@stigmer/server 3.23.0 → 3.23.1-dev.20260923075205

package/src/domain/agentshare/__tests__/create-authorization.test.ts

@@ -1,10 +1,12 @@
 /**
- * Pins the create lane's two-arm consent bar (steps.ts,
- * resolveShareCreateTargets), the Java handler's: a same-org share asks
- * can_edit on the referenced agent; a cross-org share asks can_execute on
- * the agent and then can_create_agent_share on the SHARING organization,
- * agent first; each question carries its byte-pinned copy; a missing
- * referenced agent throws.
+ * Pins the create lane's two questions (steps.ts, resolveShareCreateTargets):
+ * can_edit on the referenced agent, then can_create_agent_share on the
+ * share's organization, in that order, each with its byte-pinned copy. A
+ * share's agent lives in the share's organization (the resolve step refuses
+ * anything else before this runs), so the two bars are one organization's:
+ * sharing puts the agent in front of a wider audience (an editor's act) and
+ * spends the organization's credits on the open internet (an admin's). A
+ * missing referenced agent throws.
  */
 import { describe, expect, it } from "vitest";
 import { create } from "@bufbuild/protobuf";
@@ -24,15 +26,15 @@ import {
 } from "../steps.js";
 
 const agent = create(AgentSchema, {
-  metadata: { id: "agt_01public", name: "helper", org: "publisher-org" },
+  metadata: { id: "agt_01helper", name: "helper", org: "publisher-org" },
 });
 
-function ctxFor(shareOrg: string, agentOrg: string, stash = true) {
+function ctxFor(shareOrg: string, stash = true) {
   const ctx = new RequestContext(
     AgentShareSchema,
     create(AgentShareSchema, {
       metadata: { name: "helper", org: shareOrg },
-      spec: { agentRef: { org: agentOrg, slug: "helper" } },
+      spec: { agentRef: { org: shareOrg, slug: "helper" } },
     }),
     testCallerIdentity(),
     ApiResourceKind.agent_share,
@@ -44,33 +46,18 @@ function ctxFor(shareOrg: string, agentOrg: string, stash = true) {
 }
 
 describe("resolveShareCreateTargets", () => {
-  it("a same-org share asks can_edit on the referenced agent", () => {
-    expect(
-      resolveShareCreateTargets(ctxFor("publisher-org", "publisher-org")),
-    ).toEqual([
+  it("asks can_edit on the referenced agent, then can_create_agent_share on the share's organization", () => {
+    expect(resolveShareCreateTargets(ctxFor("publisher-org"))).toEqual([
       {
         permission: IamPermission.can_edit,
         resourceKind: ApiResourceKind.agent,
-        resourceId: "agt_01public",
-        deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
-      },
-    ]);
-  });
-
-  it("a cross-org share asks can_execute on the agent, then can_create_agent_share on the sharing organization", () => {
-    expect(
-      resolveShareCreateTargets(ctxFor("consumer-org", "publisher-org")),
-    ).toEqual([
-      {
-        permission: IamPermission.can_execute,
-        resourceKind: ApiResourceKind.agent,
-        resourceId: "agt_01public",
+        resourceId: "agt_01helper",
         deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
       },
       {
         permission: IamPermission.can_create_agent_share,
         resourceKind: ApiResourceKind.organization,
-        resourceId: "consumer-org",
+        resourceId: "publisher-org",
         deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
       },
     ]);
@@ -78,9 +65,7 @@ describe("resolveShareCreateTargets", () => {
 
   it("a missing referenced agent is a broken chain invariant and throws", () => {
     expect(() =>
-      resolveShareCreateTargets(
-        ctxFor("publisher-org", "publisher-org", false),
-      ),
+      resolveShareCreateTargets(ctxFor("publisher-org", false)),
     ).toThrow("referenced agent not found in context");
   });
 });

package/src/domain/agentshare/constants.ts

@@ -17,10 +17,12 @@ export const SHARE_LINK_TOKEN_BYTES = 20;
  * resolveShareDefaultsStep, byte-pinned. The share's org appears in the
  * hosted chat URL and is the billing org, so it can never be inferred.
  */
-export const ORG_REQUIRED_MESSAGE = "metadata.org is required for an agent share";
+export const ORG_REQUIRED_MESSAGE =
+  "metadata.org is required for an agent share";
 
 /** InvalidArgument copy when spec.agent_ref.slug is absent — Go, pinned. */
-export const AGENT_REF_SLUG_REQUIRED_MESSAGE = "spec.agent_ref.slug is required";
+export const AGENT_REF_SLUG_REQUIRED_MESSAGE =
+  "spec.agent_ref.slug is required";
 
 /**
  * InvalidArgument copy for BOTH profile lanes when org is absent — Go
@@ -28,34 +30,20 @@ export const AGENT_REF_SLUG_REQUIRED_MESSAGE = "spec.agent_ref.slug is required"
  * Anti-enumeration: an empty org would mean "match slug across all orgs"
  * on a public endpoint.
  */
-export const ORG_REQUIRED_FOR_LOOKUP_MESSAGE = "org is required for shared agent lookup";
+export const ORG_REQUIRED_FOR_LOOKUP_MESSAGE =
+  "org is required for shared agent lookup";
 
 /**
- * FailedPrecondition copy for an org-audience cross-org share (decision
- * 013 D3) — Go validateCrossOrgShare AND validateShareUpdateStep (update
- * replaces the spec wholesale and must not open a side door), byte-pinned.
+ * FailedPrecondition copy when spec.agent_ref names another organization's
+ * agent — the schedule's and the channel's same-organization sentence in
+ * the share's own words. A share offers an agent its own organization
+ * owns; to share another organization's agent, install the plugin that
+ * carries it and share the installed copy.
  */
-export function crossOrgAudienceMessage(agentOrg: string): string {
+export function sameOrgInvariantMessage(refOrg: string): string {
   return (
-    "a cross-org share must have a public audience — org-audience shares " +
-    `are limited to the agent's own organization (${agentOrg})`
-  );
-}
-
-/**
- * FailedPrecondition copy naming every non-public dependency blocking a
- * cross-org share (decision 013 D5) — Go validateCrossOrgShare,
- * byte-pinned. Blockers are deduped, formatted "<kind> <org>/<slug>", and
- * sorted, so the refusal is deterministic.
- */
-export function crossOrgBlockersMessage(
-  agentOrg: string,
-  agentSlug: string,
-  blockers: readonly string[],
-): string {
-  return (
-    `cannot share ${agentOrg}/${agentSlug} across organizations: ` +
-    `it references resources that are not public: ${blockers.join(", ")}`
+    "spec.agent_ref.org must match metadata.org — a share must live in " +
+    `the referenced agent's organization (${refOrg})`
   );
 }
 

package/src/domain/agentshare/controller.ts

@@ -93,7 +93,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -195,6 +198,7 @@ async function createShare(
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newStampAgentPinStep())
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -239,6 +243,7 @@ async function update(
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .build()
     .execute(reqCtx);

package/src/domain/agentshare/steps.ts

@@ -1,10 +1,19 @@
 /**
  * AgentShare domain steps — ports pkg/domain/agentshare/controller/steps.go
- * and the get_shared_profile.go helpers: share defaults + the cross-org
- * public-dependency contract (decision 013), the agent-id rebind pin, the
+ * and the get_shared_profile.go helpers: share defaults and the
+ * same-organization invariant on agent_ref, the agent-id rebind pin, the
  * update immutability rules, the uniform-NotFound profile resolution
  * helpers, and the constant-time link-token predicate.
  *
+ * A share's agent lives in the share's own organization. The
+ * cross-organization arm this domain once carried (a share of another
+ * organization's public agent, gated on a public audience and a sweep of
+ * the agent's dependencies for public visibility) left with the public
+ * level; sharing another organization's agent is done by installing the
+ * plugin that carries it and sharing the installed copy. A stored share
+ * whose agent is in another organization — a row from before — fails
+ * closed at the profile like a dangling reference.
+ *
  * OD-1 (deliberate exclusion): Go's boot migration
  * (pkg/domain/agentshare/migration/bootstrap_shares.go — protowire
  * decoding of the REMOVED Agent.spec.sharing fields into AgentShare rows)
@@ -29,11 +38,6 @@ import type { AgentShare } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v
 import { AgentShareStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/status_pb";
 import { SharedAgentProfileSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
 import type { SharedAgentProfile } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
-import { AgentShareAudience } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
@@ -52,7 +56,6 @@ import {
 } from "../../pipeline/steps/authorize.js";
 import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import type { GetByReferenceDesc } from "../../pipeline/steps/authorize-resolved-target.js";
-import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
 import {
@@ -60,8 +63,7 @@ import {
   ORG_REQUIRED_MESSAGE,
   SHARE_LINK_TOKEN_BYTES,
   agentRefImmutableMessage,
-  crossOrgAudienceMessage,
-  crossOrgBlockersMessage,
+  sameOrgInvariantMessage,
 } from "./constants.js";
 
 type AgentShareDesc = typeof AgentShareSchema;
@@ -84,21 +86,14 @@ export const SHARE_ORGANIZATION_DENIED_MESSAGE =
 
 /**
  * The create lane's authorization questions, for AuthorizeResolvedTarget
- * after ResolveShareDefaults: the two-arm consent bar the Java handler
- * enforced and the model's comment on can_create_agent_share describes.
- * The RPC is is_skip_authorization because the target is the referenced
- * agent, resolved from a slug, not a request field.
- *
- * A same-org share (spec.agent_ref.org equals metadata.org, after the
- * resolve step made the reference absolute) asks can_edit on the agent:
- * sharing puts the agent in front of a wider audience, an editor's act.
- *
- * A cross-org share of another organization's public agent asks two
- * questions, agent first as Java did: can_execute on the agent (whoever may
- * run it may offer it) and then can_create_agent_share on the SHARING
- * organization — a public share spends that organization's credits on the
- * open internet, an admin-level act. The cross-org validity rules (public
- * agent, no org audience, public dependencies) stay the resolve step's.
+ * after ResolveShareDefaults, agent first: can_edit on the agent (sharing
+ * puts it in front of a wider audience, an editor's act) and then
+ * can_create_agent_share on the organization (a share spends the
+ * organization's credits on the open internet, an admin-level act). The
+ * RPC is is_skip_authorization because the target is the referenced agent,
+ * resolved from a slug, not a request field. The resolve step has already
+ * made the reference absolute and refused an agent outside the share's
+ * organization, so the two bars are always the same organization's.
  */
 export function resolveShareCreateTargets(
   ctx: RequestContext<AgentShareDesc>,
@@ -107,24 +102,17 @@ export function resolveShareCreateTargets(
   if (agent === undefined) {
     throw new Error("referenced agent not found in context");
   }
-  const share = ctx.newState;
-  const shareOrg = share.metadata?.org ?? "";
-  const crossOrg = (share.spec?.agentRef?.org ?? "") !== shareOrg;
-  const agentBar: AuthorizationTarget = {
-    permission: crossOrg ? IamPermission.can_execute : IamPermission.can_edit,
-    resourceKind: ApiResourceKind.agent,
-    resourceId: agent.metadata?.id ?? "",
-    deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
-  };
-  if (!crossOrg) {
-    return [agentBar];
-  }
   return [
-    agentBar,
+    {
+      permission: IamPermission.can_edit,
+      resourceKind: ApiResourceKind.agent,
+      resourceId: agent.metadata?.id ?? "",
+      deniedMessage: SHARE_AGENT_DENIED_MESSAGE,
+    },
     {
       permission: IamPermission.can_create_agent_share,
       resourceKind: ApiResourceKind.organization,
-      resourceId: shareOrg,
+      resourceId: ctx.newState.metadata?.org ?? "",
       deniedMessage: SHARE_ORGANIZATION_DENIED_MESSAGE,
     },
   ];
@@ -306,10 +294,12 @@ export async function findShareByOrgAndSlug(
 /**
  * ResolveShareDefaults — Go resolveShareDefaultsStep:
  *   1. Requires metadata.org (URL + billing identity, never inferred).
- *   2. Normalizes spec.agent_ref.org (empty means same-org) and loads the
- *      referenced agent — a nonexistent agent is refused with the same
- *      NOT_FOUND a direct agent lookup would produce.
- *   3. For a CROSS-ORG share, enforces the decision-013 contract.
+ *   2. Normalizes spec.agent_ref.org (empty means same-org) and refuses an
+ *      agent_ref that names another organization (the module header) with
+ *      the same-organization sentence, BEFORE any lookup, so the share
+ *      lane never says whether another organization's slug exists.
+ *   3. Loads the referenced agent — a nonexistent agent is refused with
+ *      the same NOT_FOUND a direct agent lookup would produce.
  *   4. Defaults metadata.slug (and name) from the agent when the caller
  *      provided neither — the canonical share keeps the agent's hosted URL.
  *      Runs before ResolveSlug, which skips already-set slugs.
@@ -337,6 +327,9 @@ export function newResolveShareDefaultsStep(
       if (agentRef!.org === "") {
         agentRef!.org = metadata!.org;
       }
+      if (agentRef!.org !== metadata!.org) {
+        throw failedPreconditionError(sameOrgInvariantMessage(agentRef!.org));
+      }
 
       const agent = await findAgentByOrgAndSlug(
         store,
@@ -347,10 +340,6 @@ export function newResolveShareDefaultsStep(
         throw notFoundError("Agent", agentRef!.slug);
       }
 
-      if (agentRef!.org !== metadata!.org) {
-        await validateCrossOrgShare(store, share, agent);
-      }
-
       ctx.set(REFERENCED_AGENT_KEY, agent);
 
       // Canonical-share default: no slug and no name means "share this
@@ -364,133 +353,6 @@ export function newResolveShareDefaultsStep(
   };
 }
 
-/**
- * The cross-org share contract (decision 013) — Go validateCrossOrgShare:
- *   - The agent must be marketplace-public; a non-public agent is refused
- *     with the same NOT_FOUND as a missing one (no existence probe for
- *     private slugs).
- *   - The audience must be public — org-audience semantics don't carry
- *     across the org boundary.
- *   - Every declared dependency must itself be public; the refusal names
- *     every blocker (sorted) so the sharing org knows exactly what to ask
- *     the agent's org to publish.
- * Runtime re-enforcement is cloud-side; this create-time sweep is the
- * fail-loud half, mirrored in both editions.
- */
-async function validateCrossOrgShare(
-  store: Store,
-  share: AgentShare,
-  agent: Agent,
-): Promise<void> {
-  const agentMeta = agent.metadata;
-
-  if (agentMeta?.visibility !== ApiResourceVisibility.visibility_public) {
-    throw notFoundError("Agent", agentMeta?.slug ?? "");
-  }
-
-  // protobuf-es strips the shared enum prefix: proto
-  // agent_share_audience_org generates as AgentShareAudience.org.
-  if (share.spec?.audience === AgentShareAudience.org) {
-    throw failedPreconditionError(crossOrgAudienceMessage(agentMeta.org));
-  }
-
-  const blockers = await findNonPublicDependencies(store, agent);
-  if (blockers.length > 0) {
-    throw failedPreconditionError(
-      crossOrgBlockersMessage(agentMeta.org, agentMeta.slug, blockers),
-    );
-  }
-}
-
-/**
- * Sweeps the agent's declared blueprint dependencies — skill_refs
- * (including every sub-agent's) and mcp_server_usages — and returns a
- * deterministic "kind org/slug" entry for each that is missing or not
- * visibility_public — Go findNonPublicDependencies. A reference with an
- * empty org is relative to the AGENT's org (defensive parity with the
- * cloud edition's referenceMatches; agent writes normalize refs to
- * absolute form).
- */
-async function findNonPublicDependencies(
-  store: Store,
-  agent: Agent,
-): Promise<string[]> {
-  const spec = agent.spec;
-  const agentOrg = agent.metadata?.org ?? "";
-
-  interface DepRef {
-    kind: ApiResourceKind;
-    org: string;
-    slug: string;
-  }
-
-  const seen = new Set<string>();
-  const deps: DepRef[] = [];
-  const add = (
-    kind: ApiResourceKind,
-    ref: ApiResourceReference | undefined,
-  ): void => {
-    if (ref === undefined || ref.slug === "") {
-      return;
-    }
-    const org = ref.org !== "" ? ref.org : agentOrg;
-    const key = `${kind}|${org}|${ref.slug}`;
-    if (!seen.has(key)) {
-      seen.add(key);
-      deps.push({ kind, org, slug: ref.slug });
-    }
-  };
-
-  for (const ref of spec?.skillRefs ?? []) {
-    add(ApiResourceKind.skill, ref);
-  }
-  for (const sub of spec?.subAgents ?? []) {
-    for (const ref of sub.skillRefs) {
-      add(ApiResourceKind.skill, ref);
-    }
-  }
-  for (const usage of spec?.mcpServerUsages ?? []) {
-    add(ApiResourceKind.mcp_server, usage.mcpServerRef);
-  }
-
-  const blockers: string[] = [];
-  for (const dep of deps) {
-    let visibility: ApiResourceVisibility | undefined;
-    try {
-      // Per-kind resolution, exactly Go's switch — skill and mcp_server
-      // are the only dependency kinds an agent blueprint declares.
-      const resolved =
-        dep.kind === ApiResourceKind.skill
-          ? await findResourceBySlug(
-              store,
-              dep.kind,
-              SkillSchema,
-              dep.slug,
-              dep.org,
-            )
-          : await findResourceBySlug(
-              store,
-              dep.kind,
-              McpServerSchema,
-              dep.slug,
-              dep.org,
-            );
-      visibility = resolved?.metadata?.visibility;
-    } catch (error) {
-      throw internalError(
-        error,
-        `failed to resolve ${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug} while validating cross-org share`,
-      );
-    }
-    if (visibility !== ApiResourceVisibility.visibility_public) {
-      blockers.push(`${ApiResourceKind[dep.kind]} ${dep.org}/${dep.slug}`);
-    }
-  }
-
-  blockers.sort();
-  return blockers;
-}
-
 /**
  * StampAgentPin — Go stampAgentPinStep: writes status.agent_id, the
  * server-owned rebind pin (decision 013). agent_ref is org+slug and slugs
@@ -524,10 +386,8 @@ export function newStampAgentPinStep(): PipelineStep<AgentShareDesc> {
 
 /**
  * ValidateShareUpdate — Go validateShareUpdateStep: spec.agent_ref must
- * keep referencing the same agent, and the cross-org public-audience rule
- * must hold on update too (update replaces the spec wholesale and must not
- * open a side door to an org-audience cross-org share). Runs after
- * LoadExisting. metadata.slug/org immutability needs no step — the generic
+ * keep referencing the same agent. Runs after LoadExisting.
+ * metadata.slug/org immutability needs no step — the generic
  * BuildUpdateState preserves both, and status (including the pin and link
  * token) wholesale.
  */
@@ -564,14 +424,6 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
           ),
         );
       }
-
-      const isCrossOrg =
-        (existingRef?.org ?? "") !== (existing.metadata?.org ?? "");
-      if (isCrossOrg && ctx.input.spec?.audience === AgentShareAudience.org) {
-        throw failedPreconditionError(
-          crossOrgAudienceMessage(existingRef?.org ?? ""),
-        );
-      }
     },
   };
 }
@@ -583,8 +435,8 @@ export function newValidateShareUpdateStep(): PipelineStep<AgentShareDesc> {
  * SHARE; display fields and default_instance_id from the AGENT. Three
  * misses all fail closed with the uniform refusal, indistinguishable from
  * absence: a dangling agent_ref, a stale agent-id pin (the rebind guard),
- * and a cross-org agent no longer visibility_public (withdrawing public
- * visibility must kill every external channel).
+ * and an agent in another organization (a share written before the
+ * same-organization invariant; this release serves no such share).
  */
 export async function buildSharedAgentProfile(
   store: Store,
@@ -605,12 +457,7 @@ export async function buildSharedAgentProfile(
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 
-  const isCrossOrg =
-    (share.metadata?.org ?? "") !== (agent.metadata?.org ?? "");
-  if (
-    isCrossOrg &&
-    agent.metadata?.visibility !== ApiResourceVisibility.visibility_public
-  ) {
+  if ((share.metadata?.org ?? "") !== (agent.metadata?.org ?? "")) {
     throw sharedNotFound(share.metadata?.slug ?? "");
   }
 

package/src/domain/environment/controller.ts

@@ -63,7 +63,6 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
-import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import {
   newBuildNewStateStep,
   setAuditFieldsForUpdate,
@@ -97,7 +96,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -244,6 +246,7 @@ async function update(
     .addStep(newPreserveRedactedSecretsStep())
     .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newDestroyDroppedEnvironmentSecretsStep(deps.secretService, deps.logger),
@@ -398,12 +401,6 @@ async function updateVisibility(
     // After load, per the cross-edition error precedence: unknown id +
     // bad level = NOT_FOUND on both editions.
     .addStep(newValidateVisibilityUpdateStep())
-    .addStep(
-      newAuthorizeVisibilityTransitionStep(
-        UPDATE_VISIBILITY_ENVIRONMENT_KEY,
-        deps.authorizer,
-      ),
-    )
     .addStep(newValidateEnvironmentShareRestrictionStep())
     .addStep(newSetEnvironmentVisibilityStep())
     .addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store))

package/src/domain/executioncontext/controller.ts

@@ -82,7 +82,10 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newNormalizeReferencesStep,
+  newValidateReferencesStep,
+} from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -186,6 +189,7 @@ async function createExecutionContext(
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
+    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
     .addStep(newPersistStep(deps.store))
     .addStep(