@stigmer/server 3.31.0 → 3.32.0

package/src/domain/agentexecution/__tests__/create-execution-context-step.test.ts

@@ -11,6 +11,15 @@
  * agent's env united with the session servers' env, and a session
  * server's saved key reaching the run from the personal environment — for
  * an agent-bound run and for the built-in assistant alike.
+ *
+ * And the minting PlatformClient's layer (#1256): an execution whose audit
+ * names the client a minted user came through receives the client's
+ * environments BELOW the instance layer and runtime_env; a creator with no
+ * client reads no client at all; a deleted client or one of another
+ * organization contributes nothing; an unresolvable ref fails the create;
+ * and the layer survives the runner's status writes, so recovery — which
+ * rebuilds from the persisted execution with no minted caller — delivers
+ * it again.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -22,7 +31,10 @@ import { afterAll, beforeAll, expect, it } from "vitest";
 
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { AgentExecutionUpdateStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
 import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import type { EnvironmentValue } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { EnvironmentValueSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
@@ -30,6 +42,9 @@ import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/execut
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 
 import { createLogger } from "../../../boot/logger.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
@@ -38,6 +53,7 @@ import type { ManagedEnvironmentService } from "../../mcpserver/oauth/managed-en
 
 import type { ExecutionContextBuilderDeps } from "../create-execution-context-step.js";
 import { buildAndPersistExecutionContext } from "../create-execution-context-step.js";
+import { applyUpdateStatusMerge } from "../update-status.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -45,6 +61,16 @@ const silentLogger = createLogger({
   write: () => {},
 });
 
+/**
+ * The client port for every execution no minted user created: the layer
+ * answers from the execution's own audit, so reaching this is a failure.
+ */
+const unreadPlatformClients: ExecutionContextBuilderDeps["platformClients"] = {
+  findById: async () => {
+    throw new Error("no minting client: the client must not be read");
+  },
+};
+
 let dir: string;
 let store: Store;
 
@@ -113,6 +139,7 @@ it("an unresolvable environment ref surfaces the inner status code with Go's wra
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    platformClients: unreadPlatformClients,
   };
 
   const execution = create(AgentExecutionSchema, {
@@ -251,6 +278,7 @@ it("assembles merge → filter → OAuth injection → EC persist over a non-emp
       },
     }),
     managedEnvService,
+    platformClients: unreadPlatformClients,
     // The vendor's token endpoint: rotates the refresh token and issues
     // a fresh access token.
     fetchImpl: async () =>
@@ -394,6 +422,7 @@ it("a session-level server's declared key saved in the personal environment reac
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    platformClients: unreadPlatformClients,
   };
   const execution = create(AgentExecutionSchema, {
     metadata: { id: "aexec_rule", org: ORG },
@@ -480,6 +509,7 @@ it("the built-in assistant: no instance, no agent, the session's servers are the
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    platformClients: unreadPlatformClients,
   };
   const execution = create(AgentExecutionSchema, {
     metadata: { id: "aexec_assistant", org: ORG },
@@ -500,3 +530,302 @@ it("the built-in assistant: no instance, no agent, the session's servers are the
   expect(data["STRAY"]).toBeUndefined();
   expect(reads).toEqual(["NOTES_TOKEN"]);
 });
+
+// ---------------------------------------------------------------------------
+// The minting PlatformClient's layer (#1256): keyed on the execution's
+// audit created_by.platform_client_id, which the server stamped from the
+// verified token, below every other layer.
+// ---------------------------------------------------------------------------
+
+const PC_ORG = "acme";
+
+function environmentOf(
+  slug: string,
+  data: Record<string, string>,
+  org = PC_ORG,
+): ReturnType<typeof create<typeof EnvironmentSchema>> {
+  return create(EnvironmentSchema, {
+    metadata: { id: `env_${slug}`, org, slug },
+    spec: {
+      data: Object.fromEntries(
+        Object.entries(data).map(([key, value]) => [key, { value, isSecret: true }]),
+      ),
+    },
+  });
+}
+
+/** A PlatformClient of `org` whose environment_refs name `slugs`. */
+function mintingClient(org: string, ...slugs: string[]): PlatformClient {
+  return create(PlatformClientSchema, {
+    metadata: { id: "pcl_dashboard", org, slug: "dashboard" },
+    spec: {
+      environmentRefs: slugs.map((slug) => ({
+        kind: ApiResourceKind.environment,
+        org,
+        slug,
+      })),
+    },
+  });
+}
+
+/** An execution in PC_ORG created by an actor who came through `platformClientId`. */
+function executionCreatedThrough(
+  id: string,
+  platformClientId: string,
+  runtimeEnv: Record<string, string> = {},
+): AgentExecution {
+  return create(AgentExecutionSchema, {
+    metadata: { id, org: PC_ORG },
+    spec: {
+      sessionId: `ses_${id}`,
+      message: "hi",
+      runtimeEnv: Object.fromEntries(
+        Object.entries(runtimeEnv).map(([key, value]) => [key, { value, isSecret: true }]),
+      ),
+    },
+    status: {
+      audit: {
+        specAudit: { createdBy: { id: "ida_pat", platformClientId } },
+      },
+    },
+  });
+}
+
+/**
+ * Builder deps for an agent that declares nothing (every merged key passes
+ * the filter) over an instance whose one ref is `instance-secrets`. Every
+ * resolved reference and every client read is recorded.
+ */
+function platformClientLayerDeps(opts: {
+  readonly client: PlatformClient | undefined;
+  readonly environments: ReadonlyArray<ReturnType<typeof environmentOf>>;
+  readonly resolved: ApiResourceReference[];
+  readonly clientReads: string[];
+  readonly createdEcs: ExecutionContext[];
+}): ExecutionContextBuilderDeps {
+  return {
+    store,
+    logger: silentLogger,
+    agentLoader: () => ({
+      get: async () =>
+        create(AgentSchema, { metadata: { id: "agt_pc", org: PC_ORG } }),
+    }),
+    agentInstanceLoader: () => ({
+      get: async (instanceId) =>
+        create(AgentInstanceSchema, {
+          metadata: { id: instanceId, org: PC_ORG },
+          spec: {
+            agentId: "agt_pc",
+            environmentRefs: [
+              {
+                kind: ApiResourceKind.environment,
+                org: PC_ORG,
+                slug: "instance-secrets",
+              },
+            ],
+          },
+        }),
+    }),
+    sessionLoader: () => ({
+      get: async (sessionId) =>
+        create(SessionSchema, {
+          metadata: { id: sessionId, org: PC_ORG },
+          spec: { agentInstanceId: "agi_pc" },
+        }),
+    }),
+    environmentReader: () => ({
+      list: async () => {
+        throw new Error("personal-env lookup not needed in this test");
+      },
+      getSecretValue: async () => {
+        throw new Error("personal-env lookup not needed in this test");
+      },
+    }),
+    environmentResolution: {
+      resolveByReference: async (ref: ApiResourceReference) => {
+        opts.resolved.push(ref);
+        const found = opts.environments.find(
+          (env) => env.metadata?.slug === ref.slug && env.metadata?.org === ref.org,
+        );
+        if (found === undefined) {
+          throw new ConnectError(`environment not found: ${ref.slug}`, Code.NotFound);
+        }
+        return found;
+      },
+    } as unknown as ExecutionContextBuilderDeps["environmentResolution"],
+    executionContextCreator: () => ({
+      create: async (ec) => {
+        opts.createdEcs.push(ec);
+        return ec;
+      },
+    }),
+    managedEnvService: {
+      readSecretValue: async () => "",
+      updateSecrets: async () => {},
+    } as unknown as ManagedEnvironmentService,
+    platformClients: {
+      findById: async (id) => {
+        opts.clientReads.push(id);
+        return opts.client;
+      },
+    },
+  };
+}
+
+const instanceSecrets = environmentOf("instance-secrets", {
+  INSTANCE_WINS: "instance",
+});
+const clientSecrets = environmentOf("embed-secrets", {
+  SHARED_API_SECRET: "client-secret",
+  INSTANCE_WINS: "client",
+  RUNTIME_WINS: "client",
+});
+
+it("a minted user's execution receives its client's environments below the instance layer and runtime_env", async () => {
+  const resolved: ApiResourceReference[] = [];
+  const clientReads: string[] = [];
+  const createdEcs: ExecutionContext[] = [];
+  const deps = platformClientLayerDeps({
+    client: mintingClient(PC_ORG, "embed-secrets"),
+    environments: [instanceSecrets, clientSecrets],
+    resolved,
+    clientReads,
+    createdEcs,
+  });
+
+  await buildAndPersistExecutionContext(
+    deps,
+    executionCreatedThrough("aexec_pc_layer", "pcl_dashboard", {
+      RUNTIME_WINS: "runtime",
+    }),
+    "",
+  );
+
+  const data = createdEcs[0]?.spec?.data ?? {};
+  // The client's own key reaches the run.
+  expect(data["SHARED_API_SECRET"]?.value).toBe("client-secret");
+  // The precedence #1256 asks to pin: instance refs, then runtime_env,
+  // override the client on a key conflict.
+  expect(data["INSTANCE_WINS"]?.value).toBe("instance");
+  expect(data["RUNTIME_WINS"]?.value).toBe("runtime");
+  expect(clientReads).toEqual(["pcl_dashboard"]);
+  expect(resolved.map((ref) => `${ref.org}/${ref.slug}`)).toEqual([
+    "acme/instance-secrets",
+    "acme/embed-secrets",
+  ]);
+});
+
+it("no client, a deleted client and a client of another organization contribute nothing", async () => {
+  // A creator who came through no client: no client is read at all.
+  const noClient: ExecutionContext[] = [];
+  await buildAndPersistExecutionContext(
+    {
+      ...platformClientLayerDeps({
+        client: undefined,
+        environments: [instanceSecrets],
+        resolved: [],
+        clientReads: [],
+        createdEcs: noClient,
+      }),
+      platformClients: unreadPlatformClients,
+    },
+    executionCreatedThrough("aexec_pc_none", ""),
+    "",
+  );
+  expect(noClient[0]?.spec?.data["INSTANCE_WINS"]?.value).toBe("instance");
+
+  // The client was deleted since: the run proceeds without its layer.
+  const deleted: ExecutionContext[] = [];
+  const deletedReads: string[] = [];
+  await buildAndPersistExecutionContext(
+    platformClientLayerDeps({
+      client: undefined,
+      environments: [instanceSecrets, clientSecrets],
+      resolved: [],
+      clientReads: deletedReads,
+      createdEcs: deleted,
+    }),
+    executionCreatedThrough("aexec_pc_deleted", "pcl_dashboard"),
+    "",
+  );
+  expect(deletedReads).toEqual(["pcl_dashboard"]);
+  expect(deleted[0]?.spec?.data["SHARED_API_SECRET"]).toBeUndefined();
+  expect(deleted[0]?.spec?.data["INSTANCE_WINS"]?.value).toBe("instance");
+
+  // A client of another organization: no environment value crosses an
+  // organization, so its refs are never even resolved.
+  const foreign: ExecutionContext[] = [];
+  const foreignResolved: ApiResourceReference[] = [];
+  await buildAndPersistExecutionContext(
+    platformClientLayerDeps({
+      client: mintingClient("globex", "embed-secrets"),
+      environments: [instanceSecrets, environmentOf("embed-secrets", { SHARED_API_SECRET: "x" }, "globex")],
+      resolved: foreignResolved,
+      clientReads: [],
+      createdEcs: foreign,
+    }),
+    executionCreatedThrough("aexec_pc_foreign", "pcl_dashboard"),
+    "",
+  );
+  expect(foreign[0]?.spec?.data["SHARED_API_SECRET"]).toBeUndefined();
+  expect(foreignResolved.map((ref) => ref.org)).toEqual(["acme"]);
+});
+
+it("a client environment that no longer exists fails the create with the client named in the chain", async () => {
+  try {
+    await buildAndPersistExecutionContext(
+      platformClientLayerDeps({
+        client: mintingClient(PC_ORG, "gone-secrets"),
+        environments: [instanceSecrets],
+        resolved: [],
+        clientReads: [],
+        createdEcs: [],
+      }),
+      executionCreatedThrough("aexec_pc_gone", "pcl_dashboard"),
+      "",
+    );
+    expect.unreachable("expected NotFound");
+  } catch (error) {
+    const connectError = ConnectError.from(error);
+    expect(connectError.code).toBe(Code.NotFound);
+    expect(connectError.rawMessage).toBe(
+      "resolve platform client pcl_dashboard environment_refs: " +
+        "resolve environment ref (org=acme, slug=gone-secrets): " +
+        "rpc error: code = NotFound desc = environment not found: gone-secrets",
+    );
+  }
+});
+
+it("the layer survives the runner's status writes, so recovery delivers it again", async () => {
+  const execution = executionCreatedThrough("aexec_pc_recover", "pcl_dashboard");
+  // The runner's progressive status write, as UpdateStatus applies it.
+  applyUpdateStatusMerge(
+    execution,
+    create(AgentExecutionUpdateStatusInputSchema, {
+      executionId: "aexec_pc_recover",
+      status: { phase: ExecutionPhase.EXECUTION_FAILED, error: "boom" },
+    }),
+    silentLogger,
+  );
+  expect(
+    execution.status?.audit?.specAudit?.createdBy?.platformClientId,
+  ).toBe("pcl_dashboard");
+
+  // Recover rebuilds from the persisted execution with no pre-resolved
+  // instance and no minted caller (lifecycle.ts's recreate step).
+  const createdEcs: ExecutionContext[] = [];
+  await buildAndPersistExecutionContext(
+    platformClientLayerDeps({
+      client: mintingClient(PC_ORG, "embed-secrets"),
+      environments: [instanceSecrets, clientSecrets],
+      resolved: [],
+      clientReads: [],
+      createdEcs,
+    }),
+    execution,
+    "",
+  );
+  expect(createdEcs[0]?.spec?.data["SHARED_API_SECRET"]?.value).toBe(
+    "client-secret",
+  );
+});

package/src/domain/agentexecution/__tests__/lifecycle.test.ts

@@ -434,6 +434,13 @@ function stubBuilderDeps(overrides?: {
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    // No execution here was created by a minted user, so the minting
+    // client's layer answers from the audit without reading a client.
+    platformClients: {
+      findById: async () => {
+        throw new Error("no minting client in this test");
+      },
+    },
   };
 }
 

package/src/domain/agentexecution/create-execution-context-step.ts

@@ -16,10 +16,14 @@
  *     no instance layers, and the session's own MCP servers are the whole
  *     tool set.
  *
- * Merge priority (lowest to highest): schedule/workflow-task
- * environment_refs (the share/channel/schedule/agent_call layering) →
- * instance environment_refs (via the environment RuntimeResolutionService
- * — decrypted, the RPC surface redacts, oss#405) → spec.runtime_env.
+ * Merge priority (lowest to highest): the minting PlatformClient's
+ * environment_refs, for an execution a PlatformClient-minted user created
+ * (#1256) → schedule/workflow-task environment_refs (the
+ * share/channel/schedule/agent_call layering) → instance environment_refs
+ * (via the environment RuntimeResolutionService — decrypted, the RPC
+ * surface redacts, oss#405) → spec.runtime_env. Every layer is keyed on
+ * the persisted execution alone (its labels, its audit), never on the
+ * request's caller, so recovery rebuilds exactly what create built.
  *
  * Then ONE declaration rule for every shape: the run declares what its
  * agent declares and what its session's MCP servers declare, and the
@@ -96,6 +100,7 @@ import type { PersonalEnvironmentResolution } from "../environment/personal.js";
 import type { RuntimeResolutionService } from "../environment/resolution/resolution.js";
 import type { ManagedEnvironmentService } from "../mcpserver/oauth/managed-env.js";
 import { refreshTokenIfExpired } from "../mcpserver/oauth/refresh.js";
+import type { PlatformClientStore } from "../platformclient/store.js";
 import { unmarshalTaskConfig } from "../workflow/converter/unmarshal.js";
 
 import { DEFAULT_INSTANCE_ID_KEY } from "./create-steps.js";
@@ -160,6 +165,12 @@ export interface ExecutionContextBuilderDeps {
   readonly environmentResolution: RuntimeResolutionService;
   readonly executionContextCreator: () => ExecutionContextCreator;
   readonly managedEnvService: ManagedEnvironmentService;
+  /**
+   * The PlatformClient port the minting client's environment layer reads
+   * (4.7). The port, not the Store: a composition may keep client rows in
+   * a table of its own (domain/platformclient/store.ts).
+   */
+  readonly platformClients: Pick<PlatformClientStore, "findById">;
   /** Test seam forwarded to the OAuth token-endpoint refresh. */
   readonly fetchImpl?: typeof fetch;
 }
@@ -323,6 +334,22 @@ export async function buildAndPersistExecutionContext(
     environments = [...workflowEnvironments, ...environments];
   }
 
+  // 4.7 PlatformClient-minted executions: the minting client's own
+  // environment_refs, BELOW every other layer — the fifth application of
+  // the connection-resource mechanism (#381, restored by #1256). The key
+  // is the execution's audit created_by, which the server stamped from
+  // the verified token, so it holds on recover, where no minted caller
+  // exists. Independent of 4.5/4.6: a minted user's own turn carries no
+  // schedule or workflow provenance, and a fire or a workflow task stamps
+  // no minted actor.
+  const platformClientEnvironments = await resolvePlatformClientEnvironments(
+    deps,
+    execution,
+  );
+  if (platformClientEnvironments.length > 0) {
+    environments = [...platformClientEnvironments, ...environments];
+  }
+
   // 5. Merge all layers.
   const merged = mergeEnvironmentLayers(
     environments,
@@ -745,6 +772,85 @@ async function resolveScheduleEnvironments(
   }
 }
 
+/**
+ * Resolves the environment_refs of the PlatformClient whose minted user
+ * created this execution (its audit created_by.platform_client_id, stamped
+ * by the server from the verified token). No minting client — every
+ * execution not created by a minted user — answers empty without a read.
+ * A DELETED client degrades to no client environments (the schedule
+ * layer's posture; its tokens are already refused). A client of another
+ * organization than the execution's contributes nothing: no environment
+ * value crosses an organization, the run-time twin of the reference
+ * rule's cross-organization clause (pipeline/steps/references.ts). An
+ * expired client still contributes: expiry stops minting, not the tokens
+ * already minted. Environment visibility is not consulted, as for every
+ * layer (the reference rule's reasoning: the server resolves the
+ * environment on the run's behalf). An unresolvable REF fails the create.
+ */
+async function resolvePlatformClientEnvironments(
+  deps: ExecutionContextBuilderDeps,
+  execution: AgentExecution,
+): Promise<Environment[]> {
+  const platformClientId =
+    execution.status?.audit?.specAudit?.createdBy?.platformClientId ?? "";
+  if (platformClientId === "") {
+    return [];
+  }
+  const executionId = execution.metadata?.id ?? "";
+
+  let client;
+  try {
+    client = await deps.platformClients.findById(platformClientId);
+  } catch (error) {
+    throw new Error(
+      `load platform client ${platformClientId} for environment resolution: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (client === undefined) {
+    deps.logger.warn(
+      "Minting platform client is gone — running without its environments",
+      { platformClientId, executionId },
+    );
+    return [];
+  }
+
+  const clientOrg = client.metadata?.org ?? "";
+  const executionOrg = execution.metadata?.org ?? "";
+  if (clientOrg !== executionOrg) {
+    deps.logger.warn(
+      "Minting platform client belongs to another organization — its environments are not delivered",
+      { platformClientId, clientOrg, executionOrg, executionId },
+    );
+    return [];
+  }
+
+  const refs = client.spec?.environmentRefs ?? [];
+  if (refs.length === 0) {
+    return [];
+  }
+  // Stored refs are absolute (NormalizeReferences on the client's writes);
+  // an empty org is filled from the client's own, as the schedule layer
+  // does for its manifest refs.
+  const resolved = refs.map((ref) =>
+    ref.org === ""
+      ? create(ApiResourceReferenceSchema, {
+          kind: ref.kind,
+          org: clientOrg,
+          slug: ref.slug,
+        })
+      : ref,
+  );
+
+  try {
+    return await resolveEnvironments(deps, resolved);
+  } catch (error) {
+    chainError(
+      `resolve platform client ${platformClientId} environment_refs`,
+      error,
+    );
+  }
+}
+
 /**
  * Resolves the environment_refs of the agent_call task that created this
  * execution (the workflow-provenance labels). Missing labels — every

package/src/domain/iampolicy/__tests__/controller.test.ts

@@ -25,7 +25,11 @@
  *     the row's kind and id as the target); delete authorizes before it
  *     loads; create validates the role before it writes, then runs the
  *     `iam-policy-create:pre-side-effect-gate` slot, whose refusal leaves
- *     no row; bootstrapPolicy never runs that slot.
+ *     no row; bootstrapPolicy never runs that slot;
+ *   - owner is assigned by owners: an admin is refused granting owner,
+ *     revoking it and removing an owner, after position 1 and before any
+ *     write; an owner is allowed each; the last owner is kept; the
+ *     bootstrap twins run neither owner step.
  */
 import { create } from "@bufbuild/protobuf";
 import type { DescMessage } from "@bufbuild/protobuf";
@@ -76,6 +80,8 @@ import {
 import {
   AUTHENTICATION_REQUIRED_MESSAGE,
   AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE,
+  LAST_OWNER_MESSAGE,
+  OWNER_ASSIGNMENT_DENIED_MESSAGE,
   policyIdFor,
   policyNotFoundMessage,
   principalNotGrantableMessage,
@@ -129,7 +135,8 @@ function stampCaller(identity: CallerIdentity): Interceptor {
 
 interface RecordingAuthorizer extends Authorizer {
   readonly checks: AuthzCheck[];
-  decision: AuthzDecision | (() => never);
+  /** One answer for every check, or one per check (a throw is an outage). */
+  decision: AuthzDecision | ((check: AuthzCheck) => AuthzDecision);
 }
 
 function recordingAuthorizer(): RecordingAuthorizer {
@@ -140,7 +147,7 @@ function recordingAuthorizer(): RecordingAuthorizer {
     authorize(_caller, check) {
       checks.push(check);
       if (typeof authorizer.decision === "function") {
-        return authorizer.decision();
+        return Promise.resolve(authorizer.decision(check));
       }
       return Promise.resolve(authorizer.decision);
     },
@@ -933,6 +940,95 @@ describe("the write lanes' order", () => {
   });
 });
 
+describe("owner is assigned by owners, on the three caller lanes", () => {
+  /** alice is an admin of acme: she may grant access there, and may not assign owner. */
+  const adminOfAcme = (check: AuthzCheck): AuthzDecision =>
+    check.permission === IamPermission.can_assign_roles
+      ? { kind: "deny", reason: "" }
+      : { kind: "allow" };
+  const assignRolesOnAcme: AuthzCheck = {
+    permission: IamPermission.can_assign_roles,
+    resourceKind: ApiResourceKind.organization,
+    resourceId: "acme",
+  };
+
+  /** acme's roles, written straight through the grant path under the harness's store. */
+  async function acmeWith(
+    h: Harness,
+    roles: ReadonlyArray<readonly [string, string]>,
+  ): Promise<void> {
+    const path = newIamPolicyGrantPath({ policies: h.policies, lifecycle: undefined, logger: silent });
+    for (const [account, role] of roles) {
+      await path.grant(orgRole(account, role, "acme"), internal);
+    }
+  }
+
+  it("an admin is refused granting owner, after the role check and before the gate and the write", async () => {
+    const seen: string[] = [];
+    const h = await harness({
+      caller: alice,
+      createGate: { name: "RecordForTest", execute: () => void seen.push("gate") },
+    });
+    h.authorizer.decision = adminOfAcme;
+    const error = await refusal(() => h.command.create(orgRole("ida_bob", "owner", "acme")));
+    expect(error.code).toBe(Code.PermissionDenied);
+    expect(error.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+    expect(h.authorizer.checks.at(-1)).toEqual(assignRolesOnAcme);
+    expect(seen).toEqual([]);
+    expect(h.policies.rows.size).toBe(0);
+
+    // Every role up to admin is still hers to grant, and asks nothing more.
+    await h.command.create(orgRole("ida_bob", "admin", "acme"));
+    expect(h.authorizer.checks.at(-1)?.permission).toBe(IamPermission.can_grant_access);
+  });
+
+  it("an admin is refused revoking owner and removing an owner, and neither row moves", async () => {
+    const asAlice = await harness({ caller: alice });
+    await acmeWith(asAlice, [["ida_root", "owner"], ["ida_rhea", "owner"]]);
+    asAlice.authorizer.decision = adminOfAcme;
+
+    const revoke = await refusal(() => asAlice.command.delete(orgRole("ida_rhea", "owner", "acme")));
+    expect(revoke.code).toBe(Code.PermissionDenied);
+    expect(revoke.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+    const remove = await refusal(() =>
+      asAlice.command.revokeOrgAccess({ identityAccountId: "ida_rhea", organizationId: "acme" }),
+    );
+    expect(remove.code).toBe(Code.PermissionDenied);
+    expect(remove.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+    expect(asAlice.policies.rows.size).toBe(2);
+  });
+
+  it("an owner grants, revokes and removes owner, but never the last one", async () => {
+    const h = await harness({ caller: alice });
+    await acmeWith(h, [["ida_alice", "owner"]]);
+
+    await h.command.create(orgRole("ida_bob", "owner", "acme"));
+    await h.command.delete(orgRole("ida_bob", "owner", "acme"));
+    await h.command.create(orgRole("ida_bob", "owner", "acme"));
+    await h.command.revokeOrgAccess({ identityAccountId: "ida_bob", organizationId: "acme" });
+    expect([...h.policies.rows.values()].map((row) => row.spec?.principal?.id)).toEqual(["ida_alice"]);
+
+    const revoke = await refusal(() => h.command.delete(orgRole("ida_alice", "owner", "acme")));
+    expect(revoke.code).toBe(Code.FailedPrecondition);
+    expect(revoke.rawMessage).toBe(LAST_OWNER_MESSAGE);
+    const remove = await refusal(() =>
+      h.command.revokeOrgAccess({ identityAccountId: "ida_alice", organizationId: "acme" }),
+    );
+    expect(remove.code).toBe(Code.FailedPrecondition);
+    expect(remove.rawMessage).toBe(LAST_OWNER_MESSAGE);
+    expect(h.policies.rows.size).toBe(1);
+  });
+
+  it("the bootstrap twins run neither owner step: the platform removes the last owner", async () => {
+    const h = await harness({ caller: machine });
+    await acmeWith(h, [["ida_root", "owner"]]);
+    h.authorizer.decision = adminOfAcme;
+    await h.command.bootstrapRevokeOrgAccess({ identityAccountId: "ida_root", organizationId: "acme" });
+    expect(h.policies.rows.size).toBe(0);
+    expect(h.authorizer.checks.map((check) => check.permission)).not.toContain(IamPermission.can_assign_roles);
+  });
+});
+
 describe("a wire kind string is refused BEFORE position 1 on every annotated lane (Q-S6-1)", () => {
   // A kind string that names no kind names no authorization target, so
   // there is nothing to ask the Authorizer — the same reason