@stigmer/server 3.31.0 → 3.33.0

package/src/domain/agentexecution/create-execution-context-step.ts

@@ -16,10 +16,14 @@
  *     no instance layers, and the session's own MCP servers are the whole
  *     tool set.
  *
- * Merge priority (lowest to highest): schedule/workflow-task
- * environment_refs (the share/channel/schedule/agent_call layering) →
- * instance environment_refs (via the environment RuntimeResolutionService
- * — decrypted, the RPC surface redacts, oss#405) → spec.runtime_env.
+ * Merge priority (lowest to highest): the minting PlatformClient's
+ * environment_refs, for an execution a PlatformClient-minted user created
+ * (#1256) → schedule/workflow-task environment_refs (the
+ * share/channel/schedule/agent_call layering) → instance environment_refs
+ * (via the environment RuntimeResolutionService — decrypted, the RPC
+ * surface redacts, oss#405) → spec.runtime_env. Every layer is keyed on
+ * the persisted execution alone (its labels, its audit), never on the
+ * request's caller, so recovery rebuilds exactly what create built.
  *
  * Then ONE declaration rule for every shape: the run declares what its
  * agent declares and what its session's MCP servers declare, and the
@@ -96,6 +100,7 @@ import type { PersonalEnvironmentResolution } from "../environment/personal.js";
 import type { RuntimeResolutionService } from "../environment/resolution/resolution.js";
 import type { ManagedEnvironmentService } from "../mcpserver/oauth/managed-env.js";
 import { refreshTokenIfExpired } from "../mcpserver/oauth/refresh.js";
+import type { PlatformClientStore } from "../platformclient/store.js";
 import { unmarshalTaskConfig } from "../workflow/converter/unmarshal.js";
 
 import { DEFAULT_INSTANCE_ID_KEY } from "./create-steps.js";
@@ -160,6 +165,12 @@ export interface ExecutionContextBuilderDeps {
   readonly environmentResolution: RuntimeResolutionService;
   readonly executionContextCreator: () => ExecutionContextCreator;
   readonly managedEnvService: ManagedEnvironmentService;
+  /**
+   * The PlatformClient port the minting client's environment layer reads
+   * (4.7). The port, not the Store: a composition may keep client rows in
+   * a table of its own (domain/platformclient/store.ts).
+   */
+  readonly platformClients: Pick<PlatformClientStore, "findById">;
   /** Test seam forwarded to the OAuth token-endpoint refresh. */
   readonly fetchImpl?: typeof fetch;
 }
@@ -323,6 +334,22 @@ export async function buildAndPersistExecutionContext(
     environments = [...workflowEnvironments, ...environments];
   }
 
+  // 4.7 PlatformClient-minted executions: the minting client's own
+  // environment_refs, BELOW every other layer — the fifth application of
+  // the connection-resource mechanism (#381, restored by #1256). The key
+  // is the execution's audit created_by, which the server stamped from
+  // the verified token, so it holds on recover, where no minted caller
+  // exists. Independent of 4.5/4.6: a minted user's own turn carries no
+  // schedule or workflow provenance, and a fire or a workflow task stamps
+  // no minted actor.
+  const platformClientEnvironments = await resolvePlatformClientEnvironments(
+    deps,
+    execution,
+  );
+  if (platformClientEnvironments.length > 0) {
+    environments = [...platformClientEnvironments, ...environments];
+  }
+
   // 5. Merge all layers.
   const merged = mergeEnvironmentLayers(
     environments,
@@ -745,6 +772,85 @@ async function resolveScheduleEnvironments(
   }
 }
 
+/**
+ * Resolves the environment_refs of the PlatformClient whose minted user
+ * created this execution (its audit created_by.platform_client_id, stamped
+ * by the server from the verified token). No minting client — every
+ * execution not created by a minted user — answers empty without a read.
+ * A DELETED client degrades to no client environments (the schedule
+ * layer's posture; its tokens are already refused). A client of another
+ * organization than the execution's contributes nothing: no environment
+ * value crosses an organization, the run-time twin of the reference
+ * rule's cross-organization clause (pipeline/steps/references.ts). An
+ * expired client still contributes: expiry stops minting, not the tokens
+ * already minted. Environment visibility is not consulted, as for every
+ * layer (the reference rule's reasoning: the server resolves the
+ * environment on the run's behalf). An unresolvable REF fails the create.
+ */
+async function resolvePlatformClientEnvironments(
+  deps: ExecutionContextBuilderDeps,
+  execution: AgentExecution,
+): Promise<Environment[]> {
+  const platformClientId =
+    execution.status?.audit?.specAudit?.createdBy?.platformClientId ?? "";
+  if (platformClientId === "") {
+    return [];
+  }
+  const executionId = execution.metadata?.id ?? "";
+
+  let client;
+  try {
+    client = await deps.platformClients.findById(platformClientId);
+  } catch (error) {
+    throw new Error(
+      `load platform client ${platformClientId} for environment resolution: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (client === undefined) {
+    deps.logger.warn(
+      "Minting platform client is gone — running without its environments",
+      { platformClientId, executionId },
+    );
+    return [];
+  }
+
+  const clientOrg = client.metadata?.org ?? "";
+  const executionOrg = execution.metadata?.org ?? "";
+  if (clientOrg !== executionOrg) {
+    deps.logger.warn(
+      "Minting platform client belongs to another organization — its environments are not delivered",
+      { platformClientId, clientOrg, executionOrg, executionId },
+    );
+    return [];
+  }
+
+  const refs = client.spec?.environmentRefs ?? [];
+  if (refs.length === 0) {
+    return [];
+  }
+  // Stored refs are absolute (NormalizeReferences on the client's writes);
+  // an empty org is filled from the client's own, as the schedule layer
+  // does for its manifest refs.
+  const resolved = refs.map((ref) =>
+    ref.org === ""
+      ? create(ApiResourceReferenceSchema, {
+          kind: ref.kind,
+          org: clientOrg,
+          slug: ref.slug,
+        })
+      : ref,
+  );
+
+  try {
+    return await resolveEnvironments(deps, resolved);
+  } catch (error) {
+    chainError(
+      `resolve platform client ${platformClientId} environment_refs`,
+      error,
+    );
+  }
+}
+
 /**
  * Resolves the environment_refs of the agent_call task that created this
  * execution (the workflow-provenance labels). Missing labels — every

package/src/domain/apikey/__tests__/apikey.test.ts

@@ -12,7 +12,9 @@
  *     values; only the expiry fields move;
  *   - getByKeyHash resolves by the stored hash and answers the
  *     byte-pinned "ApiKey not found" for an unknown or deleted hash —
- *     deletion takes effect on the very next lookup (no cache).
+ *     deletion takes effect on the very next lookup (no cache);
+ *   - findAll answers newest first, so a key's last-use stamp rewriting
+ *     its row never reorders the list (stigmer/stigmer#1255).
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -21,7 +23,7 @@ import path from "node:path";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import type { Client, Transport } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
-import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
@@ -250,4 +252,17 @@ describe("apikey domain (composed server)", () => {
     expect(mine).toBeDefined();
     expect(mine?.spec?.keyHash).toBe(hashApiKey(plaintext));
   });
+
+  it("findAll answers newest first", async () => {
+    for (let i = 0; i < 3; i += 1) {
+      await command.create(keyInput());
+    }
+    const created = (await query.findAll({})).entries.map((entry) => {
+      const at = entry.status?.audit?.specAudit?.createdAt;
+      expect(at, "every stored key carries its creation instant").toBeDefined();
+      return timestampDate(at!).getTime();
+    });
+    expect(created.length).toBeGreaterThanOrEqual(3);
+    expect(created).toEqual([...created].sort((a, b) => b - a));
+  });
 });

package/src/domain/apikey/__tests__/verifier.test.ts

@@ -15,13 +15,18 @@
  * the REAL open-source adapter over the same SQLite store the keys live
  * in, so what is pinned is the production pair; only the fault arm
  * substitutes a one-method lookup that rejects.
+ *
+ * An accepted key's use lands on its own row (stigmer/stigmer#1255):
+ * stamped on the first verify, left alone inside the resolution, moved
+ * forward after it; a refused key records nothing; a stamp that cannot be
+ * written is logged and the request is still authenticated.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { create } from "@bufbuild/protobuf";
-import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
@@ -31,6 +36,9 @@ import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityac
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 
 import { createLogger } from "../../../boot/logger.js";
+import type { Logger } from "../../../boot/logger.js";
+import { LAST_USED_RESOLUTION_MS } from "../../../identity/credential-use.js";
+import type { Store } from "../../../store/interface.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
 import { accountIdFor } from "../../identityaccount/constants.js";
 import type { AccountsBySubject } from "../../identityaccount/resolve.js";
@@ -56,9 +64,24 @@ beforeAll(() => {
   accounts = newResourceIdentityAccountStore(store);
 });
 
+const silent = createLogger({ level: "error", pretty: false, write: () => {} });
+
 /** The verifier as compose builds it: the key store and the account port over ONE store. */
-function verifier(lookup: AccountsBySubject = accounts) {
-  return newApiKeyIdentityVerifier({ store, accounts: lookup });
+function verifier(
+  lookup: AccountsBySubject = accounts,
+  options: { store?: Store; now?: () => Date; logger?: Logger } = {},
+) {
+  return newApiKeyIdentityVerifier({
+    store: options.store ?? store,
+    accounts: lookup,
+    logger: options.logger ?? silent,
+    now: options.now ?? (() => new Date()),
+  });
+}
+
+/** The key's row as stored now. */
+function storedKey(id: string) {
+  return store.getResource(ApiResourceKind.api_key, id, ApiKeySchema);
 }
 
 /** A direct account for `sub` through the real adapter — derived id, as provisioning writes it. */
@@ -302,3 +325,63 @@ describe("creator stamp → account resolution (20260911.11 A6)", () => {
     expect(reads).toEqual([]);
   });
 });
+
+describe("last use (stigmer/stigmer#1255)", () => {
+  it("an accepted key stamps its last use on its own row, once per resolution, forward after it", async () => {
+    const { plaintext, id } = await seedKey();
+    let clock = new Date("2026-09-28T12:00:00Z");
+    const apikey = verifier(accounts, { now: () => clock });
+
+    expect((await storedKey(id)).status?.lastUsedAt).toBeUndefined();
+    await apikey.verify(plaintext);
+    const first = (await storedKey(id)).status;
+    expect(timestampDate(first!.lastUsedAt!)).toEqual(clock);
+    expect(first?.audit?.statusAudit?.event).toBe("updated");
+    expect(
+      first?.audit?.statusAudit?.createdBy?.id,
+      "the status-audit slot keeps who created the key",
+    ).toBe("user@example.com");
+    expect(first?.audit?.specAudit?.updatedAt, "the spec audit is not touched").toBeUndefined();
+
+    clock = new Date(clock.getTime() + LAST_USED_RESOLUTION_MS - 1);
+    await apikey.verify(plaintext);
+    expect(
+      (await storedKey(id)).status,
+      "inside the resolution nothing is written",
+    ).toEqual(first);
+
+    clock = new Date(clock.getTime() + 1);
+    await apikey.verify(plaintext);
+    expect(timestampDate((await storedKey(id)).status!.lastUsedAt!)).toEqual(clock);
+  });
+
+  it("a refused key records nothing", async () => {
+    const { plaintext, id } = await seedKey({
+      expiresAt: new Date(Date.now() - 60_000),
+    });
+    await expect(verifier().verify(plaintext)).rejects.toBeInstanceOf(ConnectError);
+    expect((await storedKey(id)).status?.lastUsedAt).toBeUndefined();
+  });
+
+  it("a stamp that cannot be written is logged with the key's id and the request is still authenticated", async () => {
+    const { plaintext, id } = await seedKey({ ownerId: "ida_resilient" });
+    const lines: string[] = [];
+    const logger = createLogger({
+      level: "warn",
+      pretty: false,
+      write: (line) => lines.push(line),
+    });
+    const failingWrites = {
+      findByField: store.findByField.bind(store),
+      updateResource: () => Promise.reject(new Error("disk full")),
+    } as unknown as Store;
+
+    const identity = await verifier(accounts, { store: failingWrites, logger }).verify(plaintext);
+
+    expect(identity?.identityId).toBe("ida_resilient");
+    expect(lines).toHaveLength(1);
+    const entry = JSON.parse(lines[0]!) as Record<string, unknown>;
+    expect(entry).toMatchObject({ level: "warn", credential: "api key", id, error: "disk full" });
+    expect(lines[0], "the token is never logged").not.toContain(plaintext);
+  });
+});

package/src/domain/apikey/controller.ts

@@ -58,6 +58,7 @@ import {
   newLoadExistingForDeleteStep,
 } from "../../pipeline/steps/delete.js";
 import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
 import {
   EXISTING_RESOURCE_KEY,
   newLoadExistingStep,
@@ -289,7 +290,10 @@ async function getByKeyHash(
  * 9) the list narrows to the caller's can_view keys — the Java
  * ApiKeyFindAllHandler baseline (no guest arm, no org intersection).
  * Stored hashes ride the response exactly as the cloud's do — the
- * plaintext exists nowhere.
+ * plaintext exists nowhere. Newest first, as PlatformClient's listByOrg
+ * answers: the store's scan has no order, and a key's own last-use stamp
+ * rewrites its row, so an unsorted list would reorder as keys are used
+ * (stigmer/stigmer#1255).
  */
 async function findAll(
   deps: ApiKeyControllerDeps,
@@ -319,12 +323,18 @@ async function findAll(
   } catch (error) {
     throw internalError(error, "failed to list api keys");
   }
-  const entries = await restrictListByReadScope(
+  const visible = await restrictListByReadScope(
     deps.listReadScope,
     identity,
     ApiResourceKind.api_key,
     rows.map((row) => fromBinary(ApiKeySchema, row)),
     "",
   );
+  const entries = [...visible].sort((a, b) =>
+    compareCreatedAtDesc(
+      a.status?.audit?.specAudit?.createdAt,
+      b.status?.audit?.specAudit?.createdAt,
+    ),
+  );
   return create(ApiKeysSchema, { entries });
 }

package/src/domain/apikey/verifier.ts

@@ -33,14 +33,28 @@
  * identityId changes on a hit: email/displayName stay the stamp's, the
  * actor the key recorded at minting. The credential checks run first, so
  * a revoked or expired key never reaches the account store.
+ *
+ * An accepted key's use is then recorded on its status.last_used_at
+ * (identity/credential-use.ts): at most once a resolution, judged from the
+ * row this read already holds, written atomically through
+ * Store.updateResource so it can never undo a concurrent update of the
+ * key, and best-effort — a failed stamp is logged and the request
+ * proceeds. A refused key records nothing (stigmer/stigmer#1255).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiKeySchema, ApiKeyStatusSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import type { ApiKey } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+
+import type { Logger } from "../../boot/logger.js";
 import type {
   CallerIdentity,
   IdentityVerifier,
 } from "../../extensions/identity.js";
+import { recordCredentialUse } from "../../identity/credential-use.js";
 import type { Store } from "../../store/interface.js";
 import { identityIdForSubject } from "../identityaccount/resolve.js";
 import type { AccountsBySubject } from "../identityaccount/resolve.js";
@@ -58,12 +72,16 @@ export interface ApiKeyVerifierDeps {
   readonly store: Store;
   /** The identity-account domain's subject lookup the creator stamp resolves through (A6). */
   readonly accounts: AccountsBySubject;
+  /** Where a failed last-use stamp is reported. */
+  readonly logger: Logger;
+  /** The clock both the expiry check and the last-use stamp read. */
+  readonly now: () => Date;
 }
 
 export function newApiKeyIdentityVerifier(
   deps: ApiKeyVerifierDeps,
 ): IdentityVerifier {
-  const { store, accounts } = deps;
+  const { store, accounts, logger } = deps;
   return {
     name: "apikey",
     async verify(token: string): Promise<CallerIdentity | null> {
@@ -74,8 +92,9 @@ export function newApiKeyIdentityVerifier(
       if (key === undefined) {
         throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
       }
+      const now = deps.now();
       const expiresAt = key.spec?.expiresAt;
-      if (expiresAt !== undefined && timestampDate(expiresAt) <= new Date()) {
+      if (expiresAt !== undefined && timestampDate(expiresAt) <= now) {
         throw new ConnectError(TOKEN_EXPIRED_MESSAGE, Code.Unauthenticated);
       }
       const owner = key.status?.audit?.specAudit?.createdBy;
@@ -85,8 +104,10 @@ export function newApiKeyIdentityVerifier(
         // through the pipeline; guards hand-seeded or corrupted rows).
         throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
       }
+      const identityId = await identityIdForSubject(accounts, owner.id);
+      await recordKeyUse(store, logger, key, now);
       return {
-        identityId: await identityIdForSubject(accounts, owner.id),
+        identityId,
         callerClass: "user",
         issuer: "",
         rawToken: token,
@@ -96,3 +117,25 @@ export function newApiKeyIdentityVerifier(
     },
   };
 }
+
+/** Stamps the accepted key's last use on its own row, atomically. */
+function recordKeyUse(
+  store: Store,
+  logger: Logger,
+  key: ApiKey,
+  now: Date,
+): Promise<void> {
+  const id = key.metadata?.id ?? "";
+  return recordCredentialUse({
+    credential: "api key",
+    id,
+    lastUsedAt: key.status?.lastUsedAt,
+    now,
+    logger,
+    write: (stamp) =>
+      store.updateResource(ApiResourceKind.api_key, id, ApiKeySchema, (live) => {
+        live.status ??= create(ApiKeyStatusSchema);
+        stamp(live.status);
+      }),
+  });
+}

package/src/domain/iampolicy/__tests__/controller.test.ts

@@ -25,7 +25,11 @@
  *     the row's kind and id as the target); delete authorizes before it
  *     loads; create validates the role before it writes, then runs the
  *     `iam-policy-create:pre-side-effect-gate` slot, whose refusal leaves
- *     no row; bootstrapPolicy never runs that slot.
+ *     no row; bootstrapPolicy never runs that slot;
+ *   - owner is assigned by owners: an admin is refused granting owner,
+ *     revoking it and removing an owner, after position 1 and before any
+ *     write; an owner is allowed each; the last owner is kept; the
+ *     bootstrap twins run neither owner step.
  */
 import { create } from "@bufbuild/protobuf";
 import type { DescMessage } from "@bufbuild/protobuf";
@@ -76,6 +80,8 @@ import {
 import {
   AUTHENTICATION_REQUIRED_MESSAGE,
   AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE,
+  LAST_OWNER_MESSAGE,
+  OWNER_ASSIGNMENT_DENIED_MESSAGE,
   policyIdFor,
   policyNotFoundMessage,
   principalNotGrantableMessage,
@@ -129,7 +135,8 @@ function stampCaller(identity: CallerIdentity): Interceptor {
 
 interface RecordingAuthorizer extends Authorizer {
   readonly checks: AuthzCheck[];
-  decision: AuthzDecision | (() => never);
+  /** One answer for every check, or one per check (a throw is an outage). */
+  decision: AuthzDecision | ((check: AuthzCheck) => AuthzDecision);
 }
 
 function recordingAuthorizer(): RecordingAuthorizer {
@@ -140,7 +147,7 @@ function recordingAuthorizer(): RecordingAuthorizer {
     authorize(_caller, check) {
       checks.push(check);
       if (typeof authorizer.decision === "function") {
-        return authorizer.decision();
+        return Promise.resolve(authorizer.decision(check));
       }
       return Promise.resolve(authorizer.decision);
     },
@@ -933,6 +940,95 @@ describe("the write lanes' order", () => {
   });
 });
 
+describe("owner is assigned by owners, on the three caller lanes", () => {
+  /** alice is an admin of acme: she may grant access there, and may not assign owner. */
+  const adminOfAcme = (check: AuthzCheck): AuthzDecision =>
+    check.permission === IamPermission.can_assign_roles
+      ? { kind: "deny", reason: "" }
+      : { kind: "allow" };
+  const assignRolesOnAcme: AuthzCheck = {
+    permission: IamPermission.can_assign_roles,
+    resourceKind: ApiResourceKind.organization,
+    resourceId: "acme",
+  };
+
+  /** acme's roles, written straight through the grant path under the harness's store. */
+  async function acmeWith(
+    h: Harness,
+    roles: ReadonlyArray<readonly [string, string]>,
+  ): Promise<void> {
+    const path = newIamPolicyGrantPath({ policies: h.policies, lifecycle: undefined, logger: silent });
+    for (const [account, role] of roles) {
+      await path.grant(orgRole(account, role, "acme"), internal);
+    }
+  }
+
+  it("an admin is refused granting owner, after the role check and before the gate and the write", async () => {
+    const seen: string[] = [];
+    const h = await harness({
+      caller: alice,
+      createGate: { name: "RecordForTest", execute: () => void seen.push("gate") },
+    });
+    h.authorizer.decision = adminOfAcme;
+    const error = await refusal(() => h.command.create(orgRole("ida_bob", "owner", "acme")));
+    expect(error.code).toBe(Code.PermissionDenied);
+    expect(error.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+    expect(h.authorizer.checks.at(-1)).toEqual(assignRolesOnAcme);
+    expect(seen).toEqual([]);
+    expect(h.policies.rows.size).toBe(0);
+
+    // Every role up to admin is still hers to grant, and asks nothing more.
+    await h.command.create(orgRole("ida_bob", "admin", "acme"));
+    expect(h.authorizer.checks.at(-1)?.permission).toBe(IamPermission.can_grant_access);
+  });
+
+  it("an admin is refused revoking owner and removing an owner, and neither row moves", async () => {
+    const asAlice = await harness({ caller: alice });
+    await acmeWith(asAlice, [["ida_root", "owner"], ["ida_rhea", "owner"]]);
+    asAlice.authorizer.decision = adminOfAcme;
+
+    const revoke = await refusal(() => asAlice.command.delete(orgRole("ida_rhea", "owner", "acme")));
+    expect(revoke.code).toBe(Code.PermissionDenied);
+    expect(revoke.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+    const remove = await refusal(() =>
+      asAlice.command.revokeOrgAccess({ identityAccountId: "ida_rhea", organizationId: "acme" }),
+    );
+    expect(remove.code).toBe(Code.PermissionDenied);
+    expect(remove.rawMessage).toBe(OWNER_ASSIGNMENT_DENIED_MESSAGE);
+    expect(asAlice.policies.rows.size).toBe(2);
+  });
+
+  it("an owner grants, revokes and removes owner, but never the last one", async () => {
+    const h = await harness({ caller: alice });
+    await acmeWith(h, [["ida_alice", "owner"]]);
+
+    await h.command.create(orgRole("ida_bob", "owner", "acme"));
+    await h.command.delete(orgRole("ida_bob", "owner", "acme"));
+    await h.command.create(orgRole("ida_bob", "owner", "acme"));
+    await h.command.revokeOrgAccess({ identityAccountId: "ida_bob", organizationId: "acme" });
+    expect([...h.policies.rows.values()].map((row) => row.spec?.principal?.id)).toEqual(["ida_alice"]);
+
+    const revoke = await refusal(() => h.command.delete(orgRole("ida_alice", "owner", "acme")));
+    expect(revoke.code).toBe(Code.FailedPrecondition);
+    expect(revoke.rawMessage).toBe(LAST_OWNER_MESSAGE);
+    const remove = await refusal(() =>
+      h.command.revokeOrgAccess({ identityAccountId: "ida_alice", organizationId: "acme" }),
+    );
+    expect(remove.code).toBe(Code.FailedPrecondition);
+    expect(remove.rawMessage).toBe(LAST_OWNER_MESSAGE);
+    expect(h.policies.rows.size).toBe(1);
+  });
+
+  it("the bootstrap twins run neither owner step: the platform removes the last owner", async () => {
+    const h = await harness({ caller: machine });
+    await acmeWith(h, [["ida_root", "owner"]]);
+    h.authorizer.decision = adminOfAcme;
+    await h.command.bootstrapRevokeOrgAccess({ identityAccountId: "ida_root", organizationId: "acme" });
+    expect(h.policies.rows.size).toBe(0);
+    expect(h.authorizer.checks.map((check) => check.permission)).not.toContain(IamPermission.can_assign_roles);
+  });
+});
+
 describe("a wire kind string is refused BEFORE position 1 on every annotated lane (Q-S6-1)", () => {
   // A kind string that names no kind names no authorization target, so
   // there is nothing to ask the Authorizer — the same reason