@stigmer/server 3.39.0 → 3.40.0

package/src/boot/compose.ts

@@ -85,6 +85,7 @@ import {
 import { ensureOperatorAccount } from "../domain/identityaccount/operator.js";
 import { newDirectAccountProvisioner } from "../domain/identityaccount/provisioning.js";
 import { newResourceIdentityAccountStore } from "../domain/identityaccount/resource-store.js";
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
 import { registerIamPolicyServices } from "../domain/iampolicy/controller.js";
 import { newIamPolicyGrantPath } from "../domain/iampolicy/grant-path.js";
 import { asFetch, guardedFetch, nodeLookup } from "@stigmer/outbound/egress";
@@ -178,6 +179,11 @@ import { PostgresStore } from "../store/postgres/store.js";
 import { SqliteStore } from "../store/sqlite/store.js";
 import type { Store } from "../store/interface.js";
 import { resolveExtensions } from "../extensions/registry.js";
+import {
+  artifactLaneBindError,
+  resolveArtifactLanePort,
+  resolveArtifactServeUrl,
+} from "./artifact-lane.js";
 import { resolveOAuthRedirectUri } from "./oauth-redirect-uri.js";
 import { assessSkillTransferOrigin } from "./skill-transfer-origin.js";
 import type { ServerExtension } from "../extensions/registry.js";
@@ -570,6 +576,16 @@ export async function composeServer(
           logger,
         })
       : undefined);
+  // The persons callers stand for (stigmer#1387): under the
+  // require-authentication posture every caller is someone the
+  // identity-account domain can name, so memory and the person's declared
+  // preferences are that person's own; trusted-local composes none — the
+  // laptop's one operator, whose memory is the organization's switch alone
+  // (the contract's single-operator arm). The same binding both verifiers
+  // read, so a composed driver is followed here too.
+  const personAccounts: AccountsByCaller | undefined = requireAuthentication
+    ? identityAccounts
+    : undefined;
   logger.info("authorization posture resolved", {
     posture: authorizationPosture,
     authorizer:
@@ -951,11 +967,24 @@ export async function composeServer(
   // arm landed with #13; the health probe runs in start(), matching Go's
   // boot check. Since O5 the factory consults the composition's registered
   // drivers for non-built-in types (§6b).
+  //
+  // The download lane's placement (boot/artifact-lane.ts): the configured
+  // port, or the port beside the one the unified listener binds, ephemeral
+  // when that one is. Unset, the serve URL reads the port the lane actually
+  // bound in start(), before any request can mint a URL.
+  const artifactLanePort = resolveArtifactLanePort({
+    configured: config.artifactHttpPort,
+    unifiedPort: options.portOverride ?? config.grpcPort,
+  });
+  let artifactLaneBoundPort: number | undefined;
   const artifactStorage = newArtifactStorage(
     {
       type: config.artifactStorageType,
       localBasePath: config.artifactLocalBasePath,
-      localServeUrl: config.artifactLocalServeUrl,
+      localServeUrl: resolveArtifactServeUrl(
+        config.artifactLocalServeUrl,
+        () => artifactLaneBoundPort,
+      ),
       r2Bucket: config.r2Bucket,
       r2Endpoint: config.r2Endpoint,
       r2AccessKeyId: config.r2AccessKeyId,
@@ -964,10 +993,9 @@ export async function composeServer(
     },
     extensions.drivers.artifactStorageDrivers,
   );
-  // The artifact download lane: a SECOND loopback listener on
-  // ARTIFACT_HTTP_PORT, local storage only (Go server.go 849–870) —
-  // deliberately not a unified-port lane. Lifecycle rides start()/
-  // shutdown().
+  // The artifact download lane: a SECOND loopback listener, local storage
+  // only (Go server.go 849–870) — deliberately not a unified-port lane.
+  // Lifecycle rides start()/shutdown().
   const artifactFileServer =
     config.artifactStorageType === "local"
       ? createArtifactFileServer({
@@ -1461,6 +1489,7 @@ export async function composeServer(
       authorizer,
       authorizationLifecycle,
       listReadScope,
+      personAccounts,
       runnerCredentialProvider: runnerCredentials,
     });
     registerAgentExecutionServices(router, {
@@ -1469,6 +1498,7 @@ export async function composeServer(
       authorizer,
       authorizationLifecycle,
       listReadScope,
+      personAccounts,
       runnerCredentialProvider: runnerCredentials,
       broker: agentExecutionStreamBroker,
       engineState: executionEngineState,
@@ -1846,6 +1876,28 @@ export async function composeServer(
       // Artifact storage must be reachable and writable before the server
       // answers (Go server.go boots-fatal on the same probe).
       await artifactStorage.health();
+      // The download lane binds with the store it serves, and on the same
+      // terms: a lane that cannot bind fails the boot, where the retired Go
+      // server logged the failure and served on with every download dead
+      // (stigmer#1089). Binding here, before SERVING and the unified port,
+      // also means the derived serve URL exists before a request can mint
+      // one.
+      if (artifactFileServer !== undefined) {
+        await warnOnLegacyArtifactLayout(config.artifactLocalBasePath, logger);
+        try {
+          artifactLaneBoundPort = await artifactFileServer.listen(
+            artifactLanePort,
+            config.artifactHttpHost,
+          );
+        } catch (error) {
+          throw artifactLaneBindError(
+            error,
+            config.artifactHttpHost,
+            artifactLanePort,
+            config.artifactHttpPort !== undefined,
+          );
+        }
+      }
       // Rebuild the search index before the port binds (Go
       // server.go:617): the index is separate from the resources table,
       // and rebuilding here makes every resource — including rows an
@@ -1884,22 +1936,6 @@ export async function composeServer(
         options.host,
       );
       logger.info("stigmer-server listening", { port });
-      // The artifact file server binds AFTER the main server, exactly Go's
-      // boot order; a bind failure is logged but NOT fatal (Go's
-      // ListenAndServe goroutine logs and dies while the server runs on).
-      if (artifactFileServer !== undefined) {
-        await warnOnLegacyArtifactLayout(config.artifactLocalBasePath, logger);
-        try {
-          await artifactFileServer.listen(
-            config.artifactHttpPort,
-            config.artifactHttpHost,
-          );
-        } catch (error) {
-          logger.error("Artifact HTTP file server failed", {
-            error: error instanceof Error ? error.message : String(error),
-          });
-        }
-      }
       return port;
     },
 

package/src/boot/config.ts

@@ -95,16 +95,21 @@ export interface ServerConfig {
   /** The artifact root — shared with the runner's LOCAL_ARTIFACT_PATH (#285). */
   readonly artifactLocalBasePath: string;
   /**
-   * Base URL for local artifact download URLs — the port+1 artifact file
-   * server (#13); no trailing path segment (the storage key carries the
-   * full path).
+   * Base URL for local artifact download URLs (ARTIFACT_LOCAL_SERVE_URL;
+   * #13); no trailing path segment (the storage key carries the full path).
+   * "" = unset: the URL follows the port the artifact file server actually
+   * bound (boot/artifact-lane.ts), so an ephemeral lane mints URLs that
+   * reach it.
    */
   readonly artifactLocalServeUrl: string;
   /**
-   * The artifact file server's own port (ARTIFACT_HTTP_PORT, default
-   * grpcPort+1). Only bound when artifact storage is local.
+   * The artifact file server's own port (ARTIFACT_HTTP_PORT). Undefined =
+   * unset: the lane follows the unified port, +1, or ephemeral when that
+   * port is 0 — the rule lives in boot/artifact-lane.ts, because only the
+   * composition knows the port the unified listener binds. Only bound when
+   * artifact storage is local, and a lane that cannot bind fails the boot.
    */
-  readonly artifactHttpPort: number;
+  readonly artifactHttpPort: number | undefined;
   /**
    * The artifact file server's bind host (ARTIFACT_HTTP_HOST, DD-013;
    * shipped with the Docker image, Phase-2 P4). Defaults to 127.0.0.1 —
@@ -294,8 +299,9 @@ export const DEFAULT_SANDBOX_RUNNER_IMAGE = "ghcr.io/stigmer/runner:latest";
 export function loadConfig(env: NodeJS.ProcessEnv = process.env): ServerConfig {
   const { operatorEmail, operatorName } = loadOperatorIdentity(env);
   const grpcPort = envInt(env, "GRPC_PORT", DEFAULT_GRPC_PORT);
-  // Go: ARTIFACT_HTTP_PORT defaults to the gRPC port + 1.
-  const artifactHttpPort = envInt(env, "ARTIFACT_HTTP_PORT", grpcPort + 1);
+  // Unset (or malformed, the loader's leniency) leaves the lane to follow
+  // the unified port; boot/artifact-lane.ts derives it at composition.
+  const artifactHttpPort = envOptionalInt(env, "ARTIFACT_HTTP_PORT");
   const artifactHttpHost = envString(env, "ARTIFACT_HTTP_HOST", "127.0.0.1");
   const artifactStorageType = envString(env, "ARTIFACT_STORAGE_TYPE", "local");
   const r2 = {
@@ -337,11 +343,7 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): ServerConfig {
       "ARTIFACT_LOCAL_BASE_PATH",
       defaultArtifactPath(),
     ),
-    artifactLocalServeUrl: envString(
-      env,
-      "ARTIFACT_LOCAL_SERVE_URL",
-      `http://localhost:${artifactHttpPort}`,
-    ),
+    artifactLocalServeUrl: envString(env, "ARTIFACT_LOCAL_SERVE_URL", ""),
     logLevel: envString(env, "LOG_LEVEL", "info"),
     env: envString(env, "ENV", "local"),
     modelRegistryUpstream: envString(
@@ -531,14 +533,22 @@ function envString(
 }
 
 function envInt(env: NodeJS.ProcessEnv, key: string, fallback: number): number {
+  return envOptionalInt(env, key) ?? fallback;
+}
+
+/** An integer setting, or undefined when it is unset or malformed. */
+function envOptionalInt(
+  env: NodeJS.ProcessEnv,
+  key: string,
+): number | undefined {
   const value = env[key];
   if (value === undefined || value === "") {
-    return fallback;
+    return undefined;
   }
   const parsed = Number.parseInt(value, 10);
   // Go's strconv.Atoi rejects trailing garbage ("7234x"); Number.parseInt
   // would accept it, so the round-trip check keeps the two loaders aligned.
   return Number.isSafeInteger(parsed) && String(parsed) === value.trim()
     ? parsed
-    : fallback;
+    : undefined;
 }

package/src/domain/agent/controller.ts

@@ -11,8 +11,11 @@
  * Proven by agent.conformance.test.ts (CONFORMANCE_TARGET=local),
  * __tests__/agent.test.ts and __tests__/store-faults.test.ts.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing here).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference loads, then authorizes the loaded agent exactly as `get`
+ * would (AuthorizeResolvedTarget). The kind has no list RPC. Per-RPC
+ * posture: docs/authorization-coverage.md §6.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/agentexecution/__tests__/create-steps.test.ts

@@ -7,8 +7,18 @@
  * direct-step shape as Go). Go's nil-client skip proofs map to throwing
  * providers — reaching the client would fail the test just as a nil
  * dereference would panic Go.
+ *
+ * The two compose steps are also pinned where callers are persons
+ * (stigmer#1387, stigmer#1397): recall is the run's person's own
+ * confirmed facts, behind the first-party gate, the org switch and the
+ * person's own, and user_context is that person's standing context — the
+ * retired Java steps' gates, in their order.
  */
 import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import type { AccountsByCaller } from "../../identityaccount/resolve.js";
+import { fakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -94,11 +104,12 @@ function newExecution(sessionId: string, agentId: string): AgentExecution {
 
 function newContext(
   execution: AgentExecution,
+  caller: CallerIdentity = testCallerIdentity(),
 ): RequestContext<typeof AgentExecutionSchema> {
   return new RequestContext(
     AgentExecutionSchema,
     execution,
-    testCallerIdentity(),
+    caller,
     ApiResourceKind.agent_execution,
   );
 }
@@ -476,7 +487,7 @@ describe("newComposeDeclaredPreferencesStep", () => {
         "server-owned field must be stamped on every path",
       ).toBeDefined();
       expect(got?.orgContext).toBe(tt.wantOrgContext);
-      // user_context must stay empty in OSS (no per-request user identity).
+      // user_context stays empty under the single-operator posture.
       expect(got?.userContext).toBe("");
     });
   }
@@ -775,6 +786,223 @@ describe("newComposeRecalledMemoriesStep", () => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Where callers are persons (stigmer#1387, stigmer#1397).
+// ---------------------------------------------------------------------------
+
+describe("the compose steps where callers are persons", () => {
+  const CAROL = "ida_carol";
+  const DAVE = "ida_dave";
+
+  /** Carol at the console: a wire user whose identity is her account id. */
+  const carol = testCallerIdentity({ identityId: CAROL });
+
+  function directory(preferences: {
+    memoryEnabled?: boolean;
+    standingContext?: string;
+  }): AccountsByCaller {
+    const accounts = fakeIdentityAccountStore();
+    accounts.rows.set(
+      CAROL,
+      create(IdentityAccountSchema, {
+        metadata: { id: CAROL, name: "Carol" },
+        spec: { idpId: "auth0|carol", preferences },
+      }),
+    );
+    return accounts;
+  }
+
+  const faultingDirectory: AccountsByCaller = {
+    findById: async () => {
+      throw new Error("simulated store fault");
+    },
+    findDirectByIdpId: async () => {
+      throw new Error("simulated store fault");
+    },
+  };
+
+  /** A JWT carrying `payload`, unsigned: the gate reads, never verifies. */
+  function jwtWith(payload: Record<string, unknown>): string {
+    const segment = (value: object) =>
+      Buffer.from(JSON.stringify(value)).toString("base64url");
+    return `${segment({ alg: "RS256", typ: "JWT" })}.${segment(payload)}.signature`;
+  }
+
+  /** Every lane that is not a person speaking for themselves. */
+  const notFirstParty: Array<[string, CallerIdentity]> = [
+    [
+      "a runner acting as Carol",
+      testCallerIdentity({ identityId: CAROL, callerClass: "runner" }),
+    ],
+    [
+      "a machine account",
+      testCallerIdentity({ identityId: CAROL, callerClass: "machine" }),
+    ],
+    [
+      "a cloud channel sender",
+      testCallerIdentity({ identityId: CAROL, callerClass: "channel" }),
+    ],
+    [
+      "the schedule fire acting as Carol (in-process)",
+      testCallerIdentity({ identityId: CAROL, origin: "in-process" }),
+    ],
+    [
+      "Carol through a PlatformClient user token",
+      testCallerIdentity({
+        identityId: CAROL,
+        issuer: "stigmer",
+        rawToken: jwtWith({
+          iss: "stigmer",
+          sub: CAROL,
+          platform_client_id: "pc_1",
+        }),
+      }),
+    ],
+  ];
+
+  async function seedRecallRows(): Promise<void> {
+    await seedMemoryOrg("test-org", true);
+    const confirmed = MemoryLifecycleState.lifecycle_state_confirmed;
+    await seedMemory({
+      id: "mem_carol",
+      orgId: "test-org",
+      subject: CAROL,
+      content: "Carol's",
+      state: confirmed,
+      createdAt: new Date("2026-09-01T00:00:00Z"),
+    });
+    await seedMemory({
+      id: "mem_dave",
+      orgId: "test-org",
+      subject: DAVE,
+      content: "Dave's",
+      state: confirmed,
+      createdAt: new Date("2026-09-02T00:00:00Z"),
+    });
+    await seedMemory({
+      id: "mem_sentinel",
+      orgId: "test-org",
+      subject: "",
+      content: "nobody's",
+      state: confirmed,
+      createdAt: new Date("2026-09-03T00:00:00Z"),
+    });
+    await seedMemory({
+      id: "mem_carol_proposed",
+      orgId: "test-org",
+      subject: CAROL,
+      content: "unconfirmed",
+      state: MemoryLifecycleState.lifecycle_state_proposed,
+      createdAt: new Date("2026-09-04T00:00:00Z"),
+    });
+  }
+
+  async function recall(
+    accounts: AccountsByCaller | undefined,
+    caller: CallerIdentity,
+  ) {
+    const step = newComposeRecalledMemoriesStep(store, silentLogger, accounts);
+    const ctx = newContext(newExecution("ses_1", "agt_1"), caller);
+    await step.execute(ctx);
+    return ctx.newState.spec?.recalledMemories;
+  }
+
+  it("recalls exactly the run's person's confirmed facts", async () => {
+    await seedRecallRows();
+    const got = await recall(directory({ memoryEnabled: true }), carol);
+    expect(got?.enabled).toBe(true);
+    expect(got?.facts.map((f) => f.memoryId)).toEqual(["mem_carol"]);
+  });
+
+  it("recalls nothing and offers no remember tool when the person's own switch is off", async () => {
+    await seedRecallRows();
+    const got = await recall(directory({ memoryEnabled: false }), carol);
+    expect(got?.enabled).toBe(false);
+    expect(got?.facts).toEqual([]);
+  });
+
+  it("recalls nothing when the organization's switch is off, whatever the person's", async () => {
+    await seedMemoryOrg("test-org", false);
+    const got = await recall(directory({ memoryEnabled: true }), carol);
+    expect(got?.enabled).toBe(false);
+  });
+
+  it("recalls nothing for a caller no account stands for", async () => {
+    await seedRecallRows();
+    const got = await recall(
+      directory({ memoryEnabled: true }),
+      testCallerIdentity({ identityId: "auth0|stranger" }),
+    );
+    expect(got?.enabled).toBe(false);
+  });
+
+  it("degrades to disabled on a directory fault (best-effort)", async () => {
+    await seedRecallRows();
+    const got = await recall(faultingDirectory, carol);
+    expect(got?.enabled).toBe(false);
+  });
+
+  for (const [name, caller] of notFirstParty) {
+    it(`recalls nothing for ${name}`, async () => {
+      await seedRecallRows();
+      const got = await recall(directory({ memoryEnabled: true }), caller);
+      expect(got?.enabled).toBe(false);
+      expect(got?.facts).toEqual([]);
+    });
+  }
+
+  async function declared(
+    accounts: AccountsByCaller | undefined,
+    caller: CallerIdentity,
+  ) {
+    await seedOrg("test-org", "We deploy to us-east-1.");
+    const step = newComposeDeclaredPreferencesStep(
+      store,
+      silentLogger,
+      accounts,
+    );
+    const execution = newExecution("ses_1", "agt_1");
+    execution.spec!.declaredPreferences = create(DeclaredPreferencesSchema, {
+      userContext: "injected user context",
+    });
+    const ctx = newContext(execution, caller);
+    await step.execute(ctx);
+    return ctx.newState.spec?.declaredPreferences;
+  }
+
+  it("composes the run's person's standing context beside the organization's", async () => {
+    const got = await declared(
+      directory({ standingContext: "Call me Carol." }),
+      carol,
+    );
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("Call me Carol.");
+  });
+
+  it("keeps the organization's context and composes no person's on a directory fault", async () => {
+    const got = await declared(faultingDirectory, carol);
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("");
+  });
+
+  it("composes no person's context under the single-operator posture", async () => {
+    const got = await declared(undefined, carol);
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("");
+  });
+
+  for (const [name, caller] of notFirstParty) {
+    it(`composes no person's context for ${name}, and keeps the organization's`, async () => {
+      const got = await declared(
+        directory({ standingContext: "Call me Carol." }),
+        caller,
+      );
+      expect(got?.orgContext).toBe("We deploy to us-east-1.");
+      expect(got?.userContext).toBe("");
+    });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // agentCallTaskEnvironmentRefs (create_execution_context_workflow_refs_test.go).
 // ---------------------------------------------------------------------------

package/src/domain/agentexecution/controller.ts

@@ -8,10 +8,15 @@
  * Proven by agentexecution.conformance.test.ts
  * (CONFORMANCE_TARGET=local) and __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * Publish, PublishToRedis, and TransformResponse steps (no multi-tenant
- * auth, IAM/FGA, event publishing, or Redis here — subscribe streams ride
- * in-memory channels per ADR 011).
+ * Every chain opens with Authorize, and create also authorizes its run
+ * target (AuthorizeRunTarget); create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle. The direct
+ * handlers — subscribe and the two artifact reads — evaluate their
+ * annotation through authorizeDirect; uploadAttachment is authorized at
+ * the create its storage key feeds. list, listBySession and
+ * getExecutionSummary narrow through the composed list read scope.
+ * Subscribe streams ride the in-memory stream broker (ADR 011); there is
+ * no Redis. Per-RPC posture: docs/authorization-coverage.md §16.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 
@@ -31,6 +36,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
 import { stepsForSlot } from "../../extensions/gate-slots.js";
@@ -151,6 +157,14 @@ export interface AgentExecutionControllerDeps {
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed summary read scope — undefined = the OSS full scan (C2 Stage 4). */
   readonly listReadScope: ListReadScope | undefined;
+  /**
+   * The directory of the persons callers stand for (stigmer#1387) — the
+   * composed identity-account port, bound under the require-authentication
+   * posture; undefined = the single-operator posture (trusted-local),
+   * where memory is the organization's switch alone and the subject the
+   * empty-string sentinel.
+   */
+  readonly personAccounts: AccountsByCaller | undefined;
   /**
    * The shared broadcast fabric for subscribe streams. ONE instance spans
    * both routers (serving + in-process) — see stream-broker.ts; the
@@ -360,8 +374,20 @@ async function createExecution(
         sessionCreator: deps.sessionCreator,
       }),
     )
-    .addStep(newComposeDeclaredPreferencesStep(deps.store, deps.logger))
-    .addStep(newComposeRecalledMemoriesStep(deps.store, deps.logger))
+    .addStep(
+      newComposeDeclaredPreferencesStep(
+        deps.store,
+        deps.logger,
+        deps.personAccounts,
+      ),
+    )
+    .addStep(
+      newComposeRecalledMemoriesStep(
+        deps.store,
+        deps.logger,
+        deps.personAccounts,
+      ),
+    )
     .addStep(newSetInitialPhaseStep())
     .addStep(newCreateExecutionContextStep(deps.executionContextBuilder))
     .addStep(newProcessAttachmentsStep(deps.logger))