@stigmer/server 3.31.0 → 3.33.0

package/dist/temporal/schedule/status-writes.js

@@ -1,20 +1,16 @@
 /**
- * The clock's status-write helpers — port the ensureStatus/bumpStatusAudit
- * pair of pkg/domain/schedule/temporal/syncer.go.
+ * The clock's status-write helper — ports ensureStatus of
+ * pkg/domain/schedule/temporal/syncer.go.
  *
- * bumpStatusAudit is DELIBERATELY narrower than the shared
- * setAuditFieldsForUpdate: Go's clock stamps only status-audit
- * updated_at + event ("the same two leaves every cloud runtime patch
- * bumps") and never an actor — the clock is the platform, not an operator.
- * Controller-side status writes (trigger's last_fire_at stamp, resume's
- * clear) use the FULL shared helper instead, exactly as Go splits
- * steps.SetAuditFieldsForUpdate from the clock's bump. Two flavors, two
- * writers, both wire-visible — keep them distinct.
+ * The clock's audit stamp is the shared `bumpStatusAudit`
+ * (pipeline/steps/defaults.ts): status-audit updated_at + event only, never
+ * an actor — the clock is the platform, not an operator. Controller-side
+ * status writes (trigger's last_fire_at stamp, resume's clear) use the FULL
+ * setAuditFieldsForUpdate instead, exactly as Go splits
+ * steps.SetAuditFieldsForUpdate from the clock's bump.
  */
 import { create } from "@bufbuild/protobuf";
-import { timestampNow } from "@bufbuild/protobuf/wkt";
 import { ScheduleStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/status_pb";
-import { ApiResourceAuditInfoSchema, ApiResourceAuditSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
 /**
  * Returns the schedule's status, materializing the nested message a fresh
  * row may lack (Go ensureStatus).
@@ -25,19 +21,4 @@ export function ensureStatus(schedule) {
     }
     return schedule.status;
 }
-/**
- * Stamps the status-audit trail for a runtime write — updated_at + event
- * "updated", nothing else (Go bumpStatusAudit; see the module header for
- * why this is not setAuditFieldsForUpdate).
- */
-export function bumpStatusAudit(status) {
-    if (status.audit === undefined) {
-        status.audit = create(ApiResourceAuditSchema);
-    }
-    if (status.audit.statusAudit === undefined) {
-        status.audit.statusAudit = create(ApiResourceAuditInfoSchema);
-    }
-    status.audit.statusAudit.updatedAt = timestampNow();
-    status.audit.statusAudit.event = "updated";
-}
 //# sourceMappingURL=status-writes.js.map

package/dist/temporal/schedule/status-writes.js.map

@@ -1 +1 @@
-{"version":3,"file":"status-writes.js","sourceRoot":"","sources":["../../../src/temporal/schedule/status-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0DAA0D,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,SAAS,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"status-writes.js","sourceRoot":"","sources":["../../../src/temporal/schedule/status-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAGhG;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC"}

package/dist/temporal/schedule/syncer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,oBAAoB,CAAC;AAKtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,cAAc;IAEvB,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;;IAJvB,+DAA+D;IAC9C,cAAc,EAAE,MAAM,MAAM,GAAG,SAAS,EACxC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,MAAM;IAGjC;;;;;OAKG;IACG,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IA+CpE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAqBnE;;;;OAIG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjD;;;;OAIG;YACW,gBAAgB;CA6B/B"}
+{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAuB,MAAM,oBAAoB,CAAC;AAKtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,cAAc;IAEvB,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;;IAJvB,+DAA+D;IAC9C,cAAc,EAAE,MAAM,MAAM,GAAG,SAAS,EACxC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,MAAM;IAGjC;;;;;OAKG;IACG,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IA+CpE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAqBnE;;;;OAIG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjD;;;;OAIG;YACW,gBAAgB;CA6B/B"}

package/dist/temporal/schedule/syncer.js

@@ -2,10 +2,11 @@ import { ScheduleAlreadyRunning, ScheduleNotFoundError } from "@temporalio/clien
 import { timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { bumpStatusAudit } from "../../pipeline/steps/defaults.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import { desiredPaused, note } from "./artifact.js";
 import { artifactId } from "./names.js";
-import { bumpStatusAudit, ensureStatus } from "./status-writes.js";
+import { ensureStatus } from "./status-writes.js";
 /**
  * The syncer's answer when no Temporal client exists right now (Go
  * ErrTemporalUnavailable). Callers on the write path treat it as "converge

package/dist/temporal/schedule/syncer.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.js","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAGN;IACA;IACA;IACA;IALnB;IACE,+DAA+D;IAC9C,cAAwC,EACxC,KAAY,EACZ,QAA0B,EAC1B,MAAc;QAHd,mBAAc,GAAd,cAAc,CAA0B;QACxC,UAAK,GAAL,KAAK,CAAO;QACZ,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAkB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;oBACnE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ;qBAClB,SAAS,CAAC,EAAE,CAAC;qBACb,MAAM,CAAC,CAAC,QAA6B,EAAE,EAAE,CACxC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACpD,CAAC;YACN,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,4BAA4B,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAkB;QACrC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,WAAgC,CAAC;QACrC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ;iBAChC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iBAClD,QAAQ,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAkB;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAC7B,eAAe,CAAC,QAAQ,EACxB,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,cAAc,EACd,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,UAAU;oBACf,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACvE,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAC7C,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"syncer.js","sourceRoot":"","sources":["../../../src/temporal/schedule/syncer.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAGN;IACA;IACA;IACA;IALnB;IACE,+DAA+D;IAC9C,cAAwC,EACxC,KAAY,EACZ,QAA0B,EAC1B,MAAc;QAHd,mBAAc,GAAd,cAAc,CAA0B;QACxC,UAAK,GAAL,KAAK,CAAO;QACZ,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAkB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;oBACnE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ;qBAClB,SAAS,CAAC,EAAE,CAAC;qBACb,MAAM,CAAC,CAAC,QAA6B,EAAE,EAAE,CACxC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACpD,CAAC;YACN,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,4BAA4B,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,WAAW,EAAE,EAAE;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAkB;QACrC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,WAAgC,CAAC;QACrC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ;iBAChC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iBAClD,QAAQ,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAkB;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAC7B,eAAe,CAAC,QAAQ,EACxB,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,cAAc,EACd,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,UAAU;oBACf,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACvE,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAC7C,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.31.0",
+  "version": "3.33.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.31.0",
-    "@stigmer/plugin-package": "3.31.0",
-    "@stigmer/protos": "3.31.0",
-    "@stigmer/temporal-codecs": "3.31.0",
-    "@stigmer/zip-structure": "3.31.0",
+    "@stigmer/outbound": "3.33.0",
+    "@stigmer/plugin-package": "3.33.0",
+    "@stigmer/protos": "3.33.0",
+    "@stigmer/temporal-codecs": "3.33.0",
+    "@stigmer/zip-structure": "3.33.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/authorization/__tests__/store-tests.test.ts

@@ -64,6 +64,7 @@ const DOCUMENTS = [
   "memory-subject-only.fga.yaml",
   "org-admin-owner-inheritance.fga.yaml",
   "org-shared-environment.fga.yaml",
+  "organization-role-assignment.fga.yaml",
   "platform-visibility.fga.yaml",
   "plugin-owner.fga.yaml",
   "provider-standing-viewer.fga.yaml",

package/src/authorization/model/data/authorization-model.json

@@ -199,13 +199,7 @@
               }
             ]
           },
-          "owner": {
-            "directly_related_user_types": [
-              {
-                "type": "identity_account"
-              }
-            ]
-          },
+          "owner": {},
           "platform_user": {},
           "viewer": {
             "directly_related_user_types": [
@@ -252,22 +246,13 @@
           "this": {}
         },
         "owner": {
-          "union": {
-            "child": [
-              {
-                "this": {}
-              },
-              {
-                "tupleToUserset": {
-                  "computedUserset": {
-                    "relation": "admin"
-                  },
-                  "tupleset": {
-                    "relation": "organization"
-                  }
-                }
-              }
-            ]
+          "tupleToUserset": {
+            "computedUserset": {
+              "relation": "admin"
+            },
+            "tupleset": {
+              "relation": "organization"
+            }
           }
         },
         "platform_user": {
@@ -660,13 +645,7 @@
               }
             ]
           },
-          "owner": {
-            "directly_related_user_types": [
-              {
-                "type": "identity_account"
-              }
-            ]
-          },
+          "owner": {},
           "viewer": {}
         },
         "source_info": {
@@ -693,22 +672,13 @@
           "this": {}
         },
         "owner": {
-          "union": {
-            "child": [
-              {
-                "this": {}
-              },
-              {
-                "tupleToUserset": {
-                  "computedUserset": {
-                    "relation": "admin"
-                  },
-                  "tupleset": {
-                    "relation": "organization"
-                  }
-                }
-              }
-            ]
+          "tupleToUserset": {
+            "computedUserset": {
+              "relation": "admin"
+            },
+            "tupleset": {
+              "relation": "organization"
+            }
           }
         },
         "viewer": {

package/src/boot/compose.ts

@@ -1492,6 +1492,9 @@ export async function composeServer(
         executionContextCreator: () =>
           requireInProcess().executionContextCreator,
         managedEnvService,
+        // The minting client's environment layer reads the client through
+        // the port, which a composition's driver may serve (#1256).
+        platformClients,
         // The run-start token refresh dials the vendor's token endpoint;
         // it rides the same egress-guarded fetch as every other OAuth call.
         fetchImpl: asFetch(outboundFetch),
@@ -1690,7 +1693,14 @@ export async function composeServer(
   //     own (the cloud's sandbox lanes).
   const identityVerifiers = [
     ...(requireAuthentication
-      ? [newApiKeyIdentityVerifier({ store, accounts: identityAccounts })]
+      ? [
+          newApiKeyIdentityVerifier({
+            store,
+            accounts: identityAccounts,
+            logger,
+            now: () => new Date(),
+          }),
+        ]
       : []),
     // The PlatformClient user-token lane rides the ring, which the keys
     // stage resolves only under an authentication posture. It sits before

package/src/domain/agentexecution/__tests__/create-execution-context-step.test.ts

@@ -11,6 +11,15 @@
  * agent's env united with the session servers' env, and a session
  * server's saved key reaching the run from the personal environment — for
  * an agent-bound run and for the built-in assistant alike.
+ *
+ * And the minting PlatformClient's layer (#1256): an execution whose audit
+ * names the client a minted user came through receives the client's
+ * environments BELOW the instance layer and runtime_env; a creator with no
+ * client reads no client at all; a deleted client or one of another
+ * organization contributes nothing; an unresolvable ref fails the create;
+ * and the layer survives the runner's status writes, so recovery — which
+ * rebuilds from the persisted execution with no minted caller — delivers
+ * it again.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -22,7 +31,10 @@ import { afterAll, beforeAll, expect, it } from "vitest";
 
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { AgentExecutionUpdateStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
 import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import type { EnvironmentValue } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { EnvironmentValueSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
@@ -30,6 +42,9 @@ import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/execut
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 
 import { createLogger } from "../../../boot/logger.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
@@ -38,6 +53,7 @@ import type { ManagedEnvironmentService } from "../../mcpserver/oauth/managed-en
 
 import type { ExecutionContextBuilderDeps } from "../create-execution-context-step.js";
 import { buildAndPersistExecutionContext } from "../create-execution-context-step.js";
+import { applyUpdateStatusMerge } from "../update-status.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -45,6 +61,16 @@ const silentLogger = createLogger({
   write: () => {},
 });
 
+/**
+ * The client port for every execution no minted user created: the layer
+ * answers from the execution's own audit, so reaching this is a failure.
+ */
+const unreadPlatformClients: ExecutionContextBuilderDeps["platformClients"] = {
+  findById: async () => {
+    throw new Error("no minting client: the client must not be read");
+  },
+};
+
 let dir: string;
 let store: Store;
 
@@ -113,6 +139,7 @@ it("an unresolvable environment ref surfaces the inner status code with Go's wra
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    platformClients: unreadPlatformClients,
   };
 
   const execution = create(AgentExecutionSchema, {
@@ -251,6 +278,7 @@ it("assembles merge → filter → OAuth injection → EC persist over a non-emp
       },
     }),
     managedEnvService,
+    platformClients: unreadPlatformClients,
     // The vendor's token endpoint: rotates the refresh token and issues
     // a fresh access token.
     fetchImpl: async () =>
@@ -394,6 +422,7 @@ it("a session-level server's declared key saved in the personal environment reac
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    platformClients: unreadPlatformClients,
   };
   const execution = create(AgentExecutionSchema, {
     metadata: { id: "aexec_rule", org: ORG },
@@ -480,6 +509,7 @@ it("the built-in assistant: no instance, no agent, the session's servers are the
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    platformClients: unreadPlatformClients,
   };
   const execution = create(AgentExecutionSchema, {
     metadata: { id: "aexec_assistant", org: ORG },
@@ -500,3 +530,302 @@ it("the built-in assistant: no instance, no agent, the session's servers are the
   expect(data["STRAY"]).toBeUndefined();
   expect(reads).toEqual(["NOTES_TOKEN"]);
 });
+
+// ---------------------------------------------------------------------------
+// The minting PlatformClient's layer (#1256): keyed on the execution's
+// audit created_by.platform_client_id, which the server stamped from the
+// verified token, below every other layer.
+// ---------------------------------------------------------------------------
+
+const PC_ORG = "acme";
+
+function environmentOf(
+  slug: string,
+  data: Record<string, string>,
+  org = PC_ORG,
+): ReturnType<typeof create<typeof EnvironmentSchema>> {
+  return create(EnvironmentSchema, {
+    metadata: { id: `env_${slug}`, org, slug },
+    spec: {
+      data: Object.fromEntries(
+        Object.entries(data).map(([key, value]) => [key, { value, isSecret: true }]),
+      ),
+    },
+  });
+}
+
+/** A PlatformClient of `org` whose environment_refs name `slugs`. */
+function mintingClient(org: string, ...slugs: string[]): PlatformClient {
+  return create(PlatformClientSchema, {
+    metadata: { id: "pcl_dashboard", org, slug: "dashboard" },
+    spec: {
+      environmentRefs: slugs.map((slug) => ({
+        kind: ApiResourceKind.environment,
+        org,
+        slug,
+      })),
+    },
+  });
+}
+
+/** An execution in PC_ORG created by an actor who came through `platformClientId`. */
+function executionCreatedThrough(
+  id: string,
+  platformClientId: string,
+  runtimeEnv: Record<string, string> = {},
+): AgentExecution {
+  return create(AgentExecutionSchema, {
+    metadata: { id, org: PC_ORG },
+    spec: {
+      sessionId: `ses_${id}`,
+      message: "hi",
+      runtimeEnv: Object.fromEntries(
+        Object.entries(runtimeEnv).map(([key, value]) => [key, { value, isSecret: true }]),
+      ),
+    },
+    status: {
+      audit: {
+        specAudit: { createdBy: { id: "ida_pat", platformClientId } },
+      },
+    },
+  });
+}
+
+/**
+ * Builder deps for an agent that declares nothing (every merged key passes
+ * the filter) over an instance whose one ref is `instance-secrets`. Every
+ * resolved reference and every client read is recorded.
+ */
+function platformClientLayerDeps(opts: {
+  readonly client: PlatformClient | undefined;
+  readonly environments: ReadonlyArray<ReturnType<typeof environmentOf>>;
+  readonly resolved: ApiResourceReference[];
+  readonly clientReads: string[];
+  readonly createdEcs: ExecutionContext[];
+}): ExecutionContextBuilderDeps {
+  return {
+    store,
+    logger: silentLogger,
+    agentLoader: () => ({
+      get: async () =>
+        create(AgentSchema, { metadata: { id: "agt_pc", org: PC_ORG } }),
+    }),
+    agentInstanceLoader: () => ({
+      get: async (instanceId) =>
+        create(AgentInstanceSchema, {
+          metadata: { id: instanceId, org: PC_ORG },
+          spec: {
+            agentId: "agt_pc",
+            environmentRefs: [
+              {
+                kind: ApiResourceKind.environment,
+                org: PC_ORG,
+                slug: "instance-secrets",
+              },
+            ],
+          },
+        }),
+    }),
+    sessionLoader: () => ({
+      get: async (sessionId) =>
+        create(SessionSchema, {
+          metadata: { id: sessionId, org: PC_ORG },
+          spec: { agentInstanceId: "agi_pc" },
+        }),
+    }),
+    environmentReader: () => ({
+      list: async () => {
+        throw new Error("personal-env lookup not needed in this test");
+      },
+      getSecretValue: async () => {
+        throw new Error("personal-env lookup not needed in this test");
+      },
+    }),
+    environmentResolution: {
+      resolveByReference: async (ref: ApiResourceReference) => {
+        opts.resolved.push(ref);
+        const found = opts.environments.find(
+          (env) => env.metadata?.slug === ref.slug && env.metadata?.org === ref.org,
+        );
+        if (found === undefined) {
+          throw new ConnectError(`environment not found: ${ref.slug}`, Code.NotFound);
+        }
+        return found;
+      },
+    } as unknown as ExecutionContextBuilderDeps["environmentResolution"],
+    executionContextCreator: () => ({
+      create: async (ec) => {
+        opts.createdEcs.push(ec);
+        return ec;
+      },
+    }),
+    managedEnvService: {
+      readSecretValue: async () => "",
+      updateSecrets: async () => {},
+    } as unknown as ManagedEnvironmentService,
+    platformClients: {
+      findById: async (id) => {
+        opts.clientReads.push(id);
+        return opts.client;
+      },
+    },
+  };
+}
+
+const instanceSecrets = environmentOf("instance-secrets", {
+  INSTANCE_WINS: "instance",
+});
+const clientSecrets = environmentOf("embed-secrets", {
+  SHARED_API_SECRET: "client-secret",
+  INSTANCE_WINS: "client",
+  RUNTIME_WINS: "client",
+});
+
+it("a minted user's execution receives its client's environments below the instance layer and runtime_env", async () => {
+  const resolved: ApiResourceReference[] = [];
+  const clientReads: string[] = [];
+  const createdEcs: ExecutionContext[] = [];
+  const deps = platformClientLayerDeps({
+    client: mintingClient(PC_ORG, "embed-secrets"),
+    environments: [instanceSecrets, clientSecrets],
+    resolved,
+    clientReads,
+    createdEcs,
+  });
+
+  await buildAndPersistExecutionContext(
+    deps,
+    executionCreatedThrough("aexec_pc_layer", "pcl_dashboard", {
+      RUNTIME_WINS: "runtime",
+    }),
+    "",
+  );
+
+  const data = createdEcs[0]?.spec?.data ?? {};
+  // The client's own key reaches the run.
+  expect(data["SHARED_API_SECRET"]?.value).toBe("client-secret");
+  // The precedence #1256 asks to pin: instance refs, then runtime_env,
+  // override the client on a key conflict.
+  expect(data["INSTANCE_WINS"]?.value).toBe("instance");
+  expect(data["RUNTIME_WINS"]?.value).toBe("runtime");
+  expect(clientReads).toEqual(["pcl_dashboard"]);
+  expect(resolved.map((ref) => `${ref.org}/${ref.slug}`)).toEqual([
+    "acme/instance-secrets",
+    "acme/embed-secrets",
+  ]);
+});
+
+it("no client, a deleted client and a client of another organization contribute nothing", async () => {
+  // A creator who came through no client: no client is read at all.
+  const noClient: ExecutionContext[] = [];
+  await buildAndPersistExecutionContext(
+    {
+      ...platformClientLayerDeps({
+        client: undefined,
+        environments: [instanceSecrets],
+        resolved: [],
+        clientReads: [],
+        createdEcs: noClient,
+      }),
+      platformClients: unreadPlatformClients,
+    },
+    executionCreatedThrough("aexec_pc_none", ""),
+    "",
+  );
+  expect(noClient[0]?.spec?.data["INSTANCE_WINS"]?.value).toBe("instance");
+
+  // The client was deleted since: the run proceeds without its layer.
+  const deleted: ExecutionContext[] = [];
+  const deletedReads: string[] = [];
+  await buildAndPersistExecutionContext(
+    platformClientLayerDeps({
+      client: undefined,
+      environments: [instanceSecrets, clientSecrets],
+      resolved: [],
+      clientReads: deletedReads,
+      createdEcs: deleted,
+    }),
+    executionCreatedThrough("aexec_pc_deleted", "pcl_dashboard"),
+    "",
+  );
+  expect(deletedReads).toEqual(["pcl_dashboard"]);
+  expect(deleted[0]?.spec?.data["SHARED_API_SECRET"]).toBeUndefined();
+  expect(deleted[0]?.spec?.data["INSTANCE_WINS"]?.value).toBe("instance");
+
+  // A client of another organization: no environment value crosses an
+  // organization, so its refs are never even resolved.
+  const foreign: ExecutionContext[] = [];
+  const foreignResolved: ApiResourceReference[] = [];
+  await buildAndPersistExecutionContext(
+    platformClientLayerDeps({
+      client: mintingClient("globex", "embed-secrets"),
+      environments: [instanceSecrets, environmentOf("embed-secrets", { SHARED_API_SECRET: "x" }, "globex")],
+      resolved: foreignResolved,
+      clientReads: [],
+      createdEcs: foreign,
+    }),
+    executionCreatedThrough("aexec_pc_foreign", "pcl_dashboard"),
+    "",
+  );
+  expect(foreign[0]?.spec?.data["SHARED_API_SECRET"]).toBeUndefined();
+  expect(foreignResolved.map((ref) => ref.org)).toEqual(["acme"]);
+});
+
+it("a client environment that no longer exists fails the create with the client named in the chain", async () => {
+  try {
+    await buildAndPersistExecutionContext(
+      platformClientLayerDeps({
+        client: mintingClient(PC_ORG, "gone-secrets"),
+        environments: [instanceSecrets],
+        resolved: [],
+        clientReads: [],
+        createdEcs: [],
+      }),
+      executionCreatedThrough("aexec_pc_gone", "pcl_dashboard"),
+      "",
+    );
+    expect.unreachable("expected NotFound");
+  } catch (error) {
+    const connectError = ConnectError.from(error);
+    expect(connectError.code).toBe(Code.NotFound);
+    expect(connectError.rawMessage).toBe(
+      "resolve platform client pcl_dashboard environment_refs: " +
+        "resolve environment ref (org=acme, slug=gone-secrets): " +
+        "rpc error: code = NotFound desc = environment not found: gone-secrets",
+    );
+  }
+});
+
+it("the layer survives the runner's status writes, so recovery delivers it again", async () => {
+  const execution = executionCreatedThrough("aexec_pc_recover", "pcl_dashboard");
+  // The runner's progressive status write, as UpdateStatus applies it.
+  applyUpdateStatusMerge(
+    execution,
+    create(AgentExecutionUpdateStatusInputSchema, {
+      executionId: "aexec_pc_recover",
+      status: { phase: ExecutionPhase.EXECUTION_FAILED, error: "boom" },
+    }),
+    silentLogger,
+  );
+  expect(
+    execution.status?.audit?.specAudit?.createdBy?.platformClientId,
+  ).toBe("pcl_dashboard");
+
+  // Recover rebuilds from the persisted execution with no pre-resolved
+  // instance and no minted caller (lifecycle.ts's recreate step).
+  const createdEcs: ExecutionContext[] = [];
+  await buildAndPersistExecutionContext(
+    platformClientLayerDeps({
+      client: mintingClient(PC_ORG, "embed-secrets"),
+      environments: [instanceSecrets, clientSecrets],
+      resolved: [],
+      clientReads: [],
+      createdEcs,
+    }),
+    execution,
+    "",
+  );
+  expect(createdEcs[0]?.spec?.data["SHARED_API_SECRET"]?.value).toBe(
+    "client-secret",
+  );
+});

package/src/domain/agentexecution/__tests__/lifecycle.test.ts

@@ -434,6 +434,13 @@ function stubBuilderDeps(overrides?: {
       readSecretValue: async () => "",
       updateSecrets: async () => {},
     } as unknown as ManagedEnvironmentService,
+    // No execution here was created by a minted user, so the minting
+    // client's layer answers from the audit without reading a client.
+    platformClients: {
+      findById: async () => {
+        throw new Error("no minting client in this test");
+      },
+    },
   };
 }