@stigmer/server 3.30.0 → 3.32.0

package/src/domain/oauthapp/controller.ts

@@ -12,15 +12,20 @@
  * The secret contract: client_secret is AES-256-GCM encrypted at rest via
  * the SAME SecretService instance the Environment controller uses (Go
  * wires one service for both), and redacted to ***REDACTED*** on every
- * read surface; the marker round-trips on update/apply as "keep the stored
- * secret"; client-supplied enc:v<N>:-shaped values are refused on every
- * write door (oss#395). Deletion is blocked while an McpServer's
- * oauth_app_ref resolves to the app (stigmer/stigmer#584).
+ * response, the delete's included; the marker round-trips on update/apply
+ * as "keep the stored secret"; client-supplied enc:v<N>:-shaped values are
+ * refused on every write door (oss#395). Deletion is blocked while an
+ * McpServer's oauth_app_ref resolves to the app (stigmer/stigmer#584).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing), and
- * OAuthApp is deliberately not search-indexed (a configuration resource;
- * `not_search_indexed` in the kind registry).
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded app exactly as `get` would
+ * (AuthorizeResolvedTarget); listByOrg narrows through the list read
+ * scope, so a caller who may not `get` an app does not see it listed
+ * either: the model shows an app to its creator and the organization's
+ * admins, never to members or viewers (fga/model/iam/oauth_app.fga,
+ * stigmer/stigmer#1257). OAuthApp is deliberately not search-indexed (a
+ * configuration resource; `not_search_indexed` in the kind registry).
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, fromBinary } from "@bufbuild/protobuf";
@@ -43,6 +48,8 @@ import { OAuthAppQueryController } from "@stigmer/protos/ai/stigmer/iam/oauthapp
 
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { internalError } from "../../pipeline/errors.js";
@@ -105,6 +112,8 @@ export interface OAuthAppControllerDeps {
   readonly authorizer: Authorizer;
   /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+  /** The composed list read scope — listByOrg narrows through it; undefined = the OSS full scan (stigmer/stigmer#1257). */
+  readonly listReadScope: ListReadScope | undefined;
 }
 
 /** Registers both OAuthApp services on the router (routes stage). */
@@ -261,8 +270,10 @@ async function apply(
  * between load and delete. The RESOURCE_ID_KEY is set manually because
  * ApiResourceDeleteInput carries resourceId, not the value field
  * ExtractResourceId expects (the environment-domain pattern). Returns the
- * deleted resource for the audit trail — unredacted, exactly as Go does
- * (see redactOAuthApp's header for the disclosure).
+ * deleted app for the audit trail, redacted like every other response (the
+ * ChannelApp and Environment delete shape): the chain has already
+ * destroyed the sealed secret, so the stored value could only leak
+ * (stigmer/stigmer#1257).
  */
 async function deleteOAuthApp(
   deps: OAuthAppControllerDeps,
@@ -311,7 +322,9 @@ async function deleteOAuthApp(
       "deleted OAuthApp not found in context",
     );
   }
-  return deleted as OAuthApp;
+  const app = deleted as OAuthApp;
+  redactOAuthApp(app);
+  return app;
 }
 
 /** Get — LoadTarget by id, then redact (Go buildGetPipeline). */
@@ -382,9 +395,11 @@ async function getByReference(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * ListByOrg — all OAuthApps whose metadata.org matches, each redacted,
- * sorted created_at descending (Go listByOrgStep). No pagination:
- * typically 1–5 per org. No authorization filtering in OSS.
+ * ListByOrg — the organization's OAuthApps the caller may view, each
+ * redacted, sorted created_at descending (Go listByOrgStep). No
+ * pagination: typically 1–5 per org. The annotation admits anyone who can
+ * view the organization; the list read scope then keeps only the apps a
+ * `get` would return (stigmer/stigmer#1257).
  */
 async function listByOrg(
   deps: OAuthAppControllerDeps,
@@ -408,7 +423,7 @@ async function listByOrg(
       ),
     )
     .addStep(newValidateProtoStep())
-    .addStep(newListByOrgStep(deps.store, deps.logger))
+    .addStep(newListByOrgStep(deps.store, deps.listReadScope, deps.logger))
     .build()
     .execute(reqCtx);
 
@@ -422,9 +437,17 @@ async function listByOrg(
   return list as OAuthApps;
 }
 
-/** The domain-local list step: load all, filter by org, redact, sort. */
+/**
+ * The domain-local list step: load all, keep the request's org, narrow to
+ * the caller's apps, redact, sort. The org predicate stays the step's own
+ * because with no scope composed the helper returns its input unchanged
+ * and never reads the org (the trusted-local full scan); with one, the
+ * scope is the last per-row predicate, so a composed driver is asked about
+ * the org's apps, never every tenant's (the environment list's order).
+ */
 function newListByOrgStep(
   store: Store,
+  listReadScope: ListReadScope | undefined,
   logger: Logger,
 ): PipelineStep<typeof OAuthAppQueryController.method.listByOrg.input> {
   return {
@@ -443,7 +466,7 @@ function newListByOrgStep(
         throw internalError(error, "failed to list OAuthApps");
       }
 
-      const apps: OAuthApp[] = [];
+      const requested: OAuthApp[] = [];
       for (const data of resources) {
         let app: OAuthApp;
         try {
@@ -457,8 +480,18 @@ function newListByOrgStep(
         if ((app.metadata?.org ?? "") !== org) {
           continue;
         }
+        requested.push(app);
+      }
+
+      const apps = await restrictListByReadScope(
+        listReadScope,
+        ctx.callerIdentity,
+        ApiResourceKind.oauth_app,
+        requested,
+        "",
+      );
+      for (const app of apps) {
         redactOAuthApp(app);
-        apps.push(app);
       }
 
       apps.sort((a, b) =>

package/src/domain/oauthapp/refresolution.ts

@@ -7,8 +7,9 @@
  * answers): the read-path oauth_status enricher (mcpserver, #9), the
  * OAuth initiate and token-refresh paths (#19 — refresh MUST use the app
  * initiate selected or it runs against the wrong vendor credentials), and
- * the OAuthApp delete guard (#13). This file seeds src/domain/oauthapp/;
- * the domain's controllers arrive with #13.
+ * the OAuthApp delete guard (#13). Every consumer imports it from here,
+ * so there is one ladder to change (stigmer/stigmer#1173 removed a
+ * second copy the delete guard had read).
  *
  * Resolution semantics: OSS has a flat OAuthApp store — no org-override
  * chain like the cloud's OAuthAppResolutionService, so the ref is the

package/src/domain/oauthapp/steps.ts

@@ -33,18 +33,18 @@ import {
   REDACTED_MARKER,
   deleteBlockedByMcpServerMessage,
 } from "./constants.js";
-import { resolveOAuthAppRef } from "./refresolution/refresolution.js";
+import { resolveOAuthAppRef } from "./refresolution.js";
 
 /**
  * Replaces client_secret with the redaction marker (Go RedactOAuthApp).
  *
  * A function rather than a pipeline step because redaction applies at
  * different points per operation: create/update after persist on newState;
- * get/getByReference after load on the target; listByOrg per entry. Go's
- * response list deliberately excludes DELETE — the delete RPC returns the
- * STORED resource with its encrypted secret intact, ported byte-faithfully
- * and disclosed in the PR (a cross-edition follow-up candidate: with
- * encryption disabled the stored value is plaintext).
+ * get/getByReference after load on the target; listByOrg per entry; delete
+ * on the removed row after its chain. Every response is redacted, the
+ * delete's included: the Go port returned the stored secret from delete —
+ * ciphertext, or plaintext on a keyless server — which no reader needs
+ * once the chain has destroyed the sealed value (stigmer/stigmer#1257).
  */
 export function redactOAuthApp(app: OAuthApp): void {
   if (app.spec !== undefined && app.spec.clientSecret !== "") {

package/src/domain/platformclient/__tests__/mint.test.ts

@@ -4,7 +4,8 @@
  *   - no ring (a server that trusts every request) and a verify-only ring
  *     refuse FAILED_PRECONDITION before any credential is read;
  *   - an unknown client_id and a wrong secret answer one UNAUTHENTICATED
- *     copy; an expired secret refuses, an unset or never-expiring one mints;
+ *     copy; an expired secret refuses with copy naming the owner's fix (not
+ *     rotation, #1254), an unset or never-expiring one mints;
  *     an org_id other than the owning organization refuses;
  *   - an existing platform-client account is reused with no grant and no
  *     write; an account under the subject in any other mode is refused;
@@ -232,6 +233,11 @@ describe("mintUserToken — the server and the client", () => {
     );
     expect(expired.code).toBe(Code.FailedPrecondition);
     expect(expired.rawMessage).toBe(EXPIRED_CLIENT_SECRET_MESSAGE);
+    // The literal, so a change to the copy is deliberate: it names the
+    // owner's fix, never rotation, which leaves the expiry as it is (#1254).
+    expect(expired.rawMessage).toBe(
+      "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.",
+    );
 
     await mintUserToken(harness({ client: platformClient() }).deps, request());
     await mintUserToken(

package/src/domain/platformclient/__tests__/verifier-and-guard.test.ts

@@ -5,7 +5,8 @@
  *     or typed one, refuses a bad one with the envelope's copy, refuses a
  *     token naming no client, refuses a deleted client's token with the
  *     cloud's liveness copy, lets a store fault propagate (never a
- *     revocation), and stamps the account from `sub` as a `user`;
+ *     revocation), and stamps the account from `sub` as a `user` with the
+ *     minting client it verified, for the audit actor (#1256);
  *   - the guard reads no client for a request without an Origin, passes an
  *     open allowlist and a listed origin case-insensitively, refuses an
  *     unlisted origin and the opaque "null" with the cloud's copy, and
@@ -83,7 +84,7 @@ async function refusal(promise: Promise<unknown>): Promise<ConnectError> {
 }
 
 describe("the PlatformClient user-token verifier", () => {
-  it("stamps the account the token was minted for as a user, with the asserted profile", async () => {
+  it("stamps the account the token was minted for as a user, with the asserted profile and the minting client", async () => {
     const token = userToken();
     const identity = await newPlatformClientTokenVerifier({
       keys: ring,
@@ -96,6 +97,7 @@ describe("the PlatformClient user-token verifier", () => {
       rawToken: token,
       email: "pat@example.com",
       displayName: "Pat",
+      platformClientId: "pcl_dashboard",
     });
   });
 

package/src/domain/platformclient/constants.ts

@@ -11,6 +11,11 @@
  * sentences open source adds — a server that cannot mint, the guest
  * method's edition refusal, the mismatched-account guard — follow the
  * house style (single-quoted handles).
+ *
+ * One inherited sentence was changed on purpose: the expired-secret
+ * refusal told integrators to rotate, which never helps, because rotating
+ * leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
+ * It now names the one fix and who can apply it (stigmer/stigmer#1254).
  */
 
 /** The kind's name as the shared error constructors render it. */
@@ -63,8 +68,13 @@ export function referenceNotFoundMessage(org: string, slug: string): string {
 export const INVALID_CLIENT_CREDENTIALS_MESSAGE =
   "Invalid client_id or client_secret";
 
+/**
+ * The mint's refusal for a client whose expires_at has passed. Rotating
+ * does not extend the expiry, and both update and rotateSecret need the
+ * client's owner (can_edit), so the sentence names the owner's fix.
+ */
 export const EXPIRED_CLIENT_SECRET_MESSAGE =
-  "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+  "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
 
 export function organizationMismatchMessage(owningOrg: string): string {
   return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;

package/src/domain/platformclient/verifier.ts

@@ -26,8 +26,12 @@
  * The identity is the account the token was minted for: `sub` IS the
  * account id (the mint signs it), so no account read is needed; class
  * `user`, issuer "stigmer", the token carried (the memory-capture gate and
- * the origin guard read its `platform_client_id`), and the email and name
- * the platform asserted, for display only.
+ * the origin guard read its `platform_client_id`, guards decoding their
+ * own skip logic from the raw token as extensions/caller-guards.ts
+ * prescribes), the email and name the platform asserted, for display
+ * only, and the minting client as `platformClientId` for the audit-actor
+ * seam, so every resource a minted user writes names the client they came
+ * through (stigmer/stigmer#1256).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 
@@ -100,6 +104,7 @@ export function newPlatformClientTokenVerifier(
         rawToken: token,
         ...(email !== undefined ? { email } : {}),
         ...(displayName !== undefined ? { displayName } : {}),
+        platformClientId,
       };
     },
   };

package/src/extensions/__tests__/role-reconciliation-composed.test.ts

@@ -17,10 +17,13 @@
  *      `owner`, the member `member` — each written AS the account it names
  *      (the audit actor), `findMyOrganizations` answers the organization
  *      to both, and the marker is set.
- *   3. The founder revokes everyone, the member first and then themself,
- *      and the directory boots once more: NO row returns. The marker, not
- *      "zero rows", is what makes the reconciliation one-shot — a revoked
- *      founder is not handed the organization back by a reboot.
+ *   3. The founder removes the member, and is refused removing themself
+ *      (an organization keeps its last owner on the member lanes); the
+ *      founder's row then goes from the store, the way boot 2 made its
+ *      shape, and the directory boots once more: NO row returns. The
+ *      marker, not "zero rows", is what makes the reconciliation one-shot
+ *      — a founder whose row is gone is not handed the organization back
+ *      by a reboot.
  *
  * The unit vouches for unsigned JWT-shaped tokens and declares the
  * require-authentication posture with no Authorizer (composed-support.ts;
@@ -35,7 +38,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { fromBinary } from "@bufbuild/protobuf";
-import { createClient } from "@connectrpc/connect";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
@@ -184,16 +187,21 @@ describe("role reconciliation (composed server, OIDC with no unit Authorizer, th
     ]);
   });
 
-  it("boot 3: every role revoked after the marker stays revoked — a reboot hands nothing back", async () => {
+  it("boot 3: every role removed after the marker stays removed — a reboot hands nothing back", async () => {
     const policies = createClient(IamPolicyCommandController, asFounder());
     await policies.revokeOrgAccess({
       identityAccountId: memberId,
       organizationId: ORG,
     });
-    await policies.revokeOrgAccess({
-      identityAccountId: founderId,
-      organizationId: ORG,
-    });
+    const lastOwner = await policies
+      .revokeOrgAccess({ identityAccountId: founderId, organizationId: ORG })
+      .then(
+        () => undefined,
+        (error: unknown) => ConnectError.from(error),
+      );
+    expect(lastOwner?.code).toBe(Code.FailedPrecondition);
+    // The founder's row, the one left, goes the way boot 2 made its shape.
+    await server.store.deleteResourcesByKind(ApiResourceKind.iam_policy);
     expect(await rolesIn(server.store)).toEqual([]);
     await server.shutdown();
 

package/src/extensions/identity.ts

@@ -74,6 +74,20 @@ export interface CallerIdentity {
    */
   readonly email?: string;
   readonly displayName?: string;
+  /**
+   * The PlatformClient whose minted user token this caller presented,
+   * carried for the audit-actor seam as `email` and `displayName` are:
+   * the audit actor records it (ApiResourceAuditActor.platform_client_id),
+   * and that server-owned record is what later readers key on, never this
+   * field (stigmer/stigmer#1256). Set ONLY by the PlatformClient
+   * user-token verifier (domain/platformclient/verifier.ts), from the
+   * claim it has just verified and whose client it has just found alive;
+   * absent on every other credential. It is provenance, not authorization
+   * data (the account the token names is still the principal), and not a
+   * guard vocabulary: caller guards decode their own skip logic from
+   * `rawToken` (extensions/caller-guards.ts).
+   */
+  readonly platformClientId?: string;
   /**
    * The transport the request entered through (C2 Stage 3, ruling R5).
    * Absent = the wire; the in-process interceptor stamps `in-process` on

package/src/index.ts

@@ -168,6 +168,11 @@ export type {
   IamPolicyStoreContractFixture,
 } from "./domain/iampolicy/store-contract.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
+// The owner rule's refusal, the one sentence every door that grants the
+// owner role answers when its caller is no owner: the IamPolicy lanes here,
+// and an edition's own lanes that grant a role on a person's behalf (an
+// owner invitation).
+export { OWNER_ASSIGNMENT_DENIED_MESSAGE } from "./domain/iampolicy/constants.js";
 export type { PolicyGrantScope } from "./extensions/policy-grant-scope.js";
 export type { AuthorizationQueryEngine } from "./extensions/authorization-queries.js";
 // How an access list names a grantee that is not a person

package/src/pipeline/__tests__/steps.test.ts

@@ -5,7 +5,10 @@
  * state building (status clearing, ULID minting, audit slots #540,
  * visibility default + oss#573 immutability), the loaders' error copy, the
  * best-effort search indexing, visibility validation with cloud-identical
- * copy, reference normalization/validation, and operator identity (#400).
+ * copy, reference normalization/validation, operator identity (#400), and
+ * the PlatformClient provenance the audit actor records for a minted
+ * caller (#1256): stamped from the verified identity only, never from the
+ * request, and kept through an update by anyone else.
  *
  * Uses the organization resource (the vertical slice) and agent (whose
  * spec carries ApiResourceReference fields) as vehicles.
@@ -248,6 +251,74 @@ describe("operator identity (#400) → audit-actor derivation (O2 ruling Q5)", (
   });
 });
 
+describe("PlatformClient provenance on the audit actor (#1256)", () => {
+  const minted = testCallerIdentity({
+    identityId: "ida_pat",
+    issuer: "stigmer",
+    platformClientId: "pcl_dashboard",
+  });
+
+  it("a minted caller's actor names the client; every other identity stamps it empty", () => {
+    expect(auditActorFor(minted).platformClientId).toBe("pcl_dashboard");
+    expect(auditActorFor(minted).id).toBe("ida_pat");
+    expect(auditActorFor(trustedLocalIdentity()).platformClientId).toBe("");
+    expect(auditActorFor(testCallerIdentity()).platformClientId).toBe("");
+  });
+
+  it("BuildNewState stamps the caller's client and discards a client the request claimed", async () => {
+    const forged = create(OrganizationSchema, {
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: "Acme" },
+      spec: { description: "a test organization" },
+      status: {
+        audit: {
+          specAudit: {
+            createdBy: { id: "ida_pat", platformClientId: "pcl_forged" },
+          },
+        },
+      },
+    });
+    const byMinted = new RequestContext(
+      OrganizationSchema,
+      clone(OrganizationSchema, forged),
+      minted,
+      ORG,
+    );
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(byMinted);
+    expect(
+      byMinted.newState.status?.audit?.specAudit?.createdBy?.platformClientId,
+    ).toBe("pcl_dashboard");
+
+    const byOther = orgCtx(clone(OrganizationSchema, forged));
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(byOther);
+    expect(
+      byOther.newState.status?.audit?.specAudit?.createdBy?.platformClientId,
+    ).toBe("");
+  });
+
+  it("an update by another caller keeps the creator's client and stamps its own actor", async () => {
+    const createCtx = new RequestContext(
+      OrganizationSchema,
+      org({ name: "Acme" }),
+      minted,
+      ORG,
+    );
+    await newResolveSlugStep<typeof OrganizationSchema>().execute(createCtx);
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(createCtx);
+    const existing = createCtx.newState;
+
+    const ctx = orgCtx(org({ id: existing.metadata!.id, name: "Acme Renamed" }));
+    ctx.set(EXISTING_RESOURCE_KEY, clone(OrganizationSchema, existing));
+    await newBuildUpdateStateStep<typeof OrganizationSchema>().execute(ctx);
+
+    const audit = ctx.newState.status?.audit?.specAudit;
+    expect(audit?.createdBy?.platformClientId).toBe("pcl_dashboard");
+    expect(audit?.updatedBy?.id).toBe("test-caller");
+    expect(audit?.updatedBy?.platformClientId).toBe("");
+  });
+});
+
 describe("BuildUpdateState", () => {
   it("preserves id/slug/org/visibility (oss#573), replaces spec, keeps creation audit", async () => {
     // The stored resource, created through the real create steps.

package/src/pipeline/steps/defaults.ts

@@ -237,13 +237,18 @@ export function operatorIdentitySnapshot(): {
  * unconfigured → the "system" placeholder, which the runner deliberately
  * demotes to anonymous (SYSTEM_CREATOR_SENTINEL). Verifier-produced
  * identities (O3's OIDC claims onward) stamp their own email/displayName
- * when present, identityId alone otherwise.
+ * when present, identityId alone otherwise. A PlatformClient-minted
+ * caller also stamps the client it came through (platform_client_id):
+ * the account alone cannot say, and the execution-context builder keys
+ * the PlatformClient environment layer on this record (#1256). Every
+ * other identity stamps it empty, so local-posture bytes are unchanged.
  */
 export function auditActorFor(identity: CallerIdentity): ApiResourceAuditActor {
   return create(ApiResourceAuditActorSchema, {
     id: identity.identityId,
     email: identity.email ?? "",
     displayName: identity.displayName ?? "",
+    platformClientId: identity.platformClientId ?? "",
   });
 }
 

package/src/sandbox/__tests__/docker.integration.test.ts

@@ -47,6 +47,8 @@ describe.skipIf(!optedIn || !dockerAnswers())(
       // them (the runner tolerates an unreachable backend at boot).
       backendEndpoint: "http://host.docker.internal:7234",
       temporalAddress: "host.docker.internal:7233",
+      temporalNamespace: "default",
+      temporalConnectionEnv: {},
       runnerImage:
         process.env["STIGMER_SANDBOX_RUNNER_IMAGE"] ??
         "ghcr.io/stigmer/runner:latest",

package/src/sandbox/__tests__/kubernetes.test.ts

@@ -34,6 +34,8 @@ const silentLogger = { info: () => {} };
 const config: SandboxDriverConfig = {
   backendEndpoint: "http://stigmer-server.stigmer.svc:7234",
   temporalAddress: "temporal.stigmer.svc:7233",
+  temporalNamespace: "stigmer",
+  temporalConnectionEnv: {},
   runnerImage: "ghcr.io/stigmer/runner:latest",
   runnerCommand: "stigmer-runner",
   kubernetesNamespace: "stigmer-sandboxes",
@@ -205,6 +207,7 @@ describe("the manifest shapes (the Java SandboxManifestFactory pins)", () => {
     expect(envByName.get("TEMPORAL_SERVICE_ADDRESS")?.value).toBe(
       config.temporalAddress,
     );
+    expect(envByName.get("TEMPORAL_NAMESPACE")?.value).toBe("stigmer");
     expect(envByName.get("WORKSPACE_ROOT_DIR")?.value).toBe("/workspace");
     expect(envByName.get("STIGMER_TOKEN")?.valueFrom?.secretKeyRef?.name).toBe(
       `${sandboxBaseName("session", "ses_1")}-env`,
@@ -233,4 +236,28 @@ describe("the manifest shapes (the Java SandboxManifestFactory pins)", () => {
     const secret = buildSandboxSecret("session", "ses_1", "");
     expect(secret.stringData).toEqual({});
   });
+
+  it("an authenticated Temporal's settings live in the Secret and are only named by the Deployment", () => {
+    const connectionEnv = {
+      STIGMER_TEMPORAL_TLS: "true",
+      STIGMER_TEMPORAL_API_KEY: "api-key-1",
+      STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_DATA: "-----BEGIN CERTIFICATE-----\nca\n-----END CERTIFICATE-----\n",
+    };
+    const authenticated = { ...config, temporalConnectionEnv: connectionEnv };
+    const env = { taskQueue: "session:ses_1", stigmerToken: "tok", callerClass: "user" };
+
+    const secret = buildSandboxSecret("session", "ses_1", "tok", connectionEnv);
+    expect(secret.stringData).toEqual({ ...connectionEnv, STIGMER_TOKEN: "tok" });
+
+    const container = buildSandboxDeployment("session", "ses_1", env, authenticated).spec?.template.spec
+      ?.containers[0];
+    for (const name of Object.keys(connectionEnv)) {
+      const entry = (container?.env ?? []).find((candidate) => candidate.name === name);
+      expect(entry?.value, `${name} must not be a plain manifest value`).toBeUndefined();
+      expect(entry?.valueFrom?.secretKeyRef).toEqual({
+        name: `${sandboxBaseName("session", "ses_1")}-env`,
+        key: name,
+      });
+    }
+  });
 });

package/src/sandbox/__tests__/local-process.integration.test.ts

@@ -54,6 +54,8 @@ describe.skipIf(process.platform === "win32")(
     const config: SandboxDriverConfig = {
       backendEndpoint: "http://127.0.0.1:7234",
       temporalAddress: "127.0.0.1:7233",
+      temporalNamespace: "stigmer-smoke",
+      temporalConnectionEnv: { STIGMER_TEMPORAL_TLS: "true", STIGMER_TEMPORAL_API_KEY: "k-smoke" },
       runnerImage: "unused-by-this-driver",
       runnerCommand: script,
       kubernetesNamespace: "unused-by-this-driver",
@@ -78,6 +80,9 @@ describe.skipIf(process.platform === "win32")(
     }
 
     it("ensure spawns once, injects the runner env contract, and is idempotent", async () => {
+      // A server configured by path: the child must get the rendered
+      // settings only, never the inherited _PATH item beside them.
+      process.env["STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH"] = "/etc/inherited-ca.pem";
       await driver.ensureSessionSandbox("ses_smoke", {
         taskQueue: "session:ses_smoke",
         stigmerToken: "tok-smoke",
@@ -111,6 +116,11 @@ describe.skipIf(process.platform === "win32")(
         `TEMPORAL_SERVICE_ADDRESS=${config.temporalAddress}`,
       );
       expect(dump).toMatch(/WORKSPACE_ROOT_DIR=.+session-ses_smoke/);
+      expect(dump).toContain("TEMPORAL_NAMESPACE=stigmer-smoke");
+      expect(dump).toContain("STIGMER_TEMPORAL_TLS=true");
+      expect(dump).toContain("STIGMER_TEMPORAL_API_KEY=k-smoke");
+      expect(dump).not.toContain("STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH");
+      delete process.env["STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH"];
     });
 
     it("deprovision kills the child; probe reports absent; re-ensure respawns", async () => {

package/src/sandbox/__tests__/provisioner.test.ts

@@ -34,6 +34,8 @@ const silentLogger = createLogger({
 const driverConfig: SandboxDriverConfig = {
   backendEndpoint: "http://host.docker.internal:7234",
   temporalAddress: "host.docker.internal:7233",
+  temporalNamespace: "default",
+  temporalConnectionEnv: {},
   runnerImage: "ghcr.io/stigmer/runner:latest",
   runnerCommand: "stigmer-runner",
   kubernetesNamespace: "stigmer-sandboxes",

package/src/sandbox/docker.ts

@@ -142,14 +142,20 @@ export const newDockerSandboxProvisioner: SandboxProvisionerFactory = ({
       "--env",
       `TEMPORAL_SERVICE_ADDRESS=${config.temporalAddress}`,
       "--env",
+      `TEMPORAL_NAMESPACE=${config.temporalNamespace}`,
+      "--env",
       `WORKSPACE_ROOT_DIR=${CONTAINER_WORKSPACE_DIR}`,
     ];
+    // Value-less --env inherits from the CLI's environment (module header:
+    // the token must never appear in argv). The Temporal connection
+    // settings ride the same channel: they carry credentials, and PEM text
+    // does not belong on a command line.
+    const secretEnv: Record<string, string> = { ...config.temporalConnectionEnv };
+    if (env.stigmerToken !== "") secretEnv["STIGMER_TOKEN"] = env.stigmerToken;
     let runEnv: NodeJS.ProcessEnv | undefined;
-    if (env.stigmerToken !== "") {
-      // Value-less --env inherits from the CLI's environment (module
-      // header: the token must never appear in argv).
-      runArgs.push("--env", "STIGMER_TOKEN");
-      runEnv = { ...process.env, STIGMER_TOKEN: env.stigmerToken };
+    if (Object.keys(secretEnv).length > 0) {
+      for (const name of Object.keys(secretEnv)) runArgs.push("--env", name);
+      runEnv = { ...process.env, ...secretEnv };
     }
     runArgs.push(config.runnerImage, ...RUNNER_CONTAINER_COMMAND);
     await docker(runArgs, runEnv);