@stigmer/server 3.22.0 → 3.22.1-dev.20260922095755

package/src/domain/mcpserver/__tests__/mcpserver.test.ts

@@ -41,7 +41,11 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 
-const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
 
 const API_VERSION = "agentic.stigmer.ai/v1";
 const KIND = "McpServer";
@@ -128,7 +132,11 @@ function serverInput(overrides?: {
   };
 }
 
-async function expectCode(promise: Promise<unknown>, code: Code, arm: string): Promise<ConnectError> {
+async function expectCode(
+  promise: Promise<unknown>,
+  code: Code,
+  arm: string,
+): Promise<ConnectError> {
   try {
     await promise;
   } catch (error) {
@@ -157,7 +165,10 @@ async function seedCapabilities(
     serverId,
     McpServerSchema,
   );
-  const patched = fromBinary(McpServerSchema, toBinary(McpServerSchema, stored));
+  const patched = fromBinary(
+    McpServerSchema,
+    toBinary(McpServerSchema, stored),
+  );
   patched.status ??= create(McpServerStatusSchema, {});
   patched.status.discoveredCapabilities = create(DiscoveredCapabilitiesSchema, {
     tools: tools.map((name) => ({ name })),
@@ -176,13 +187,19 @@ describe("CRUD", () => {
     const created = await command.create(serverInput({ name: "GitHub Tools" }));
     expect(created.metadata?.id).toMatch(/^mcp_[0-9a-z]{26}$/);
     expect(created.metadata?.slug).toBe("github-tools");
-    expect(created.metadata?.visibility).toBe(ApiResourceVisibility.visibility_org);
+    expect(created.metadata?.visibility).toBe(
+      ApiResourceVisibility.visibility_org,
+    );
   });
 
   it("rejects a duplicate create by slug within the org; a different org reuses the slug", async () => {
     const name = `Dup Target ${++counter}`;
     await command.create(serverInput({ name }));
-    await expectCode(command.create(serverInput({ name })), Code.AlreadyExists, "duplicate create");
+    await expectCode(
+      command.create(serverInput({ name })),
+      Code.AlreadyExists,
+      "duplicate create",
+    );
     const other = await command.create(serverInput({ name, org: "other-org" }));
     expect(other.metadata?.org).toBe("other-org");
   });
@@ -201,10 +218,17 @@ describe("CRUD", () => {
   it("get and getByReference resolve the same resource; unknowns answer NotFound", async () => {
     const created = await command.create(serverInput());
     const byId = await query.get({ value: created.metadata!.id });
-    const byRef = await query.getByReference({ org: ORG, slug: created.metadata!.slug });
+    const byRef = await query.getByReference({
+      org: ORG,
+      slug: created.metadata!.slug,
+    });
     expect(byId.metadata?.id).toBe(created.metadata?.id);
     expect(byRef.metadata?.id).toBe(created.metadata?.id);
-    await expectCode(query.get({ value: "mcps_missing" }), Code.NotFound, "get unknown");
+    await expectCode(
+      query.get({ value: "mcps_missing" }),
+      Code.NotFound,
+      "get unknown",
+    );
     await expectCode(
       query.getByReference({ org: ORG, slug: "never-created" }),
       Code.NotFound,
@@ -216,7 +240,11 @@ describe("CRUD", () => {
     const created = await command.create(serverInput());
     const deleted = await command.delete({ resourceId: created.metadata!.id });
     expect(deleted.metadata?.id).toBe(created.metadata?.id);
-    await expectCode(query.get({ value: created.metadata!.id }), Code.NotFound, "get after delete");
+    await expectCode(
+      query.get({ value: created.metadata!.id }),
+      Code.NotFound,
+      "get after delete",
+    );
   });
 
   it("update of a non-existent server and delete of a non-existent server answer NotFound; delete with an empty id is InvalidArgument", async () => {
@@ -233,7 +261,11 @@ describe("CRUD", () => {
       Code.NotFound,
       "delete non-existent",
     );
-    await expectCode(command.delete({}), Code.InvalidArgument, "delete empty id");
+    await expectCode(
+      command.delete({}),
+      Code.InvalidArgument,
+      "delete empty id",
+    );
   });
 });
 
@@ -244,13 +276,17 @@ describe("updateVisibility (no conformance coverage for this domain — the D4-d
       resourceId: created.metadata!.id,
       visibility: ApiResourceVisibility.visibility_private,
     });
-    expect(updated.metadata?.visibility).toBe(ApiResourceVisibility.visibility_private);
+    expect(updated.metadata?.visibility).toBe(
+      ApiResourceVisibility.visibility_private,
+    );
     expect(updated.spec?.description).toBe(created.spec?.description);
     // A visibility change is a STATUS mutation: status_audit re-stamped
     // (updated event, fresh timestamp bounds are creation-or-later),
     // spec_audit byte-untouched.
     expect(updated.status?.audit?.statusAudit?.event).toBe("updated");
-    expect(updated.status?.audit?.specAudit).toEqual(created.status?.audit?.specAudit);
+    expect(updated.status?.audit?.specAudit).toEqual(
+      created.status?.audit?.specAudit,
+    );
   });
 
   it("answers NotFound for an unknown id", async () => {
@@ -296,7 +332,9 @@ describe("ValidateDefaultEnabledTools (#402)", () => {
   it("accepts names the server exposes; skips when the list is empty or the server never connected", async () => {
     // Never connected: any names pass (no authoritative toolset yet).
     const fresh = await command.create(serverInput());
-    const freshUpdate = await command.update(updateInput(fresh, ["anything-goes"]));
+    const freshUpdate = await command.update(
+      updateInput(fresh, ["anything-goes"]),
+    );
     expect(freshUpdate.spec?.defaultEnabledTools).toEqual(["anything-goes"]);
 
     // Connected: valid names pass.
@@ -308,7 +346,11 @@ describe("ValidateDefaultEnabledTools (#402)", () => {
 
   it("rejects unknown tools and resource templates with the byte-pinned teaching copy", async () => {
     const created = await command.create(serverInput());
-    await seedCapabilities(created.metadata!.id, ["search", "fetch"], ["files"]);
+    await seedCapabilities(
+      created.metadata!.id,
+      ["search", "fetch"],
+      ["files"],
+    );
 
     const err = await expectCode(
       command.update(updateInput(created, ["serch", "files"])),
@@ -334,7 +376,10 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
       OAuthAppSchema,
       create(OAuthAppSchema, {
         metadata: { id, org: ORG, slug, name: slug },
-        spec: { vendorApprovalStatus: approval, vendorApprovalDocsUrl: docsUrl },
+        spec: {
+          vendorApprovalStatus: approval,
+          vendorApprovalDocsUrl: docsUrl,
+        },
       }),
     );
   }
@@ -346,14 +391,25 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   });
 
   it("a missing OAuthApp skips enrichment (the initiate path owns refusing)", async () => {
-    const created = await command.create(serverInput({ oauthAppSlug: "never-applied" }));
+    // The app must exist when the server is written (the reference rule);
+    // a reference dangles when its target leaves afterwards.
+    await seedOAuthApp("never-applied", VendorApprovalStatus.UNSPECIFIED, "");
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "never-applied" }),
+    );
+    await server.store.deleteResource(
+      ApiResourceKind.oauth_app,
+      "oaa_neverapplied",
+    );
     const got = await query.get({ value: created.metadata!.id });
     expect(got.status?.oauthStatus).toBeUndefined();
   });
 
   it("nothing-to-report means ABSENT — presence itself is the SDK's signal", async () => {
     await seedOAuthApp("plain-app", VendorApprovalStatus.UNSPECIFIED, "");
-    const created = await command.create(serverInput({ oauthAppSlug: "plain-app" }));
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "plain-app" }),
+    );
     const got = await query.get({ value: created.metadata!.id });
     expect(got.status?.oauthStatus).toBeUndefined();
   });
@@ -363,24 +419,42 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   // alone must enrich (Go enrich_oauth_status_test.go's docs-only and
   // status-only arms — the executable spec of the #523 shared contract).
   it("a docs URL ALONE enriches, even with an UNSPECIFIED approval status", async () => {
-    await seedOAuthApp("docs-only-app", VendorApprovalStatus.UNSPECIFIED, "https://vendor.example/setup");
-    const created = await command.create(serverInput({ oauthAppSlug: "docs-only-app" }));
+    await seedOAuthApp(
+      "docs-only-app",
+      VendorApprovalStatus.UNSPECIFIED,
+      "https://vendor.example/setup",
+    );
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "docs-only-app" }),
+    );
     const got = await query.get({ value: created.metadata!.id });
-    expect(got.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.UNSPECIFIED);
-    expect(got.status?.oauthStatus?.vendorApprovalDocsUrl).toBe("https://vendor.example/setup");
+    expect(got.status?.oauthStatus?.vendorApprovalStatus).toBe(
+      VendorApprovalStatus.UNSPECIFIED,
+    );
+    expect(got.status?.oauthStatus?.vendorApprovalDocsUrl).toBe(
+      "https://vendor.example/setup",
+    );
   });
 
   it("a non-default approval status ALONE enriches — REJECTED and even APPROVED are reported", async () => {
     await seedOAuthApp("rejected-app", VendorApprovalStatus.REJECTED, "");
-    const rejected = await command.create(serverInput({ oauthAppSlug: "rejected-app" }));
+    const rejected = await command.create(
+      serverInput({ oauthAppSlug: "rejected-app" }),
+    );
     const gotRejected = await query.get({ value: rejected.metadata!.id });
-    expect(gotRejected.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.REJECTED);
+    expect(gotRejected.status?.oauthStatus?.vendorApprovalStatus).toBe(
+      VendorApprovalStatus.REJECTED,
+    );
     expect(gotRejected.status?.oauthStatus?.vendorApprovalDocsUrl).toBe("");
 
     await seedOAuthApp("approved-app", VendorApprovalStatus.APPROVED, "");
-    const approved = await command.create(serverInput({ oauthAppSlug: "approved-app" }));
+    const approved = await command.create(
+      serverInput({ oauthAppSlug: "approved-app" }),
+    );
     const gotApproved = await query.get({ value: approved.metadata!.id });
-    expect(gotApproved.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.APPROVED);
+    expect(gotApproved.status?.oauthStatus?.vendorApprovalStatus).toBe(
+      VendorApprovalStatus.APPROVED,
+    );
   });
 
   it("an auth block WITHOUT an oauth_app_ref (the DCR arm) is untouched", async () => {
@@ -391,8 +465,14 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   });
 
   it("a gating approval status or docs URL enriches BOTH read paths, response-only", async () => {
-    await seedOAuthApp("gated-app", VendorApprovalStatus.PENDING, "https://vendor.example/approval");
-    const created = await command.create(serverInput({ oauthAppSlug: "gated-app" }));
+    await seedOAuthApp(
+      "gated-app",
+      VendorApprovalStatus.PENDING,
+      "https://vendor.example/approval",
+    );
+    const created = await command.create(
+      serverInput({ oauthAppSlug: "gated-app" }),
+    );
 
     for (const loaded of [
       await query.get({ value: created.metadata!.id }),
@@ -430,7 +510,12 @@ describe("org-OAuth-app surface — UNIMPLEMENTED by design (#558, DD-019)", ()
     expect(getErr.rawMessage).toBe("method GetOrgOAuthApp not implemented");
 
     const setErr = await expectCode(
-      command.setOrgOAuthApp({ resourceId: "mcps_test", org: ORG, clientId: "x", clientSecret: "y" }),
+      command.setOrgOAuthApp({
+        resourceId: "mcps_test",
+        org: ORG,
+        clientId: "x",
+        clientSecret: "y",
+      }),
       Code.Unimplemented,
       "setOrgOAuthApp",
     );
@@ -441,6 +526,8 @@ describe("org-OAuth-app surface — UNIMPLEMENTED by design (#558, DD-019)", ()
       Code.Unimplemented,
       "deleteOrgOAuthApp",
     );
-    expect(deleteErr.rawMessage).toBe("method DeleteOrgOAuthApp not implemented");
+    expect(deleteErr.rawMessage).toBe(
+      "method DeleteOrgOAuthApp not implemented",
+    );
   });
 });

package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts

@@ -41,7 +41,11 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 
-const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
 
 const REDIRECT_URI = "http://127.0.0.1:8234/auth/oauth/callback";
 const ORG = "acme";
@@ -368,20 +372,30 @@ describe("initiateOAuthConnect", () => {
       "OAuth sign-in is unavailable: the platform's OAuth app for 'exampleco' is pending approval by the vendor. This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.",
     ],
   ];
-  it.each(refusals)("vendor arm refuses %s", async (_label, status, oauthOnly, copy) => {
-    const slug = `vendor-${status}-${oauthOnly ? "only" : "manual"}`;
-    await seedOAuthApp(slug, status);
-    const id = await applyServer({ vendorSlug: slug, oauthOnly });
-    const error = await expectCode(
-      command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
-      Code.FailedPrecondition,
-      copy,
-    );
-    expect(error.rawMessage).toBe(copy);
-  });
+  it.each(refusals)(
+    "vendor arm refuses %s",
+    async (_label, status, oauthOnly, copy) => {
+      const slug = `vendor-${status}-${oauthOnly ? "only" : "manual"}`;
+      await seedOAuthApp(slug, status);
+      const id = await applyServer({ vendorSlug: slug, oauthOnly });
+      const error = await expectCode(
+        command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
+        Code.FailedPrecondition,
+        copy,
+      );
+      expect(error.rawMessage).toBe(copy);
+    },
+  );
 
   it("vendor arm answers NotFound for an unresolvable oauth_app_ref", async () => {
+    // The app must exist when the server is written (the reference rule);
+    // the reference becomes unresolvable when its target leaves afterwards.
+    await seedOAuthApp("no-such-app", VendorApprovalStatus.APPROVED);
     const id = await applyServer({ vendorSlug: "no-such-app" });
+    await server.store.deleteResource(
+      ApiResourceKind.oauth_app,
+      "oap_no-such-app",
+    );
     await expectCode(
       command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
       Code.NotFound,
@@ -406,17 +420,29 @@ describe("initiateOAuthConnect", () => {
 describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", () => {
   it("guards its inputs (proto rules answer first, exactly as on Go)", async () => {
     await expectCode(
-      command.completeOAuthConnect({ mcpServerId: "", state: "s", authorizationCode: "c" }),
+      command.completeOAuthConnect({
+        mcpServerId: "",
+        state: "s",
+        authorizationCode: "c",
+      }),
       Code.InvalidArgument,
       "mcp_server_id: value is required [required]",
     );
     await expectCode(
-      command.completeOAuthConnect({ mcpServerId: "m", state: "", authorizationCode: "c" }),
+      command.completeOAuthConnect({
+        mcpServerId: "m",
+        state: "",
+        authorizationCode: "c",
+      }),
       Code.InvalidArgument,
       "state:",
     );
     await expectCode(
-      command.completeOAuthConnect({ mcpServerId: "m", state: "s", authorizationCode: "" }),
+      command.completeOAuthConnect({
+        mcpServerId: "m",
+        state: "s",
+        authorizationCode: "",
+      }),
       Code.InvalidArgument,
       "authorization_code:",
     );
@@ -500,7 +526,10 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
 
     // The grant is queryable and HEALTHY; the refresh-token env var is
     // stamped unconditionally (oss#863's precondition, ported as-is).
-    const status = await query.getOAuthGrantStatus({ resourceId: id, org: ORG });
+    const status = await query.getOAuthGrantStatus({
+      resourceId: id,
+      org: ORG,
+    });
     expect(status.connected).toBe(true);
     expect(status.targetEnvVar).toBe("EXAMPLE_TOKEN");
     expect(status.authMethod).toBe("mcp_oauth");
@@ -514,7 +543,10 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
     expect(firstEnvId).not.toBe("");
 
     // Re-connect reuses the managed environment.
-    const again = await command.initiateOAuthConnect({ mcpServerId: id, org: ORG });
+    const again = await command.initiateOAuthConnect({
+      mcpServerId: id,
+      org: ORG,
+    });
     await command.completeOAuthConnect({
       mcpServerId: id,
       state: again.state,
@@ -525,7 +557,10 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
 
     // Disconnect tears down grant + environment; a second disconnect is
     // the idempotent no-grant arm.
-    const disconnected = await command.disconnectOAuth({ resourceId: id, org: ORG });
+    const disconnected = await command.disconnectOAuth({
+      resourceId: id,
+      org: ORG,
+    });
     expect(disconnected.disconnected).toBe(true);
     expect(await server.store.oauthGrants.find("", id, ORG)).toBeUndefined();
     const againDisconnected = await command.disconnectOAuth({

package/src/domain/mcpserver/controller.ts

@@ -58,10 +58,6 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
-import {
-  newAuthorizeVisibilityTransitionStep,
-  newGuardPublicVisibilityStep,
-} from "../../pipeline/steps/visibility-gates.js";
 import {
   setAuditFieldsForUpdate,
   newBuildNewStateStep,
@@ -92,7 +88,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -241,13 +240,13 @@ async function createMcpServer(
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
-    .addStep(newGuardPublicVisibilityStep(deps.authorizer))
     // A URL-only server is asked once whether it wants OAuth and completed
     // when it does; immediately before GuardReservedLabels because the
     // provenance label it stamps is one the guard diffs.
     .addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps)))
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -300,6 +299,7 @@ async function update(
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newValidateDefaultEnabledToolsStep())
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newIndexSearchStep(deps.store, mcpServerSearchExtractor, deps.logger),
@@ -463,12 +463,6 @@ async function updateVisibility(
       newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY),
     )
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_MCP_SERVER_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newSetMcpServerVisibilityStep())
     .addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store))
     .addStep(

package/src/domain/plugin/controller.ts

@@ -103,7 +103,6 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import type { VersionHistoryBinding } from "../../pipeline/steps/version-history.js";
-import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
 import type { Store } from "../../store/interface.js";
 import { uploadUrl } from "../skill/transfer/handler.js";
@@ -226,7 +225,7 @@ async function push(
     .addStep(newParseOverlayDocumentsStep())
     .addStep(newSanitizePluginMetadataStep(deps.authorizer))
     .addStep(newPlanMaterializationStep(deps.store, deps.authorizer))
-    .addStep(newGuardPluginVisibilityStep(deps.authorizer))
+    .addStep(newGuardPluginVisibilityStep())
     .addStep(newResolveConvergenceStep())
     .build()
     .execute(reqCtx);
@@ -359,12 +358,6 @@ async function updateVisibility(
     .addStep(newLoadPluginByIdStep(deps.store, UPDATE_VISIBILITY_PLUGIN_KEY))
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY))
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_PLUGIN_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newSetPluginVisibilityStep())
     .addStep(
       newPersistPluginStep(

package/src/domain/plugin/push.ts

@@ -94,7 +94,6 @@ import { ARTIFACT_BYTES_KEY } from "../../pipeline/steps/resolve-artifact-source
 import { generateSlug } from "../../pipeline/steps/slug.js";
 import { rejectUnsupportedVisibility } from "../../pipeline/steps/validate-visibility.js";
 import { newArchiveCurrentVersionStep } from "../../pipeline/steps/version-archive.js";
-import { requireOperatorMaySetPublic } from "../../pipeline/steps/visibility-gates.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { openPluginArchive } from "./archive.js";
@@ -493,30 +492,23 @@ export function newPlanMaterializationStep(
 
 /**
  * GuardPluginVisibility — the requested level must be one the plugin and
- * every planned member kind support, and PUBLIC needs the operator grant
- * (the one owner of that question, shared with every other create door).
- * Each member's own chain will check again in-process; refusing here keeps
- * the head from being written before the answer is known.
+ * every planned member kind support: the push chain's counterpart of the
+ * ValidateVisibility step on the resource create chains, asked here for
+ * the head and for each member kind before anything is written, so a
+ * plugin cannot be installed at a level one of its members may not hold.
+ * Each member's own chain checks again in-process; refusing here keeps the
+ * head from being written before the answer is known.
  */
-export function newGuardPluginVisibilityStep(
-  authorizer: Authorizer,
-): PipelineStep<PushDesc> {
+export function newGuardPluginVisibilityStep(): PipelineStep<PushDesc> {
   return {
     name: "GuardPluginVisibility",
-    async execute(ctx: RequestContext<PushDesc>): Promise<void> {
+    execute(ctx: RequestContext<PushDesc>): void {
       const level = requestedVisibility(ctx);
       const plan = ctx.get(PLUGIN_PLAN_KEY) as MaterializationPlan;
       rejectUnsupportedVisibility(ctx.apiResourceKind, level);
       for (const kind of new Set(plan.members.map((member) => member.kind))) {
         rejectUnsupportedVisibility(kind, level);
       }
-      if (level !== ApiResourceVisibility.visibility_public) {
-        return;
-      }
-      if (ctx.callerIdentity.callerClass === "internal") {
-        return;
-      }
-      await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
     },
   };
 }

package/src/domain/schedule/controller.ts

@@ -97,7 +97,10 @@ import {
   newCreateAuthorizationTuplesStep,
 } from "../../pipeline/steps/authorization-tuples.js";
 import { newPersistStep } from "../../pipeline/steps/persist.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
@@ -220,6 +223,7 @@ async function createSchedule(
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -259,6 +263,7 @@ async function update(
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistScheduleUpdateStep(deps.store))
     .addStep(newArmScheduleStep(deps.clock, deps.logger))
     .build()

package/src/domain/session/controller.ts

@@ -85,7 +85,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -208,7 +211,8 @@ async function createSession(
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
-    .addStep(newNormalizeReferencesStep());
+    .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store));
   // The ratified pre-side-effect gate slot (blueprint 03 §3a; O4; Q2
   // ruling — see the create doc comment). Empty in OSS.
   for (const step of stepsForSlot<typeof SessionSchema>(
@@ -499,7 +503,9 @@ async function list(
       newAuthorizeStep(SessionQueryController.method.list, deps.authorizer),
     )
     .addStep(newValidateProtoStep())
-    .addStep(newListAllSessionsStep(deps.store, deps.logger, deps.listReadScope))
+    .addStep(
+      newListAllSessionsStep(deps.store, deps.logger, deps.listReadScope),
+    )
     .build()
     .execute(reqCtx);
   return requireListResult(reqCtx.get(LIST_RESULT_KEY));
@@ -559,7 +565,9 @@ async function listByChannel(
     )
     .addStep(newValidateProtoStep())
     .addStep(newAuthorizeChannelAccessStep(deps.authorizer))
-    .addStep(newFilterByChannelStep(deps.store, deps.logger, deps.listReadScope))
+    .addStep(
+      newFilterByChannelStep(deps.store, deps.logger, deps.listReadScope),
+    )
     .build()
     .execute(reqCtx);
   return requireListResult(reqCtx.get(LIST_RESULT_KEY));

package/src/domain/skill/controller.ts

@@ -75,7 +75,6 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import { versionHistoryTarget } from "../../pipeline/steps/version-history.js";
-import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import {
   newCleanupIamPoliciesStep,
   newRecordVisibilityBeforeUpdateStep,
@@ -450,12 +449,6 @@ async function updateVisibility(
     )
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_SKILL_KEY))
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_SKILL_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newSetVisibilityStep())
     .addStep(newPersistSkillForVisibilityUpdateStep(deps.store))
     .addStep(