@stigmer/server 3.39.0 → 3.40.0

package/src/domain/mcpserver/controller.ts

@@ -19,8 +19,12 @@
  * managed-env wiring is a disclosed, deliberately unpinned composition
  * artifact).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference loads, then authorizes the loaded server exactly as `get`
+ * would (AuthorizeResolvedTarget). The connect/OAuth handlers evaluate
+ * their annotation through authorizeDirect, after the load where they load
+ * (#224). Per-RPC posture: docs/authorization-coverage.md §20.
  *
  * Proven by mcpserver.conformance.test.ts +
  * agent-mcpserver-references.conformance.test.ts +

package/src/domain/memory/__tests__/capture-credential.test.ts

@@ -42,7 +42,7 @@ function memoryCtx(spec: {
 }
 
 describe("ResolveMemoryDefaults with an admitted capture credential", () => {
-  it("writes the proved subject and overrides provenance.session_id", () => {
+  it("writes the proved subject and overrides provenance.session_id", async () => {
     const ctx = memoryCtx({
       provenance: {
         sessionId: "ses_runner_reported",
@@ -54,7 +54,7 @@ describe("ResolveMemoryDefaults with an admitted capture credential", () => {
       subjectIdentityAccountId: "ida_human",
       provedSessionId: "ses_proved",
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("ida_human");
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
     // The threaded agent id survives; the forged tool_call_id never does.
@@ -62,21 +62,21 @@ describe("ResolveMemoryDefaults with an admitted capture credential", () => {
     expect(ctx.newState.spec?.provenance?.toolCallId).toBe("");
   });
 
-  it("creates provenance when the request supplied none", () => {
+  it("creates provenance when the request supplied none", async () => {
     const ctx = memoryCtx({});
     ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
       subjectIdentityAccountId: "ida_human",
       provedSessionId: "ses_proved",
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
   });
 
-  it("without the handoff the OSS arms stand", () => {
+  it("without the handoff the OSS arms stand", async () => {
     const ctx = memoryCtx({
       provenance: { sessionId: "ses_supplied", toolCallId: "forged" },
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_supplied");
     expect(ctx.newState.spec?.provenance?.toolCallId).toBe("");

package/src/domain/memory/__tests__/person-consent-composed.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Pins memory's double opt-in and its subject at the composition root
+ * (stigmer#1387), over a real boot under the BUILT-IN posture (a unit that
+ * declares require-authentication and registers no Authorizer — the
+ * open-source self-host with sign-in), with two signed-in people on the
+ * wire:
+ *
+ *   - Carol founds an organization with memory on. With her own switch
+ *     still off (the default), her capture is refused with the account
+ *     copy — before this fix it was stored, filed under nobody.
+ *   - Once she turns her own switch on, her capture is filed under HER
+ *     account id, she can read and confirm it (the model's subject tuple
+ *     names her), and Dave, a member of the same organization, can
+ *     neither read it nor see it listed: memory is subject-only.
+ *   - Dave, whose own switch is off, is refused exactly as Carol was.
+ *
+ * Recall is not driven here: an execution create needs an engine, and the
+ * recall step runs after the engine check. Its gates are pinned
+ * step-for-step in domain/agentexecution/__tests__/create-steps.test.ts,
+ * over the same identity-account reads this boot composes.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { clone, create } from "@bufbuild/protobuf";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryCommandController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/command_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { MemoryQueryController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/query_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import {
+  IdentityAccountPreferencesSchema,
+  IdentityAccountSpecSchema,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import type { ServerExtension } from "../../../extensions/registry.js";
+import {
+  baseConfig,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "../../../extensions/__tests__/composed-support.js";
+import { MEMORY_ACCOUNT_DISABLED_MESSAGE } from "../constants.js";
+
+const CAROL = "fake|carol";
+const DAVE = "fake|dave";
+const ORG = "memory-person-org";
+
+async function failureOf(promise: Promise<unknown>): Promise<ConnectError> {
+  try {
+    await promise;
+  } catch (error) {
+    expect(error).toBeInstanceOf(ConnectError);
+    return error as ConnectError;
+  }
+  throw new Error("expected the call to fail");
+}
+
+function memoryInput(content: string) {
+  return create(MemorySchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "Memory",
+    metadata: { org: ORG },
+    spec: { content },
+  });
+}
+
+describe("memory where callers are persons (built-in posture, composed server)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+  let carolAccount: IdentityAccount;
+
+  const asCarol = () => transportFor(port, fakeJwt(CAROL, "carol@example.com"));
+  const asDave = () => transportFor(port, fakeJwt(DAVE, "dave@example.com"));
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "memory-person-consent-composed-"));
+    const unit: ServerExtension = {
+      name: "fake-oidc-only",
+      requireAuthentication: true,
+      identityVerifiers: [fakeVerifier],
+    };
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+
+    // Carol provisions and founds the organization with memory on; Dave
+    // provisions afterwards and is a member of it (the membership rules
+    // run at a person's first provisioning).
+    carolAccount = await createClient(
+      IdentityAccountCommandController,
+      asCarol(),
+    ).provisionMyAccount({});
+    await createClient(OrganizationCommandController, asCarol()).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: ORG, preferences: { memoryEnabled: true } },
+    });
+    await createClient(
+      IdentityAccountCommandController,
+      asDave(),
+    ).provisionMyAccount({});
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("refuses a person whose own switch is off, with the account's copy", async () => {
+    const failure = await failureOf(
+      createClient(MemoryCommandController, asCarol()).create(
+        memoryInput("Carol prefers OpenTofu."),
+      ),
+    );
+    expect(failure.code).toBe(Code.FailedPrecondition);
+    expect(failure.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+
+  it("files the fact under the person once they opt in, and it stays theirs alone", async () => {
+    const carolId = carolAccount.metadata?.id ?? "";
+    expect(carolId).not.toBe("");
+    const optedIn = clone(IdentityAccountSchema, carolAccount);
+    optedIn.spec ??= create(IdentityAccountSpecSchema);
+    optedIn.spec.preferences ??= create(IdentityAccountPreferencesSchema);
+    optedIn.spec.preferences.memoryEnabled = true;
+    await createClient(IdentityAccountCommandController, asCarol()).update(
+      optedIn,
+    );
+
+    const carolMemories = createClient(MemoryCommandController, asCarol());
+    const created = await carolMemories.create(
+      memoryInput("Carol prefers OpenTofu."),
+    );
+    const memoryId = created.metadata?.id ?? "";
+    expect(created.spec?.subjectIdentityAccountId).toBe(carolId);
+
+    // The subject tuple names Carol: she decides on her own memory.
+    const confirmed = await carolMemories.confirm({ value: memoryId });
+    expect(confirmed.status?.lifecycleState).toBe(
+      MemoryLifecycleState.lifecycle_state_confirmed,
+    );
+    const carolReads = createClient(MemoryQueryController, asCarol());
+    expect((await carolReads.get({ value: memoryId })).metadata?.id).toBe(
+      memoryId,
+    );
+    expect(
+      (await carolReads.list({ org: ORG })).items.map((m) => m.metadata?.id),
+    ).toContain(memoryId);
+
+    // Dave shares the organization, not the memory.
+    const daveReads = createClient(MemoryQueryController, asDave());
+    const failure = await failureOf(daveReads.get({ value: memoryId }));
+    expect(failure.code).toBe(Code.PermissionDenied);
+    expect(
+      (await daveReads.list({ org: ORG })).items.map((m) => m.metadata?.id),
+    ).not.toContain(memoryId);
+  });
+
+  it("refuses the second person exactly as the first, while their switch is off", async () => {
+    const failure = await failureOf(
+      createClient(MemoryCommandController, asDave()).create(
+        memoryInput("Dave deploys on Fridays."),
+      ),
+    );
+    expect(failure.code).toBe(Code.FailedPrecondition);
+    expect(failure.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+});

package/src/domain/memory/__tests__/person-consent.test.ts

@@ -0,0 +1,274 @@
+/**
+ * Pins memory capture where callers are persons (stigmer#1387): with the
+ * identity-account directory composed, ResolveMemoryDefaults files the
+ * memory under the id of the account it is about — the admitted capture
+ * credential's subject (an account id or a raw issuer subject, read the
+ * way accountForStamp reads a creator stamp), else the calling person —
+ * and hands that account to CheckMemoryEnablement, which requires the
+ * organization's switch and then the person's own (the Java
+ * MemoryCreateHandler's order and copy). A caller no account stands for is
+ * stamped "" and refused by the enablement step, behind the authorization
+ * bar. Without the directory — the single-operator posture — the org flag
+ * alone decides and the subject stays the "" sentinel.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import { MEMORY_CAPTURE_CREDENTIAL_KEY } from "../../../pipeline/steps/guard-memory-capture.js";
+import type { Store } from "../../../store/interface.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
+import type { AccountsByCaller } from "../../identityaccount/resolve.js";
+import { fakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
+import type { FakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
+import {
+  MEMORY_ACCOUNT_DISABLED_MESSAGE,
+  memoryDisabledMessage,
+} from "../constants.js";
+import {
+  memorySubjectAccountOf,
+  newCheckMemoryEnablementStep,
+  newResolveMemoryDefaultsStep,
+} from "../steps.js";
+
+const ORG = "org_acme";
+const CAROL = "ida_carol";
+const CAROL_SUBJECT = "auth0|carol";
+
+/** Carol at the console: a wire user whose identity is her account id. */
+const CAROL_AT_CONSOLE: CallerIdentity = {
+  identityId: CAROL,
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: "opaque",
+};
+
+/** A sandbox-lane caller; its capture credential names the subject. */
+const SANDBOX: CallerIdentity = {
+  identityId: CAROL,
+  callerClass: "sandbox",
+  issuer: "stigmer",
+  rawToken: "opaque",
+};
+
+/** A signed-in caller no account stands for yet (idp-shaped). */
+const STRANGER: CallerIdentity = {
+  identityId: "auth0|stranger",
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: "opaque",
+};
+
+let dir: string;
+let store: Store;
+let accounts: FakeIdentityAccountStore;
+
+beforeEach(async () => {
+  dir = mkdtempSync(path.join(tmpdir(), "memory-person-consent-"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+  accounts = fakeIdentityAccountStore();
+  seedCarol({ memoryEnabled: true });
+  await seedOrg(true);
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function seedCarol(preferences: { memoryEnabled: boolean }): void {
+  accounts.rows.set(
+    CAROL,
+    create(IdentityAccountSchema, {
+      metadata: { id: CAROL, name: "Carol" },
+      spec: { idpId: CAROL_SUBJECT, preferences },
+    }),
+  );
+}
+
+async function seedOrg(memoryEnabled: boolean): Promise<void> {
+  await store.saveResource(
+    ApiResourceKind.organization,
+    ORG,
+    OrganizationSchema,
+    create(OrganizationSchema, {
+      metadata: { id: ORG, name: ORG, org: ORG },
+      spec: { preferences: { memoryEnabled } },
+    }),
+  );
+}
+
+function memoryCtx(
+  caller: CallerIdentity,
+): RequestContext<typeof MemorySchema> {
+  return new RequestContext(
+    MemorySchema,
+    create(MemorySchema, {
+      metadata: { name: "m", org: ORG },
+      // A forged subject: the server always overwrites it.
+      spec: { content: "fact", subjectIdentityAccountId: "ida_forged" },
+    }),
+    caller,
+    ApiResourceKind.memory,
+  );
+}
+
+function withCredential(
+  ctx: RequestContext<typeof MemorySchema>,
+  subject: string,
+): RequestContext<typeof MemorySchema> {
+  ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
+    subjectIdentityAccountId: subject,
+    provedSessionId: "ses_proved",
+  });
+  return ctx;
+}
+
+/** Runs the create chain's two consent steps in their chain order. */
+async function capture(
+  ctx: RequestContext<typeof MemorySchema>,
+  personAccounts: AccountsByCaller | undefined,
+): Promise<void> {
+  await newResolveMemoryDefaultsStep(personAccounts).execute(ctx);
+  await newCheckMemoryEnablementStep(store, personAccounts).execute(ctx);
+}
+
+async function refusalOf(run: Promise<void>): Promise<ConnectError> {
+  try {
+    await run;
+  } catch (error) {
+    return ConnectError.from(error);
+  }
+  throw new Error("expected the capture to be refused");
+}
+
+describe("capture where callers are persons", () => {
+  it("files a direct capture under the calling person's account", async () => {
+    const ctx = memoryCtx(CAROL_AT_CONSOLE);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+    expect(memorySubjectAccountOf(ctx)?.metadata?.id).toBe(CAROL);
+  });
+
+  it("files a credentialed capture under the credential's subject", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), CAROL);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+    expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
+  });
+
+  it("normalises a credential subject that arrived as a raw issuer subject to the account id", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), CAROL_SUBJECT);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+  });
+
+  it("refuses with the person's copy when their own switch is off", async () => {
+    seedCarol({ memoryEnabled: false });
+    for (const ctx of [
+      memoryCtx(CAROL_AT_CONSOLE),
+      withCredential(memoryCtx(SANDBOX), CAROL),
+    ]) {
+      const refusal = await refusalOf(capture(ctx, accounts));
+      expect(refusal.code).toBe(Code.FailedPrecondition);
+      expect(refusal.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+    }
+  });
+
+  it("asks the organization first: its switch off refuses with the org's copy", async () => {
+    seedCarol({ memoryEnabled: false });
+    await seedOrg(false);
+    const refusal = await refusalOf(
+      capture(memoryCtx(CAROL_AT_CONSOLE), accounts),
+    );
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(refusal.rawMessage).toBe(memoryDisabledMessage(ORG));
+  });
+
+  it("stamps nobody and refuses in the enablement step when no account stands for the caller", async () => {
+    const ctx = memoryCtx(STRANGER);
+    await newResolveMemoryDefaultsStep(accounts).execute(ctx);
+    // Not refused here: the refusal belongs behind the authorization bar.
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+    expect(memorySubjectAccountOf(ctx)).toBeUndefined();
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newCheckMemoryEnablementStep(store, accounts).execute(ctx),
+      ),
+    );
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(refusal.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+
+  it("refuses a credential whose subject names no account", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), "chn_org_acme");
+    const refusal = await refusalOf(capture(ctx, accounts));
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+  });
+
+  it("answers a directory fault as an infrastructure fault, never a refusal", async () => {
+    const faulting: AccountsByCaller = {
+      findById: async () => {
+        throw new Error("simulated store fault");
+      },
+      findDirectByIdpId: async () => {
+        throw new Error("simulated store fault");
+      },
+    };
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newResolveMemoryDefaultsStep(faulting).execute(
+          memoryCtx(CAROL_AT_CONSOLE),
+        ),
+      ),
+    );
+    expect(refusal.code).toBe(Code.Internal);
+  });
+
+  it("refuses to file under an account row that carries no id", async () => {
+    const nameless: AccountsByCaller = {
+      findById: async () =>
+        create(IdentityAccountSchema, {
+          spec: { preferences: { memoryEnabled: true } },
+        }),
+      findDirectByIdpId: async () => undefined,
+    };
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newResolveMemoryDefaultsStep(nameless).execute(
+          memoryCtx(CAROL_AT_CONSOLE),
+        ),
+      ),
+    );
+    expect(refusal.code).toBe(Code.Internal);
+  });
+});
+
+describe("capture under the single-operator posture", () => {
+  it("keeps the sentinel subject and the org flag alone, whatever the account says", async () => {
+    seedCarol({ memoryEnabled: false });
+    const ctx = memoryCtx(CAROL_AT_CONSOLE);
+    await capture(ctx, undefined);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+    expect(memorySubjectAccountOf(ctx)).toBeUndefined();
+  });
+
+  it("still refuses with the org's copy when the organization is off", async () => {
+    await seedOrg(false);
+    const refusal = await refusalOf(
+      capture(memoryCtx(CAROL_AT_CONSOLE), undefined),
+    );
+    expect(refusal.rawMessage).toBe(memoryDisabledMessage(ORG));
+  });
+});

package/src/domain/memory/constants.ts

@@ -30,6 +30,17 @@ export function memoryDisabledMessage(org: string): string {
   return `memory is not enabled for organization ${org} — an organization admin can enable it in organization preferences`;
 }
 
+/**
+ * Refuses a create while the PERSON the memory would be about has not
+ * enabled memory on their own account — the member half of the double
+ * opt-in (DD-006 D1), and the answer for a caller no account stands for,
+ * since only an unprovisioned person reaches that arm. The Java
+ * MemoryPolicy.MEMORY_ACCOUNT_DISABLED_MESSAGE, byte-pinned: the hosted
+ * edition's clients have rendered it since the Java handler shipped.
+ */
+export const MEMORY_ACCOUNT_DISABLED_MESSAGE =
+  "memory is not enabled for your account — enable it in account preferences";
+
 /**
  * Refuses confirming a rejected memory: the decision is auditable and
  * stands; a fresh proposal is the way back. Go

package/src/domain/memory/controller.ts

@@ -35,12 +35,15 @@
  *
  * Authorization posture (OSS): this edition is single-user and local, so
  * handlers perform no authorization — a documented no-op, not a silent
- * divergence. The subject is the empty-string sentinel (the OAuth grant
- * store convention); enablement is the org flag alone (the user scope
- * collapses — DD-002 D1). The cloud edition derives the subject from the
- * calling credential, enforces the strict first-party-human gate, checks
- * both memory_enabled flags, and gates every RPC through FGA (subject-only
- * can_view/can_edit/can_delete).
+ * divergence. The subject and the double opt-in follow the POSTURE, not
+ * the edition (stigmer#1387): where callers are persons (the
+ * require-authentication posture composes `personAccounts` — the hosted
+ * edition, a self-host with sign-in) the subject is the identity account
+ * the memory is about and both memory_enabled flags must be on; under the
+ * single-operator posture (trusted-local) the subject is the empty-string
+ * sentinel (the OAuth grant store convention) and enablement is the org
+ * flag alone (the user scope collapses — DD-002 D1). Every RPC's FGA
+ * question is subject-only (can_view/can_edit/can_delete).
  *
  * Memory is deliberately NOT search-indexed (privacy — subject-only
  * content must not surface in org-visible search): no search-extractor,
@@ -70,6 +73,7 @@ import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import { internalError } from "../../pipeline/errors.js";
@@ -131,6 +135,14 @@ export interface MemoryControllerDeps {
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed list read scope — list narrows through it; undefined = the OSS full scan (20260830.01). */
   readonly listReadScope: ListReadScope | undefined;
+  /**
+   * The directory of the persons callers stand for (stigmer#1387) — the
+   * composed identity-account port, bound under the require-authentication
+   * posture; undefined = the single-operator posture (trusted-local),
+   * where memory is the organization's switch alone and the subject the
+   * empty-string sentinel.
+   */
+  readonly personAccounts: AccountsByCaller | undefined;
   /**
    * The composed runner-credential provider — GuardMemoryCapture consults
    * its authorizeMemoryCapture capability for the runner-credential
@@ -172,10 +184,13 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
  * No search-index step: memory is not_search_indexed by design (privacy —
  * content is subject-only and must not surface in org-visible search).
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the strict
- * first-party-human-operator gate and the caller's own memory_enabled
- * check (no per-request user identity — the user scope collapses, DD-006
- * D1) and creates no FGA tuples.
+ * Authorization: GuardMemoryCapture decides WHO may capture (the composed
+ * RunnerCredentialProvider), AuthorizeResolvedTarget decides WHERE
+ * (can_create_session on the organization), and CreateAuthorizationTuples
+ * runs against the composed lifecycle. ResolveMemoryDefaults names the
+ * person the memory is about and CheckMemoryEnablement requires both
+ * halves of the double opt-in where callers are persons (both step docs;
+ * stigmer#1387).
  */
 async function createMemory(
   deps: MemoryControllerDeps,
@@ -195,7 +210,7 @@ async function createMemory(
     .addStep(newValidateProtoStep())
     .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
     .addStep(newValidateVisibilityStep())
-    .addStep(newResolveMemoryDefaultsStep())
+    .addStep(newResolveMemoryDefaultsStep(deps.personAccounts))
     // Before the enablement and cap checks, so a refused caller learns
     // nothing about the organization's settings (steps.ts,
     // resolveMemoryCreateTargets).
@@ -205,7 +220,7 @@ async function createMemory(
         resolveMemoryCreateTargets,
       ),
     )
-    .addStep(newCheckMemoryEnablementStep(deps.store))
+    .addStep(newCheckMemoryEnablementStep(deps.store, deps.personAccounts))
     .addStep(newCheckMemoryCapStep(deps.store))
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
@@ -236,8 +251,7 @@ async function createMemory(
  * owners (create, confirm, reject) last wrote it, even against a
  * concurrent confirm landing between this pipeline's load and persist.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_edit on the memory — FGA subject-only).
+ * Authorize evaluates can_edit on the memory (subject-only in the model).
  */
 async function update(
   deps: MemoryControllerDeps,
@@ -332,9 +346,8 @@ async function reject(
  * runTransition: one contract with opposite verdicts (DD-005 D3),
  * answering with the post-image row.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_edit on the memory — FGA subject-only, loading before
- * authorizing so a missing memory answers NOT_FOUND, #224).
+ * Authorize evaluates can_edit on the memory (subject-only in the model)
+ * against the request's id, before the load.
  */
 async function runTransition(
   deps: MemoryControllerDeps,
@@ -381,8 +394,7 @@ async function runTransition(
  *
  * No search-index cleanup: memory is not_search_indexed.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_delete on the memory — FGA subject-only).
+ * Authorize evaluates can_delete on the memory (subject-only in the model).
  *
  * The deleted memory is returned for audit trail purposes (gRPC
  * convention).
@@ -425,9 +437,8 @@ async function deleteMemory(
 /**
  * Get — chain per Go buildGetPipeline (ExtractResourceId → LoadTarget).
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_view — FGA subject-only: only the person a memory is about
- * can read it).
+ * Authorize evaluates can_view on the memory: in the model only the person
+ * a memory is about can read it.
  */
 async function get(
   deps: MemoryControllerDeps,
@@ -466,11 +477,9 @@ async function get(
  * console's presentation concern (DD-005 D4), deliberately not an RPC
  * parameter at the kind's dozens-of-records scale.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes:
- *   - Authorization filtering (single user — every record is the
- *     caller's; cloud filters to can_view via FGA, which resolves to the
- *     subject)
- *   - Pagination (returns all matching results)
+ * Narrowed to the caller's authorized rows (can_view, which resolves to
+ * the subject) by the composed list read scope. Unpaginated (returns all
+ * matching results).
  */
 async function list(
   deps: MemoryControllerDeps,