@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/src/domain/workflowinstance/controller.ts

@@ -53,11 +53,11 @@ import type { PipelineStep } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
-import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
-  newAuthorizeVisibilityTransitionStep,
-  newGuardPublicVisibilityStep,
-} from "../../pipeline/steps/visibility-gates.js";
+  loadedTargetAsMethod,
+  newAuthorizeResolvedTargetStep,
+} from "../../pipeline/steps/authorize-resolved-target.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import {
   newBuildNewStateStep,
   setAuditFieldsForUpdate,
@@ -87,7 +87,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -108,6 +111,7 @@ import {
   newRejectDefaultWorkflowInstanceVisibilityUpdateStep,
   newValidateInstanceUpdateStep,
   newValidateSameOrgBusinessRuleStep,
+  resolveWorkflowInstanceCreateTargets,
 } from "./steps.js";
 import type { ParentWorkflowLoaderProvider } from "./steps.js";
 
@@ -182,12 +186,20 @@ async function createInstance(
     .addStep(newValidateVisibilityStep())
     .addStep(newResolveSlugStep())
     .addStep(newLoadParentWorkflowStep(deps.parentWorkflowLoader, deps.logger))
+    // Before the same-org rule, whose refusal names the parent's organization
+    // (steps.ts, resolveWorkflowInstanceCreateTargets).
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        resolveWorkflowInstanceCreateTargets,
+      ),
+    )
     .addStep(newValidateSameOrgBusinessRuleStep(deps.logger))
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
-    .addStep(newGuardPublicVisibilityStep(deps.authorizer))
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -236,6 +248,7 @@ async function update(
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newIndexSearchStep(
@@ -394,12 +407,6 @@ async function updateVisibility(
       ),
     )
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_INSTANCE_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newSetInstanceVisibilityStep())
     .addStep(
       newPersistInstanceStep(
@@ -707,6 +714,12 @@ async function getByReference(
     )
     .addStep(newValidateProtoStep())
     .addStep(newLoadByReferenceStep(deps.store, WorkflowInstanceSchema))
+    .addStep(
+      newAuthorizeResolvedTargetStep(
+        deps.authorizer,
+        loadedTargetAsMethod(WorkflowInstanceQueryController.method.get),
+      ),
+    )
     .build()
     .execute(reqCtx);
   return reqCtx.get(TARGET_RESOURCE_KEY) as WorkflowInstance;

package/src/domain/workflowinstance/steps.ts

@@ -16,8 +16,10 @@ import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/ap
 import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import type { WorkflowInstance } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { isDefaultInstance } from "../../pipeline/apiresource-labels.js";
 import {
   failedPreconditionError,
@@ -27,6 +29,7 @@ import {
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { rejectDefaultInstanceVisibilityUpdate } from "../../pipeline/steps/validate-visibility.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
@@ -72,7 +75,8 @@ export function newLoadParentWorkflowStep(
         parent = await loaderProvider().get(workflowId);
       } catch (error) {
         logger.warn("Parent workflow not found", {
-          error: error instanceof ConnectError ? error.rawMessage : String(error),
+          error:
+            error instanceof ConnectError ? error.rawMessage : String(error),
           workflowId,
         });
         throw notFoundError("Workflow", workflowId);
@@ -83,6 +87,50 @@ export function newLoadParentWorkflowStep(
   };
 }
 
+/** The deny copy of the parent's bar, the Java WorkflowInstanceCreateHandler's. */
+export const WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE =
+  "You don't have permission to create instances of this workflow";
+
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after LoadParentWorkflow and BEFORE ValidateSameOrgBusinessRule (whose
+ * refusal names the parent's organization, which a refused caller should
+ * not learn). The RPC is is_skip_authorization because its target is the
+ * PARENT, loaded from spec.workflow_id, not a request field.
+ *
+ * One question: may the caller run this workflow (can_execute on the
+ * parent, the relation the run gate asks; the same-org rule already binds
+ * the instance's organization to the workflow's, so there is no separate
+ * organization bar). A DEFAULT instance asks nothing, for the reason its
+ * agent twin gives (agentinstance/steps.ts): it is the workflow's row,
+ * composed by the server for the run's human, keyed on the in-process
+ * origin, the reserved label and the parent's organization together.
+ */
+export function resolveWorkflowInstanceCreateTargets(
+  ctx: RequestContext<InstanceDesc>,
+): ReadonlyArray<AuthorizationTarget> {
+  const parent = ctx.get(PARENT_WORKFLOW_KEY) as Workflow | undefined;
+  if (parent === undefined) {
+    throw new Error("parent workflow not found in context");
+  }
+  const metadata = ctx.newState.metadata;
+  if (
+    isDefaultInstance(metadata) &&
+    isServerComposedRequest(ctx.callerIdentity) &&
+    (metadata?.org ?? "") === (parent.metadata?.org ?? "")
+  ) {
+    return [];
+  }
+  return [
+    {
+      permission: IamPermission.can_execute,
+      resourceKind: ApiResourceKind.workflow,
+      resourceId: parent.metadata?.id ?? "",
+      deniedMessage: WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE,
+    },
+  ];
+}
+
 /**
  * ValidateSameOrgBusinessRule — create.go: instances must live in the same
  * organization as the parent workflow; cross-org instances could leak

package/src/extensions/__tests__/built-in-authorization-composed.test.ts

@@ -16,8 +16,9 @@
  *     outsider on an EXISTING resource hears PERMISSION_DENIED, the
  *     cloud's answer; `findMyOrganizations` lists what a person may view
  *     and `find` refuses enumeration; `checkMyPermission` tells the truth;
- *     nobody sets public visibility; an unprovisioned subject
- *     writes nothing until provisioned. The LIST lanes are a member's
+ *     the retired public level is refused for the founder too, as an
+ *     invalid level and not a permission question; an unprovisioned
+ *     subject writes nothing until provisioned. The LIST lanes are a member's
  *     lists: an outsider lists nothing of an organization they hold no
  *     row in; environments and API keys are their owner's even to the
  *     organization's owner; the library (a search) omits a private agent
@@ -26,8 +27,9 @@
  *     provisioned.
  *   - trusted-local: the permissive default stays (one caller,
  *     nothing to separate; the laptop's rows are stamped `"system"`):
- *     tokenless reads, public visibility and organization enumeration all
- *     keep working.
+ *     tokenless reads and organization enumeration keep working, and
+ *     the retired public level is refused here exactly as it is under
+ *     every other posture (the level is gone, not gated).
  *   - a unit's own Authorizer: nothing built in is installed; the unit's
  *     answer stands even against the founder.
  *
@@ -80,7 +82,6 @@ import { loadConfig } from "../../boot/config.js";
 import { composeServer } from "../../boot/compose.js";
 import type { ComposedServer } from "../../boot/compose.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
-import { PUBLIC_VISIBILITY_DENY_MESSAGE } from "../../pipeline/steps/visibility-gates.js";
 import type { Store } from "../../store/interface.js";
 import type { Authorizer } from "../authorizer.js";
 import type { ListReadScope } from "../list-read-scope.js";
@@ -132,6 +133,15 @@ function organizationInput(slug: string) {
   };
 }
 
+/**
+ * The one sentence for a level a kind does not support, as the agent chain
+ * answers it (pipeline/steps/validate-visibility.ts builds it from the
+ * kind's config); pinned as bytes because clients render it.
+ */
+const PUBLIC_LEVEL_REFUSED_FOR_AGENT =
+  "agent resources cannot be set to visibility_public. " +
+  "Supported visibility levels: visibility_private, visibility_org, visibility_platform.";
+
 function agentInput(
   name: string,
   visibility: ApiResourceVisibility,
@@ -377,14 +387,14 @@ describe("built-in authorizer (composed server, OIDC with no unit Authorizer: th
     );
   });
 
-  it("nobody sets PUBLIC visibility on an enforcing self-host — the platform gate denies the founder with the policy copy", async () => {
+  it("the retired public level is refused for the founder as an invalid level, before any permission question", async () => {
     const failure = await failureOf(
       createClient(AgentCommandController, asFounder()).create(
         agentInput("Public Agent", ApiResourceVisibility.visibility_public),
       ),
     );
-    expect(failure.code).toBe(Code.PermissionDenied);
-    expect(failure.rawMessage).toBe(PUBLIC_VISIBILITY_DENY_MESSAGE);
+    expect(failure.code).toBe(Code.InvalidArgument);
+    expect(failure.rawMessage).toBe(PUBLIC_LEVEL_REFUSED_FOR_AGENT);
   });
 
   describe("the list lanes (the built-in ListReadScope)", () => {
@@ -595,20 +605,18 @@ describe("built-in authorizer (composed server, trusted-local: the permissive de
     expect(read.metadata?.id).toBe(created.metadata!.id);
   });
 
-  it("the laptop keeps public visibility and organization enumeration — no directory, no platform gate that bites", async () => {
+  it("the laptop keeps organization enumeration and refuses the retired public level like every posture — the level is gone, not gated", async () => {
     const anonymous = transportFor(port);
-    const publicAgent = await createClient(
-      AgentCommandController,
-      anonymous,
-    ).create(
-      agentInput(
-        "Public Laptop Agent",
-        ApiResourceVisibility.visibility_public,
+    const failure = await failureOf(
+      createClient(AgentCommandController, anonymous).create(
+        agentInput(
+          "Public Laptop Agent",
+          ApiResourceVisibility.visibility_public,
+        ),
       ),
     );
-    expect(publicAgent.metadata?.visibility).toBe(
-      ApiResourceVisibility.visibility_public,
-    );
+    expect(failure.code).toBe(Code.InvalidArgument);
+    expect(failure.rawMessage).toBe(PUBLIC_LEVEL_REFUSED_FOR_AGENT);
     const all = await createClient(OrganizationQueryController, anonymous).find(
       { org: ORG },
     );
@@ -617,6 +625,11 @@ describe("built-in authorizer (composed server, trusted-local: the permissive de
 
   it("the laptop's lists are the full scan — no scope composed, the rows stamped `system` included", async () => {
     const anonymous = transportFor(port);
+    // A second agent beside the private one the earlier test created, so
+    // the search below proves a scan and not a single-row coincidence.
+    await createClient(AgentCommandController, anonymous).create(
+      agentInput("Second Laptop Agent", ApiResourceVisibility.visibility_org),
+    );
     const environments = createClient(EnvironmentCommandController, anonymous);
     await environments.create(environmentInput("laptop env one"));
     await environments.create(environmentInput("laptop env two"));

package/src/extensions/__tests__/composed-support.ts

@@ -23,7 +23,7 @@
  */
 import path from "node:path";
 
-import type { DescService } from "@bufbuild/protobuf";
+import type { DescMethod, DescService } from "@bufbuild/protobuf";
 import type {
   ConnectRouter,
   Interceptor,
@@ -94,11 +94,30 @@ export function bearer(token: string): Interceptor {
 export function servedServices(
   routes: (router: ConnectRouter) => void,
 ): DescService[] {
-  const served: DescService[] = [];
+  return servedRegistrations(routes).map((r) => r.service);
+}
+
+/** One `router.service(desc, implementation)` registration, as replayed. */
+export interface ServedRegistration {
+  readonly service: DescService;
+  readonly implementation: Readonly<Record<string, unknown>>;
+}
+
+/**
+ * The registrations themselves, with each service's implementation map,
+ * for a reader that must know which of a service's methods are actually
+ * served: a partially implemented service (a method registered only when
+ * a composed capability carries it) lists the method on its descriptor
+ * and omits it from the map, and ConnectRPC answers UNIMPLEMENTED for it.
+ */
+export function servedRegistrations(
+  routes: (router: ConnectRouter) => void,
+): ServedRegistration[] {
+  const served: ServedRegistration[] = [];
   const recorder = {
     handlers: [],
-    service(desc: DescService) {
-      served.push(desc);
+    service(desc: DescService, implementation: Record<string, unknown>) {
+      served.push({ service: desc, implementation });
       return recorder;
     },
     rpc() {
@@ -109,6 +128,21 @@ export function servedServices(
   return served;
 }
 
+/** The methods a composed server actually serves: on a registered service AND in its implementation map. */
+export function servedMethods(
+  routes: (router: ConnectRouter) => void,
+): DescMethod[] {
+  const methods: DescMethod[] = [];
+  for (const { service, implementation } of servedRegistrations(routes)) {
+    for (const method of service.methods) {
+      if (method.localName in implementation) {
+        methods.push(method);
+      }
+    }
+  }
+  return methods;
+}
+
 /** A gRPC transport to the composed server on `port`, presenting `token` when given. */
 export function transportFor(port: number, token?: string): Transport {
   return createGrpcTransport({

package/src/extensions/__tests__/extension-composition.test.ts

@@ -1074,7 +1074,7 @@ describe("extension composition (C2 tuple lifecycle + organization directory)",
     });
   });
 
-  it("updateVisibility fires the set-diff transition (org→public keeps the floor)", async () => {
+  it("updateVisibility fires the set-diff transition (org→private deletes the org shape)", async () => {
     const command = createClient(AgentCommandController, portTransport);
     const agent = await command.create(
       create(AgentSchema, {
@@ -1091,12 +1091,12 @@ describe("extension composition (C2 tuple lifecycle + organization directory)",
     visibilityEvents.length = 0;
     await command.updateVisibility({
       resourceId: agent.metadata?.id ?? "",
-      visibility: ApiResourceVisibility.visibility_public,
+      visibility: ApiResourceVisibility.visibility_private,
     });
     expect(visibilityEvents).toHaveLength(1);
     const event = visibilityEvents[0]!;
-    expect(event.shapesToCreate).toEqual(["public-viewer"]);
-    expect(event.shapesToDelete).toEqual([]);
+    expect(event.shapesToCreate).toEqual([]);
+    expect(event.shapesToDelete).toEqual(["org-viewer"]);
   });
 
   it("delete fires the cleanup event; a cleanup failure never fails the delete", async () => {

package/src/extensions/__tests__/identity.test.ts

@@ -6,10 +6,20 @@
  * `create` RPC's admission rule (2a A7) and the three IamPolicy system
  * RPCs' (Q-OR-7). A wire `user`, `runner` or a composition's own class
  * (guest) is never one.
+ *
+ * Also pins `isServerComposedRequest`, the narrower predicate the label
+ * guard, the memory-capture gate, the execution-context create check and
+ * the default-instance arm of the instance creates share: `internal` or an
+ * in-process origin, and never a wire `machine` account — the one row
+ * where the two predicates part, pinned so a step trusting server-composed
+ * state can never be widened to the wire by picking the wrong one.
  */
 import { describe, expect, it } from "vitest";
 
-import { isPlatformPipelineCaller } from "../identity.js";
+import {
+  isPlatformPipelineCaller,
+  isServerComposedRequest,
+} from "../identity.js";
 import type { CallerIdentity } from "../identity.js";
 
 function caller(fields: Partial<CallerIdentity>): CallerIdentity {
@@ -60,3 +70,36 @@ describe("isPlatformPipelineCaller", () => {
     );
   });
 });
+
+describe("isServerComposedRequest", () => {
+  it("is true for the internal class and for any identity that entered in-process", () => {
+    expect(isServerComposedRequest(caller({ callerClass: "internal" }))).toBe(
+      true,
+    );
+    expect(
+      isServerComposedRequest(
+        caller({ callerClass: "user", origin: "in-process" }),
+      ),
+    ).toBe(true);
+    expect(
+      isServerComposedRequest(
+        caller({ callerClass: "channel", origin: "in-process" }),
+      ),
+    ).toBe(true);
+  });
+
+  it("is false for every wire caller, the machine class included — the row where it parts from isPlatformPipelineCaller", () => {
+    const wireMachine = caller({ callerClass: "machine" });
+    expect(isServerComposedRequest(wireMachine)).toBe(false);
+    expect(isPlatformPipelineCaller(wireMachine)).toBe(true);
+    expect(isServerComposedRequest(caller({ callerClass: "user" }))).toBe(
+      false,
+    );
+    expect(
+      isServerComposedRequest(caller({ callerClass: "user", origin: "wire" })),
+    ).toBe(false);
+    expect(isServerComposedRequest(caller({ callerClass: "runner" }))).toBe(
+      false,
+    );
+  });
+});

package/src/extensions/__tests__/list-read-scope-composed.test.ts

@@ -10,9 +10,16 @@
  *     narrows, blank spans orgs — lane 6),
  *   - activity.listRecentActivity (enumeration verb, two kinds — lane 22),
  *   - search (enumeration verb feeding the engine allowlist, and the
- *     crossOrgPublic bypass where FGA is never consulted — lane 21),
+ *     proof that no request shape bypasses it — lane 21),
  *   - the OUTAGE arm: a throwing scope answers the sanitized INTERNAL,
- *     never an empty (or full!) list.
+ *     never an empty (or full!) list;
+ *   - the SERVER'S OWN reads over `inProcessTransport` (stigmer#1207):
+ *     the bare in-process call is stamped `internal` and the helper
+ *     answers it before the scope — agentexecution.listBySession (the
+ *     lane every server-internal reader of a session's turns rides) and
+ *     workflowexecution.list with the org arm still applied; a caller
+ *     PROPAGATED through the in-process header keeps its class and is
+ *     narrowed exactly like the wire.
  *
  * Per-lane logic beyond the wiring is pinned in the helper matrix
  * (list-read-scope.test.ts), the summaries suite, and the store-contract
@@ -31,6 +38,8 @@ import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 
 import { ActivityQueryController } from "@stigmer/protos/ai/stigmer/activity/v1/query_pb";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
 import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
@@ -44,6 +53,11 @@ import { loadConfig } from "../../boot/config.js";
 import { composeServer } from "../../boot/compose.js";
 import type { ComposedServer } from "../../boot/compose.js";
 import { createLogger } from "../../boot/logger.js";
+import { testCallerIdentity } from "../../pipeline/__tests__/support.js";
+import {
+  IN_PROCESS_CALLER_HEADER,
+  encodeInProcessCaller,
+} from "../../pipeline/interceptors/auth.js";
 import type { ListReadScope } from "../list-read-scope.js";
 import type { ServerExtension } from "../registry.js";
 
@@ -133,6 +147,27 @@ describe("list read scope (composed server, fake scope)", () => {
         }),
       );
     }
+    // Two turns of one session — the rows a server-internal reader of a
+    // conversation's executions asks listBySession for.
+    for (const id of ["aex_turn_1", "aex_turn_2"]) {
+      await server.store.saveResource(
+        ApiResourceKind.agent_execution,
+        id,
+        AgentExecutionSchema,
+        create(AgentExecutionSchema, {
+          apiVersion: "agentic.stigmer.ai/v1",
+          kind: "AgentExecution",
+          metadata: { id, name: id, org: "acme" },
+          spec: { sessionId: "ses_mine" },
+          status: {
+            audit: {
+              specAudit: { createdAt: { seconds: 1_700_000_000n } },
+              statusAudit: { updatedAt: { seconds: 1_700_000_000n } },
+            },
+          },
+        }),
+      );
+    }
     for (const [id, org] of [
       ["wfe_mine", "acme"],
       ["wfe_other_org", "rival"],
@@ -242,20 +277,23 @@ describe("list read scope (composed server, fake scope)", () => {
     ]);
   });
 
-  it("search narrows through the engine allowlist; crossOrgPublic bypasses the scope (lane 21)", async () => {
+  it("search narrows through the engine allowlist on every request shape — nothing bypasses the scope (lane 21)", async () => {
     allowed = new Set(["agt_mine"]);
     const search = createClient(SearchService, transport);
     const scoped = await search.search({ query: "scopedagent" });
     expect(scoped.entries.map((e) => e.id)).toEqual(["agt_mine"]);
 
-    // The Java bypass: public-widened discovery never consults FGA.
+    // The org-filtered shape asks the scope too: the one request shape
+    // that once skipped it (the retired public level's cross-organization
+    // discovery) no longer exists on the wire.
     seenKinds.length = 0;
-    await search.search({
+    const orgScoped = await search.search({
+      kinds: [ApiResourceKind.agent],
       query: "scopedagent",
       org: "acme",
-      crossOrgPublic: true,
     });
-    expect(seenKinds).toEqual([]);
+    expect(orgScoped.entries.map((e) => e.id)).toEqual(["agt_mine"]);
+    expect(seenKinds).toEqual([ApiResourceKind.agent]);
   });
 
   it("a scope outage answers the sanitized INTERNAL — never an unscoped or empty success", async () => {
@@ -273,4 +311,55 @@ describe("list read scope (composed server, fake scope)", () => {
     const list = await query.list({});
     expect(list.entries).toEqual([]);
   });
+
+  describe("the server's own reads over the in-process transport (stigmer#1207)", () => {
+    it("agentexecution.listBySession, bare: every turn of the session, the scope never asked", async () => {
+      // The scope would hide everything if it were asked.
+      allowed = new Set();
+      const query = createClient(
+        AgentExecutionQueryController,
+        server.inProcessTransport,
+      );
+      const turns = await query.listBySession({ sessionId: "ses_mine" });
+      expect(turns.entries.map((e) => e.metadata?.id).sort()).toEqual([
+        "aex_turn_1",
+        "aex_turn_2",
+      ]);
+      expect(seenKinds).toEqual([]);
+    });
+
+    it("a caller propagated through the in-process header keeps its class and is narrowed like the wire", async () => {
+      allowed = new Set(["aex_turn_2"]);
+      const query = createClient(
+        AgentExecutionQueryController,
+        server.inProcessTransport,
+      );
+      const turns = await query.listBySession(
+        { sessionId: "ses_mine" },
+        {
+          headers: {
+            [IN_PROCESS_CALLER_HEADER]: encodeInProcessCaller(
+              testCallerIdentity({ identityId: "alice" }),
+            ),
+          },
+        },
+      );
+      expect(turns.entries.map((e) => e.metadata?.id)).toEqual(["aex_turn_2"]);
+      expect(seenKinds).toEqual([ApiResourceKind.agent_execution]);
+    });
+
+    it("workflowexecution.list, bare: the request's org predicate still applies, the scope never asked", async () => {
+      allowed = new Set();
+      const query = createClient(
+        WorkflowExecutionQueryController,
+        server.inProcessTransport,
+      );
+      const acme = await query.list({ org: "acme" });
+      expect(acme.entries.map((e) => e.metadata?.id).sort()).toEqual([
+        "wfe_foreign",
+        "wfe_mine",
+      ]);
+      expect(seenKinds).toEqual([]);
+    });
+  });
 });

package/src/extensions/__tests__/list-read-scope.test.ts

@@ -12,6 +12,11 @@
  *     20260913.04 T02 the scope is the last per-row predicate, so it is
  *     offered the org's rows and never the kind's — the same result set,
  *     a fraction of the candidates);
+ *   - the `internal` class — the server acting as itself — gets the
+ *     org-narrowed rows and the scope is never asked (the Authorize
+ *     step's trust-domain rule on a list answer, stigmer#1207); the rule
+ *     is class-only, so a caller PROPAGATED through the in-process
+ *     transport (its own class, origin in-process) is still narrowed;
  *   - the candidates carry {id, org, labels} — the driver's guest
  *     cookie rule keys on labels — and the row's AUTHORIZATION FACTS
  *     (creator stamp, visibility level, every parent link), read by the
@@ -160,6 +165,64 @@ describe("restrictListByReadScope", () => {
     ]);
   });
 
+  describe("the internal class — the server acting as itself (stigmer#1207)", () => {
+    /** A scope that must never be reached: any call is the failure under test. */
+    const neverAsked: ListReadScope = {
+      authorizedResourceIds: () =>
+        Promise.reject(new Error("the scope was asked for the internal class")),
+      restrictListEntries: () =>
+        Promise.reject(new Error("the scope was asked for the internal class")),
+    };
+    const internal = testCallerIdentity({
+      identityId: "system",
+      callerClass: "internal",
+      origin: "in-process",
+    });
+
+    it("gets the org-narrowed rows in the lane's order; the scope is never asked", async () => {
+      const withOrg = await restrictListByReadScope(
+        neverAsked,
+        internal,
+        ApiResourceKind.session,
+        rows,
+        "acme",
+      );
+      // The request's org predicate still applies — it is the request's,
+      // not the caller's; only the caller predicate is skipped.
+      expect(withOrg.map((r) => r.metadata.id)).toEqual(["ses_a", "ses_b"]);
+      const blankOrg = await restrictListByReadScope(
+        neverAsked,
+        internal,
+        ApiResourceKind.session,
+        rows,
+        "",
+      );
+      expect(blankOrg.map((r) => r.metadata.id)).toEqual([
+        "ses_a",
+        "ses_b",
+        "ses_c",
+      ]);
+      // A fresh array either way, as every arm of the helper returns.
+      expect(blankOrg).not.toBe(rows);
+    });
+
+    it("the rule is class-only: a caller propagated through the in-process transport keeps its class and is still narrowed", async () => {
+      const propagated = testCallerIdentity({
+        identityId: "alice",
+        callerClass: "user",
+        origin: "in-process",
+      });
+      const kept = await restrictListByReadScope(
+        scopeKeeping(["ses_c"]),
+        propagated,
+        ApiResourceKind.session,
+        rows,
+        "",
+      );
+      expect(kept.map((r) => r.metadata.id)).toEqual(["ses_c"]);
+    });
+  });
+
   it("an empty kept set is a real answer — the empty list", async () => {
     const kept = await restrictListByReadScope(
       scopeKeeping([]),