@stigmer/server 3.23.0 → 3.23.1-dev.20260923075205

package/src/query/search/__tests__/criteria.test.ts

@@ -25,8 +25,6 @@ function criteria(overrides?: {
   kinds?: ApiResourceKind[];
   query?: string;
   org?: string;
-  excludePublic?: boolean;
-  crossOrgPublic?: boolean;
   pageNumber?: number;
   pageSize?: number;
 }): SearchCriteria {
@@ -34,8 +32,6 @@ function criteria(overrides?: {
     overrides?.kinds ?? [],
     overrides?.query ?? "",
     overrides?.org ?? "",
-    overrides?.excludePublic ?? false,
-    overrides?.crossOrgPublic ?? false,
     overrides?.pageNumber ?? 1,
     overrides?.pageSize ?? 20,
   );

package/src/query/search/__tests__/query-store.test.ts

@@ -3,8 +3,8 @@
  * sqlite_search_query_store_test.go (the kind-parsing table) and
  * sqlite_search_query_store_query_test.go (the end-to-end
  * write→index→query pins: session list mode, the #440 emptiness arm, the
- * #439 newly-searchable-kind arm), plus the scope-filter matrix
- * (org strict / crossOrgPublic / excludePublic) and RebuildIndex —
+ * #439 newly-searchable-kind arm), plus the scope filter (org strict:
+ * visibility never widens or narrows it) and RebuildIndex —
  * including the DD-D proof: rebuilding over an ADOPTED Go-created
  * database re-indexes the rows it already holds. The escaping and
  * score-normalization tables moved with their code into the sqlite
@@ -118,8 +118,6 @@ function criteria(overrides: {
   kinds?: ApiResourceKind[];
   query?: string;
   org?: string;
-  excludePublic?: boolean;
-  crossOrgPublic?: boolean;
   pageNumber?: number;
   pageSize?: number;
 }): SearchCriteria {
@@ -127,8 +125,6 @@ function criteria(overrides: {
     overrides.kinds ?? [],
     overrides.query ?? "",
     overrides.org ?? "",
-    overrides.excludePublic ?? false,
-    overrides.crossOrgPublic ?? false,
     overrides.pageNumber ?? 1,
     overrides.pageSize ?? 20,
   );
@@ -249,7 +245,7 @@ describe("write→index→query pins (Go's query_test.go)", () => {
   });
 });
 
-describe("scope-filter matrix (Go buildScopeFilter)", () => {
+describe("scope filter (the org filter is strict)", () => {
   beforeEach(async () => {
     await seed(
       ApiResourceKind.session,
@@ -269,10 +265,10 @@ describe("scope-filter matrix (Go buildScopeFilter)", () => {
     );
     await seed(
       ApiResourceKind.session,
-      "ses-b-public",
+      "ses-b-org",
       SessionSchema,
-      newSession("ses-b-public", "org-b", "b public", {
-        visibility: ApiResourceVisibility.visibility_public,
+      newSession("ses-b-org", "org-b", "b org", {
+        visibility: ApiResourceVisibility.visibility_org,
         createdAtSeconds: 1_700_000_001,
       }),
     );
@@ -288,38 +284,15 @@ describe("scope-filter matrix (Go buildScopeFilter)", () => {
     expect(ids(result)).toEqual(["ses-a-private"]);
   });
 
-  it("crossOrgPublic widens to OTHER orgs' public rows only", async () => {
+  it("another org's rows stay out of an org filter whatever their visibility", async () => {
     const result = await queryStore.search(
-      criteria({
-        kinds: [ApiResourceKind.session],
-        org: "org-a",
-        crossOrgPublic: true,
-      }),
+      criteria({ kinds: [ApiResourceKind.session], org: "org-b" }),
     );
     expect(new Set(ids(result))).toEqual(
-      new Set(["ses-a-private", "ses-b-public"]),
+      new Set(["ses-b-private", "ses-b-org"]),
     );
   });
 
-  it("excludePublic subtracts public rows from any scope", async () => {
-    const unscoped = await queryStore.search(
-      criteria({ kinds: [ApiResourceKind.session], excludePublic: true }),
-    );
-    expect(new Set(ids(unscoped))).toEqual(
-      new Set(["ses-a-private", "ses-b-private"]),
-    );
-
-    const widened = await queryStore.search(
-      criteria({
-        kinds: [ApiResourceKind.session],
-        org: "org-a",
-        crossOrgPublic: true,
-        excludePublic: true,
-      }),
-    );
-    expect(ids(widened)).toEqual(["ses-a-private"]);
-  });
-
   it("no org filter returns every row, newest first (list mode ordering)", async () => {
     const result = await queryStore.search(
       criteria({ kinds: [ApiResourceKind.session] }),
@@ -327,7 +300,7 @@ describe("scope-filter matrix (Go buildScopeFilter)", () => {
     expect(ids(result)).toEqual([
       "ses-a-private",
       "ses-b-private",
-      "ses-b-public",
+      "ses-b-org",
     ]);
   });
 });
@@ -474,9 +447,7 @@ describe("rebuildIndex", () => {
         "skl_1",
         SkillSchema,
       );
-      expect(toBinary(SkillSchema, raw)).toEqual(
-        toBinary(SkillSchema, skill),
-      );
+      expect(toBinary(SkillSchema, raw)).toEqual(toBinary(SkillSchema, skill));
     } finally {
       await adopted.close();
       fixture.cleanup();

package/src/query/search/controller.ts

@@ -61,7 +61,6 @@ async function search(
     kinds: request.kinds.map((kind) => ApiResourceKind[kind] ?? String(kind)),
     query: request.query,
     org: request.org,
-    exclude_public: request.excludePublic,
   });
 
   try {

package/src/query/search/criteria.ts

@@ -98,8 +98,6 @@ export class SearchCriteria {
     private readonly requestedKinds: readonly ApiResourceKind[],
     private readonly queryText: string,
     private readonly orgFilterValue: string,
-    private readonly excludePublicFlag: boolean,
-    private readonly crossOrgPublicFlag: boolean,
     private readonly pageNumberValue: number,
     private readonly pageSizeValue: number,
   ) {}
@@ -121,8 +119,6 @@ export class SearchCriteria {
     kinds: readonly ApiResourceKind[],
     query: string,
     orgFilter: string,
-    excludePublic: boolean,
-    crossOrgPublic: boolean,
     pageNumber: number,
     pageSize: number,
   ): SearchCriteria {
@@ -136,8 +132,6 @@ export class SearchCriteria {
       [...kinds],
       normalizedQuery,
       goTrimSpace(orgFilter),
-      excludePublic,
-      crossOrgPublic,
       pageNumber < 1 ? 1 : pageNumber,
       pageSize < 1 ? DEFAULT_PAGE_SIZE : Math.min(pageSize, MAX_PAGE_SIZE),
     );
@@ -156,14 +150,6 @@ export class SearchCriteria {
     return this.orgFilterValue;
   }
 
-  excludePublic(): boolean {
-    return this.excludePublicFlag;
-  }
-
-  crossOrgPublic(): boolean {
-    return this.crossOrgPublicFlag;
-  }
-
   pageNumber(): number {
     return this.pageNumberValue;
   }

package/src/query/search/handler.ts

@@ -52,10 +52,11 @@ export class SearchHandler {
    * mapping string-matches them (#478 sanitization contract).
    *
    * With a composed ListReadScope (20260830.01, census lane 21) the
-   * store read carries a per-effective-kind authorized-id map — the Java
-   * SearchHandler's QueryAuthorizedIds step, with its crossOrgPublic
-   * bypass preserved verbatim (public-widened discovery is
-   * visibility-filtered by the engine, FGA never consulted). A scope
+   * store read ALWAYS carries a per-effective-kind authorized-id map —
+   * the Java SearchHandler's QueryAuthorizedIds step. There is no request
+   * shape that skips the scope: the one that did (the retired public
+   * level's cross-organization discovery, which the engine filtered by
+   * visibility with FGA never consulted) left with the level. A scope
    * failure propagates — the controller's default arm answers the
    * sanitized Internal, never a silently unscoped result.
    */
@@ -74,8 +75,6 @@ export class SearchHandler {
         request.kinds,
         request.query,
         request.org,
-        request.excludePublic,
-        request.crossOrgPublic,
         request.page?.num ?? 0,
         request.page?.size ?? 0,
       );
@@ -87,7 +86,7 @@ export class SearchHandler {
     }
 
     let authorizedIdsByKind: Map<string, ReadonlySet<string>> | undefined;
-    if (this.listReadScope !== undefined && !criteria.crossOrgPublic()) {
+    if (this.listReadScope !== undefined) {
       authorizedIdsByKind = new Map<string, ReadonlySet<string>>();
       for (const kind of criteria.effectiveKinds()) {
         authorizedIdsByKind.set(

package/src/query/search/query-store.ts

@@ -81,8 +81,6 @@ export class SqliteSearchQueryStore implements SearchQueryStore {
         // is already goTrimSpace'd). Engine syntax is the driver's job.
         terms: criteria.hasQuery() ? goFields(criteria.query()) : undefined,
         orgFilter: criteria.orgFilter(),
-        crossOrgPublic: criteria.crossOrgPublic(),
-        excludePublic: criteria.excludePublic(),
         limit: criteria.pageSize(),
         offset: criteria.offset(),
       });

package/src/store/__tests__/public-visibility-retired.test.ts

@@ -0,0 +1,127 @@
+/**
+ * Pins the driver-neutral half of the public-visibility data migration
+ * (public-visibility-retired.ts): the frozen kind table is exactly the
+ * seven kinds that could hold the level, a public row is moved to org with
+ * every other byte it carried intact (an unknown field a newer release
+ * wrote included), a row at any other level is left alone (undefined, so
+ * the driver never rewrites bytes it did not change; a row with no
+ * metadata holds no level and is one of these), and bytes that do not
+ * decode are a thrown fault, never a skipped row.
+ * The drivers' replay tests pin the SQL around this function.
+ */
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { BinaryWriter, WireType } from "@bufbuild/protobuf/wire";
+import { describe, expect, it } from "vitest";
+
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+
+import {
+  LEVEL_AFTER_RETIREMENT,
+  PUBLIC_ROW_KINDS_AT_RETIREMENT,
+  movePublicRowToOrg,
+} from "../public-visibility-retired.js";
+
+const AGENT = PUBLIC_ROW_KINDS_AT_RETIREMENT[0]!;
+
+function agentBytes(visibility: ApiResourceVisibility): Uint8Array {
+  return toBinary(
+    AgentSchema,
+    create(AgentSchema, {
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "Agent",
+      metadata: {
+        id: "agt_1",
+        name: "Public Agent",
+        slug: "public-agent",
+        org: "acme",
+        visibility,
+        labels: { team: "platform" },
+      },
+      spec: { instructions: "a conformant instruction body" },
+    }),
+  );
+}
+
+/** `bytes` followed by one field this schema does not declare (a newer release's). */
+function withUnknownField(bytes: Uint8Array): Uint8Array {
+  const trailer = new BinaryWriter()
+    .tag(4093, WireType.LengthDelimited)
+    .string("written by a release this one does not know")
+    .finish();
+  const joined = new Uint8Array(bytes.length + trailer.length);
+  joined.set(bytes, 0);
+  joined.set(trailer, bytes.length);
+  return joined;
+}
+
+describe("the frozen kind table", () => {
+  it("is exactly the seven kinds that could hold the level, by the enum names the drivers store", () => {
+    expect(PUBLIC_ROW_KINDS_AT_RETIREMENT.map((entry) => entry.kind)).toEqual([
+      "agent",
+      "skill",
+      "mcp_server",
+      "agent_instance",
+      "workflow",
+      "workflow_instance",
+      "plugin",
+    ]);
+    expect(AGENT.schema).toBe(AgentSchema);
+    expect(PUBLIC_ROW_KINDS_AT_RETIREMENT[1]!.schema).toBe(SkillSchema);
+  });
+});
+
+describe("movePublicRowToOrg", () => {
+  it("moves a public row to org and changes nothing else", () => {
+    const moved = movePublicRowToOrg(
+      AGENT,
+      agentBytes(ApiResourceVisibility.visibility_public),
+    );
+    expect(moved).toBeDefined();
+    const after = fromBinary(AgentSchema, moved!);
+    expect(after.metadata?.visibility).toBe(LEVEL_AFTER_RETIREMENT);
+    expect(after.metadata?.visibility).toBe(
+      ApiResourceVisibility.visibility_org,
+    );
+    // Every other byte: the moved row re-encodes to exactly the bytes an
+    // org row with the same content encodes to.
+    expect(moved).toEqual(agentBytes(ApiResourceVisibility.visibility_org));
+  });
+
+  it("keeps an unknown field a newer release wrote through the round trip", () => {
+    const moved = movePublicRowToOrg(
+      AGENT,
+      withUnknownField(agentBytes(ApiResourceVisibility.visibility_public)),
+    );
+    expect(moved).toEqual(
+      withUnknownField(agentBytes(ApiResourceVisibility.visibility_org)),
+    );
+  });
+
+  it("leaves a row at any other level alone", () => {
+    for (const level of [
+      ApiResourceVisibility.api_resource_visibility_unspecified,
+      ApiResourceVisibility.visibility_private,
+      ApiResourceVisibility.visibility_org,
+      ApiResourceVisibility.visibility_platform,
+    ]) {
+      expect(movePublicRowToOrg(AGENT, agentBytes(level))).toBeUndefined();
+    }
+  });
+
+  it("leaves a message with no metadata alone — it holds no level", () => {
+    expect(
+      movePublicRowToOrg(
+        AGENT,
+        toBinary(AgentSchema, create(AgentSchema, { kind: "Agent" })),
+      ),
+    ).toBeUndefined();
+  });
+
+  it("refuses bytes that do not decode as the kind", () => {
+    expect(() =>
+      movePublicRowToOrg(AGENT, new Uint8Array([0xff, 0xff, 0xff])),
+    ).toThrow();
+  });
+});

package/src/store/__tests__/store-contract.ts

@@ -934,8 +934,6 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: ["kubernetes"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -959,8 +957,6 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: ["kuber"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -970,8 +966,6 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: ["kubernetes", "deployment"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -981,8 +975,6 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: ["kubernetes", "absent"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -1008,8 +1000,6 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: ["NEAR", "plain"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -1039,8 +1029,6 @@ export function describeStoreContract(
         kinds: ["agent", "workflow"],
         terms: ["scoped"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         authorizedIdsByKind: new Map([["agent", new Set(["agt-mine"])]]),
         limit: 20,
         offset: 0,
@@ -1056,8 +1044,6 @@ export function describeStoreContract(
         kinds: ["agent", "workflow"],
         terms: ["scoped"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         authorizedIdsByKind: new Map([
           ["agent", new Set<string>()],
           ["workflow", new Set(["wfl-any"])],
@@ -1072,8 +1058,6 @@ export function describeStoreContract(
         kinds: ["agent", "workflow"],
         terms: ["scoped"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         authorizedIdsByKind: new Map([
           ["agent", new Set<string>()],
           ["workflow", new Set<string>()],
@@ -1089,15 +1073,13 @@ export function describeStoreContract(
         kinds: ["agent", "workflow"],
         terms: ["scoped"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
       expect(unscoped.totalCount).toBe(3);
     });
 
-    it("org scoping: strict filter, cross-org public widening, and the public subtraction", async () => {
+    it("org scoping is strict: the visibility column never widens or narrows the org filter", async () => {
       await fx.store.upsertSearchIndex(
         ApiResourceKind.agent,
         "agt-mine",
@@ -1105,11 +1087,11 @@ export function describeStoreContract(
       );
       await fx.store.upsertSearchIndex(
         ApiResourceKind.agent,
-        "agt-public",
+        "agt-platform",
         entry({
           name: "searchable beta",
           org: "globex",
-          visibility: "visibility_public",
+          visibility: "visibility_platform",
         }),
       );
       await fx.store.upsertSearchIndex(
@@ -1122,37 +1104,20 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: ["searchable"],
         orgFilter: "acme",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
       expect(strict.hits.map((hit) => hit.resourceId)).toEqual(["agt-mine"]);
 
-      const widened = await fx.store.querySearchIndex({
-        kinds: ["agent"],
-        terms: ["searchable"],
-        orgFilter: "acme",
-        crossOrgPublic: true,
-        excludePublic: false,
-        limit: 20,
-        offset: 0,
-      });
-      expect(new Set(widened.hits.map((hit) => hit.resourceId))).toEqual(
-        new Set(["agt-mine", "agt-public"]),
-      );
-
-      const noPublic = await fx.store.querySearchIndex({
+      const unscoped = await fx.store.querySearchIndex({
         kinds: ["agent"],
         terms: ["searchable"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: true,
         limit: 20,
         offset: 0,
       });
-      expect(new Set(noPublic.hits.map((hit) => hit.resourceId))).toEqual(
-        new Set(["agt-mine", "agt-foreign"]),
+      expect(new Set(unscoped.hits.map((hit) => hit.resourceId))).toEqual(
+        new Set(["agt-mine", "agt-platform", "agt-foreign"]),
       );
     });
 
@@ -1172,8 +1137,6 @@ export function describeStoreContract(
         kinds: ["agent"],
         terms: undefined,
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -1203,8 +1166,6 @@ export function describeStoreContract(
         kinds: ["organization"],
         terms: ["original"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -1214,8 +1175,6 @@ export function describeStoreContract(
         kinds: ["organization"],
         terms: ["renamed"],
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -1226,8 +1185,6 @@ export function describeStoreContract(
         kinds: ["organization"],
         terms: undefined,
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });
@@ -1243,8 +1200,6 @@ export function describeStoreContract(
         kinds: ["organization"],
         terms: undefined,
         orgFilter: "",
-        crossOrgPublic: false,
-        excludePublic: false,
         limit: 20,
         offset: 0,
       });

package/src/store/interface.ts

@@ -135,8 +135,9 @@ export interface SearchIndexEntry {
   /** Owning org (metadata.org) — org-scoped filtering. */
   readonly org: string;
   /**
-   * Visibility enum NAME (e.g. "visibility_public"); scope filtering only
-   * special-cases "visibility_public", all other levels are org-scoped.
+   * Visibility enum NAME (e.g. "visibility_org"), carried for display;
+   * scope filtering is by org and by the authorized-id map, never by
+   * this column.
    */
   readonly visibility: string;
   /** Unix seconds creation time — sorting in list mode (no query). */
@@ -166,10 +167,6 @@ export interface SearchIndexQuery {
   readonly terms: readonly string[] | undefined;
   /** Org scope; "" = no org filter. */
   readonly orgFilter: string;
-  /** With orgFilter: also admit visibility_public rows from ANY org. */
-  readonly crossOrgPublic: boolean;
-  /** Independent subtraction: drop visibility_public rows from any scope. */
-  readonly excludePublic: boolean;
   /**
    * Optional per-kind authorized-id allowlist (kind NAME → ids) — the
    * multi-tenant list-read scoping arm (20260830.01): a listed kind