@stigmer/server 3.31.0 → 3.33.0

package/src/domain/platformclient/__tests__/mint.test.ts

@@ -4,7 +4,8 @@
  *   - no ring (a server that trusts every request) and a verify-only ring
  *     refuse FAILED_PRECONDITION before any credential is read;
  *   - an unknown client_id and a wrong secret answer one UNAUTHENTICATED
- *     copy; an expired secret refuses, an unset or never-expiring one mints;
+ *     copy; an expired secret refuses with copy naming the owner's fix (not
+ *     rotation, #1254), an unset or never-expiring one mints;
  *     an org_id other than the owning organization refuses;
  *   - an existing platform-client account is reused with no grant and no
  *     write; an account under the subject in any other mode is refused;
@@ -14,13 +15,17 @@
  *     nothing; a failed create leaves the grant, and the next mint completes
  *     the account; a concurrent winner is read back;
  *   - the default role is viewer, owner is refused, and the token carries
- *     the cloud's claim set for the account.
+ *     the cloud's claim set for the account;
+ *   - a successful mint stamps the client's last use through the port's
+ *     atomic modifyById (never the whole-row update), once per resolution;
+ *     a refused mint records nothing; a stamp that cannot be written is
+ *     logged and the token is still answered (stigmer/stigmer#1255).
  */
 import { generateKeyPairSync } from "node:crypto";
 
 import { Code, ConnectError } from "@connectrpc/connect";
-import { create } from "@bufbuild/protobuf";
-import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { clone, create } from "@bufbuild/protobuf";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { describe, expect, it } from "vitest";
 
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
@@ -29,12 +34,18 @@ import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/
 import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
-import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import {
+  PlatformClientSchema,
+  PlatformClientStatusSchema,
+} from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 import { MintUserTokenRequestSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
+import { createLogger } from "../../../boot/logger.js";
+import type { Logger } from "../../../boot/logger.js";
 import type { CallerIdentity } from "../../../extensions/identity.js";
 import { silentLogger } from "../../../extensions/__tests__/composed-support.js";
+import { LAST_USED_RESOLUTION_MS } from "../../../identity/credential-use.js";
 import { verifyPlatformToken } from "../../../platformtoken/envelope.js";
 import { platformTokenKeyRingFromPem } from "../../../platformtoken/key-ring.js";
 import type { PlatformTokenKeyRing } from "../../../platformtoken/key-ring.js";
@@ -100,6 +111,10 @@ interface Harness {
   }>;
   readonly granted: Array<{ spec: IamPolicySpec; caller: CallerIdentity }>;
   readonly accounts: Map<string, IdentityAccount>;
+  /** The client row as the port holds it; modifyById writes here. */
+  readonly stored: { client: PlatformClient };
+  /** Every port write, by method: the stamp must ride modifyById alone. */
+  readonly clientWrites: string[];
 }
 
 function harness(
@@ -108,9 +123,12 @@ function harness(
     keys?: PlatformTokenKeyRing | undefined;
     failGrant?: boolean;
     failCreate?: "fault" | "lost-race";
+    failStamp?: boolean;
+    logger?: Logger;
   } = {},
 ): Harness {
-  const client = options.client ?? platformClient();
+  const stored = { client: options.client ?? platformClient() };
+  const clientWrites: string[] = [];
   const events: string[] = [];
   const created: Harness["created"] = [];
   const granted: Harness["granted"] = [];
@@ -125,12 +143,25 @@ function harness(
   };
   const deps: PlatformClientMintDeps = {
     clients: {
-      save: async () => {},
-      update: async () => {},
+      save: async () => {
+        clientWrites.push("save");
+      },
+      update: async () => {
+        clientWrites.push("update");
+      },
+      modifyById: async (id, modify) => {
+        clientWrites.push("modifyById");
+        if (options.failStamp === true) throw new Error("client store down");
+        if (id !== stored.client.metadata?.id) return undefined;
+        const next = clone(PlatformClientSchema, stored.client);
+        modify(next);
+        stored.client = next;
+        return next;
+      },
       deleteById: async () => {},
-      findById: async () => client,
+      findById: async () => stored.client,
       findByClientId: async (clientId) =>
-        clientId === client.spec?.clientId ? client : undefined,
+        clientId === stored.client.spec?.clientId ? stored.client : undefined,
       findByOrgAndSlug: async () => undefined,
       findByOrg: async () => [],
     },
@@ -155,10 +186,10 @@ function harness(
     },
     grantPath,
     keys: "keys" in options ? options.keys : RING,
-    logger: silentLogger,
+    logger: options.logger ?? silentLogger,
     now: () => NOW,
   };
-  return { deps, events, created, granted, accounts };
+  return { deps, events, created, granted, accounts, stored, clientWrites };
 }
 
 function request(
@@ -232,6 +263,11 @@ describe("mintUserToken — the server and the client", () => {
     );
     expect(expired.code).toBe(Code.FailedPrecondition);
     expect(expired.rawMessage).toBe(EXPIRED_CLIENT_SECRET_MESSAGE);
+    // The literal, so a change to the copy is deliberate: it names the
+    // owner's fix, never rotation, which leaves the expiry as it is (#1254).
+    expect(expired.rawMessage).toBe(
+      "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.",
+    );
 
     await mintUserToken(harness({ client: platformClient() }).deps, request());
     await mintUserToken(
@@ -413,3 +449,59 @@ describe("mintUserToken — the user", () => {
     );
   });
 });
+
+describe("mintUserToken — the client's last use", () => {
+  it("a successful mint stamps the client's last use at the mint's clock, through modifyById alone", async () => {
+    const h = harness();
+    await mintUserToken(h.deps, request());
+    expect(h.clientWrites).toEqual(["modifyById"]);
+    expect(timestampDate(h.stored.client.status!.lastUsedAt!)).toEqual(NOW);
+    expect(h.stored.client.status?.audit?.statusAudit?.event).toBe("updated");
+    expect(
+      h.stored.client.spec?.clientSecretHash,
+      "the stamp never rewrites the credential",
+    ).toBe(hashClientSecret(SECRET));
+  });
+
+  it("a mint inside the resolution writes nothing", async () => {
+    const recent = platformClient();
+    recent.status = create(PlatformClientStatusSchema, {
+      lastUsedAt: timestampFromDate(
+        new Date(NOW.getTime() - LAST_USED_RESOLUTION_MS / 2),
+      ),
+    });
+    const h = harness({ client: recent });
+    await mintUserToken(h.deps, request());
+    expect(h.clientWrites).toEqual([]);
+  });
+
+  it("a refused mint records nothing", async () => {
+    const h = harness();
+    await refusal(mintUserToken(h.deps, request({ clientSecret: "wrong" })));
+    await refusal(mintUserToken(h.deps, request({ orgId: "globex" })));
+    expect(h.clientWrites).toEqual([]);
+    expect(h.stored.client.status?.lastUsedAt).toBeUndefined();
+  });
+
+  it("a stamp that cannot be written is logged with the client's id and the token is still answered", async () => {
+    const lines: string[] = [];
+    const h = harness({
+      failStamp: true,
+      logger: createLogger({
+        level: "warn",
+        pretty: false,
+        write: (line) => lines.push(line),
+      }),
+    });
+    const response = await mintUserToken(h.deps, request());
+    expect(response.accessToken).not.toBe("");
+    expect(lines).toHaveLength(1);
+    expect(JSON.parse(lines[0]!)).toMatchObject({
+      level: "warn",
+      credential: "platform client",
+      id: "pcl_dashboard",
+      error: "client store down",
+    });
+    expect(lines[0], "the secret is never logged").not.toContain(SECRET);
+  });
+});

package/src/domain/platformclient/__tests__/resource-store.test.ts

@@ -39,6 +39,10 @@ const CONTRACT_CASE_NAMES = [
   "the same slug in another organization is a different client",
   "update replaces the row in place",
   "update of an unknown id writes nothing",
+  "modifyById persists what modify did, answers the persisted row, and the lookups follow it",
+  "modifyById of an unknown id answers undefined and writes nothing",
+  "a modify that throws writes nothing and rejects with its error",
+  "concurrent modifyById calls on one row lose no write",
   "deleteById frees the id, the client_id and the slug; deleting an unknown id resolves",
   "findByOrg answers every client of the organization and no other",
   "a disconnected store is an infrastructure fault, never 'not found'",

package/src/domain/platformclient/__tests__/verifier-and-guard.test.ts

@@ -5,7 +5,8 @@
  *     or typed one, refuses a bad one with the envelope's copy, refuses a
  *     token naming no client, refuses a deleted client's token with the
  *     cloud's liveness copy, lets a store fault propagate (never a
- *     revocation), and stamps the account from `sub` as a `user`;
+ *     revocation), and stamps the account from `sub` as a `user` with the
+ *     minting client it verified, for the audit actor (#1256);
  *   - the guard reads no client for a request without an Origin, passes an
  *     open allowlist and a listed origin case-insensitively, refuses an
  *     unlisted origin and the opaque "null" with the cloud's copy, and
@@ -83,7 +84,7 @@ async function refusal(promise: Promise<unknown>): Promise<ConnectError> {
 }
 
 describe("the PlatformClient user-token verifier", () => {
-  it("stamps the account the token was minted for as a user, with the asserted profile", async () => {
+  it("stamps the account the token was minted for as a user, with the asserted profile and the minting client", async () => {
     const token = userToken();
     const identity = await newPlatformClientTokenVerifier({
       keys: ring,
@@ -96,6 +97,7 @@ describe("the PlatformClient user-token verifier", () => {
       rawToken: token,
       email: "pat@example.com",
       displayName: "Pat",
+      platformClientId: "pcl_dashboard",
     });
   });
 

package/src/domain/platformclient/constants.ts

@@ -11,6 +11,11 @@
  * sentences open source adds — a server that cannot mint, the guest
  * method's edition refusal, the mismatched-account guard — follow the
  * house style (single-quoted handles).
+ *
+ * One inherited sentence was changed on purpose: the expired-secret
+ * refusal told integrators to rotate, which never helps, because rotating
+ * leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
+ * It now names the one fix and who can apply it (stigmer/stigmer#1254).
  */
 
 /** The kind's name as the shared error constructors render it. */
@@ -63,8 +68,13 @@ export function referenceNotFoundMessage(org: string, slug: string): string {
 export const INVALID_CLIENT_CREDENTIALS_MESSAGE =
   "Invalid client_id or client_secret";
 
+/**
+ * The mint's refusal for a client whose expires_at has passed. Rotating
+ * does not extend the expiry, and both update and rotateSecret need the
+ * client's owner (can_edit), so the sentence names the owner's fix.
+ */
 export const EXPIRED_CLIENT_SECRET_MESSAGE =
-  "PlatformClient secret has expired. Use rotateSecret to generate a new one.";
+  "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
 
 export function organizationMismatchMessage(owningOrg: string): string {
   return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;

package/src/domain/platformclient/mint.ts

@@ -44,6 +44,14 @@
  *
  * The email and name in the token and on the account are the platform's
  * assertion; nothing on the server derives authority from either.
+ *
+ * A signed token is a successful mint, so the client's use is then
+ * recorded on its status.last_used_at (identity/credential-use.ts): at most
+ * once a resolution, judged from the row authentication already read,
+ * written through the port's atomic `modifyById` — never the whole-row
+ * `update`, which could write back the secret hash a concurrent rotation
+ * just replaced — and best-effort: a failed stamp is logged and the token
+ * is still answered. A refused mint records nothing (stigmer/stigmer#1255).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { create } from "@bufbuild/protobuf";
@@ -54,6 +62,7 @@ import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityacc
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientStatusSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 import type {
   MintUserTokenRequest,
   MintUserTokenResponse,
@@ -63,6 +72,7 @@ import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
+import { recordCredentialUse } from "../../identity/credential-use.js";
 import { internalError } from "../../pipeline/errors.js";
 import { serverActingFor } from "../../pipeline/interceptors/auth.js";
 import { validator } from "../../pipeline/steps/validation.js";
@@ -164,6 +174,7 @@ export async function mintUserToken(
     user,
   );
 
+  const now = deps.now();
   const signed = signPlatformToken(
     keys,
     {
@@ -174,8 +185,9 @@ export async function mintUserToken(
       [USER_TOKEN_CLAIMS.org]: owningOrg,
       [USER_TOKEN_CLAIMS.platformClientId]: client.metadata?.id ?? "",
     },
-    { now: deps.now() },
+    { now },
   );
+  await recordClientUse(deps, client, now);
   return create(MintUserTokenResponseSchema, {
     accessToken: signed.token,
     tokenType: BEARER_TOKEN_TYPE,
@@ -223,6 +235,27 @@ async function authenticateClient(
   return client;
 }
 
+/** Stamps the minting client's last use on its own row, through the port's atomic write. */
+function recordClientUse(
+  deps: PlatformClientMintDeps,
+  client: PlatformClient,
+  now: Date,
+): Promise<void> {
+  const id = client.metadata?.id ?? "";
+  return recordCredentialUse({
+    credential: "platform client",
+    id,
+    lastUsedAt: client.status?.lastUsedAt,
+    now,
+    logger: deps.logger,
+    write: (stamp) =>
+      deps.clients.modifyById(id, (live) => {
+        live.status ??= create(PlatformClientStatusSchema);
+        stamp(live.status);
+      }),
+  });
+}
+
 /** The account id for the user: the existing platform-client account, or one provisioned now. */
 async function resolveOrProvisionAccount(
   deps: PlatformClientMintDeps,

package/src/domain/platformclient/resource-store.ts

@@ -20,6 +20,8 @@
  * (org, slug) or client_id; `update` writes nothing for an unknown id; the
  * residual window between the read and the write is the platform-wide
  * CheckDuplicate-then-upsert window, not this adapter's to close.
+ * `modifyById` has no such window: it IS Store.updateResource, the generic
+ * store's own atomic read-modify-write, its not-found read as `undefined`.
  *
  * Store faults follow the ratified mapping: a typed ResourceNotFoundError
  * reads as `undefined`; anything else propagates — an outage must never
@@ -135,6 +137,22 @@ export function newResourcePlatformClientStore(
       await store.saveResource(KIND, id, PlatformClientSchema, client);
     },
 
+    async modifyById(id, modify): Promise<PlatformClient | undefined> {
+      try {
+        return await store.updateResource(
+          KIND,
+          id,
+          PlatformClientSchema,
+          modify,
+        );
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          return undefined;
+        }
+        throw error;
+      }
+    },
+
     async deleteById(id): Promise<void> {
       await store.deleteResource(KIND, id);
     },

package/src/domain/platformclient/store-contract.ts

@@ -242,6 +242,106 @@ const CASES: ReadonlyArray<PortContractDeclaration<PlatformClientStore>> = [
       );
     },
   ],
+  [
+    "modifyById persists what modify did, answers the persisted row, and the lookups follow it",
+    async ({ store }) => {
+      await store.save(ACME_DASHBOARD);
+      const answered = await store.modifyById(
+        "pcl_contract_acme_dashboard",
+        (client) => {
+          assert.ok(client.spec, "the saved client carries a spec");
+          client.spec.allowedOrigins = ["https://app.acme.example"];
+        },
+      );
+      const expected = platformClient({
+        id: "pcl_contract_acme_dashboard",
+        org: "acme",
+        slug: "dashboard",
+        clientId: "stgm_cid_contract_acme_dashboard",
+        allowedOrigins: ["https://app.acme.example"],
+      });
+      assertSameClient(answered, expected, "modifyById must answer the persisted row");
+      assertSameClient(
+        await store.findById("pcl_contract_acme_dashboard"),
+        expected,
+        "findById must answer the modified row",
+      );
+      assertSameClient(
+        await store.findByClientId("stgm_cid_contract_acme_dashboard"),
+        expected,
+        "findByClientId must answer the modified row",
+      );
+      assertSameClient(
+        await store.findByOrgAndSlug("acme", "dashboard"),
+        expected,
+        "findByOrgAndSlug must answer the modified row",
+      );
+    },
+  ],
+  [
+    "modifyById of an unknown id answers undefined and writes nothing",
+    async ({ store }) => {
+      let called = false;
+      const answered = await store.modifyById(
+        "pcl_contract_acme_dashboard",
+        () => {
+          called = true;
+        },
+      );
+      assert.equal(answered, undefined);
+      assert.equal(called, false, "modify must not run for a row that is not held");
+      assert.equal(
+        await store.findById("pcl_contract_acme_dashboard"),
+        undefined,
+        "modifyById must modify, never create",
+      );
+    },
+  ],
+  [
+    "a modify that throws writes nothing and rejects with its error",
+    async ({ store }) => {
+      await store.save(ACME_DASHBOARD);
+      const refusal = new Error("modify refused");
+      await assert.rejects(
+        store.modifyById("pcl_contract_acme_dashboard", (client) => {
+          assert.ok(client.spec, "the saved client carries a spec");
+          client.spec.allowedOrigins = ["https://half.written.example"];
+          throw refusal;
+        }),
+        (error: unknown) => error === refusal,
+        "the modify's own error must propagate",
+      );
+      assertSameClient(
+        await store.findById("pcl_contract_acme_dashboard"),
+        ACME_DASHBOARD,
+        "nothing a throwing modify did may persist",
+      );
+    },
+  ],
+  [
+    "concurrent modifyById calls on one row lose no write",
+    async ({ store }) => {
+      await store.save(ACME_DASHBOARD);
+      const origins = Array.from(
+        { length: 8 },
+        (_, i) => `https://writer-${i}.acme.example`,
+      );
+      await Promise.all(
+        origins.map((origin) =>
+          store.modifyById("pcl_contract_acme_dashboard", (client) => {
+            assert.ok(client.spec, "the saved client carries a spec");
+            client.spec.allowedOrigins.push(origin);
+          }),
+        ),
+      );
+      const stored = await store.findById("pcl_contract_acme_dashboard");
+      assert.deepEqual(
+        [...(stored?.spec?.allowedOrigins ?? [])].sort(),
+        [...origins].sort(),
+        "every concurrent modify must see the one before it: a read-then-write driver loses edits here",
+      );
+    },
+  ],
   [
     "deleteById frees the id, the client_id and the slug; deleting an unknown id resolves",
     async ({ store }) => {

package/src/domain/platformclient/store.ts

@@ -13,6 +13,14 @@
  * duplicate check), by organization (listByOrg). A port carries nothing
  * only one edition calls.
  *
+ * One write is atomic: `modifyById`, the port's rendering of
+ * `Store.updateResource`, for the status the platform writes on its own
+ * (the mint's last-use stamp, identity/credential-use.ts). `update` stays
+ * a whole-row replace for the chains that load, edit and persist; a stamp
+ * written that way would race them and could restore a rotated secret. The
+ * driver supplies only the atomicity; what `modify` does stays the
+ * domain's, written once for every edition.
+ *
  * Contract every implementation must satisfy — proven by the port-contract
  * kit (store-contract.ts, exported), which the OSS adapter's test iterates
  * on both drivers and a composition's driver test iterates too:
@@ -21,6 +29,10 @@
  *     overwrite;
  *   - `update` replaces by id and never creates: an unknown id writes
  *     nothing;
+ *   - `modifyById` reads the row, applies `modify` and persists the result
+ *     in one atomic step, so no concurrent write is lost; it answers the
+ *     persisted row, an unknown id answers `undefined` and writes nothing,
+ *     and a `modify` that throws writes nothing and rejects with its error;
  *   - `deleteById` of an unknown id resolves;
  *   - `findByOrg` answers every client of the organization and no other,
  *     in no promised order (the chain sorts);
@@ -49,6 +61,17 @@ export interface PlatformClientStore {
   save(client: PlatformClient): Promise<void>;
   /** Full-row replace by id; an unknown id writes nothing. */
   update(client: PlatformClient): Promise<void>;
+  /**
+   * Atomic read-modify-write by id: `modify` mutates the stored client in
+   * place and the result is persisted, or nothing is. `modify` MUST be
+   * synchronous (Store.updateResource's rule: a driver may hold a write
+   * transaction or a row lock while it runs). Answers the persisted client;
+   * an unknown id answers `undefined`.
+   */
+  modifyById(
+    id: string,
+    modify: (client: PlatformClient) => void,
+  ): Promise<PlatformClient | undefined>;
   /** Removes the row; no error when it does not exist. */
   deleteById(id: string): Promise<void>;
   findById(id: string): Promise<PlatformClient | undefined>;

package/src/domain/platformclient/verifier.ts

@@ -26,8 +26,12 @@
  * The identity is the account the token was minted for: `sub` IS the
  * account id (the mint signs it), so no account read is needed; class
  * `user`, issuer "stigmer", the token carried (the memory-capture gate and
- * the origin guard read its `platform_client_id`), and the email and name
- * the platform asserted, for display only.
+ * the origin guard read its `platform_client_id`, guards decoding their
+ * own skip logic from the raw token as extensions/caller-guards.ts
+ * prescribes), the email and name the platform asserted, for display
+ * only, and the minting client as `platformClientId` for the audit-actor
+ * seam, so every resource a minted user writes names the client they came
+ * through (stigmer/stigmer#1256).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 
@@ -100,6 +104,7 @@ export function newPlatformClientTokenVerifier(
         rawToken: token,
         ...(email !== undefined ? { email } : {}),
         ...(displayName !== undefined ? { displayName } : {}),
+        platformClientId,
       };
     },
   };

package/src/extensions/__tests__/role-reconciliation-composed.test.ts

@@ -17,10 +17,13 @@
  *      `owner`, the member `member` — each written AS the account it names
  *      (the audit actor), `findMyOrganizations` answers the organization
  *      to both, and the marker is set.
- *   3. The founder revokes everyone, the member first and then themself,
- *      and the directory boots once more: NO row returns. The marker, not
- *      "zero rows", is what makes the reconciliation one-shot — a revoked
- *      founder is not handed the organization back by a reboot.
+ *   3. The founder removes the member, and is refused removing themself
+ *      (an organization keeps its last owner on the member lanes); the
+ *      founder's row then goes from the store, the way boot 2 made its
+ *      shape, and the directory boots once more: NO row returns. The
+ *      marker, not "zero rows", is what makes the reconciliation one-shot
+ *      — a founder whose row is gone is not handed the organization back
+ *      by a reboot.
  *
  * The unit vouches for unsigned JWT-shaped tokens and declares the
  * require-authentication posture with no Authorizer (composed-support.ts;
@@ -35,7 +38,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { fromBinary } from "@bufbuild/protobuf";
-import { createClient } from "@connectrpc/connect";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
@@ -184,16 +187,21 @@ describe("role reconciliation (composed server, OIDC with no unit Authorizer, th
     ]);
   });
 
-  it("boot 3: every role revoked after the marker stays revoked — a reboot hands nothing back", async () => {
+  it("boot 3: every role removed after the marker stays removed — a reboot hands nothing back", async () => {
     const policies = createClient(IamPolicyCommandController, asFounder());
     await policies.revokeOrgAccess({
       identityAccountId: memberId,
       organizationId: ORG,
     });
-    await policies.revokeOrgAccess({
-      identityAccountId: founderId,
-      organizationId: ORG,
-    });
+    const lastOwner = await policies
+      .revokeOrgAccess({ identityAccountId: founderId, organizationId: ORG })
+      .then(
+        () => undefined,
+        (error: unknown) => ConnectError.from(error),
+      );
+    expect(lastOwner?.code).toBe(Code.FailedPrecondition);
+    // The founder's row, the one left, goes the way boot 2 made its shape.
+    await server.store.deleteResourcesByKind(ApiResourceKind.iam_policy);
     expect(await rolesIn(server.store)).toEqual([]);
     await server.shutdown();
 

package/src/extensions/identity.ts

@@ -74,6 +74,20 @@ export interface CallerIdentity {
    */
   readonly email?: string;
   readonly displayName?: string;
+  /**
+   * The PlatformClient whose minted user token this caller presented,
+   * carried for the audit-actor seam as `email` and `displayName` are:
+   * the audit actor records it (ApiResourceAuditActor.platform_client_id),
+   * and that server-owned record is what later readers key on, never this
+   * field (stigmer/stigmer#1256). Set ONLY by the PlatformClient
+   * user-token verifier (domain/platformclient/verifier.ts), from the
+   * claim it has just verified and whose client it has just found alive;
+   * absent on every other credential. It is provenance, not authorization
+   * data (the account the token names is still the principal), and not a
+   * guard vocabulary: caller guards decode their own skip logic from
+   * `rawToken` (extensions/caller-guards.ts).
+   */
+  readonly platformClientId?: string;
   /**
    * The transport the request entered through (C2 Stage 3, ruling R5).
    * Absent = the wire; the in-process interceptor stamps `in-process` on