@stigmer/server 3.22.1 → 3.23.1-dev.20260923075205

package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/blueprint-private-visibility.fga.yaml
-# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for real blueprint privacy (Phase 3 of the visibility model).
@@ -14,7 +14,6 @@
 #             viewers; pre-cloud#257 tuples carried #member, which excluded
 #             viewer-role users — still honored until backfilled, see the
 #             legacy-bot fixture)
-#   PUBLIC    viewer@identity_account:* (allow_public)  +  the ORG tuple
 #   PLATFORM  platform_viewer@identity_provider:<idp>#platform_user  +  the ORG tuple
 #
 # Read vs spend: an org viewer-role user READS org-visible blueprints (and, at
@@ -23,9 +22,8 @@
 # can_create_execution_in permissions, which require member-or-guest. The
 # vera assertions pin both halves of that contract.
 #
-# The ORG tuple rides along on PUBLIC/PLATFORM (the "org floor") so a shared
-# blueprint stays listable in its own org — org-scoped ListObjects runs with
-# {"allow": false}, which suppresses the public wildcard.
+# The ORG tuple rides along on PLATFORM (the "org floor") so a shared
+# blueprint stays listable in its own org.
 #
 # T08 exception: org ADMINS (and org owners, via the role hierarchy) are
 # composed into blueprint `owner` and therefore see, list, and manage
@@ -39,8 +37,8 @@
 # Scenario: org "acme" has owner-creator carol, org admin oscar, plain
 # member dave, and read-only viewer vera (the role SSO auto-provisioning
 # grants by default); mallory belongs to an unrelated org. Carol authors one
-# blueprint of each kind at PRIVATE, plus an ORG agent, a PUBLIC agent, and
-# a legacy ORG agent whose tuple still carries the pre-cloud#257 shape.
+# blueprint of each kind at PRIVATE, plus an ORG agent and a legacy ORG
+# agent whose tuple still carries the pre-cloud#257 shape.
 name: blueprint-private-visibility
 model_file: ../model/fga.mod
 
@@ -114,22 +112,6 @@ tuples:
     relation: viewer
     object: agent:legacy-bot
 
-  # --- PUBLIC agent (wildcard + org floor tuple) ---
-  - user: organization:acme
-    relation: organization
-    object: agent:open-bot
-  - user: identity_account:carol
-    relation: owner
-    object: agent:open-bot
-  - user: identity_account:*
-    relation: viewer
-    object: agent:open-bot
-    condition:
-      name: allow_public
-  - user: organization:acme#viewer
-    relation: viewer
-    object: agent:open-bot
-
   # --- PRIVATE agent with an explicit individual viewer grant ---
   - user: organization:acme
     relation: organization
@@ -146,8 +128,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -155,22 +135,16 @@ tests:
           can_clone: false
       - user: identity_account:dave
         object: skill:secret-notes
-        context:
-          allow: false
         assertions:
           can_view: false
           can_use: false
       - user: identity_account:dave
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
       - user: identity_account:dave
         object: mcp_server:secret-tools
-        context:
-          allow: false
         assertions:
           can_view: false
           can_use: false
@@ -180,8 +154,6 @@ tests:
     check:
       - user: identity_account:oscar
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -189,15 +161,11 @@ tests:
           can_execute: true
       - user: identity_account:oscar
         object: skill:secret-notes
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:oscar
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -205,8 +173,6 @@ tests:
       # four private-blueprint kinds are pinned to the same rule.
       - user: identity_account:oscar
         object: mcp_server:secret-tools
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -215,22 +181,17 @@ tests:
     list_objects:
       - user: identity_account:oscar
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   - name: owner retains full access to private blueprints
     check:
       - user: identity_account:carol
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -239,8 +200,6 @@ tests:
           can_delete: true
       - user: identity_account:carol
         object: workflow:secret-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -250,8 +209,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -260,33 +217,10 @@ tests:
           can_delete: false
       - user: identity_account:mallory
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
 
-  - name: public agent is reachable by everyone with allow context, and by org members without it
-    check:
-      # Outsider resolves through the conditional wildcard ({"allow": true}).
-      - user: identity_account:mallory
-        object: agent:open-bot
-        context:
-          allow: true
-        assertions:
-          can_view: true
-          can_execute: true
-      # Org member resolves through the org floor tuple even with the
-      # wildcard suppressed — this is what keeps public blueprints in
-      # org-scoped listings.
-      - user: identity_account:dave
-        object: agent:open-bot
-        context:
-          allow: false
-        assertions:
-          can_view: true
-          can_execute: true
-
   - name: explicit individual viewer grant on a private agent conveys view and run
     check:
       # Run-what-you-can-read: can_execute derives from viewer, so an
@@ -294,38 +228,30 @@ tests:
       # which checks can_view).
       - user: identity_account:dave
         object: agent:shared-secret
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
           can_edit: false
 
-  - name: org member's listable agents exclude private ones (wildcard suppressed)
+  - name: org member's listable agents exclude private ones
     list_objects:
       - user: identity_account:dave
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   - name: owner's listable agents include everything they authored
     list_objects:
       - user: identity_account:carol
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:secret-bot
             - agent:team-bot
             - agent:legacy-bot
-            - agent:open-bot
             - agent:shared-secret
 
   # ── cloud#257: the viewer-role cell (previously untested) ──────────────
@@ -336,27 +262,16 @@ tests:
       # spend refusal is pinned separately on the org permissions below.
       - user: identity_account:vera
         object: agent:team-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_clone: true
           can_execute: true
           can_edit: false
           can_delete: false
-      # The org floor of a PUBLIC blueprint reaches viewers the same way.
-      - user: identity_account:vera
-        object: agent:open-bot
-        context:
-          allow: false
-        assertions:
-          can_view: true
       # Private stays private — the viewer role grants nothing beyond the
       # explicit visibility tuples.
       - user: identity_account:vera
         object: agent:secret-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -382,8 +297,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:legacy-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -392,8 +305,6 @@ tests:
       # organization#member. The boot backfill converges these tuples.
       - user: identity_account:vera
         object: agent:legacy-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -402,9 +313,6 @@ tests:
     list_objects:
       - user: identity_account:vera
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:team-bot
-            - agent:open-bot

package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/default-instance-inheritance.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for default-instance structural inheritance (default_of).
@@ -7,8 +7,8 @@
 # A blueprint's system-managed default instance carries a single
 #   instance#default_of@<blueprint>:<id>
 # tuple and inherits the blueprint's ENTIRE viewer set through
-# `viewer from default_of` — org members, public users (allow_public), and
-# platform users (identity_provider#platform_user). No enum-derived
+# `viewer from default_of` — org members and platform users
+# (identity_provider#platform_user). No enum-derived
 # visibility tuples are ever written on default instances, so their access
 # can never drift from the template's.
 #
@@ -20,8 +20,7 @@
 # visibility level; each has a default instance linked via default_of.
 # Alice (acme member) reaches default instances of platform-shared
 # blueprints; planton members reach default instances of org-visible ones;
-# everyone reaches default instances of public ones; personal instances
-# never leak.
+# personal instances never leak.
 name: default-instance-inheritance
 model_file: ../model/fga.mod
 
@@ -115,35 +114,6 @@ tuples:
     relation: default_of
     object: agent_instance:internal-default
 
-  # --- Public agent + its default instance ---
-  # PUBLIC carries the org floor tuple too (viewer@org#viewer).
-  - user: organization:planton
-    relation: organization
-    object: agent:public-bot
-  - user: identity_account:swarup
-    relation: owner
-    object: agent:public-bot
-  - user: identity_account:*
-    relation: viewer
-    object: agent:public-bot
-    condition:
-      name: allow_public
-  - user: organization:planton#viewer
-    relation: viewer
-    object: agent:public-bot
-  - user: organization:planton
-    relation: organization
-    object: agent_instance:public-bot-default
-  - user: agent:public-bot
-    relation: agent
-    object: agent_instance:public-bot-default
-  - user: identity_account:swarup
-    relation: owner
-    object: agent_instance:public-bot-default
-  - user: agent:public-bot
-    relation: default_of
-    object: agent_instance:public-bot-default
-
   # --- Platform-shared workflow + its default instance ---
   - user: organization:planton
     relation: organization
@@ -175,8 +145,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent_instance:sara-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -187,8 +155,6 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent_instance:sara-default
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -199,14 +165,10 @@ tests:
       # default_of tuple — only she (its owner) can reach it.
       - user: identity_account:swarup
         object: agent_instance:alice-personal
-        context:
-          allow: false
         assertions:
           can_view: false
       - user: identity_account:alice
         object: agent_instance:alice-personal
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -215,8 +177,6 @@ tests:
     check:
       - user: identity_account:priya
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -226,34 +186,19 @@ tests:
       # read audience, and the default instance inherits it structurally.
       - user: identity_account:veda
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: false
       # Managed-org membership grants nothing on non-platform-shared agents.
       - user: identity_account:alice
         object: agent_instance:internal-default
-        context:
-          allow: false
         assertions:
           can_view: false
 
-  - name: everyone reaches the default instance of a public agent
-    check:
-      - user: identity_account:mallory
-        object: agent_instance:public-bot-default
-        context:
-          allow: true
-        assertions:
-          can_view: true
-
   - name: managed-org member reaches the default instance of a platform-shared workflow
     check:
       - user: identity_account:alice
         object: workflow_instance:onboarding-default
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -263,8 +208,6 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent_instance
-        context:
-          allow: false
         assertions:
           can_view:
             - agent_instance:sara-default

package/src/authorization/__tests__/fixtures/fga/mcp-server-authoring.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/mcp-server-authoring.fga.yaml
-# at commit 4c03c38d2 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for MCP-server authoring: an MCP server is an organization's
@@ -88,24 +88,18 @@ tests:
     check:
       - user: identity_account:dave
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_connect: true
           can_edit: false
       - user: identity_account:vera
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_connect: true
           can_edit: false
       - user: identity_account:mallory
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: false
           can_connect: false
@@ -114,30 +108,22 @@ tests:
     check:
       - user: identity_account:oscar
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: true
           can_connect: true
           can_edit: true
       - user: identity_account:olivia
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
       - user: identity_account:dave
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: false
           can_connect: false
       - user: identity_account:vera
         object: mcp_server:vault
-        context:
-          allow: false
         assertions:
           can_view: false
           can_connect: false

package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/org-admin-owner-inheritance.fga.yaml
-# as changed by stigmer-cloud#757 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for org-admin owner inheritance (T08).
@@ -131,8 +131,6 @@ tests:
     check:
       - user: identity_account:ana
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -169,8 +167,6 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: skill:carols-notes
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -178,8 +174,6 @@ tests:
           can_grant_access: true
       - user: identity_account:ana
         object: workflow:carols-flow
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -197,8 +191,6 @@ tests:
     check:
       - user: identity_account:root
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_edit: true
           can_delete: true
@@ -218,8 +210,6 @@ tests:
     check:
       - user: identity_account:dave
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -250,8 +240,6 @@ tests:
     check:
       - user: identity_account:zara
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -266,8 +254,6 @@ tests:
     check:
       - user: identity_account:ana
         object: agent_instance:carols-instance
-        context:
-          allow: false
         assertions:
           can_view: false
           can_edit: false
@@ -297,8 +283,6 @@ tests:
     check:
       - user: identity_account:carol
         object: agent:carols-bot
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -309,8 +293,6 @@ tests:
     list_objects:
       - user: identity_account:ana
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:carols-bot
@@ -318,8 +300,6 @@ tests:
             - agent:carols-bot
       - user: identity_account:ana
         type: agent_instance
-        context:
-          allow: false
         assertions:
           can_view: []
       - user: identity_account:ana

package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml

@@ -1,5 +1,5 @@
 # Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/platform-visibility.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
+# as changed by stigmer-cloud#765 (the OpenFGA store test the cloud runs against its live model).
 # The body below is byte-identical to the source; the cloud re-runs the LIVE
 # file against this evaluator at the re-pin, so a stale copy is caught there.
 # Store tests for platform visibility (visibility_platform).
@@ -102,8 +102,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -112,8 +110,6 @@ tests:
           can_delete: false
       - user: identity_account:bob
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -122,8 +118,6 @@ tests:
     check:
       - user: identity_account:mallory
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -133,8 +127,6 @@ tests:
     check:
       - user: identity_account:priya
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -144,8 +136,6 @@ tests:
       # narrower: platform_user resolves member-from-managed_org.)
       - user: identity_account:veda
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: false
@@ -154,8 +144,6 @@ tests:
     check:
       - user: identity_account:alice
         object: agent:internal-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -163,8 +151,6 @@ tests:
       # without an explicit visibility tuple.
       - user: identity_account:priya
         object: agent:internal-bot
-        context:
-          allow: false
         assertions:
           can_view: false
           can_execute: false
@@ -173,8 +159,6 @@ tests:
     check:
       - user: identity_account:alice
         object: skill:research
-        context:
-          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -184,8 +168,6 @@ tests:
     check:
       - user: identity_account:alice
         object: workflow:onboarding
-        context:
-          allow: false
         assertions:
           can_view: true
           can_execute: true
@@ -194,8 +176,6 @@ tests:
     check:
       - user: identity_account:alice
         object: mcp_server:github
-        context:
-          allow: false
         assertions:
           can_view: true
           can_use: true
@@ -205,8 +185,6 @@ tests:
     check:
       - user: identity_account:swarup
         object: agent:sara
-        context:
-          allow: false
         assertions:
           can_view: true
           can_edit: true
@@ -216,8 +194,6 @@ tests:
     list_objects:
       - user: identity_account:alice
         type: agent
-        context:
-          allow: false
         assertions:
           can_view:
             - agent:sara