@stigmer/server 3.22.1-dev.20260922095755 → 3.23.0

package/src/domain/agentshare/__tests__/create-authorization.test.ts

@@ -1,12 +1,10 @@
 /**
- * Pins the create lane's two questions (steps.ts, resolveShareCreateTargets):
- * can_edit on the referenced agent, then can_create_agent_share on the
- * share's organization, in that order, each with its byte-pinned copy. A
- * share's agent lives in the share's organization (the resolve step refuses
- * anything else before this runs), so the two bars are one organization's:
- * sharing puts the agent in front of a wider audience (an editor's act) and
- * spends the organization's credits on the open internet (an admin's). A
- * missing referenced agent throws.
+ * Pins the create lane's two-arm consent bar (steps.ts,
+ * resolveShareCreateTargets), the Java handler's: a same-org share asks
+ * can_edit on the referenced agent; a cross-org share asks can_execute on
+ * the agent and then can_create_agent_share on the SHARING organization,
+ * agent first; each question carries its byte-pinned copy; a missing
+ * referenced agent throws.
  */
 import { describe, expect, it } from "vitest";
 import { create } from "@bufbuild/protobuf";
@@ -26,15 +24,15 @@ import {
 } from "../steps.js";
 
 const agent = create(AgentSchema, {
-  metadata: { id: "agt_01helper", name: "helper", org: "publisher-org" },
+  metadata: { id: "agt_01public", name: "helper", org: "publisher-org" },
 });
 
-function ctxFor(shareOrg: string, stash = true) {
+function ctxFor(shareOrg: string, agentOrg: string, stash = true) {
   const ctx = new RequestContext(
     AgentShareSchema,
     create(AgentShareSchema, {
       metadata: { name: "helper", org: shareOrg },
-      spec: { agentRef: { org: shareOrg, slug: "helper" } },
+      spec: { agentRef: { org: agentOrg, slug: "helper" } },
     }),
     testCallerIdentity(),
     ApiResourceKind.agent_share,
@@ -46,18 +44,33 @@ function ctxFor(shareOrg: string, stash = true) {
 }
 
 describe("resolveShareCreateTargets", () => {
-  it("asks can_edit on the referenced agent, then can_create_agent_share on the share's organization", () => {
-    expect(resolveShareCreateTargets(ctxFor("publisher-org"))).toEqual([
+  it("a same-org share asks can_edit on the referenced agent", () => {
+    expect(
+      resolveShareCreateTargets(ctxFor("publisher-org", "publisher-org")),
+    ).toEqual([
       {
         permission: IamPermission.can_edit,
         resourceKind: ApiResourceKind.agent,
-        resourceId: "agt_01helper",
+        resourceId: "agt_01public",
+        deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
+      },
+    ]);
+  });
+
+  it("a cross-org share asks can_execute on the agent, then can_create_agent_share on the sharing organization", () => {
+    expect(
+      resolveShareCreateTargets(ctxFor("consumer-org", "publisher-org")),
+    ).toEqual([
+      {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.agent,
+        resourceId: "agt_01public",
         deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
       },
       {
         permission: IamPermission.can_create_agent_share,
         resourceKind: ApiResourceKind.organization,
-        resourceId: "publisher-org",
+        resourceId: "consumer-org",
         deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
       },
     ]);
@@ -65,7 +78,9 @@ describe("resolveShareCreateTargets", () => {
 
   it("a missing referenced agent is a broken chain invariant and throws", () => {
     expect(() =>
-      resolveShareCreateTargets(ctxFor("publisher-org", false)),
+      resolveShareCreateTargets(
+        ctxFor("publisher-org", "publisher-org", false),
+      ),
     ).toThrow("referenced agent not found in context");
   });
 });

package/src/domain/agentshare/constants.ts

@@ -17,12 +17,10 @@ export const SHARE_LINK_TOKEN_BYTES = 20;
  * resolveShareDefaultsStep, byte-pinned. The share's org appears in the
  * hosted chat URL and is the billing org, so it can never be inferred.
  */
-export const ORG_REQUIRED_MESSAGE =
-  "metadata.org is required for an agent share";
+export const ORG_REQUIRED_MESSAGE = "metadata.org is required for an agent share";
 
 /** InvalidArgument copy when spec.agent_ref.slug is absent — Go, pinned. */
-export const AGENT_REF_SLUG_REQUIRED_MESSAGE =
-  "spec.agent_ref.slug is required";
+export const AGENT_REF_SLUG_REQUIRED_MESSAGE = "spec.agent_ref.slug is required";
 
 /**
  * InvalidArgument copy for BOTH profile lanes when org is absent — Go
@@ -30,20 +28,34 @@ export const AGENT_REF_SLUG_REQUIRED_MESSAGE =
  * Anti-enumeration: an empty org would mean "match slug across all orgs"
  * on a public endpoint.
  */
-export const ORG_REQUIRED_FOR_LOOKUP_MESSAGE =
-  "org is required for shared agent lookup";
+export const ORG_REQUIRED_FOR_LOOKUP_MESSAGE = "org is required for shared agent lookup";
 
 /**
- * FailedPrecondition copy when spec.agent_ref names another organization's
- * agent — the schedule's and the channel's same-organization sentence in
- * the share's own words. A share offers an agent its own organization
- * owns; to share another organization's agent, install the plugin that
- * carries it and share the installed copy.
+ * FailedPrecondition copy for an org-audience cross-org share (decision
+ * 013 D3) — Go validateCrossOrgShare AND validateShareUpdateStep (update
+ * replaces the spec wholesale and must not open a side door), byte-pinned.
  */
-export function sameOrgInvariantMessage(refOrg: string): string {
+export function crossOrgAudienceMessage(agentOrg: string): string {
   return (
-    "spec.agent_ref.org must match metadata.org — a share must live in " +
-    `the referenced agent's organization (${refOrg})`
+    "a cross-org share must have a public audience — org-audience shares " +
+    `are limited to the agent's own organization (${agentOrg})`
+  );
+}
+
+/**
+ * FailedPrecondition copy naming every non-public dependency blocking a
+ * cross-org share (decision 013 D5) — Go validateCrossOrgShare,
+ * byte-pinned. Blockers are deduped, formatted "<kind> <org>/<slug>", and
+ * sorted, so the refusal is deterministic.
+ */
+export function crossOrgBlockersMessage(
+  agentOrg: string,
+  agentSlug: string,
+  blockers: readonly string[],
+): string {
+  return (
+    `cannot share ${agentOrg}/${agentSlug} across organizations: ` +
+    `it references resources that are not public: ${blockers.join(", ")}`
   );
 }
 

package/src/domain/agentshare/controller.ts

@@ -93,10 +93,7 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import {
-  newNormalizeReferencesStep,
-  newValidateReferencesStep,
-} from "../../pipeline/steps/references.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -198,7 +195,6 @@ async function createShare(
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newStampAgentPinStep())
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -243,7 +239,6 @@ async function update(
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .build()
     .execute(reqCtx);

package/src/domain/agentshare/steps.ts

@@ -1,19 +1,10 @@
 /**
  * AgentShare domain steps — ports pkg/domain/agentshare/controller/steps.go
- * and the get_shared_profile.go helpers: share defaults and the
- * same-organization invariant on agent_ref, the agent-id rebind pin, the
+ * and the get_shared_profile.go helpers: share defaults + the cross-org
+ * public-dependency contract (decision 013), the agent-id rebind pin, the
  * update immutability rules, the uniform-NotFound profile resolution
  * helpers, and the constant-time link-token predicate.
  *
- * A share's agent lives in the share's own organization. The
- * cross-organization arm this domain once carried (a share of another
- * organization's public agent, gated on a public audience and a sweep of
- * the agent's dependencies for public visibility) left with the public
- * level; sharing another organization's agent is done by installing the
- * plugin that carries it and sharing the installed copy. A stored share
- * whose agent is in another organization — a row from before — fails
- * closed at the profile like a dangling reference.
- *
  * OD-1 (deliberate exclusion): Go's boot migration
  * (pkg/domain/agentshare/migration/bootstrap_shares.go — protowire
  * decoding of the REMOVED Agent.spec.sharing fields into AgentShare rows)
@@ -38,6 +29,11 @@ import type { AgentShare } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v
 import { AgentShareStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/status_pb";
 import { SharedAgentProfileSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
 import type { SharedAgentProfile } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
+import { AgentShareAudience } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
@@ -56,6 +52,7 @@ import {
 } from "../../pipeline/steps/authorize.js";
 import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import type { GetByReferenceDesc } from "../../pipeline/steps/authorize-resolved-target.js";
+import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
 import {
@@ -63,7 +60,8 @@ import {
   ORG_REQUIRED_MESSAGE,
   SHARE_LINK_TOKEN_BYTES,
   agentRefImmutableMessage,
-  sameOrgInvariantMessage,
+  crossOrgAudienceMessage,
+  crossOrgBlockersMessage,
 } from "./constants.js";
 
 type AgentShareDesc = typeof AgentShareSchema;
@@ -86,14 +84,21 @@ export const SHARE_ORGANIZATION_DENIED_MESSAGE =
 
 /**
  * The create lane's authorization questions, for AuthorizeResolvedTarget
- * after ResolveShareDefaults, agent first: can_edit on the agent (sharing
- * puts it in front of a wider audience, an editor's act) and then
- * can_create_agent_share on the organization (a share spends the
- * organization's credits on the open internet, an admin-level act). The
- * RPC is is_skip_authorization because the target is the referenced agent,
- * resolved from a slug, not a request field. The resolve step has already
- * made the reference absolute and refused an agent outside the share's
- * organization, so the two bars are always the same organization's.
+ * after ResolveShareDefaults: the two-arm consent bar the Java handler
+ * enforced and the model's comment on can_create_agent_share describes.
+ * The RPC is is_skip_authorization because the target is the referenced
+ * agent, resolved from a slug, not a request field.
+ *
+ * A same-org share (spec.agent_ref.org equals metadata.org, after the
+ * resolve step made the reference absolute) asks can_edit on the agent:
+ * sharing puts the agent in front of a wider audience, an editor's act.
+ *
+ * A cross-org share of another organization's public agent asks two
+ * questions, agent first as Java did: can_execute on the agent (whoever may
+ * run it may offer it) and then can_create_agent_share on the SHARING
+ * organization — a public share spends that organization's credits on the
+ * open internet, an admin-level act. The cross-org validity rules (public
+ * agent, no org audience, public dependencies) stay the resolve step's.
  */
 export function resolveShareCreateTargets(
   ctx: RequestContext<AgentShareDesc>,
@@ -102,17 +107,24 @@ export function resolveShareCreateTargets(
   if (agent === undefined) {
     throw new Error("referenced agent not found in context");
   }
+  const share = ctx.newState;
+  const shareOrg = share.metadata?.org ?? "";
+  const crossOrg = (share.spec?.agentRef?.org ?? "") !== shareOrg;
+  const agentBar: AuthorizationTarget = {
+    permission: crossOrg ? IamPermission.can_execute : IamPermission.can_edit,
+    resourceKind: ApiResourceKind.agent,
+    resourceId: agent.metadata?.id ?? "",
+    deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
+  };
+  if (!crossOrg) {
+    return [agentBar];
+  }
   return [
-    {
-      permission: IamPermission.can_edit,
-      resourceKind: ApiResourceKind.agent,
-      resourceId: agent.metadata?.id ?? "",
-      deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
-    },
+    agentBar,
     {
       permission: IamPermission.can_create_agent_share,
       resourceKind: ApiResourceKind.organization,
-      resourceId: ctx.newState.metadata?.org ?? "",
+      resourceId: shareOrg,
       deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
     },
   ];
@@ -294,12 +306,10 @@ export async function findShareByOrgAndSlug(
 /**
  * ResolveShareDefaults — Go resolveShareDefaultsStep:
  *   1. Requires metadata.org (URL + billing identity, never inferred).
- *   2. Normalizes spec.agent_ref.org (empty means same-org) and refuses an
- *      agent_ref that names another organization (the module header) with
- *      the same-organization sentence, BEFORE any lookup, so the share
- *      lane never says whether another organization's slug exists.
- *   3. Loads the referenced agent — a nonexistent agent is refused with
- *      the same NOT_FOUND a direct agent lookup would produce.
+ *   2. Normalizes spec.agent_ref.org (empty means same-org) and loads the
+ *      referenced agent — a nonexistent agent is refused with the same
+ *      NOT_FOUND a direct agent lookup would produce.
+ *   3. For a CROSS-ORG share, enforces the decision-013 contract.
  *   4. Defaults metadata.slug (and name) from the agent when the caller
  *      provided neither — the canonical share keeps the agent's hosted URL.
  *      Runs before ResolveSlug, which skips already-set slugs.
@@ -327,9 +337,6 @@ export function newResolveShareDefaultsStep(
       if (agentRef!.org === "") {
         agentRef!.org = metadata!.org;
       }
-      if (agentRef!.org !== metadata!.org) {
-        throw failedPreconditionError(sameOrgInvariantMessage(agentRef!.org));
-      }
 
       const agent = await findAgentByOrgAndSlug(
         store,
@@ -340,6 +347,10 @@ export function newResolveShareDefaultsStep(
         throw notFoundError("Agent", agentRef!.slug);
       }
 
+      if (agentRef!.org !== metadata!.org) {
+        await validateCrossOrgShare(store, share, agent);
+      }
+
       ctx.set(REFERENCED_AGENT_KEY, agent);
 
       // Canonical-share default: no slug and no name means "share this
@@ -353,6 +364,133 @@ export function newResolveShareDefaultsStep(
   };
 }
 
+/**
+ * The cross-org share contract (decision 013) — Go validateCrossOrgShare:
+ *   - The agent must be marketplace-public; a non-public agent is refused
+ *     with the same NOT_FOUND as a missing one (no existence probe for
+ *     private slugs).
+ *   - The audience must be public — org-audience semantics don't carry
+ *     across the org boundary.
+ *   - Every declared dependency must itself be public; the refusal names
+ *     every blocker (sorted) so the sharing org knows exactly what to ask
+ *     the agent's org to publish.
+ * Runtime re-enforcement is cloud-side; this create-time sweep is the
+ * fail-loud half, mirrored in both editions.
+ */
+async function validateCrossOrgShare(
+  store: Store,
+  share: AgentShare,
+  agent: Agent,
+): Promise<void> {
+  const agentMeta = agent.metadata;
+
+  if (agentMeta?.visibility !== ApiResourceVisibility.visibility_public) {
+    throw notFoundError("Agent", agentMeta?.slug ?? "");
+  }
+
+  // protobuf-es strips the shared enum prefix: proto
+  // agent_share_audience_org generates as AgentShareAudience.org.
+  if (share.spec?.audience === AgentShareAudience.org) {
+    throw failedPreconditionError(crossOrgAudienceMessage(agentMeta.org));
+  }
+
+  const blockers = await findNonPublicDependencies(store, agent);
+  if (blockers.length > 0) {
+    throw failedPreconditionError(
+      crossOrgBlockersMessage(agentMeta.org, agentMeta.slug, blockers),
+    );
+  }
+}
+
+/**
+ * Sweeps the agent's declared blueprint dependencies — skill_refs
+ * (including every sub-agent's) and mcp_server_usages — and returns a
+ * deterministic "kind org/slug" entry for each that is missing or not
+ * visibility_public — Go findNonPublicDependencies. A reference with an
+ * empty org is relative to the AGENT's org (defensive parity with the
+ * cloud edition's referenceMatches; agent writes normalize refs to
+ * absolute form).
+ */
+async function findNonPublicDependencies(
+  store: Store,
+  agent: Agent,
+): Promise<string[]> {
+  const spec = agent.spec;
+  const agentOrg = agent.metadata?.org ?? "";
+
+  interface DepRef {
+    kind: ApiResourceKind;
+    org: string;
+    slug: string;
+  }
+
+  const seen = new Set<string>();
+  const deps: DepRef[] = [];
+  const add = (
+    kind: ApiResourceKind,
+    ref: ApiResourceReference | undefined,
+  ): void => {
+    if (ref === undefined || ref.slug === "") {
+      return;
+    }
+    const org = ref.org !== "" ? ref.org : agentOrg;
+    const key = `${kind}|${org}|${ref.slug}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      deps.push({ kind, org, slug: ref.slug });
+    }
+  };
+
+  for (const ref of spec?.skillRefs ?? []) {
+    add(ApiResourceKind.skill, ref);
+  }
+  for (const sub of spec?.subAgents ?? []) {
+    for (const ref of sub.skillRefs) {
+      add(ApiResourceKind.skill, ref);
+    }
+  }
+  for (const usage of spec?.mcpServerUsages ?? []) {
+    add(ApiResourceKind.mcp_server, usage.mcpServerRef);
+  }
+
+  const blockers: string[] = [];
+  for (const dep of deps) {
+    let visibility: ApiResourceVisibility | undefined;
+    try {
+      // Per-kind resolution, exactly Go's switch — skill and mcp_server
+      // are the only dependency kinds an agent blueprint declares.
+      const resolved =
+        dep.kind === ApiResourceKind.skill
+          ? await findResourceBySlug(
+              store,
+              dep.kind,
+              SkillSchema,
+              dep.slug,
+              dep.org,
+            )
+          : await findResourceBySlug(
+              store,
+              dep.kind,
+              McpServerSchema,
+              dep.slug,
+              dep.org,
+            );
+      visibility = resolved?.metadata?.visibility;
+    } catch (error) {
+      throw internalError(
+        error,
+        `failed to resolve ${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug} while validating cross-org share`,
+      );
+    }
+    if (visibility !== ApiResourceVisibility.visibility_public) {
+      blockers.push(`${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug}`);
+    }
+  }
+
+  blockers.sort();
+  return blockers;
+}
+
 /**
  * StampAgentPin — Go stampAgentPinStep: writes status.agent_id, the
  * server-owned rebind pin (decision 013). agent_ref is org+slug and slugs
@@ -386,8 +524,10 @@ export function newStampAgentPinStep(): PipelineStep<AgentShareDesc> {
 
 /**
  * ValidateShareUpdate — Go validateShareUpdateStep: spec.agent_ref must
- * keep referencing the same agent. Runs after LoadExisting.
- * metadata.slug/org immutability needs no step — the generic
+ * keep referencing the same agent, and the cross-org public-audience rule
+ * must hold on update too (update replaces the spec wholesale and must not
+ * open a side door to an org-audience cross-org share). Runs after
+ * LoadExisting. metadata.slug/org immutability needs no step — the generic
  * BuildUpdateState preserves both, and status (including the pin and link
  * token) wholesale.
  */
@@ -424,6 +564,14 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
           ),
         );
       }
+
+      const isCrossOrg =
+        (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
+      if (isCrossOrg && ctx.input.spec?.audience === AgentShareAudience.org) {
+        throw failedPreconditionError(
+          crossOrgAudienceMessage(existingRef?.org ?? ""),
+        );
+      }
     },
   };
 }
@@ -435,8 +583,8 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
  * SHARE; display fields and default_instance_id from the AGENT. Three
  * misses all fail closed with the uniform refusal, indistinguishable from
  * absence: a dangling agent_ref, a stale agent-id pin (the rebind guard),
- * and an agent in another organization (a share written before the
- * same-organization invariant; this release serves no such share).
+ * and a cross-org agent no longer visibility_public (withdrawing public
+ * visibility must kill every external channel).
  */
 export async function buildSharedAgentProfile(
   store: Store,
@@ -457,7 +605,12 @@ export async function buildSharedAgentProfile(
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 
-  if ((share.metadata?.org ?? "") !== (agent.metadata?.org ?? "")) {
+  const isCrossOrg =
+    (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
+  if (
+    isCrossOrg &&
+    agent.metadata?.visibility !== ApiResourceVisibility.visibility_public
+  ) {
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 

package/src/domain/environment/controller.ts

@@ -63,6 +63,7 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import {
   newBuildNewStateStep,
   setAuditFieldsForUpdate,
@@ -96,10 +97,7 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import {
-  newNormalizeReferencesStep,
-  newValidateReferencesStep,
-} from "../../pipeline/steps/references.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -246,7 +244,6 @@ async function update(
     .addStep(newPreserveRedactedSecretsStep())
     .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newDestroyDroppedEnvironmentSecretsStep(deps.secretService, deps.logger),
@@ -401,6 +398,12 @@ async function updateVisibility(
     // After load, per the cross-edition error precedence: unknown id +
     // bad level = NOT_FOUND on both editions.
     .addStep(newValidateVisibilityUpdateStep())
+    .addStep(
+      newAuthorizeVisibilityTransitionStep(
+        UPDATE_VISIBILITY_ENVIRONMENT_KEY,
+        deps.authorizer,
+      ),
+    )
     .addStep(newValidateEnvironmentShareRestrictionStep())
     .addStep(newSetEnvironmentVisibilityStep())
     .addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store))

package/src/domain/executioncontext/controller.ts

@@ -82,10 +82,7 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import {
-  newNormalizeReferencesStep,
-  newValidateReferencesStep,
-} from "../../pipeline/steps/references.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -189,7 +186,6 @@ async function createExecutionContext(
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
     .addStep(newPersistStep(deps.store))
     .addStep(