerIdentity) {
+  return new RequestContext(
+    MemorySchema,
+    create(MemorySchema, { metadata: { name: "prefers-tea", org: "acme" } }),
+    caller,
+    ApiResourceKind.memory,
+  );
+}
+
+describe("resolveMemoryCreateTargets", () => {
+  it("a wire caller asks can_create_session on the memory's organization", () => {
+    expect(resolveMemoryCreateTargets(ctxFor(testCallerIdentity()))).toEqual([
+      {
+        permission: IamPermission.can_create_session,
+        resourceKind: ApiResourceKind.organization,
+        resourceId: "acme",
+        deniedMessage: MEMORY_CREATE_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a server-composed request asks nothing", () => {
+    expect(
+      resolveMemoryCreateTargets(
+        ctxFor(testCallerIdentity({ callerClass: "internal" })),
+      ),
+    ).toEqual([]);
+    expect(
+      resolveMemoryCreateTargets(
+        ctxFor(
+          testCallerIdentity({ callerClass: "user", origin: "in-process" }),
+        ),
+      ),
+    ).toEqual([]);
+  });
+});

package/src/domain/memory/controller.ts

@@ -77,6 +77,7 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardMemoryCaptureStep } from "../../pipeline/steps/guard-memory-capture.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
@@ -118,6 +119,7 @@ import {
   newResolveMemoryDefaultsStep,
   newTransitionMemoryLifecycleStep,
   newValidateMemoryUpdateStep,
+  resolveMemoryCreateTargets,
 } from "./steps.js";
 
 export interface MemoryControllerDeps {
@@ -194,6 +196,15 @@ async function createMemory(
     .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveMemoryDefaultsStep())
+    // Before the enablement and cap checks, so a refused caller learns
+    // nothing about the organization's settings (steps.ts,
+    // resolveMemoryCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveMemoryCreateTargets,
+      ),
+    )
     .addStep(newCheckMemoryEnablementStep(deps.store))
     .addStep(newCheckMemoryCapStep(deps.store))
     .addStep(newResolveSlugStep())