@stigmer/server 3.36.0 → 3.37.1

package/src/extensions/__tests__/extension-composition.test.ts

@@ -8,7 +8,10 @@
  * services), and the registry-declared edition answers on getServerInfo.
  * Later entries add their own composed arms below: caller guards
  * (20260902.02), the require-authentication posture (20260904.02), the
- * O5 drivers, the O4 slots and hooks, the C2 tuple lifecycle.
+ * O5 drivers, the O4 slots and hooks, the C2 tuple lifecycle, and the
+ * organization directory's external-id lookup: scoped to the identity
+ * provider the request names, and answered only to a caller who may view
+ * that provider, with one NotFound for every miss.
  *
  * The empty-set arm — no extensions composed, wire behavior byte-identical
  * to before the parameter existed — is pinned where it belongs: the
@@ -43,6 +46,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiKeyCommandController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/command_pb";
 import { ApiKeyQueryController } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/query_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import {
   PlatformQueryController,
   ServerEdition,
@@ -62,6 +66,7 @@ import type { ComposedServer } from "../../boot/compose.js";
 import { createLogger } from "../../boot/logger.js";
 import { AUTHENTICATION_TOKEN_MISSING_MESSAGE } from "../../pipeline/interceptors/auth.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { AuthzCheck } from "../authorizer.js";
 import type { GateSlotName } from "../gate-slots.js";
 import type { OrganizationDirectory } from "../organization-directory.js";
 import type {
@@ -73,6 +78,16 @@ import type {
 import type { AgentExecutionStatusTransition } from "../status-hooks.js";
 import type { ServerExtension } from "../registry.js";
 
+/** The refusal a call answered; a call that succeeds fails the case. */
+async function refusalOf(work: Promise<unknown>): Promise<ConnectError> {
+  try {
+    await work;
+  } catch (error) {
+    return ConnectError.from(error);
+  }
+  throw new Error("the call was admitted");
+}
+
 const BILLING_PROCEDURE =
   "/ai.stigmer.billing.v1.BillingQueryController/getBillingAccount";
 
@@ -1019,16 +1034,46 @@ describe("extension composition (C2 tuple lifecycle + organization directory)",
   // The directory answers are test-mutable so each case can stage its
   // own world without a second composed server.
   const myOrgIds: string[] = [];
+  // Providers by `org/slug` → id, and mappings by `providerId:externalId`:
+  // the directory scopes every lookup to the provider the request names.
+  const providers = new Map<string, string>([
+    ["c2seededorg/test-idp", "idp_viewable"],
+    ["c2seededorg/other-idp", "idp_other"],
+    ["c2seededorg/hidden-idp", "idp_hidden"],
+  ]);
   const externalOrgMap = new Map<string, string>();
   const fakeDirectory: OrganizationDirectory = {
     refusesEnumeration: true,
     listMyOrganizationIds: async () => [...myOrgIds],
-    getOrganizationIdByExternalOrgId: async (externalOrgId) =>
-      externalOrgMap.get(externalOrgId),
+    lookupExternalOrganization: async (ref, externalOrgId) => {
+      const providerId = providers.get(`${ref.org}/${ref.slug}`);
+      return providerId === undefined
+        ? { kind: "no-identity-provider" }
+        : {
+            kind: "resolved",
+            identityProviderId: providerId,
+            organizationId: externalOrgMap.get(`${providerId}:${externalOrgId}`),
+          };
+    },
   };
+  // Every check is allowed except viewing the providers named here, so the
+  // lookup's own authorization is the one refusal the suite can see.
+  const deniedProviders = new Set<string>(["idp_hidden"]);
+  const lookupChecks: AuthzCheck[] = [];
 
   const iamExtension: ServerExtension = {
     name: "fake-iam",
+    authorizer: {
+      authorize: (_caller, check) => {
+        if (check.resourceKind === ApiResourceKind.identity_provider) {
+          lookupChecks.push(check);
+          if (deniedProviders.has(check.resourceId)) {
+            return Promise.resolve({ kind: "deny", reason: "" });
+          }
+        }
+        return Promise.resolve({ kind: "allow" });
+      },
+    },
     drivers: {
       resourceAuthorizationLifecycle: fakeLifecycle,
       organizationDirectory: fakeDirectory,
@@ -1077,7 +1122,8 @@ describe("extension composition (C2 tuple lifecycle + organization directory)",
     expect(event.parentLinks).toEqual([]);
     expect(event.caller.identityId).not.toBe("");
     myOrgIds.push(org.metadata?.id ?? "");
-    externalOrgMap.set("ext-org-42", org.metadata?.id ?? "");
+    externalOrgMap.set("idp_viewable:ext-org-42", org.metadata?.id ?? "");
+    externalOrgMap.set("idp_hidden:ext-org-42", org.metadata?.id ?? "");
   });
 
   it("agent create fires creation events for the agent AND its in-process default instance", async () => {
@@ -1236,26 +1282,52 @@ describe("extension composition (C2 tuple lifecycle + organization directory)",
     expect(mine.entries.map((org) => org.metadata?.id)).toEqual(myOrgIds);
   });
 
-  it("getByExternalOrgId registers with the directory lookup and resolves the mapping", async () => {
+  it("getByExternalOrgId resolves a mapping under the named provider for a caller who may view it", async () => {
     const query = createClient(OrganizationQueryController, portTransport);
-    // identity_provider_ref is proto-required on the lookup message; the
-    // directory's resolution key is the (globally unique) external id.
-    const idpRef = { org: "c2seededorg", slug: "test-idp" };
+    lookupChecks.length = 0;
     const org = await query.getByExternalOrgId({
-      identityProviderRef: idpRef,
+      identityProviderRef: { org: "c2seededorg", slug: "test-idp" },
       externalOrgId: "ext-org-42",
     });
     expect(org.metadata?.id).toBe(myOrgIds[0]);
+    expect(lookupChecks).toEqual([
+      {
+        permission: IamPermission.can_view,
+        resourceKind: ApiResourceKind.identity_provider,
+        resourceId: "idp_viewable",
+      },
+    ]);
+  });
 
-    let missing: ConnectError | undefined;
-    try {
-      await query.getByExternalOrgId({
-        identityProviderRef: idpRef,
-        externalOrgId: "ext-org-unknown",
-      });
-    } catch (error) {
-      missing = ConnectError.from(error);
+  it("getByExternalOrgId refuses a caller who may not view the named provider, before saying whether a mapping exists", async () => {
+    const query = createClient(OrganizationQueryController, portTransport);
+    for (const externalOrgId of ["ext-org-42", "ext-org-unknown"]) {
+      const refused = await refusalOf(
+        query.getByExternalOrgId({
+          identityProviderRef: { org: "c2seededorg", slug: "hidden-idp" },
+          externalOrgId,
+        }),
+      );
+      expect(refused.code).toBe(Code.PermissionDenied);
+      expect(refused.rawMessage).toBe("unauthorized to view identity provider");
+    }
+  });
+
+  it("getByExternalOrgId answers one NotFound for an unknown provider, an unmapped id, and another provider's mapping", async () => {
+    const query = createClient(OrganizationQueryController, portTransport);
+    for (const [slug, externalOrgId] of [
+      ["no-such-idp", "ext-org-42"],
+      ["test-idp", "ext-org-unknown"],
+      ["other-idp", "ext-org-42"],
+    ] as const) {
+      const missing = await refusalOf(
+        query.getByExternalOrgId({
+          identityProviderRef: { org: "c2seededorg", slug },
+          externalOrgId,
+        }),
+      );
+      expect(missing.code).toBe(Code.NotFound);
+      expect(missing.rawMessage).toBe(`Organization not found: ${externalOrgId}`);
     }
-    expect(missing?.code).toBe(Code.NotFound);
   });
 });

package/src/extensions/organization-directory.ts

@@ -15,7 +15,11 @@
  *     and the built-in directory filter to what the caller may view.
  *   - `getByExternalOrgId` (capability `externalOrgLookup`): deliberately
  *     absent from the OSS partial registration (UNIMPLEMENTED by
- *     construction); the cloud resolves external IdP org ids.
+ *     construction); the cloud resolves external IdP org ids. The lookup
+ *     is scoped to the identity provider the request names: the directory
+ *     resolves that provider and the external id within it, and the
+ *     controller answers only a caller who may view the provider, so one
+ *     integrator's tenant ids never answer another's organizations.
  *
  * No directory composed = the trusted-local behavior, byte-identical; the
  * built-in directory (authorization/organization-directory.ts) composes
@@ -47,12 +51,34 @@ export interface OrganizationDirectory {
     caller: CallerIdentity,
   ): Promise<ReadonlyArray<string> | typeof ALL_ORGANIZATIONS>;
   /**
-   * Resolves an external IdP organization id to the org's resource id;
-   * undefined = no mapping. When this method is present, the controller
-   * registers `getByExternalOrgId` (its chain stays controller-owned);
-   * when absent, the RPC stays unregistered and answers UNIMPLEMENTED.
+   * Resolves the identity provider a lookup names, and the external IdP
+   * organization id within that provider alone. When this method is
+   * present, the controller registers `getByExternalOrgId` (its chain,
+   * the provider's authorization included, stays controller-owned); when
+   * absent, the RPC stays unregistered and answers UNIMPLEMENTED.
    */
-  getOrganizationIdByExternalOrgId?(
+  lookupExternalOrganization?(
+    identityProviderRef: IdentityProviderRef,
     externalOrgId: string,
-  ): Promise<string | undefined>;
+  ): Promise<ExternalOrganizationLookup>;
 }
+
+/** The identity provider a lookup names: its organization and its slug. */
+export interface IdentityProviderRef {
+  readonly org: string;
+  readonly slug: string;
+}
+
+/**
+ * What a directory found for a lookup: no such identity provider, or the
+ * provider's id with the organization its external id maps to under it
+ * (undefined = no mapping). The controller authorizes on the provider's
+ * id before it reveals whether a mapping exists.
+ */
+export type ExternalOrganizationLookup =
+  | { readonly kind: "no-identity-provider" }
+  | {
+      readonly kind: "resolved";
+      readonly identityProviderId: string;
+      readonly organizationId: string | undefined;
+    };

package/src/index.ts

@@ -116,7 +116,11 @@ export type {
   VisibilityTupleShape,
   ResolvedParentLink,
 } from "./extensions/resource-authorization.js";
-export type { OrganizationDirectory } from "./extensions/organization-directory.js";
+export type {
+  ExternalOrganizationLookup,
+  IdentityProviderRef,
+  OrganizationDirectory,
+} from "./extensions/organization-directory.js";
 export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
 // The license-status seam (drivers.licenseStatus): the provider an
 // Enterprise composition registers so getLicenseStatus answers from its

package/src/pipeline/__tests__/blind-not-found.test.ts

@@ -0,0 +1,297 @@
+/**
+ * Holds the error contract's store-fault rule structurally: no error handler
+ * in the server answers NotFound without looking at the error it caught.
+ * Only a typed not-found (`ResourceNotFoundError` and its kin) means the
+ * record is missing; any other failure is an infrastructure fault answered
+ * through `internalError` (`src/pipeline/errors.ts`), because a client told
+ * "not found" may discard state that still exists
+ * (`.agents/skills/ts-server-dev-guidelines/SKILL.md`, "Errors").
+ *
+ * A *blind NotFound* is a `throw` of a NotFound that is a direct statement of
+ * a `catch` block or of a `.catch(...)` callback — not nested under any
+ * condition. That is the defect's exact shape: a discriminating handler throws
+ * its NotFound under `if (error instanceof ...)` or a code check, so it passes
+ * whatever error class it tests, and the guard needs no list of them. A throw
+ * constructs a NotFound when it is `new ConnectError(..., Code.NotFound)` or
+ * a call to a NotFound constructor; the constructors are derived from the
+ * source (`notFoundError`, plus every function whose body is a single
+ * `return` of a NotFound construction, to a fixed point), so a domain's own
+ * wrapper cannot hide a blind site, and a discriminating mapper is not one.
+ *
+ * The scan parses each module with the TypeScript compiler API rather than a
+ * regular expression, because a catch block's extent (nested braces, a log
+ * line before the throw) is a syntax question. `PENDING` is the list of known
+ * blind sites still to be fixed; the scan must equal it exactly, so a new
+ * blind site fails here, and so does a fixed site still listed.
+ */
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import ts from "typescript";
+import { describe, expect, it } from "vitest";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SRC = path.resolve(HERE, "../..");
+
+/** Known blind sites by module (relative to `src`), with their count. */
+const PENDING: ReadonlyMap<string, number> = new Map([
+  // Store loads, stigmer/stigmer#1345 (fixed domain by domain).
+  ["domain/agent/controller.ts", 1],
+  ["domain/agentchannel/controller.ts", 1],
+  ["domain/agentinstance/controller.ts", 1],
+  ["domain/agentshare/controller.ts", 1],
+  ["domain/artifact/controller.ts", 1],
+  ["domain/environment/controller.ts", 1],
+  ["domain/environment/steps.ts", 1],
+  ["domain/mcpserver/complete-oauth-connect.ts", 1],
+  ["domain/mcpserver/connect.ts", 1],
+  ["domain/mcpserver/controller.ts", 1],
+  ["domain/mcpserver/initiate-oauth-connect.ts", 1],
+  ["domain/mcpserver/start-connect.ts", 2],
+  ["domain/plugin/controller.ts", 1],
+  ["domain/skill/controller.ts", 1],
+  ["domain/workflow/controller.ts", 1],
+  ["domain/workflowinstance/controller.ts", 1],
+  // Parent loads through the in-process chain that fold every RPC error,
+  // validation included, stigmer/stigmer#1351.
+  ["domain/agentinstance/steps.ts", 1],
+  ["domain/workflowinstance/steps.ts", 1],
+]);
+
+interface BlindSite {
+  readonly module: string;
+  readonly line: number;
+}
+
+function isCodeNotFound(node: ts.Expression): boolean {
+  return (
+    ts.isPropertyAccessExpression(node) &&
+    ts.isIdentifier(node.expression) &&
+    node.expression.text === "Code" &&
+    node.name.text === "NotFound"
+  );
+}
+
+function isNotFoundConstruction(
+  node: ts.Expression | undefined,
+  constructors: ReadonlySet<string>,
+): boolean {
+  if (node === undefined) {
+    return false;
+  }
+  if (ts.isCallExpression(node)) {
+    return (
+      ts.isIdentifier(node.expression) && constructors.has(node.expression.text)
+    );
+  }
+  if (ts.isNewExpression(node)) {
+    return (
+      ts.isIdentifier(node.expression) &&
+      node.expression.text === "ConnectError" &&
+      (node.arguments ?? []).some(isCodeNotFound)
+    );
+  }
+  return false;
+}
+
+function forEachNode(node: ts.Node, visit: (node: ts.Node) => void): void {
+  visit(node);
+  ts.forEachChild(node, (child) => forEachNode(child, visit));
+}
+
+/** `notFoundError` plus every single-`return` wrapper of a NotFound. */
+function notFoundConstructors(
+  sources: readonly ts.SourceFile[],
+): ReadonlySet<string> {
+  const constructors = new Set(["notFoundError"]);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const source of sources) {
+      forEachNode(source, (node) => {
+        if (
+          !ts.isFunctionDeclaration(node) ||
+          node.name === undefined ||
+          node.body === undefined ||
+          node.body.statements.length !== 1 ||
+          constructors.has(node.name.text)
+        ) {
+          return;
+        }
+        const only = node.body.statements[0];
+        if (
+          only !== undefined &&
+          ts.isReturnStatement(only) &&
+          isNotFoundConstruction(only.expression, constructors)
+        ) {
+          constructors.add(node.name.text);
+          grew = true;
+        }
+      });
+    }
+  }
+  return constructors;
+}
+
+/** The handler block of a `.catch(fn)` call, when `fn` has a block body. */
+function catchCallbackBlock(node: ts.Node): ts.Block | undefined {
+  if (
+    !ts.isCallExpression(node) ||
+    !ts.isPropertyAccessExpression(node.expression) ||
+    node.expression.name.text !== "catch"
+  ) {
+    return undefined;
+  }
+  const handler = node.arguments[0];
+  if (
+    handler !== undefined &&
+    (ts.isArrowFunction(handler) || ts.isFunctionExpression(handler)) &&
+    ts.isBlock(handler.body)
+  ) {
+    return handler.body;
+  }
+  return undefined;
+}
+
+function blindSites(
+  source: ts.SourceFile,
+  module: string,
+  constructors: ReadonlySet<string>,
+): BlindSite[] {
+  const sites: BlindSite[] = [];
+  forEachNode(source, (node) => {
+    const block = ts.isCatchClause(node)
+      ? node.block
+      : catchCallbackBlock(node);
+    if (block === undefined) {
+      return;
+    }
+    for (const statement of block.statements) {
+      if (
+        ts.isThrowStatement(statement) &&
+        isNotFoundConstruction(statement.expression, constructors)
+      ) {
+        const { line } = source.getLineAndCharacterOfPosition(
+          statement.getStart(source),
+        );
+        sites.push({ module, line: line + 1 });
+      }
+    }
+  });
+  return sites;
+}
+
+function parse(fileName: string, text: string): ts.SourceFile {
+  return ts.createSourceFile(fileName, text, ts.ScriptTarget.Latest, true);
+}
+
+/** Every non-test module under `src`, parsed. */
+function serverSources(): ts.SourceFile[] {
+  const sources: ts.SourceFile[] = [];
+  const walk = (dir: string): void => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name !== "__tests__") {
+          walk(full);
+        }
+      } else if (
+        entry.name.endsWith(".ts") &&
+        !entry.name.endsWith(".d.ts") &&
+        !entry.name.endsWith(".test.ts")
+      ) {
+        sources.push(parse(full, readFileSync(full, "utf8")));
+      }
+    }
+  };
+  walk(SRC);
+  return sources;
+}
+
+/** The rule applied to one inline module, for the rule's own cases. */
+function blindLinesOf(text: string): number[] {
+  const source = parse("fixture.ts", text);
+  return blindSites(source, "fixture.ts", notFoundConstructors([source])).map(
+    (site) => site.line,
+  );
+}
+
+describe("the blind-NotFound rule", () => {
+  it("flags an unconditional NotFound in a catch block, bound or not", () => {
+    expect(
+      blindLinesOf(`
+        try { load(); } catch { throw notFoundError("agent", id); }
+        try { load(); } catch (error) {
+          log(error);
+          throw new ConnectError(copy(id), Code.NotFound);
+        }
+      `),
+    ).toEqual([2, 5]);
+  });
+
+  it("flags a NotFound built by a derived wrapper and one in a .catch callback", () => {
+    expect(
+      blindLinesOf(`
+        function missing(id: string) { return notFoundError("agent", id); }
+        function missingAgain(id: string) { return missing(id); }
+        try { load(); } catch { throw missingAgain(id); }
+        load().catch(() => { throw missing(id); });
+      `),
+    ).toEqual([4, 5]);
+  });
+
+  it("passes a NotFound thrown only under a test of the error", () => {
+    expect(
+      blindLinesOf(`
+        try { load(); } catch (error) {
+          if (error instanceof ResourceNotFoundError) {
+            throw notFoundError("agent", id);
+          }
+          throw internalError(error, "failed to load agent");
+        }
+      `),
+    ).toEqual([]);
+  });
+
+  it("does not treat a discriminating mapper as a constructor", () => {
+    expect(
+      blindLinesOf(`
+        function mapNotFound(error: unknown, id: string): unknown {
+          if (error instanceof WorkflowNotFoundError) {
+            return notFoundError("workflow", id);
+          }
+          return error;
+        }
+        try { load(); } catch (error) { throw mapNotFound(error, id); }
+      `),
+    ).toEqual([]);
+  });
+});
+
+describe("the server source", () => {
+  it("has no blind NotFound beyond the pending list, and the list names only live sites", () => {
+    const sources = serverSources();
+    const constructors = notFoundConstructors(sources);
+    const found = new Map<string, number[]>();
+    for (const source of sources) {
+      const module = path
+        .relative(SRC, source.fileName)
+        .split(path.sep)
+        .join("/");
+      for (const site of blindSites(source, module, constructors)) {
+        found.set(module, [...(found.get(module) ?? []), site.line]);
+      }
+    }
+
+    const counts = Object.fromEntries(
+      [...found].map(([module, lines]) => [module, lines.length]),
+    );
+    const where = [...found]
+      .flatMap(([module, lines]) => lines.map((line) => `${module}:${line}`))
+      .join("\n");
+    expect(counts, `blind NotFound sites found:\n${where}`).toEqual(
+      Object.fromEntries(PENDING),
+    );
+  });
+});

package/src/pipeline/steps/__tests__/guard-memory-capture.test.ts

@@ -7,8 +7,13 @@
  * the capability, the org-mismatch throw propagating untouched, and the
  * absent-capability posture staying byte-identical to the pre-seam gate
  * (trusted-local and OIDC callers admit; machine and
- * platform_client_id-carrying callers refuse).
+ * platform_client_id-carrying callers refuse). The claim counts only on a
+ * platform token (stigmer#1312): the refusing cases carry tokens signed by
+ * the envelope every Stigmer lane mints through, and another issuer's
+ * token carrying the same claim is admitted.
  */
+import { generateKeyPairSync } from "node:crypto";
+
 import { describe, expect, it } from "vitest";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { create } from "@bufbuild/protobuf";
@@ -17,6 +22,9 @@ import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_p
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import type { CallerIdentity } from "../../../extensions/identity.js";
+import { signPlatformToken } from "../../../platformtoken/envelope.js";
+import { platformTokenKeyRingFromPem } from "../../../platformtoken/key-ring.js";
+import type { SigningPlatformTokenKeyRing } from "../../../platformtoken/key-ring.js";
 import type {
   MemoryCaptureDecision,
   RunnerCredentialProvider,
@@ -77,11 +85,40 @@ function providerWith(
   };
 }
 
+const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+  modulusLength: 2048,
+});
+const built = platformTokenKeyRingFromPem({
+  privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
+  publicKeyPems: [publicKey.export({ format: "pem", type: "spki" }).toString()],
+});
+if (built.signer === undefined) throw new Error("fixture ring must sign");
+const ring: SigningPlatformTokenKeyRing = { ...built, signer: built.signer };
+
+/** A platform token, signed as every Stigmer-minted lane signs it. */
+function mintedToken(claims: Record<string, string>): string {
+  return signPlatformToken(ring, { sub: "ida_minted", ...claims }).token;
+}
+
+/** Another issuer's JWT: the claims as given, never signed by the ring. */
 function jwtWith(payload: Record<string, unknown>): string {
-  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  return `header.${body}.signature`;
+  const segment = (value: object) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${segment({ alg: "RS256", typ: "JWT" })}.${segment(payload)}.signature`;
 }
 
+/** An OIDC login whose issuer happens to stamp a platform_client_id claim. */
+const FOREIGN_CLAIM_CALLER: CallerIdentity = {
+  identityId: "ida_oidc",
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: jwtWith({
+    iss: "https://issuer.example",
+    sub: "ida_oidc",
+    platform_client_id: "pc_1",
+  }),
+};
+
 async function rejectionOf(run: void | Promise<void>): Promise<unknown> {
   return Promise.resolve(run).then(
     () => {
@@ -172,13 +209,22 @@ describe("GuardMemoryCapture with the capability composed", () => {
       identityId: "ida_guest",
       callerClass: "guest",
       issuer: "stigmer",
-      rawToken: jwtWith({ platform_client_id: "pc_1" }),
+      rawToken: mintedToken({ platform_client_id: "pc_1" }),
     };
     await expect(step.execute(memoryCtx(minted))).rejects.toThrowError(
       MEMORY_CAPTURE_CALLER_MESSAGE,
     );
   });
 
+  it("no-opinion falls through: another issuer's platform_client_id claim is admitted", async () => {
+    // Both editions' capabilities answer no-opinion for a person, so this
+    // is the path an OIDC login takes in production.
+    const step = newGuardMemoryCaptureStep<typeof MemorySchema>(
+      providerWith(() => ({ verdict: "no-opinion" })),
+    );
+    await step.execute(memoryCtx(FOREIGN_CLAIM_CALLER));
+  });
+
   it("internal and in-process callers never consult the capability", async () => {
     const step = newGuardMemoryCaptureStep<typeof MemorySchema>(
       providerWith(() => {
@@ -220,12 +266,28 @@ describe("GuardMemoryCapture without the capability (the pre-seam gate)", () =>
       step.execute(
         memoryCtx({
           ...LOCAL_USER,
-          rawToken: jwtWith({ platform_client_id: "pc_1" }),
+          rawToken: mintedToken({ platform_client_id: "pc_1" }),
         }),
       ),
     ).rejects.toThrowError(MEMORY_CAPTURE_CALLER_MESSAGE);
   });
 
+  it("admits a platform_client_id claim on a token Stigmer did not issue", async () => {
+    const step = newGuardMemoryCaptureStep<typeof MemorySchema>(providerWith());
+    await step.execute(memoryCtx(FOREIGN_CLAIM_CALLER));
+  });
+
+  it("admits a platform token whose platform_client_id is empty", async () => {
+    const step = newGuardMemoryCaptureStep<typeof MemorySchema>(providerWith());
+    await step.execute(
+      memoryCtx({
+        ...LOCAL_USER,
+        issuer: "stigmer",
+        rawToken: mintedToken({ platform_client_id: "" }),
+      }),
+    );
+  });
+
   it("admits a runner-shaped caller — the recorded pre-fix posture", async () => {
     // With no capability composed the gate cannot classify runner
     // credentials — the single-user OSS posture admits them (the #564