@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/domain/memory/steps.ts

@@ -30,6 +30,7 @@ import { MemoryListSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/i
 import { MemoryProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/spec_pb";
 import { MemoryStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/status_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
 import {
@@ -42,6 +43,8 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import {
   generateId,
   setAuditFieldsForUpdate,
@@ -159,6 +162,44 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
   };
 }
 
+/** The deny copy of the create lane's organization bar. */
+export const MEMORY_CREATE_DENIED_MESSAGE =
+  "unauthorized to capture memory in this organization";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after ResolveMemoryDefaults (which requires metadata.org) and BEFORE
+ * CheckMemoryEnablement, so a refused caller learns nothing about the
+ * organization's memory settings. The RPC is is_skip_authorization
+ * because the row does not exist yet and the subject IS the caller
+ * (command.proto); GuardMemoryCapture is the gate that decides WHO may
+ * capture at all, and this question is WHERE: can_create_session on
+ * metadata.org — memory is captured inside a conversation, so whoever may
+ * converse in an organization may remember there.
+ *
+ * The credentialed capture lane is already scoped to the run's
+ * organization by the credential provider (a mismatch is refused inside
+ * GuardMemoryCapture with its own copy); this question closes the plain
+ * path, a person with no run credential naming an organization they hold
+ * nothing in. A server-composed traversal asks nothing, as the gate itself
+ * says: the entry-point request already passed.
+ */
+export function resolveMemoryCreateTargets(
+  ctx: RequestContext<typeof MemorySchema>,
+): ReadonlyArray<AuthorizationTarget> {
+  if (isServerComposedRequest(ctx.callerIdentity)) {
+    return [];
+  }
+  return [
+    {
+      permission: IamPermission.can_create_session,
+      resourceKind: ApiResourceKind.organization,
+      resourceId: ctx.newState.metadata?.org ?? "",
+      deniedMessage: MEMORY_CREATE_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * CheckMemoryEnablement — Go checkMemoryEnablementStep: enforces the
  * org's memory_enabled switch at write time, FAIL-CLOSED (DD-005 D2): a

package/src/domain/oauthapp/controller.ts

@@ -52,6 +52,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
@@ -362,6 +366,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, OAuthAppSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(OAuthAppQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   const app = reqCtx.get(TARGET_RESOURCE_KEY) as OAuthApp;

package/src/domain/plugin/controller.ts

@@ -51,7 +51,6 @@ import type {
   ApiResourceReference,
   UpdateVisibilityInput,
 } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { ContentAddressedArchiveStore } from "../../archive/content-store.js";
 import { MAX_ZIP_SIZE } from "../../archive/limits.js";
@@ -74,10 +73,7 @@ import {
   newRecordVisibilityBeforeUpdateStep,
   newUpdateVisibilityTuplesStep,
 } from "../../pipeline/steps/authorization-tuples.js";
-import {
-  authorizeResolvedResource,
-  newAuthorizeStep,
-} from "../../pipeline/steps/authorize.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
 import { setAuditFieldsForUpdate } from "../../pipeline/steps/defaults.js";
 import {
   newDeleteResourceStep,
@@ -96,14 +92,17 @@ import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityUpdateStep } from "../../pipeline/steps/validate-visibility.js";
 import { newDeleteVersionArchivesStep } from "../../pipeline/steps/version-archive.js";
 import {
-  LIST_VERSIONS_RESOURCE_ID_KEY,
   LIST_VERSIONS_RESPONSE_KEY,
   newLoadAndMapVersionsStep,
   newLoadByReferenceWithVersionStep,
   newResolveBySlugForVersionsStep,
+  versionHistoryTarget,
 } from "../../pipeline/steps/version-history.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import type { VersionHistoryBinding } from "../../pipeline/steps/version-history.js";
-import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
 import type { Store } from "../../store/interface.js";
 import { uploadUrl } from "../skill/transfer/handler.js";
@@ -226,7 +225,7 @@ async function push(
     .addStep(newParseOverlayDocumentsStep())
     .addStep(newSanitizePluginMetadataStep(deps.authorizer))
     .addStep(newPlanMaterializationStep(deps.store, deps.authorizer))
-    .addStep(newGuardPluginVisibilityStep(deps.authorizer))
+    .addStep(newGuardPluginVisibilityStep())
     .addStep(newResolveConvergenceStep())
     .build()
     .execute(reqCtx);
@@ -359,12 +358,6 @@ async function updateVisibility(
     .addStep(newLoadPluginByIdStep(deps.store, UPDATE_VISIBILITY_PLUGIN_KEY))
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY))
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_PLUGIN_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newSetPluginVisibilityStep())
     .addStep(
       newPersistPluginStep(
@@ -718,22 +711,13 @@ async function getByReference(
         "LoadPluginByReference",
       ),
     )
-    .addStep({
-      name: "AuthorizeResolvedPlugin",
-      async execute(stepCtx): Promise<void> {
-        const resolved = stepCtx.get(TARGET_RESOURCE_KEY) as Plugin;
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.plugin,
-            resourceId: resolved.metadata?.id ?? "",
-          },
-          "unauthorized to get plugin",
-        );
-      },
-    })
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(PluginQueryController.method.get),
+        "AuthorizeResolvedPlugin",
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as Plugin;
@@ -817,21 +801,16 @@ async function listVersions(
         "ResolvePluginBySlug",
       ),
     )
-    .addStep({
-      name: "AuthorizeResolvedPlugin",
-      async execute(stepCtx): Promise<void> {
-        await authorizeResolvedResource(
-          deps.authorizer,
-          stepCtx.callerIdentity,
-          {
-            permission: IamPermission.can_view,
-            resourceKind: ApiResourceKind.plugin,
-            resourceId: stepCtx.get(LIST_VERSIONS_RESOURCE_ID_KEY) as string,
-          },
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        versionHistoryTarget(
+          ApiResourceKind.plugin,
           "unauthorized to view plugin version history",
-        );
-      },
-    })
+        ),
+        "AuthorizeResolvedPlugin",
+      ),
+    )
     .addStep(
       newLoadAndMapVersionsStep(
         deps.store,

package/src/domain/plugin/push.ts

@@ -94,7 +94,6 @@ import { ARTIFACT_BYTES_KEY } from "../../pipeline/steps/resolve-artifact-source
 import { generateSlug } from "../../pipeline/steps/slug.js";
 import { rejectUnsupportedVisibility } from "../../pipeline/steps/validate-visibility.js";
 import { newArchiveCurrentVersionStep } from "../../pipeline/steps/version-archive.js";
-import { requireOperatorMaySetPublic } from "../../pipeline/steps/visibility-gates.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { openPluginArchive } from "./archive.js";
@@ -493,30 +492,23 @@ export function newPlanMaterializationStep(
 
 /**
  * GuardPluginVisibility — the requested level must be one the plugin and
- * every planned member kind support, and PUBLIC needs the operator grant
- * (the one owner of that question, shared with every other create door).
- * Each member's own chain will check again in-process; refusing here keeps
- * the head from being written before the answer is known.
+ * every planned member kind support: the push chain's counterpart of the
+ * ValidateVisibility step on the resource create chains, asked here for
+ * the head and for each member kind before anything is written, so a
+ * plugin cannot be installed at a level one of its members may not hold.
+ * Each member's own chain checks again in-process; refusing here keeps the
+ * head from being written before the answer is known.
  */
-export function newGuardPluginVisibilityStep(
-  authorizer: Authorizer,
-): PipelineStep<PushDesc> {
+export function newGuardPluginVisibilityStep(): PipelineStep<PushDesc> {
   return {
     name: "GuardPluginVisibility",
-    async execute(ctx: RequestContext<PushDesc>): Promise<void> {
+    execute(ctx: RequestContext<PushDesc>): void {
       const level = requestedVisibility(ctx);
       const plan = ctx.get(PLUGIN_PLAN_KEY) as MaterializationPlan;
       rejectUnsupportedVisibility(ctx.apiResourceKind, level);
       for (const kind of new Set(plan.members.map((member) => member.kind))) {
         rejectUnsupportedVisibility(kind, level);
       }
-      if (level !== ApiResourceVisibility.visibility_public) {
-        return;
-      }
-      if (ctx.callerIdentity.callerClass === "internal") {
-        return;
-      }
-      await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
     },
   };
 }

package/src/domain/schedule/__tests__/create-authorization.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Pins the create lane's authorization question (steps.ts,
+ * resolveScheduleCreateTargets): can_edit on the REFERENCED AGENT with the
+ * Java handler's copy, and nothing on the organization (the same-org
+ * invariant already binds the schedule to the agent's); a missing
+ * referenced agent throws.
+ */
+import { describe, expect, it } from "vitest";
+import { create } from "@bufbuild/protobuf";
+
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import {
+  REFERENCED_AGENT_KEY,
+  SCHEDULE_CREATE_DENIED_MESSAGE,
+  resolveScheduleCreateTargets,
+} from "../steps.js";
+
+const agent = create(AgentSchema, {
+  metadata: { id: "agt_01target", name: "helper", org: "acme" },
+});
+
+function ctxFor(stash = true) {
+  const ctx = new RequestContext(
+    ScheduleSchema,
+    create(ScheduleSchema, { metadata: { name: "nightly", org: "acme" } }),
+    testCallerIdentity(),
+    ApiResourceKind.schedule,
+  );
+  if (stash) {
+    ctx.set(REFERENCED_AGENT_KEY, agent);
+  }
+  return ctx;
+}
+
+describe("resolveScheduleCreateTargets", () => {
+  it("asks can_edit on the referenced agent and nothing else", () => {
+    expect(resolveScheduleCreateTargets(ctxFor())).toEqual([
+      {
+        permission: IamPermission.can_edit,
+        resourceKind: ApiResourceKind.agent,
+        resourceId: "agt_01target",
+        deniedMessage: SCHEDULE_CREATE_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a missing referenced agent is a broken chain invariant and throws", () => {
+    expect(() => resolveScheduleCreateTargets(ctxFor(false))).toThrow(
+      "referenced agent not found in context",
+    );
+  });
+});

package/src/domain/schedule/controller.ts

@@ -62,6 +62,10 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import {
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
 import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
@@ -93,7 +97,10 @@ import {
   newCreateAuthorizationTuplesStep,
 } from "../../pipeline/steps/authorization-tuples.js";
 import { newPersistStep } from "../../pipeline/steps/persist.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
@@ -116,6 +123,7 @@ import { newClearSchedulePauseStep } from "./resume.js";
 import {
   newResolveScheduleDefaultsStep,
   newValidateScheduleUpdateStep,
+  resolveScheduleCreateTargets,
 } from "./steps.js";
 import {
   TRIGGER_RESULT_KEY,
@@ -201,11 +209,21 @@ async function createSchedule(
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveScheduleDefaultsStep(deps))
+    // Before the duplicate check and before ArmSchedule: a refused caller
+    // learns nothing about existing slugs and costs no Temporal schedule
+    // (steps.ts, resolveScheduleCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveScheduleCreateTargets,
+      ),
+    )
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -245,6 +263,7 @@ async function update(
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistScheduleUpdateStep(deps.store))
     .addStep(newArmScheduleStep(deps.clock, deps.logger))
     .build()
@@ -477,6 +496,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, ScheduleSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(ScheduleQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as Schedule;

package/src/domain/schedule/steps.ts

@@ -8,10 +8,12 @@
  * __tests__/schedule.composed.test.ts.
  */
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { ScheduleSpec } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   failedPreconditionError,
@@ -21,6 +23,7 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
@@ -128,10 +131,47 @@ export function newResolveScheduleDefaultsStep(
       if (agentRef !== undefined) {
         agentRef.org = refOrg;
       }
+      ctx.set(REFERENCED_AGENT_KEY, found);
     },
   };
 }
 
+/**
+ * Context key for the agent ResolveScheduleDefaults resolved from
+ * spec.agent.agent_ref, read by the create lane's authorization step.
+ */
+export const REFERENCED_AGENT_KEY = "scheduleReferencedAgent";
+
+/** The deny copy of the create bar, the Java ScheduleCreateHandler's. */
+export const SCHEDULE_CREATE_DENIED_MESSAGE =
+  "You don't have permission to schedule this agent";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after ResolveScheduleDefaults: can_edit on the REFERENCED AGENT. The RPC
+ * is is_skip_authorization because its target is that agent, resolved from
+ * a slug, not a request field; and there is deliberately no organization
+ * bar — a schedule is unattended spend on an agent, an editor's act, and
+ * the same-org invariant the resolve step enforces already binds the
+ * schedule's organization to the agent's (command.proto).
+ */
+export function resolveScheduleCreateTargets(
+  ctx: RequestContext<typeof ScheduleSchema>,
+): ReadonlyArray<AuthorizationTarget> {
+  const agent = ctx.get(REFERENCED_AGENT_KEY) as Agent | undefined;
+  if (agent === undefined) {
+    throw new Error("referenced agent not found in context");
+  }
+  return [
+    {
+      permission: IamPermission.can_edit,
+      resourceKind: ApiResourceKind.agent,
+      resourceId: agent.metadata?.id ?? "",
+      deniedMessage: SCHEDULE_CREATE_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * Enforces the schedule-specific workspace constraint on the shared
  * AgentInvocation (DD-018 D-3): every workspace entry must be a git_repo
@@ -140,7 +180,9 @@ export function newResolveScheduleDefaultsStep(
  * deterministic provisioning failure at 3 AM. Copy is cross-edition
  * contract (Go validateScheduleWorkspace).
  */
-export function validateScheduleWorkspace(spec: ScheduleSpec | undefined): void {
+export function validateScheduleWorkspace(
+  spec: ScheduleSpec | undefined,
+): void {
   const entries =
     spec?.target.case === "agent" ? spec.target.value.workspaceEntries : [];
   for (const [i, entry] of entries.entries()) {
@@ -174,7 +216,8 @@ export function validateScheduleModelPinning(
   if (presence !== "") {
     throw invalidArgumentError(presence);
   }
-  const invocation = spec?.target.case === "agent" ? spec.target.value : undefined;
+  const invocation =
+    spec?.target.case === "agent" ? spec.target.value : undefined;
   const existence = unknownModelPinRefusal(
     modelRegistry,
     "spec.agent.run_config.model_name",

package/src/domain/session/controller.ts

@@ -85,7 +85,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -208,7 +211,8 @@ async function createSession(
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
-    .addStep(newNormalizeReferencesStep());
+    .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store));
   // The ratified pre-side-effect gate slot (blueprint 03 §3a; O4; Q2
   // ruling — see the create doc comment). Empty in OSS.
   for (const step of stepsForSlot<typeof SessionSchema>(
@@ -499,7 +503,9 @@ async function list(
       newAuthorizeStep(SessionQueryController.method.list, deps.authorizer),
     )
     .addStep(newValidateProtoStep())
-    .addStep(newListAllSessionsStep(deps.store, deps.logger, deps.listReadScope))
+    .addStep(
+      newListAllSessionsStep(deps.store, deps.logger, deps.listReadScope),
+    )
     .build()
     .execute(reqCtx);
   return requireListResult(reqCtx.get(LIST_RESULT_KEY));
@@ -559,7 +565,9 @@ async function listByChannel(
     )
     .addStep(newValidateProtoStep())
     .addStep(newAuthorizeChannelAccessStep(deps.authorizer))
-    .addStep(newFilterByChannelStep(deps.store, deps.logger, deps.listReadScope))
+    .addStep(
+      newFilterByChannelStep(deps.store, deps.logger, deps.listReadScope),
+    )
     .build()
     .execute(reqCtx);
   return requireListResult(reqCtx.get(LIST_RESULT_KEY));

package/src/domain/session/steps.ts

@@ -44,7 +44,7 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
-import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
+import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
 import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
 import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
@@ -533,41 +533,33 @@ export function newFilterByAgentInstanceStep(
 
 /**
  * AuthorizeChannelAccess — the Java SessionListByChannelHandler's
- * two-stage authorization, stage one (census lane 3's extra arm,
- * 20260830.01 ruling Q8): an explicit can_view check on the TARGET
- * agent_channel before any session work, so a caller without channel
- * access learns nothing about the channel's sessions. The mid-chain
- * resolved-id evaluation (the is_skip_authorization annotation makes the
- * position-1 step a no-op on this lane); deny copy is the Java handler's
- * byte-pinned "unauthorized to list channel conversations". The blank-id
- * refusal stays FilterByChannel's (the step behind this gate) — the gate
- * checks only a named channel.
+ * two-stage authorization, stage one: an explicit can_view check on the
+ * TARGET agent_channel before any session work, so a caller without
+ * channel access learns nothing about the channel's sessions. The
+ * mid-chain resolved-target evaluation (the is_skip_authorization
+ * annotation makes the position-1 step a no-op on this lane); deny copy is
+ * the Java handler's byte-pinned "unauthorized to list channel
+ * conversations". The blank-id refusal stays FilterByChannel's (the step
+ * behind this gate) — the gate asks nothing when no channel is named.
  */
 export function newAuthorizeChannelAccessStep(
   authorizer: Authorizer,
 ): PipelineStep<typeof SessionQueryController.method.listByChannel.input> {
-  return {
-    name: "AuthorizeChannelAccess",
-    async execute(
-      ctx: RequestContext<
-        typeof SessionQueryController.method.listByChannel.input
-      >,
-    ): Promise<void> {
-      if (ctx.input.channelId === "") {
-        return;
-      }
-      await authorizeResolvedResource(
-        authorizer,
-        ctx.callerIdentity,
-        {
-          permission: IamPermission.can_view,
-          resourceKind: ApiResourceKind.agent_channel,
-          resourceId: ctx.input.channelId,
-        },
-        "unauthorized to list channel conversations",
-      );
-    },
-  };
+  return newAuthorizeResolvedTargetStep(
+    authorizer,
+    ({ input }) =>
+      input.channelId === ""
+        ? []
+        : [
+            {
+              permission: IamPermission.can_view,
+              resourceKind: ApiResourceKind.agent_channel,
+              resourceId: input.channelId,
+              deniedMessage: "unauthorized to list channel conversations",
+            },
+          ],
+    "AuthorizeChannelAccess",
+  );
 }
 
 /**