@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/org-admin-owner-inheritance.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#757 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for org-admin owner inheritance (T08).
@@ -131,6 +131,8 @@ tests:
     check:
       - user: identity_account:ana
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -167,6 +169,8 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: skill:carols-notes
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -174,6 +178,8 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: workflow:carols-flow
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -191,6 +197,8 @@ tests:
     check:
       - user: identity_account:root
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_edit: true
           can_delete: true
@@ -210,6 +218,8 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -240,6 +250,8 @@ tests:
     check:
       - user: identity_account:zara
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -254,6 +266,8 @@ tests:
     check:
       - user: identity_account:ana
         object: agent_instance:carols-instance
+        context:
+          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -283,6 +297,8 @@ tests:
     check:
       - user: identity_account:carol
         object: agent:carols-bot
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -293,6 +309,8 @@ tests:
     list_objects:
       - user: identity_account:ana
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:carols-bot
@@ -300,6 +318,8 @@ tests:
             - agent:carols-bot
       - user: identity_account:ana
         type: agent_instance
+        context:
+          allow: false
         assertions:
           can_view: []
       - user: identity_account:ana

package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/platform-visibility.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for platform visibility (visibility_platform).
@@ -102,6 +102,8 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -110,6 +112,8 @@ tests:
           can_delete: false
       - user: identity_account:bob
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -118,6 +122,8 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -127,6 +133,8 @@ tests:
     check:
       - user: identity_account:priya
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -136,6 +144,8 @@ tests:
       # narrower: platform_user resolves member-from-managed_org.)
       - user: identity_account:veda
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: false
@@ -144,6 +154,8 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:internal-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -151,6 +163,8 @@ tests:
       # without an explicit visibility tuple.
       - user: identity_account:priya
         object: agent:internal-bot
+        context:
+          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -159,6 +173,8 @@ tests:
     check:
       - user: identity_account:alice
         object: skill:research
+        context:
+          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -168,6 +184,8 @@ tests:
     check:
       - user: identity_account:alice
         object: workflow:onboarding
+        context:
+          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -176,6 +194,8 @@ tests:
     check:
       - user: identity_account:alice
         object: mcp_server:github
+        context:
+          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -185,6 +205,8 @@ tests:
     check:
       - user: identity_account:swarup
         object: agent:sara
+        context:
+          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -194,6 +216,8 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent
+        context:
+          allow: false
         assertions:
           can_view:
             - agent:sara

package/src/authorization/__tests__/fixtures/fga/public-visibility-setter.fga.yaml

@@ -0,0 +1,52 @@
+# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/public-visibility-setter.fga.yaml
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# The body below is byte-identical to the source; the cloud re-runs the LIVE
+# file against this evaluator at the re-pin, so a stale copy is caught there.
+# Store tests for the public-visibility permission (marketplace curation).
+#
+# can_set_public_visibility gates who may set a resource's visibility to
+# PUBLIC — the only level that crosses every org boundary. It derives
+# from the platform operator role: operators (human curators and the
+# seeding machine account) hold it; ordinary tenants — even org owners,
+# who can otherwise fully manage their resources — never do. Enforced by
+# PublicVisibilityEscalationPolicy at both write doors (updateVisibility
+# escalation and create-with-public).
+#
+# Run with:
+#   fga model test --tests public-visibility-setter.fga.yaml
+name: public-visibility-setter
+model_file: ../model/fga.mod
+
+tuples:
+  # The bootstrap machine account is the platform operator
+  # (BootstrapIdentitySeeder re-asserts this tuple on every boot).
+  - user: identity_account:machine
+    relation: operator
+    object: platform:stigmer
+
+  # A human operator granted the same platform role.
+  - user: identity_account:opal
+    relation: operator
+    object: platform:stigmer
+
+  # A tenant org owner — owns everything in their org, nothing on the
+  # platform.
+  - user: identity_account:mallory
+    relation: owner
+    object: organization:acme
+
+tests:
+  - name: operators may set public visibility, tenants may not
+    check:
+      - user: identity_account:machine
+        object: platform:stigmer
+        assertions:
+          can_set_public_visibility: true
+      - user: identity_account:opal
+        object: platform:stigmer
+        assertions:
+          can_set_public_visibility: true
+      - user: identity_account:mallory
+        object: platform:stigmer
+        assertions:
+          can_set_public_visibility: false

package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/workflow-execution-sharing.fga.yaml
-# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
+# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for workflow_execution sharing and run observability.
@@ -173,6 +173,8 @@ tests:
       # never alice's run history.
       - user: identity_account:vera
         object: workflow_instance:inst1
+        context:
+          allow: false
         assertions:
           can_view: true
       - user: identity_account:vera

package/src/authorization/__tests__/list-read-scope.test.ts

@@ -1,15 +1,15 @@
 /**
  * Pins the built-in list read scope on both store drivers as the twin of
  * the cloud's driver (stigmer-cloud iam/list-read-scope.ts): every
- * candidate a list lane offers is answered by `can_view` through the same
- * evaluator the Authorizer uses, over tuples derived from the facts the
- * candidate carries — no candidate row is read twice.
+ * candidate a list lane offers is answered by `can_view` under the
+ * LISTING context (`allow: false`, the public wildcard suppressed) through
+ * the same evaluator the Authorizer uses, over tuples derived from the
+ * facts the candidate carries — no candidate row is read twice.
  *
  * The adversarial cells come first, because until slice 5's sibling
  * cells this file and the composed proof are the only proof that a
- * member's list is a member's list: the outsider sees nothing (a row
- * still carrying the retired public level included); the viewer rung sees
- * the org-visible blueprints
+ * member's list is a member's list: the outsider sees nothing (a legacy
+ * PUBLIC row included); the viewer rung sees the org-visible blueprints
  * and nothing personal; the founder — an admin — sees the organization's
  * blueprints and NOT its members' sessions, keys, environments or
  * memories (the model's own line, now list-visible); an execution is its session's and
@@ -280,10 +280,9 @@ describe.each(driverFixtures(SEEDED_KINDS))(
           await grant(orgRole(VIEWER, "viewer", ORG));
 
           // Blueprints: the founder's private and org-visible agents, a
-          // member's private one, one still carrying the retired public
-          // level (a row the store migration has not met, which derives no
-          // viewer grant and so reads as its owner's alone), and one
-          // stamped by the 3.14 verifiers' raw subject.
+          // member's private one, a legacy PUBLIC one (nobody can set public
+          // under the built-in posture; a row from before it can carry it),
+          // and one stamped by the 3.14 verifiers' raw subject.
           await save("agent", {
             id: "agt_private",
             org: ORG,
@@ -428,7 +427,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
         });
 
         describe("the adversarial cells", () => {
-          it("an OUTSIDER lists nothing of the organization's — a row still carrying the retired public level included", async () => {
+          it("an OUTSIDER lists nothing of the organization's — not even the legacy PUBLIC blueprint, which the listing context suppresses", async () => {
             for (const kind of SEEDED_KINDS.filter(
               (k) =>
                 k !== ApiResourceKind.iam_policy &&
@@ -442,13 +441,13 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             }
           });
 
-          it("a VIEWER lists the org-visible blueprint and nothing private; a MEMBER adds their own private one; the retired level grants neither anything", async () => {
+          it("a VIEWER lists the org-visible and the public blueprints and nothing private; a MEMBER adds their own private one", async () => {
             expect(
               await listAs(resolved(VIEWER), ApiResourceKind.agent),
-            ).toEqual(["agt_org"]);
+            ).toEqual(["agt_org", "agt_public"]);
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent),
-            ).toEqual(["agt_org", "agt_member_private"]);
+            ).toEqual(["agt_org", "agt_member_private", "agt_public"]);
           });
 
           it("the FOUNDER and the ADMIN list every blueprint (`owner: … or admin from organization`), including a member's private one", async () => {
@@ -543,7 +542,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             const offered = [
               entryOf(
                 ApiResourceKind.agent,
-                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
               ),
               entryOf(
                 ApiResourceKind.agent,
@@ -563,15 +562,15 @@ describe.each(driverFixtures(SEEDED_KINDS))(
               ApiResourceKind.agent,
               offered,
             );
-            expect([...kept]).toEqual(["agt_member_private", "agt_org"]);
+            expect([...kept]).toEqual(["agt_public", "agt_org"]);
             // The lane's order is the lane's: the helper filters its own
             // array by the kept set.
             expect(
               await listAs(resolved(MEMBER), ApiResourceKind.agent, [
-                rows.get(ApiResourceKind.agent)!.get("agt_member_private")!,
+                rows.get(ApiResourceKind.agent)!.get("agt_public")!,
                 rows.get(ApiResourceKind.agent)!.get("agt_org")!,
               ]),
-            ).toEqual(["agt_member_private", "agt_org"]);
+            ).toEqual(["agt_public", "agt_org"]);
           });
 
           it("no candidates: the empty set, with no read of any kind", async () => {

package/src/authorization/__tests__/store-tests.test.ts

@@ -50,18 +50,22 @@ const FIXTURES = new URL("./fixtures/fga/", import.meta.url);
  */
 const DOCUMENTS = [
   "agent-channel-owner.fga.yaml",
+  "agent-instance-creation.fga.yaml",
   "agent-share-owner.fga.yaml",
   "artifact-org-and-owner.fga.yaml",
   "blueprint-private-visibility.fga.yaml",
   "channel-app-owner.fga.yaml",
   "channel-participation.fga.yaml",
   "channel-session-visibility.fga.yaml",
+  "cross-org-share-creation.fga.yaml",
   "default-instance-inheritance.fga.yaml",
+  "mcp-server-authoring.fga.yaml",
   "memory-subject-only.fga.yaml",
   "org-admin-owner-inheritance.fga.yaml",
   "org-shared-environment.fga.yaml",
   "platform-visibility.fga.yaml",
   "provider-standing-viewer.fga.yaml",
+  "public-visibility-setter.fga.yaml",
   "reserved-label-writer.fga.yaml",
   "schedule-owner.fga.yaml",
   "schedule-session-visibility.fga.yaml",
@@ -98,7 +102,7 @@ const SKIPPED_PINNED: ReadonlyArray<string> = [
   "artifact-org-and-owner :: listing reflects org inheritance plus creator ownership :: identity_account:eve <artifact> :: list-objects",
   "artifact-org-and-owner :: listing reflects org inheritance plus creator ownership :: identity_account:victor <artifact> :: list-objects",
   "blueprint-private-visibility :: org admin's listable agents include private ones (T08) :: identity_account:oscar <agent> :: list-objects",
-  "blueprint-private-visibility :: org member's listable agents exclude private ones :: identity_account:dave <agent> :: list-objects",
+  "blueprint-private-visibility :: org member's listable agents exclude private ones (wildcard suppressed) :: identity_account:dave <agent> :: list-objects",
   "blueprint-private-visibility :: org viewer's listable agents are exactly the viewer-shaped org-visible ones :: identity_account:vera <agent> :: list-objects",
   "blueprint-private-visibility :: owner's listable agents include everything they authored :: identity_account:carol <agent> :: list-objects",
   "channel-app-owner :: listing channel apps reflects ownership and grants, not membership :: identity_account:alice <channel_app> :: list-objects",
@@ -128,6 +132,9 @@ const SKIPPED_PINNED: ReadonlyArray<string> = [
   // undeclared-kind: platform
   "provider-standing-viewer :: operator may view provider standing, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
   "provider-standing-viewer :: operator may view provider standing, tenants may not :: identity_account:opal platform:stigmer :: undeclared-kind",
+  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:machine platform:stigmer :: undeclared-kind",
+  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
+  "public-visibility-setter :: operators may set public visibility, tenants may not :: identity_account:opal platform:stigmer :: undeclared-kind",
   "reserved-label-writer :: operator may write reserved labels, tenants may not :: identity_account:machine platform:stigmer :: undeclared-kind",
   "reserved-label-writer :: operator may write reserved labels, tenants may not :: identity_account:mallory platform:stigmer :: undeclared-kind",
   // undeclared-subject-type: identity_provider#platform_user

package/src/authorization/__tests__/tuples.test.ts

@@ -13,7 +13,7 @@ import {
 } from "../tuples.js";
 
 describe("the string notation", () => {
-  it("parses an object and a userset, and an id may carry a colon (issuer subjects do)", () => {
+  it("parses an object, a userset and the wildcard, and an id may carry a colon (issuer subjects do)", () => {
     expect(parseObjectRef("agent:agt_1")).toEqual({
       type: "agent",
       id: "agt_1",
@@ -27,6 +27,11 @@ describe("the string notation", () => {
       object: { type: "organization", id: "acme" },
       relation: "viewer",
     });
+    expect(parseSubject("identity_account:*")).toEqual({
+      form: "wildcard",
+      type: "identity_account",
+      condition: undefined,
+    });
     expect(parseSubject("identity_account:ida_x")).toEqual({
       form: "object",
       object: { type: "identity_account", id: "ida_x" },
@@ -38,24 +43,18 @@ describe("the string notation", () => {
     expect(() => parseObjectRef(":id")).toThrow("not an object reference");
   });
 
-  it("refuses the wildcard notation — no line of the model admits one", () => {
-    expect(() => parseSubject("identity_account:*")).toThrow(
-      "wildcard subject 'identity_account:*' is not admitted",
-    );
-  });
-
-  it("formats a tuple in the proto's notation", () => {
+  it("formats a tuple in the proto's notation, the condition spelled after `with`", () => {
     expect(
       formatTuple({
         object: parseObjectRef("agent:a"),
         relation: "viewer",
         subject: {
-          form: "userset",
-          object: { type: "organization", id: "acme" },
-          relation: "viewer",
+          form: "wildcard",
+          type: "identity_account",
+          condition: "allow_public",
         },
       }),
-    ).toBe("agent:a#viewer@organization:acme#viewer");
+    ).toBe("agent:a#viewer@identity_account:* with allow_public");
     expect(formatSubject(parseSubject("organization:acme#member"))).toBe(
       "organization:acme#member",
     );

package/src/authorization/authorizer.ts

@@ -17,7 +17,9 @@
  *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
  *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
  *      and the server agree by construction). `platform` is the one that
- *      can arrive, through an operator capability no self-host holds.
+ *      arrives, through `can_set_public_visibility` — under the built-in
+ *      posture nobody sets public visibility, the model's own reason for
+ *      making it a platform operator's act.
  *   3. The caller as a person (person.ts) and one derived tuple source for
  *      them; the target loaded ONCE through the source's memoised loader,
  *      so the read that decides not-found is the read the derivation
@@ -29,9 +31,11 @@
  *      member cannot learn which account ids exist. Present or exempt, the
  *      row is then evaluated: the cloud asks OpenFGA whether or not the row
  *      exists, and so does this driver.
- *   5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
- *      reason, so the method annotation's byte-pinned `error_msg` wins on
- *      the wire, exactly the cloud's genuine-denial path.
+ *   5. `checkRelation` with the point-check context (`allow: true`: a
+ *      public resource reads for any authenticated caller, the cloud's
+ *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
+ *      the method annotation's byte-pinned `error_msg` wins on the wire,
+ *      exactly the cloud's genuine-denial path.
  *
  * Faults. Everything past the pre-checks runs under one guard: a store
  * fault, a person that names nobody (`personFor`), an evaluation fault
@@ -175,6 +179,7 @@ export function newBuiltInAuthorizer(deps: BuiltInAuthorizerDeps): Authorizer {
           object,
           relation,
           person,
+          { allow: true },
         );
         if (allowed) {
           return { kind: "allow" };

package/src/authorization/derived-tuples.ts

@@ -12,6 +12,7 @@
  *   - owner SELF:     <row>#owner@identity_account:<row id>
  *   - creator:        <row>#creator@identity_account:<creator stamp>   (kinds flagged requires_creator_tuple)
  *   - org-viewer:     <row>#viewer@organization:<org>#viewer          (visibility_org; cloud#257's shape)
+ *   - public-viewer:  <row>#viewer@identity_account:* with allow_public
  *   - platform-viewer: none — it fans out over identity providers, a kind this edition does not serve
  *
  * Two facts are this edition's own and are stated here, nowhere else:
@@ -90,7 +91,11 @@ import type {
   Tuple,
   TupleSource,
 } from "./tuples.js";
-import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
+import {
+  ACCOUNT_TYPE,
+  ALLOW_PUBLIC_CONDITION,
+  formatObjectRef,
+} from "./tuples.js";
 
 /**
  * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
@@ -179,6 +184,12 @@ function visibilitySubject(
             object: { type: "organization", id: org },
             relation: "viewer",
           };
+    case "public-viewer":
+      return {
+        form: "wildcard",
+        type: ACCOUNT_TYPE,
+        condition: ALLOW_PUBLIC_CONDITION,
+      };
     case "platform-viewer":
       return undefined;
     default: {
@@ -350,18 +361,24 @@ function tupleOfRow(row: IamPolicy): Tuple {
     type: principal?.kind ?? "",
     id: principal?.id ?? "",
   };
-  // A principal id of `*` (a wildcard row a cloud database may still hold
-  // from the retired public level) is read as an ordinary object id here:
-  // no person carries `*` among their aliases, so the row matches nobody
-  // and reads as the inert grant it is, never as a fault that would turn
-  // the resource unreadable.
-  const subject: Subject =
-    principal !== undefined && principal.relation !== ""
-      ? {
-          form: "userset",
-          object: principalObject,
-          relation: principal.relation,
-        }
-      : { form: "object", object: principalObject };
+  let subject: Subject;
+  if (principal !== undefined && principal.relation !== "") {
+    subject = {
+      form: "userset",
+      object: principalObject,
+      relation: principal.relation,
+    };
+  } else if (principalObject.id === "*") {
+    // A wildcard row carries no condition of its own; the evaluator
+    // honours it only where a line admits an unconditioned wildcard,
+    // which no line in the model does.
+    subject = {
+      form: "wildcard",
+      type: principalObject.type,
+      condition: undefined,
+    };
+  } else {
+    subject = { form: "object", object: principalObject };
+  }
   return { object, relation: spec?.relation ?? "", subject };
 }