@stigmer/server 3.38.1 → 3.38.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.38.1",
+  "version": "3.38.3",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.38.1",
-    "@stigmer/plugin-package": "3.38.1",
-    "@stigmer/protos": "3.38.1",
-    "@stigmer/temporal-codecs": "3.38.1",
-    "@stigmer/zip-structure": "3.38.1",
+    "@stigmer/outbound": "3.38.3",
+    "@stigmer/plugin-package": "3.38.3",
+    "@stigmer/protos": "3.38.3",
+    "@stigmer/temporal-codecs": "3.38.3",
+    "@stigmer/zip-structure": "3.38.3",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/domain/agentexecution/__tests__/run-gate.test.ts

@@ -7,7 +7,10 @@
  * denial leaves no execution row AND creates no default instance — the
  * "no side effect precedes the check" property; (3) the gate precedes the
  * engine gate: an ALLOWED create on this engineless server answers the
- * engine's UNAVAILABLE, a DENIED one PERMISSION_DENIED. The authorizer
+ * engine's UNAVAILABLE, a DENIED one PERMISSION_DENIED; (4) the
+ * thinking-mode validation, which may read the stored session, runs behind
+ * the gate (stigmer/stigmer#1280): a DENIED create with an invalid thinking
+ * mode answers PERMISSION_DENIED, an ALLOWED one INVALID_ARGUMENT. The authorizer
  * under test answers only run-gate checks (runGateOnlyAuthorizer), so every
  * refusal here is the run gate's and nobody else's.
  */
@@ -25,6 +28,7 @@ import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb"
 import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
@@ -134,6 +138,7 @@ function createInput(spec: {
   agentId?: string;
   sessionId?: string;
   sessionSpec?: { agentInstanceId: string };
+  executionConfig?: { modelName?: string; thinkingMode?: ThinkingMode };
 }) {
   return {
     apiVersion: API_VERSION,
@@ -242,4 +247,40 @@ describe("agent-execution-create run gate (composed server)", () => {
     expect(err.rawMessage).toBe(ENGINE_UNAVAILABLE_MESSAGE);
     expect(gate.runGateChecks.map((c) => c.resourceId)).toEqual([agentId]);
   });
+
+  it("thinking-mode validation runs behind the gate: a denied caller learns nothing about the session", async () => {
+    decision = { kind: "deny", reason: "" };
+    gate.runGateChecks.length = 0;
+
+    const err = await captureError(() =>
+      command.create(
+        createInput({
+          sessionId: "ses_01someoneelses",
+          executionConfig: { modelName: "composer-2.5", thinkingMode: ThinkingMode.ENABLED },
+        }),
+      ),
+    );
+
+    expect(err.code).toBe(Code.PermissionDenied);
+    expect(err.rawMessage).toBe(addExecutionToSessionDeniedMessage("ses_01someoneelses"));
+  });
+
+  it("an allowed create with an invalid thinking mode is refused by the validation, before the engine gate", async () => {
+    decision = { kind: "allow" };
+    const agentId = await createAgentWithoutDefaultInstance("Thinking agent");
+    const instancesBefore = await count(ApiResourceKind.agent_instance);
+
+    const err = await captureError(() =>
+      command.create(
+        createInput({
+          agentId,
+          executionConfig: { modelName: "composer-2.5", thinkingMode: ThinkingMode.ENABLED },
+        }),
+      ),
+    );
+
+    expect(err.code).toBe(Code.InvalidArgument);
+    expect(err.rawMessage).toContain("no thinking capability");
+    expect(await count(ApiResourceKind.agent_instance)).toBe(instancesBefore);
+  });
 });

package/src/domain/agentexecution/__tests__/update-status.test.ts

@@ -8,7 +8,9 @@
  * Also pins the platform-row rules (platform-rows.ts, stigmer#980): a
  * platform marker write is appended to the transcript and never replaces
  * it, idempotently, and a PAUSED or CANCELLED execution's stop row stays
- * last across the runner's late writes, whatever order they land in.
+ * last across the runner's late writes, whatever order they land in; and a
+ * paused execution's phase moves only on the platform's own write
+ * (stigmer#1370), so the runner's straggler streaming cannot un-pause it.
  * These exercise applyUpdateStatusMerge directly on a clone — mirroring
  * the freshly-loaded resource the merge mutates in place inside the
  * updateResource write lock.
@@ -37,6 +39,7 @@ import { createLogger } from "../../../boot/logger.js";
 import { findToolCallInExecution } from "../submit-approval.js";
 import { CANCEL_STOP_ROW, PAUSE_STOP_ROW } from "../platform-rows.js";
 import { applyUpdateStatusMerge } from "../update-status.js";
+import type { StatusWriter } from "../update-status.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -51,13 +54,14 @@ const silentLogger = createLogger({
 function runBuildStep(
   existing: AgentExecution,
   incoming: MessageInitShape<typeof AgentExecutionStatusSchema>,
+  writer: StatusWriter = "wire",
 ): AgentExecution {
   const input = create(AgentExecutionUpdateStatusInputSchema, {
     executionId: existing.metadata?.id ?? "",
     status: incoming,
   });
   const merged = clone(AgentExecutionSchema, existing);
-  applyUpdateStatusMerge(merged, input, silentLogger);
+  applyUpdateStatusMerge(merged, input, silentLogger, writer);
   return merged;
 }
 
@@ -584,3 +588,55 @@ describe("platform rows (stigmer#980)", () => {
     });
   });
 });
+
+describe("a paused execution stays paused until Resume (stigmer#1370)", () => {
+  function pausedWith(...contents: string[]): AgentExecution {
+    return create(AgentExecutionSchema, {
+      metadata: { id: "exec-paused", name: "exec-paused" },
+      spec: {},
+      status: {
+        phase: ExecutionPhase.EXECUTION_PAUSED,
+        messages: [
+          ...contents.map((content) => ({ type: MessageType.MESSAGE_AI, content })),
+          { type: MessageType.MESSAGE_SYSTEM, content: PAUSE_STOP_ROW },
+        ],
+      },
+    });
+  }
+  const contentsOf = (e: AgentExecution) => (e.status?.messages ?? []).map((m) => m.content);
+
+  it("keeps PAUSED across the runner's straggler streaming write, and merges its text beneath the pause row", () => {
+    // The Pause RPC and the workflow's row landed; the runner learns of the
+    // pause on a later heartbeat and keeps streaming IN_PROGRESS writes that
+    // carry its growing transcript without the row.
+    const merged = runBuildStep(pausedWith("The press, part"), {
+      phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+      messages: [{ type: MessageType.MESSAGE_AI, content: "The press, part one and two" }],
+    });
+    expect(merged.status?.phase, "a wire write cannot un-pause").toBe(ExecutionPhase.EXECUTION_PAUSED);
+    expect(contentsOf(merged)).toEqual(["The press, part one and two", PAUSE_STOP_ROW]);
+  });
+
+  it("keeps PAUSED against a wire phase-only IN_PROGRESS write", () => {
+    const merged = runBuildStep(pausedWith("a1"), { phase: ExecutionPhase.EXECUTION_IN_PROGRESS });
+    expect(merged.status?.phase).toBe(ExecutionPhase.EXECUTION_PAUSED);
+  });
+
+  it("lets the platform's own write move a paused execution (the workflow's resume heal)", () => {
+    const merged = runBuildStep(
+      pausedWith("a1"),
+      { phase: ExecutionPhase.EXECUTION_IN_PROGRESS },
+      "platform",
+    );
+    expect(merged.status?.phase).toBe(ExecutionPhase.EXECUTION_IN_PROGRESS);
+    expect(contentsOf(merged)).toEqual(["a1", PAUSE_STOP_ROW]);
+  });
+
+  it("leaves a wire write on a running execution as it was (the latch is PAUSED's alone)", () => {
+    const merged = runBuildStep(existingWith(ExecutionPhase.EXECUTION_IN_PROGRESS, "m1"), {
+      phase: ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+      messages: [{ content: "m1" }],
+    });
+    expect(merged.status?.phase).toBe(ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL);
+  });
+});

package/src/domain/agentexecution/__tests__/validate-thinking-mode.test.ts

@@ -1,29 +1,38 @@
 /**
- * Pins validate-thinking-mode.ts against Go's
- * validate_thinking_mode_test.go case-for-case: fail-closed create-time
- * validation of ExecutionConfig.thinking_mode (#772) against the BUNDLED
- * registry. Capability-gated and cursor-harness-scoped: claude-opus-4-6
- * declares capabilities.thinking on its cursor entry; composer-2.5's
- * cursor entry declares thinking=false; claude-sonnet-4.6 declares the
- * capability but only on its NATIVE entry, which has no thinking wire
- * mapping in v1 and must refuse.
+ * Pins validate-thinking-mode.ts: fail-closed create-time validation of
+ * ExecutionConfig.thinking_mode (#772) against the BUNDLED registry, judged
+ * on the harness the execution will run on (#1280). The harness comes from
+ * the stored session for a turn on an existing session, else the bootstrap
+ * session_spec, UNSPECIFIED read as native; a real SQLite store holds the
+ * sessions. The bundled rows it leans on: claude-opus-4-6 declares
+ * `thinking` on its cursor entry and composer-2.5 declares none;
+ * claude-sonnet-5 is adaptive on its native entry and claude-haiku-4.5 is
+ * budget-shaped; claude-fable-5's native entry requires thinking.
  */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
 import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
 import { create } from "@bufbuild/protobuf";
 import type { MessageInitShape } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
-import { describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ServiceTier,
   ThinkingMode,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { ExecutionConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { AgentExecutionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { createLogger } from "../../../boot/logger.js";
 import { RequestContext } from "../../../pipeline/request-context.js";
+import type { Store } from "../../../store/interface.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
 import { bundledModelRegistryDocument } from "../../workflow/registry/bundled.js";
 import { ModelRegistryStore } from "../../workflow/registry/model-registry-store.js";
 import { newValidateThinkingModeStep } from "../validate-thinking-mode.js";
@@ -41,16 +50,31 @@ const registry = new ModelRegistryStore({
   logger: silentLogger,
 });
 
-const step = newValidateThinkingModeStep(registry);
+let dir: string;
+let store: Store;
+
+beforeEach(() => {
+  dir = mkdtempSync(path.join(tmpdir(), "validate-thinking-mode-test-"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+type SpecInit = MessageInitShape<typeof AgentExecutionSpecSchema>;
+type ExecutionConfigInit = NonNullable<SpecInit["executionConfig"]>;
 
 function contextFor(
-  config: MessageInitShape<typeof ExecutionConfigSchema> | undefined,
+  config: ExecutionConfigInit | undefined,
+  target: Pick<SpecInit, "sessionId" | "sessionSpec"> = {},
 ): RequestContext<typeof AgentExecutionSchema> {
   return new RequestContext(
     AgentExecutionSchema,
     create(AgentExecutionSchema, {
       spec: {
         message: "hello",
+        ...target,
         ...(config === undefined ? {} : { executionConfig: config }),
       },
     }),
@@ -59,11 +83,24 @@ function contextFor(
   );
 }
 
-function refusal(
-  config: MessageInitShape<typeof ExecutionConfigSchema>,
-): ConnectError {
+const onCursor = { sessionSpec: { harness: Harness.CURSOR } };
+const onNative = { sessionSpec: { harness: Harness.NATIVE } };
+
+async function passes(
+  config: ExecutionConfigInit | undefined,
+  target: Pick<SpecInit, "sessionId" | "sessionSpec"> = {},
+  onStore: Store = store,
+): Promise<void> {
+  await newValidateThinkingModeStep(registry, onStore).execute(contextFor(config, target));
+}
+
+async function refusal(
+  config: ExecutionConfigInit,
+  target: Pick<SpecInit, "sessionId" | "sessionSpec"> = {},
+  onStore: Store = store,
+): Promise<ConnectError> {
   try {
-    step.execute(contextFor(config));
+    await passes(config, target, onStore);
   } catch (error) {
     expect(error).toBeInstanceOf(ConnectError);
     return error as ConnectError;
@@ -71,73 +108,184 @@ function refusal(
   throw new Error("expected a fail-closed refusal, step passed");
 }
 
-describe("ValidateThinkingMode (#772, bundled registry)", () => {
-  it("no execution_config passes", () => {
-    expect(() => step.execute(contextFor(undefined))).not.toThrow();
+async function storeSession(id: string, harness: Harness): Promise<void> {
+  await store.saveResource(
+    ApiResourceKind.session,
+    id,
+    SessionSchema,
+    create(SessionSchema, { metadata: { id, org: "acme" }, spec: { harness } }),
+  );
+}
+
+describe("ValidateThinkingMode: modes that need no harness", () => {
+  it("no execution_config passes", async () => {
+    await expect(passes(undefined)).resolves.toBeUndefined();
   });
 
-  it("explicit DISABLED passes without a model", () => {
-    expect(() =>
-      step.execute(contextFor({ thinkingMode: ThinkingMode.DISABLED })),
-    ).not.toThrow();
+  it("explicit DISABLED passes without a model", async () => {
+    await expect(passes({ thinkingMode: ThinkingMode.DISABLED })).resolves.toBeUndefined();
   });
+});
 
-  it("ENABLED with a thinking-capable cursor model passes", () => {
-    expect(() =>
-      step.execute(
-        contextFor({
-          modelName: "claude-opus-4-6",
-          thinkingMode: ThinkingMode.ENABLED,
-        }),
-      ),
-    ).not.toThrow();
+describe("ValidateThinkingMode on the cursor harness", () => {
+  it("ENABLED with a thinking-capable cursor model passes", async () => {
+    await expect(
+      passes({ modelName: "claude-opus-4-6", thinkingMode: ThinkingMode.ENABLED }, onCursor),
+    ).resolves.toBeUndefined();
   });
 
-  it("ENABLED combines freely with FAST — the combination bills as the fast variant", () => {
-    expect(() =>
-      step.execute(
-        contextFor({
-          modelName: "claude-opus-4-6",
-          serviceTier: ServiceTier.FAST,
-          thinkingMode: ThinkingMode.ENABLED,
-        }),
+  it("ENABLED combines freely with FAST — the combination bills as the fast variant", async () => {
+    await expect(
+      passes(
+        { modelName: "claude-opus-4-6", serviceTier: ServiceTier.FAST, thinkingMode: ThinkingMode.ENABLED },
+        onCursor,
       ),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
   });
 
-  it("ENABLED without model_name fails closed (no thinking-on-Auto)", () => {
-    const err = refusal({ thinkingMode: ThinkingMode.ENABLED });
+  it("ENABLED without model_name fails closed, naming the cursor models that think", async () => {
+    const err = await refusal({ thinkingMode: ThinkingMode.ENABLED }, onCursor);
     expect(err.code).toBe(Code.InvalidArgument);
     expect(err.rawMessage).toContain("requires execution_config.model_name");
-    // Thinking-capable suggestions ride along.
     expect(err.rawMessage).toContain("claude-opus-4-6");
   });
 
-  it("ENABLED on a cursor model without the capability fails closed", () => {
-    const err = refusal({
-      modelName: "composer-2.5",
-      thinkingMode: ThinkingMode.ENABLED,
-    });
+  it("ENABLED on a cursor model without the capability fails closed", async () => {
+    const err = await refusal({ modelName: "composer-2.5", thinkingMode: ThinkingMode.ENABLED }, onCursor);
     expect(err.code).toBe(Code.InvalidArgument);
     expect(err.rawMessage).toContain("no thinking capability");
     expect(err.rawMessage).toContain("composer-2.5");
+    expect(err.rawMessage).toContain("cursor harness");
   });
 
-  it("ENABLED on a native-only model fails closed (no native wire mapping in v1)", () => {
-    const err = refusal({
-      modelName: "claude-sonnet-4.6",
-      thinkingMode: ThinkingMode.ENABLED,
-    });
+  it("ENABLED on a native-only model fails closed on cursor: the cursor entry is the one that decides", async () => {
+    const err = await refusal({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED }, onCursor);
     expect(err.code).toBe(Code.InvalidArgument);
-    expect(err.rawMessage).toContain("cursor");
-    expect(err.rawMessage).toContain("claude-sonnet-4.6");
+    expect(err.rawMessage).toContain("cursor harness");
   });
 
-  it("ENABLED on an unknown model fails closed", () => {
-    const err = refusal({
-      modelName: "not-a-model",
-      thinkingMode: ThinkingMode.ENABLED,
-    });
+  it("DISABLED on claude-fable-5 passes on cursor: only its native entry requires thinking", async () => {
+    await expect(
+      passes({ modelName: "claude-fable-5", thinkingMode: ThinkingMode.DISABLED }, onCursor),
+    ).resolves.toBeUndefined();
+  });
+});
+
+describe("ValidateThinkingMode on the native harness (#1280)", () => {
+  it("ENABLED on an adaptive native model passes — the #1280 case, claude-sonnet-5 on a native session", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+
+  it("ENABLED on a budget-shaped native model passes", async () => {
+    await expect(
+      passes({ modelName: "claude-haiku-4.5", thinkingMode: ThinkingMode.ENABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+
+  it("an UNSPECIFIED harness is native", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED }, { sessionSpec: {} }),
+    ).resolves.toBeUndefined();
+    await expect(passes({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED })).resolves.toBeUndefined();
+  });
+
+  it("ENABLED on a model with no native entry fails closed, naming the native models that think", async () => {
+    const err = await refusal({ modelName: "composer-2.5", thinkingMode: ThinkingMode.ENABLED }, onNative);
+    expect(err.code).toBe(Code.InvalidArgument);
+    expect(err.rawMessage).toContain("native harness");
+    expect(err.rawMessage).toContain("claude-sonnet-5");
+    expect(err.rawMessage).toContain("claude-haiku-4.5");
+  });
+
+  it("ENABLED on an unknown model fails closed", async () => {
+    const err = await refusal({ modelName: "not-a-model", thinkingMode: ThinkingMode.ENABLED }, onNative);
+    expect(err.code).toBe(Code.InvalidArgument);
+  });
+
+  it("an explicit DISABLED on a model that requires thinking fails closed", async () => {
+    const err = await refusal({ modelName: "claude-fable-5", thinkingMode: ThinkingMode.DISABLED }, onNative);
     expect(err.code).toBe(Code.InvalidArgument);
+    expect(err.rawMessage).toContain("always thinks");
+    expect(err.rawMessage).toContain("claude-fable-5");
+  });
+
+  it("UNSPECIFIED and ENABLED pass on a model that requires thinking", async () => {
+    await expect(passes({ modelName: "claude-fable-5" }, onNative)).resolves.toBeUndefined();
+    await expect(
+      passes({ modelName: "claude-fable-5", thinkingMode: ThinkingMode.ENABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+
+  it("an explicit DISABLED passes on a model that may turn thinking off", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.DISABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+});
+
+describe("ValidateThinkingMode reads a stored session's harness", () => {
+  it("a turn on a stored cursor session is judged on cursor", async () => {
+    await storeSession("ses_cursor", Harness.CURSOR);
+
+    await expect(
+      passes({ modelName: "claude-opus-4-6", thinkingMode: ThinkingMode.ENABLED }, { sessionId: "ses_cursor" }),
+    ).resolves.toBeUndefined();
+    const err = await refusal({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED }, { sessionId: "ses_cursor" });
+    expect(err.rawMessage).toContain("cursor harness");
+  });
+
+  it("a turn on a stored native session is judged on native, whatever the request's session_spec says", async () => {
+    await storeSession("ses_native", Harness.NATIVE);
+
+    await expect(
+      passes(
+        { modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED },
+        { sessionId: "ses_native", sessionSpec: { harness: Harness.CURSOR } },
+      ),
+    ).resolves.toBeUndefined();
+  });
+
+  it("a dangling session id is judged on the default native harness", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED }, { sessionId: "ses_missing" }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("a store fault is Internal, never a reading of the session", async () => {
+    const faulty = new Proxy(store, {
+      get(target, prop, receiver) {
+        if (prop === "getResource") {
+          return async () => {
+            throw new Error("simulated store fault");
+          };
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+
+    const err = await refusal(
+      { modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED },
+      { sessionId: "ses_any" },
+      faulty,
+    );
+    expect(err.code).toBe(Code.Internal);
+  });
+
+  it("a mode that needs no harness never reads the store", async () => {
+    const untouchable = new Proxy(store, {
+      get(target, prop, receiver) {
+        if (prop === "getResource") {
+          throw new Error("the store must not be read");
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+
+    await expect(passes(undefined, { sessionId: "ses_any" }, untouchable)).resolves.toBeUndefined();
+    await expect(
+      passes({ thinkingMode: ThinkingMode.DISABLED }, { sessionId: "ses_any" }, untouchable),
+    ).resolves.toBeUndefined();
   });
 });

package/src/domain/agentexecution/controller.ts

@@ -279,12 +279,16 @@ export function registerAgentExecutionServices(
 
 /**
  * Create — create.go buildCreatePipeline, step-for-step: validation
- * (proto → visibility → tier #357 → thinking #772) → the run gate
+ * (proto → visibility → tier #357) → the run gate
  * (AuthorizeRunTarget, P1 sp.run-gate: asking the target's own permission
  * by request shape — session, instance or blueprint; the all-empty shape
  * is the built-in assistant, admitted by Authorize's organization check
  * and gated on nothing further — before the engine gate so a denied caller
- * learns nothing about engine state, and before every side effect) → the standard build
+ * learns nothing about engine state, and before every side effect) → the
+ * thinking-mode validation (#772), which judges the model on the harness
+ * the execution will run on and so may read the stored session: it runs
+ * behind the run gate, so nothing about a session is read or disclosed
+ * before the caller may add a turn to it (#1280) → the standard build
  * → the engine gate (fail fast BEFORE the first side effect, so a down
  * engine orphans nothing) → the pre-side-effect gate slot (O4; empty in OSS) → the
  * side-effecting steps (default instance, session bootstrap,
@@ -317,10 +321,10 @@ async function createExecution(
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())
     .addStep(newValidateServiceTierStep(deps.modelRegistry))
-    .addStep(newValidateThinkingModeStep(deps.modelRegistry))
     .addStep(
       newAuthorizeRunTargetStep(deps.authorizer, agentExecutionRunTarget),
     )
+    .addStep(newValidateThinkingModeStep(deps.modelRegistry, deps.store))
     .addStep(newResolveSlugStep())
     .addStep(newBuildNewStateStep())
     // Vouches the runner-stamped workflow lineage labels (or refuses a

package/src/domain/agentexecution/update-status.ts

@@ -29,7 +29,11 @@
  * appended and never replaces the transcript, and a PAUSED or CANCELLED
  * execution's stop row stays last across the runner's later writes,
  * because the Pause and Cancel RPCs, the invoke workflow and the runner
- * all write a stopped execution and nothing orders them.
+ * all write a stopped execution and nothing orders them. For the same
+ * reason a PAUSED execution's phase moves only on the platform's own
+ * write (stigmer#1370): the runner learns of a pause on a later heartbeat
+ * and keeps streaming IN_PROGRESS until then, and without the latch its
+ * stragglers un-pause the execution and Resume finds nothing to resume.
  *
  * Broadcast rides in-memory channels (ADR 011).
  */
@@ -66,6 +70,7 @@ import {
 } from "../../pipeline/errors.js";
 import { newPipeline } from "../../pipeline/pipeline.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
@@ -161,7 +166,12 @@ export async function updateStatus(
               oldPhase =
                 execution.status?.phase ??
                 ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
-              applyUpdateStatusMerge(execution, ctx.input, deps.logger);
+              applyUpdateStatusMerge(
+                execution,
+                ctx.input,
+                deps.logger,
+                isServerComposedRequest(identity) ? "platform" : "wire",
+              );
             },
           );
         } catch (error) {
@@ -315,18 +325,27 @@ function mergeTranscript(
   return next;
 }
 
+/**
+ * Who sent a status write: the platform's own (the invoke workflow's
+ * writes, which reach this handler over the in-process transport, the
+ * one origin the wire cannot claim) or the wire (the runner).
+ */
+export type StatusWriter = "platform" | "wire";
+
 /**
  * Merges an incoming status update into the execution in place — the
  * runner-owns-the-transcript merge rules, exactly update_status.go
  * applyUpdateStatusMerge. Runs inside the updateResource closure
  * (synchronous by store contract), so the merge, the approval event
  * authoring, and the pending_approvals projection all see the same
- * snapshot that will be persisted.
+ * snapshot that will be persisted. `writer` defaults to the wire, the
+ * side that grants nothing extra.
  */
 export function applyUpdateStatusMerge(
   execution: AgentExecution,
   input: AgentExecutionUpdateStatusInput,
   logger: Logger,
+  writer: StatusWriter = "wire",
 ): void {
   if (execution.status === undefined) {
     execution.status = create(AgentExecutionStatusSchema);
@@ -415,8 +434,29 @@ export function applyUpdateStatusMerge(
   // re-terminalize it is gone. Recover is the one sanctioned
   // un-terminalizer and runs through its own lifecycle step, never this
   // merge.
+  //
+  // A PAUSED execution is latched the same way against the wire
+  // (stigmer#1370): the runner's straggler persists, sent before its
+  // heartbeat delivers the pause, carry IN_PROGRESS. Resume moves the
+  // phase through its own lifecycle step; through this merge only the
+  // platform's own writes do (the workflow's resume and recovery
+  // re-assertions, which also heal a stale PAUSED over a fast resume,
+  // oss#869). The straggler's transcript still merges, beneath the held
+  // pause row.
   if (requestStatus.phase !== ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED) {
     if (
+      existingPhase === ExecutionPhase.EXECUTION_PAUSED &&
+      writer === "wire" &&
+      requestStatus.phase !== existingPhase
+    ) {
+      logger.warn(
+        "Ignored a wire phase change on a paused execution; Resume or the platform's own write moves it",
+        {
+          executionId: input.executionId,
+          ignoredPhase: ExecutionPhase[requestStatus.phase],
+        },
+      );
+    } else if (
       isTerminalExecutionPhase(existingPhase) &&
       requestStatus.phase !== existingPhase
     ) {