@stigmer/server 3.39.0 → 3.40.0

package/src/domain/workflow/__tests__/store-faults.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Pins the store-fault contract of the workflow's visibility-update load: a
+ * typed ResourceNotFoundError answers NotFound with the domain's pinned copy
+ * (`workflow not found: <id>`), and any other store failure is an
+ * infrastructure fault answered as a sanitized Internal, never a NotFound that
+ * tells a client the workflow does not exist (stigmer/stigmer#1345).
+ *
+ * The surface is updateVisibility, reached through the registered handler on
+ * an in-process router. The composed suites reach only a real store, which
+ * cannot fail selectively, so it runs here against a store whose read throws.
+ * The validator and the default-instance creator are untouchable: a load that
+ * fails must stop the call before anything past it runs.
+ *
+ * Out of scope: the NotFound copy itself (wire contract).
+ */
+import type { Client, ConnectError } from "@connectrpc/connect";
+import { Code, createClient, createRouterTransport } from "@connectrpc/connect";
+import { describe, expect, it } from "vitest";
+
+import { WorkflowCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/command_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { createApiResourceInterceptor } from "../../../pipeline/interceptors/apiresource.js";
+import { createVerifierChainInterceptor } from "../../../pipeline/interceptors/auth.js";
+import {
+  errorOf,
+  failingStore,
+  untouchable,
+} from "../../../pipeline/__tests__/support.js";
+import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../../store/interface.js";
+import type { Store } from "../../../store/interface.js";
+
+import { registerWorkflowServices } from "../controller.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const WORKFLOW_ID = "wfl_storefault";
+
+const NOT_FOUND_COPY = `workflow not found: ${WORKFLOW_ID}`;
+const LOAD_FAULT_COPY = "failed to load workflow";
+
+const MISSING = (): Error =>
+  new ResourceNotFoundError(`workflow/${WORKFLOW_ID}`);
+const LOCKED = (): Error => new Error("SQLITE_BUSY: database is locked");
+
+/**
+ * The registered handlers on an in-process router: the verifier chain stamps
+ * the trusted-local caller and the apiresource interceptor the kind, then
+ * Authorize and ValidateProto run and the load is the first step that reads
+ * the store.
+ */
+function workflowCommand(
+  store: Store,
+): Client<typeof WorkflowCommandController> {
+  const transport = createRouterTransport(
+    (router) => {
+      registerWorkflowServices(router, {
+        store,
+        logger: silentLogger,
+        authorizer: newPermissiveSingleTeamAuthorizer(),
+        authorizationLifecycle: undefined,
+        validator: untouchable("validator"),
+        workflowInstanceCreator: untouchable("workflowInstanceCreator"),
+      });
+    },
+    {
+      router: {
+        interceptors: [
+          createVerifierChainInterceptor([], [], silentLogger),
+          createApiResourceInterceptor(),
+        ],
+      },
+    },
+  );
+  return createClient(WorkflowCommandController, transport);
+}
+
+describe("updateVisibility — LoadWorkflowForVisibilityUpdate", () => {
+  function surfaceError(store: Store): Promise<ConnectError> {
+    return errorOf(() =>
+      workflowCommand(store).updateVisibility({
+        resourceId: WORKFLOW_ID,
+        visibility: ApiResourceVisibility.visibility_private,
+      }),
+    );
+  }
+
+  it("a missing workflow answers NotFound with the domain's copy", async () => {
+    const error = await surfaceError(failingStore(MISSING()));
+
+    expect(error.code).toBe(Code.NotFound);
+    expect(error.rawMessage).toBe(NOT_FOUND_COPY);
+  });
+
+  it("any other store failure answers a sanitized Internal", async () => {
+    const error = await surfaceError(failingStore(LOCKED()));
+
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe(LOAD_FAULT_COPY);
+  });
+});

package/src/domain/workflow/controller.ts

@@ -13,8 +13,12 @@
  * Proven by workflow.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing here).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference and listVersions authorize the resolved workflow as `get`
+ * would. getVersion evaluates its annotation through authorizeDirect;
+ * validateSpec deliberately does not, since it persists nothing. Per-RPC
+ * posture: docs/authorization-coverage.md §17.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, enumToJson, fromBinary } from "@bufbuild/protobuf";
@@ -492,7 +496,7 @@ async function updateVisibility(
   return reqCtx.get(UPDATE_VISIBILITY_WORKFLOW_KEY) as Workflow;
 }
 
-/** Loads the workflow by resource_id; ANY load failure → NotFound. */
+/** Loads the workflow by resource_id; a missing one answers NotFound, a store fault Internal. */
 function newLoadWorkflowForVisibilityUpdateStep(
   store: Store,
 ): PipelineStep<UpdateVisibilityDesc> {
@@ -507,8 +511,11 @@ function newLoadWorkflowForVisibilityUpdateStep(
           input.resourceId,
           WorkflowSchema,
         );
-      } catch {
-        throw notFoundError("workflow", input.resourceId);
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          throw notFoundError("workflow", input.resourceId);
+        }
+        throw internalError(error, "failed to load workflow");
       }
       ctx.set(UPDATE_VISIBILITY_WORKFLOW_KEY, workflow);
     },

package/src/domain/workflowexecution/controller.ts

@@ -12,10 +12,14 @@
  * Proven by workflowexecution.conformance.test.ts
  * (CONFORMANCE_TARGET=local) and __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, Publish,
- * PublishToRedis, and TransformResponse steps (no multi-tenant auth,
- * event publishing, or Redis here — subscribe streams ride in-memory
- * channels per ADR 011).
+ * Every chain opens with Authorize, and create also authorizes its run
+ * target (AuthorizeRunTarget); create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle. The streams and
+ * the event log evaluate their annotation through authorizeDirect; the
+ * list, summary and pending-approval reads narrow through the composed
+ * list read scope. Subscribe streams ride the in-memory stream broker
+ * (ADR 011); there is no Redis. Per-RPC posture:
+ * docs/authorization-coverage.md §19.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/workflowexecution/update-status.ts

@@ -22,8 +22,9 @@
  * phase-transition-only statusAudit bump (heartbeats must not perpetually
  * re-sort long-running executions above new ones in the recents sidebar).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, PublishToRedis, and
- * Publish steps (broadcast rides in-memory channels per ADR 011).
+ * The chain opens with Authorize (can_edit on the execution); the
+ * broadcast rides the in-memory stream broker (ADR 011) — there is no
+ * Redis.
  */
 import { create, toBinary } from "@bufbuild/protobuf";
 import { timestampNow } from "@bufbuild/protobuf/wkt";

package/src/domain/workflowinstance/__tests__/store-faults.test.ts

@@ -0,0 +1,172 @@
+/**
+ * Pins the store-fault contract of the workflow instance's loads. The shared
+ * targeted-update load (updateVisibility and updateExecutionVisibility): a
+ * typed ResourceNotFoundError answers NotFound with the domain's pinned copy
+ * (`workflow instance not found: <id>`), and any other store failure is an
+ * infrastructure fault answered as a sanitized Internal, never a NotFound that
+ * tells a client the instance does not exist (stigmer/stigmer#1345). Create's
+ * parent-workflow load reads the workflow through the in-process query
+ * client, so the store's typed miss arrives as a Connect NotFound: that
+ * answers the pinned `Workflow not found: <id>`, and any other failure an
+ * Internal, never a missing parent (stigmer/stigmer#1351).
+ *
+ * Every surface is reached through the registered handler on an in-process
+ * router. The composed suites reach only a real store, which cannot fail
+ * selectively, so the updates run against a store whose read throws and
+ * create against a parent loader whose read throws. Whatever the surface does
+ * not need is untouchable: a load that fails must stop the call before
+ * anything past it runs.
+ *
+ * Out of scope: the NotFound copies themselves (wire contract).
+ */
+import type { Client } from "@connectrpc/connect";
+import {
+  Code,
+  ConnectError,
+  createClient,
+  createRouterTransport,
+} from "@connectrpc/connect";
+import { describe, expect, it } from "vitest";
+
+import { WorkflowInstanceCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/command_pb";
+import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { createApiResourceInterceptor } from "../../../pipeline/interceptors/apiresource.js";
+import { createVerifierChainInterceptor } from "../../../pipeline/interceptors/auth.js";
+import {
+  errorOf,
+  failingStore,
+  untouchable,
+} from "../../../pipeline/__tests__/support.js";
+import { INTERNAL_FALLBACK_MESSAGE } from "../../../pipeline/pipeline.js";
+import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../../store/interface.js";
+import type { Store } from "../../../store/interface.js";
+
+import { registerWorkflowInstanceServices } from "../controller.js";
+import type { ParentWorkflowLoaderProvider } from "../steps.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const INSTANCE_ID = "win_storefault";
+const WORKFLOW_ID = "wfl_storefault";
+
+const NOT_FOUND_COPY = `workflow instance not found: ${INSTANCE_ID}`;
+const LOAD_FAULT_COPY = "failed to load workflow instance";
+const PARENT_NOT_FOUND_COPY = `Workflow not found: ${WORKFLOW_ID}`;
+const PARENT_LOAD_FAULT_COPY = "failed to load parent workflow";
+
+const MISSING = (): Error =>
+  new ResourceNotFoundError(`workflow_instance/${INSTANCE_ID}`);
+const LOCKED = (): Error => new Error("SQLITE_BUSY: database is locked");
+
+/** What the workflow query's `get` answers for a missing and a faulted workflow. */
+const PARENT_MISSING = (): Error =>
+  new ConnectError(`Workflow not found: ${WORKFLOW_ID}`, Code.NotFound);
+const PARENT_FAULTED = (): Error =>
+  new ConnectError(INTERNAL_FALLBACK_MESSAGE, Code.Internal);
+
+/**
+ * The registered handlers on an in-process router: the verifier chain stamps
+ * the trusted-local caller and the apiresource interceptor the kind, then
+ * Authorize and ValidateProto run and the load is the first step that reads
+ * the store or the parent.
+ */
+function instanceCommand(
+  store: Store,
+  parentWorkflowLoader: ParentWorkflowLoaderProvider = untouchable(
+    "parentWorkflowLoader",
+  ),
+): Client<typeof WorkflowInstanceCommandController> {
+  const transport = createRouterTransport(
+    (router) => {
+      registerWorkflowInstanceServices(router, {
+        store,
+        logger: silentLogger,
+        authorizer: newPermissiveSingleTeamAuthorizer(),
+        authorizationLifecycle: undefined,
+        parentWorkflowLoader,
+        listReadScope: undefined,
+      });
+    },
+    {
+      router: {
+        interceptors: [
+          createVerifierChainInterceptor([], [], silentLogger),
+          createApiResourceInterceptor(),
+        ],
+      },
+    },
+  );
+  return createClient(WorkflowInstanceCommandController, transport);
+}
+
+describe.each([
+  {
+    surface: "updateVisibility — LoadInstanceForVisibilityUpdate",
+    call: (store: Store) =>
+      instanceCommand(store).updateVisibility({
+        resourceId: INSTANCE_ID,
+        visibility: ApiResourceVisibility.visibility_private,
+      }),
+  },
+  {
+    surface:
+      "updateExecutionVisibility — LoadInstanceForExecutionVisibilityUpdate",
+    call: (store: Store) =>
+      instanceCommand(store).updateExecutionVisibility({
+        resourceId: INSTANCE_ID,
+        executionVisibility: WorkflowExecutionVisibility.private,
+      }),
+  },
+])("$surface", ({ call }) => {
+  it("a missing workflow instance answers NotFound with the domain's copy", async () => {
+    const error = await errorOf(() => call(failingStore(MISSING())));
+
+    expect(error.code).toBe(Code.NotFound);
+    expect(error.rawMessage).toBe(NOT_FOUND_COPY);
+  });
+
+  it("any other store failure answers a sanitized Internal", async () => {
+    const error = await errorOf(() => call(failingStore(LOCKED())));
+
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe(LOAD_FAULT_COPY);
+  });
+});
+
+describe("create — LoadParentWorkflow", () => {
+  function surfaceError(parentError: Error): Promise<ConnectError> {
+    const failingParent: ParentWorkflowLoaderProvider = () => ({
+      get: () => Promise.reject(parentError),
+    });
+    return errorOf(() =>
+      instanceCommand(untouchable("store"), failingParent).create({
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "WorkflowInstance",
+        metadata: { name: "Store Fault Instance", org: "org_storefault" },
+        spec: { workflowId: WORKFLOW_ID },
+      }),
+    );
+  }
+
+  it("a missing parent workflow answers NotFound with the pinned copy", async () => {
+    const error = await surfaceError(PARENT_MISSING());
+
+    expect(error.code).toBe(Code.NotFound);
+    expect(error.rawMessage).toBe(PARENT_NOT_FOUND_COPY);
+  });
+
+  it("any other parent-load failure answers a sanitized Internal", async () => {
+    const error = await surfaceError(PARENT_FAULTED());
+
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe(PARENT_LOAD_FAULT_COPY);
+  });
+});

package/src/domain/workflowinstance/controller.ts

@@ -13,8 +13,8 @@
  *
  * Pipeline per RPC mirrors the Go step chains character-for-character.
  * Proven by workflowinstance.conformance.test.ts
- * (CONFORMANCE_TARGET=local) and the family test
- * ../workflow/__tests__/workflow.test.ts (the mutual edge makes the two
+ * (CONFORMANCE_TARGET=local), __tests__/store-faults.test.ts and the family
+ * test ../workflow/__tests__/workflow.test.ts (the mutual edge makes the two
  * domains one testable unit).
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
@@ -104,6 +104,7 @@ import {
   newValidateVisibilityStep,
   newValidateVisibilityUpdateStep,
 } from "../../pipeline/steps/validate-visibility.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { workflowInstanceSearchExtractor } from "./search-extractor.js";
 import {
@@ -573,9 +574,10 @@ function newSetInstanceExecutionVisibilityStep(): PipelineStep<UpdateExecutionVi
 // ---------------------------------------------------------------------------
 
 /**
- * Loads the instance by resource_id; ANY load failure → NotFound. The
- * accessor keeps the input shape compiler-checked (both targeted-update
- * inputs carry resource_id, but the compiler should prove it, not a cast).
+ * Loads the instance by resource_id; a missing one answers NotFound, a store
+ * fault Internal. The accessor keeps the input shape compiler-checked (both
+ * targeted-update inputs carry resource_id, but the compiler should prove it,
+ * not a cast).
  */
 function newLoadInstanceStep<Desc extends DescMessage>(
   store: Store,
@@ -594,8 +596,11 @@ function newLoadInstanceStep<Desc extends DescMessage>(
           resourceId,
           WorkflowInstanceSchema,
         );
-      } catch {
-        throw notFoundError("workflow instance", resourceId);
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          throw notFoundError("workflow instance", resourceId);
+        }
+        throw internalError(error, "failed to load workflow instance");
       }
       ctx.set(instanceKey, instance);
     },

package/src/domain/workflowinstance/steps.ts

@@ -8,7 +8,7 @@
  * the family test ../workflow/__tests__/workflow.test.ts (the mutual edge
  * makes the two domains one testable unit).
  */
-import { ConnectError } from "@connectrpc/connect";
+import { Code, ConnectError } from "@connectrpc/connect";
 import type { DescMessage } from "@bufbuild/protobuf";
 
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
@@ -55,9 +55,11 @@ export type ParentWorkflowLoaderProvider = () => ParentWorkflowLoader;
 
 /**
  * LoadParentWorkflow — create.go: loads the workflow the instance
- * materializes and stashes it for the same-org rule. ANY load failure maps
- * to NotFound("Workflow", id) — Go folds every client error into that arm
- * (capital-W copy is the wire contract).
+ * materializes and stashes it for the same-org rule. The workflow is read
+ * through the in-process query client, so a missing one arrives as a Connect
+ * NotFound and answers NotFound("Workflow", id) (the capital-W copy is the
+ * wire contract); any other failure is a fault answered as Internal, never a
+ * missing parent.
  */
 export function newLoadParentWorkflowStep(
   loaderProvider: ParentWorkflowLoaderProvider,
@@ -74,12 +76,14 @@ export function newLoadParentWorkflowStep(
       try {
         parent = await loaderProvider().get(workflowId);
       } catch (error) {
-        logger.warn("Parent workflow not found", {
-          error:
-            error instanceof ConnectError ? error.rawMessage : String(error),
-          workflowId,
-        });
-        throw notFoundError("Workflow", workflowId);
+        if (error instanceof ConnectError && error.code === Code.NotFound) {
+          logger.warn("Parent workflow not found", {
+            error: error.rawMessage,
+            workflowId,
+          });
+          throw notFoundError("Workflow", workflowId);
+        }
+        throw internalError(error, "failed to load parent workflow");
       }
 
       ctx.set(PARENT_WORKFLOW_KEY, parent);

package/src/extensions/__tests__/identity.test.ts

@@ -13,10 +13,18 @@
  * in-process origin, and never a wire `machine` account — the one row
  * where the two predicates part, pinned so a step trusting server-composed
  * state can never be widened to the wire by picking the wrong one.
+ *
+ * And pins `isFirstPartyHumanOperator` (stigmer#1387), the allow-list
+ * memory recall and the person's declared preferences read: a wire `user`
+ * whose bearer is not a PlatformClient user token. Every other class, an
+ * in-process `user` (the open-source schedule fire's shape) and a
+ * platform token naming a PlatformClient are excluded; another issuer's
+ * token carrying the same claim is not a platform token (stigmer#1312).
  */
 import { describe, expect, it } from "vitest";
 
 import {
+  isFirstPartyHumanOperator,
   isPlatformPipelineCaller,
   isServerComposedRequest,
 } from "../identity.js";
@@ -103,3 +111,77 @@ describe("isServerComposedRequest", () => {
     );
   });
 });
+
+/** A JWT carrying `payload`, unsigned: the predicate reads, never verifies. */
+function jwtWith(payload: Record<string, unknown>): string {
+  const segment = (value: object) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${segment({ alg: "RS256", typ: "JWT" })}.${segment(payload)}.signature`;
+}
+
+describe("isFirstPartyHumanOperator", () => {
+  it("is true for a wire user — an OIDC login, an API key, the laptop's operator", () => {
+    expect(isFirstPartyHumanOperator(caller({}))).toBe(true);
+    expect(isFirstPartyHumanOperator(caller({ origin: "wire" }))).toBe(true);
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "https://issuer.example",
+          rawToken: jwtWith({ iss: "https://issuer.example", sub: "carol" }),
+        }),
+      ),
+    ).toBe(true);
+  });
+
+  it("is false for every other class, a composition's own included", () => {
+    for (const callerClass of [
+      "machine",
+      "runner",
+      "internal",
+      "guest",
+      "channel",
+      "schedule",
+      "sandbox",
+    ]) {
+      expect(
+        isFirstPartyHumanOperator(caller({ callerClass })),
+        callerClass,
+      ).toBe(false);
+    }
+  });
+
+  it("is false for a user the server composed a request for (the schedule fire)", () => {
+    expect(
+      isFirstPartyHumanOperator(
+        caller({ callerClass: "user", origin: "in-process" }),
+      ),
+    ).toBe(false);
+  });
+
+  it("is false for a PlatformClient user token, and true when another issuer stamps the claim", () => {
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "stigmer",
+          rawToken: jwtWith({
+            iss: "stigmer",
+            sub: "ida_x",
+            platform_client_id: "pc_1",
+          }),
+        }),
+      ),
+    ).toBe(false);
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "https://issuer.example",
+          rawToken: jwtWith({
+            iss: "https://issuer.example",
+            sub: "ida_x",
+            platform_client_id: "pc_1",
+          }),
+        }),
+      ),
+    ).toBe(true);
+  });
+});

package/src/extensions/identity.ts

@@ -12,6 +12,11 @@
  * HandlerContext.values (never ambient state — the every-dependency-
  * explicit doctrine).
  */
+import { USER_TOKEN_CLAIMS } from "../domain/platformclient/constants.js";
+import {
+  decodeVerifiedPlatformTokenPayload,
+  stringClaim,
+} from "../platformtoken/envelope.js";
 
 /**
  * The caller-class discriminant. OSS knows user / machine / runner plus
@@ -152,3 +157,45 @@ export function isPlatformPipelineCaller(caller: CallerIdentity): boolean {
 export function isServerComposedRequest(caller: CallerIdentity): boolean {
   return caller.callerClass === "internal" || caller.origin === "in-process";
 }
+
+/**
+ * Whether `caller` is a FIRST-PARTY HUMAN OPERATOR: a person at the
+ * console, the CLI or an SDK, speaking for themselves on the wire — the
+ * TS rendering of the Java RequestCallerIdentity.isFirstPartyHumanOperator
+ * (not machine, not impersonated, no token_type, not a PlatformClient user
+ * token). Stated once for every consumer that must tell the person from a
+ * lane acting near them: memory recall and the person's declared
+ * preferences on execution create (domain/agentexecution/create-steps.ts).
+ *
+ * An ALLOW-list, so a lane this module has never heard of is excluded by
+ * construction: the class must be `user` (every human verifier stamps it —
+ * OIDC, API key, the cloud's direct and federated logins; runners, the
+ * cloud's token lanes and the platform's own pipelines each carry their
+ * own class), the request must come from the wire (the open-source
+ * schedule fire acts as its creator with class `user` but rides the
+ * in-process transport, which is exactly what `isServerComposedRequest`
+ * reads), and the bearer must not be a PlatformClient user token (a
+ * person, but spoken for by a third-party client — DD-002 D4 as amended).
+ */
+export function isFirstPartyHumanOperator(caller: CallerIdentity): boolean {
+  return (
+    caller.callerClass === "user" &&
+    !isServerComposedRequest(caller) &&
+    !carriesPlatformClientClaim(caller.rawToken)
+  );
+}
+
+/**
+ * Whether the bearer is a platform token naming a PlatformClient. Anything
+ * that is not a platform token (no token, an API key, another issuer's
+ * JWT) is not one, whatever claims it carries (stigmer#1312). Read from
+ * the raw token, never from `platformClientId`, which is audit provenance
+ * set by one verifier and not a guard vocabulary (see its field doc).
+ */
+export function carriesPlatformClientClaim(rawToken: string): boolean {
+  const payload = decodeVerifiedPlatformTokenPayload(rawToken);
+  return (
+    payload !== undefined &&
+    stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId) !== undefined
+  );
+}

package/src/pipeline/__tests__/blind-not-found.test.ts

@@ -20,9 +20,8 @@
  *
  * The scan parses each module with the TypeScript compiler API rather than a
  * regular expression, because a catch block's extent (nested braces, a log
- * line before the throw) is a syntax question. `PENDING` is the list of known
- * blind sites still to be fixed; the scan must equal it exactly, so a new
- * blind site fails here, and so does a fixed site still listed.
+ * line before the throw) is a syntax question. The scan must find no blind
+ * site at all, so a new one fails here with its module and line.
  */
 import { readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
@@ -34,19 +33,6 @@ import { describe, expect, it } from "vitest";
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const SRC = path.resolve(HERE, "../..");
 
-/** Known blind sites by module (relative to `src`), with their count. */
-const PENDING: ReadonlyMap<string, number> = new Map([
-  // Store loads, stigmer/stigmer#1345 (fixed domain by domain).
-  ["domain/plugin/controller.ts", 1],
-  ["domain/skill/controller.ts", 1],
-  ["domain/workflow/controller.ts", 1],
-  ["domain/workflowinstance/controller.ts", 1],
-  // Parent loads through the in-process chain that fold every RPC error,
-  // validation included, stigmer/stigmer#1351.
-  ["domain/agentinstance/steps.ts", 1],
-  ["domain/workflowinstance/steps.ts", 1],
-]);
-
 interface BlindSite {
   readonly module: string;
   readonly line: number;
@@ -258,7 +244,7 @@ describe("the blind-NotFound rule", () => {
 });
 
 describe("the server source", () => {
-  it("has no blind NotFound beyond the pending list, and the list names only live sites", () => {
+  it("has no blind NotFound", () => {
     const sources = serverSources();
     const constructors = notFoundConstructors(sources);
     const found = new Map<string, number[]>();
@@ -278,8 +264,6 @@ describe("the server source", () => {
     const where = [...found]
       .flatMap(([module, lines]) => lines.map((line) => `${module}:${line}`))
       .join("\n");
-    expect(counts, `blind NotFound sites found:\n${where}`).toEqual(
-      Object.fromEntries(PENDING),
-    );
+    expect(counts, `blind NotFound sites found:\n${where}`).toEqual({});
   });
 });