@stigmer/server 3.39.1-dev.20260928194002 → 3.40.0

package/src/domain/memory/constants.ts

@@ -30,6 +30,17 @@ export function memoryDisabledMessage(org: string): string {
   return `memory is not enabled for organization ${org} — an organization admin can enable it in organization preferences`;
 }
 
+/**
+ * Refuses a create while the PERSON the memory would be about has not
+ * enabled memory on their own account — the member half of the double
+ * opt-in (DD-006 D1), and the answer for a caller no account stands for,
+ * since only an unprovisioned person reaches that arm. The Java
+ * MemoryPolicy.MEMORY_ACCOUNT_DISABLED_MESSAGE, byte-pinned: the hosted
+ * edition's clients have rendered it since the Java handler shipped.
+ */
+export const MEMORY_ACCOUNT_DISABLED_MESSAGE =
+  "memory is not enabled for your account — enable it in account preferences";
+
 /**
  * Refuses confirming a rejected memory: the decision is auditable and
  * stands; a fresh proposal is the way back. Go

package/src/domain/memory/controller.ts

@@ -35,12 +35,15 @@
  *
  * Authorization posture (OSS): this edition is single-user and local, so
  * handlers perform no authorization — a documented no-op, not a silent
- * divergence. The subject is the empty-string sentinel (the OAuth grant
- * store convention); enablement is the org flag alone (the user scope
- * collapses — DD-002 D1). The cloud edition derives the subject from the
- * calling credential, enforces the strict first-party-human gate, checks
- * both memory_enabled flags, and gates every RPC through FGA (subject-only
- * can_view/can_edit/can_delete).
+ * divergence. The subject and the double opt-in follow the POSTURE, not
+ * the edition (stigmer#1387): where callers are persons (the
+ * require-authentication posture composes `personAccounts` — the hosted
+ * edition, a self-host with sign-in) the subject is the identity account
+ * the memory is about and both memory_enabled flags must be on; under the
+ * single-operator posture (trusted-local) the subject is the empty-string
+ * sentinel (the OAuth grant store convention) and enablement is the org
+ * flag alone (the user scope collapses — DD-002 D1). Every RPC's FGA
+ * question is subject-only (can_view/can_edit/can_delete).
  *
  * Memory is deliberately NOT search-indexed (privacy — subject-only
  * content must not surface in org-visible search): no search-extractor,
@@ -70,6 +73,7 @@ import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import { internalError } from "../../pipeline/errors.js";
@@ -131,6 +135,14 @@ export interface MemoryControllerDeps {
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed list read scope — list narrows through it; undefined = the OSS full scan (20260830.01). */
   readonly listReadScope: ListReadScope | undefined;
+  /**
+   * The directory of the persons callers stand for (stigmer#1387) — the
+   * composed identity-account port, bound under the require-authentication
+   * posture; undefined = the single-operator posture (trusted-local),
+   * where memory is the organization's switch alone and the subject the
+   * empty-string sentinel.
+   */
+  readonly personAccounts: AccountsByCaller | undefined;
   /**
    * The composed runner-credential provider — GuardMemoryCapture consults
    * its authorizeMemoryCapture capability for the runner-credential
@@ -172,10 +184,13 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
  * No search-index step: memory is not_search_indexed by design (privacy —
  * content is subject-only and must not surface in org-visible search).
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the strict
- * first-party-human-operator gate and the caller's own memory_enabled
- * check (no per-request user identity — the user scope collapses, DD-006
- * D1) and creates no FGA tuples.
+ * Authorization: GuardMemoryCapture decides WHO may capture (the composed
+ * RunnerCredentialProvider), AuthorizeResolvedTarget decides WHERE
+ * (can_create_session on the organization), and CreateAuthorizationTuples
+ * runs against the composed lifecycle. ResolveMemoryDefaults names the
+ * person the memory is about and CheckMemoryEnablement requires both
+ * halves of the double opt-in where callers are persons (both step docs;
+ * stigmer#1387).
  */
 async function createMemory(
   deps: MemoryControllerDeps,
@@ -195,7 +210,7 @@ async function createMemory(
     .addStep(newValidateProtoStep())
     .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
     .addStep(newValidateVisibilityStep())
-    .addStep(newResolveMemoryDefaultsStep())
+    .addStep(newResolveMemoryDefaultsStep(deps.personAccounts))
     // Before the enablement and cap checks, so a refused caller learns
     // nothing about the organization's settings (steps.ts,
     // resolveMemoryCreateTargets).
@@ -205,7 +220,7 @@ async function createMemory(
         resolveMemoryCreateTargets,
       ),
     )
-    .addStep(newCheckMemoryEnablementStep(deps.store))
+    .addStep(newCheckMemoryEnablementStep(deps.store, deps.personAccounts))
     .addStep(newCheckMemoryCapStep(deps.store))
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
@@ -236,8 +251,7 @@ async function createMemory(
  * owners (create, confirm, reject) last wrote it, even against a
  * concurrent confirm landing between this pipeline's load and persist.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_edit on the memory — FGA subject-only).
+ * Authorize evaluates can_edit on the memory (subject-only in the model).
  */
 async function update(
   deps: MemoryControllerDeps,
@@ -332,9 +346,8 @@ async function reject(
  * runTransition: one contract with opposite verdicts (DD-005 D3),
  * answering with the post-image row.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_edit on the memory — FGA subject-only, loading before
- * authorizing so a missing memory answers NOT_FOUND, #224).
+ * Authorize evaluates can_edit on the memory (subject-only in the model)
+ * against the request's id, before the load.
  */
 async function runTransition(
   deps: MemoryControllerDeps,
@@ -381,8 +394,7 @@ async function runTransition(
  *
  * No search-index cleanup: memory is not_search_indexed.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_delete on the memory — FGA subject-only).
+ * Authorize evaluates can_delete on the memory (subject-only in the model).
  *
  * The deleted memory is returned for audit trail purposes (gRPC
  * convention).
@@ -425,9 +437,8 @@ async function deleteMemory(
 /**
  * Get — chain per Go buildGetPipeline (ExtractResourceId → LoadTarget).
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_view — FGA subject-only: only the person a memory is about
- * can read it).
+ * Authorize evaluates can_view on the memory: in the model only the person
+ * a memory is about can read it.
  */
 async function get(
   deps: MemoryControllerDeps,
@@ -466,11 +477,9 @@ async function get(
  * console's presentation concern (DD-005 D4), deliberately not an RPC
  * parameter at the kind's dozens-of-records scale.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes:
- *   - Authorization filtering (single user — every record is the
- *     caller's; cloud filters to can_view via FGA, which resolves to the
- *     subject)
- *   - Pagination (returns all matching results)
+ * Narrowed to the caller's authorized rows (can_view, which resolves to
+ * the subject) by the composed list read scope. Unpaginated (returns all
+ * matching results).
  */
 async function list(
   deps: MemoryControllerDeps,

package/src/domain/memory/steps.ts

@@ -17,7 +17,7 @@
  * Proven by memory.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/memory.test.ts.
  */
-import { create, equals, fromBinary } from "@bufbuild/protobuf";
+import { create, equals, fromBinary, isMessage } from "@bufbuild/protobuf";
 import { timestampNow } from "@bufbuild/protobuf/wkt";
 import type { ConnectError } from "@connectrpc/connect";
 
@@ -30,6 +30,8 @@ import { MemoryListSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/i
 import { MemoryProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/spec_pb";
 import { MemoryStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/status_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
@@ -52,10 +54,16 @@ import {
 import { memoryCaptureCredentialOf } from "../../pipeline/steps/guard-memory-capture.js";
 import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
+import {
+  accountForCaller,
+  accountForStamp,
+} from "../identityaccount/resolve.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import {
   MAX_MEMORIES_PER_SUBJECT,
+  MEMORY_ACCOUNT_DISABLED_MESSAGE,
   MEMORY_FULL_MESSAGE,
   MEMORY_PROVENANCE_IMMUTABLE_MESSAGE,
   MEMORY_SUBJECT_IMMUTABLE_MESSAGE,
@@ -77,10 +85,22 @@ export const LIST_RESULT_KEY = "listResult";
  *     memories are id-addressed records (the remember tool sends content
  *     only), and the platform's slug machinery requires a name. A
  *     client-supplied name still wins — the default only fills absence.
- *  3. Overwrites spec.subject_identity_account_id with the empty-string
- *     sentinel — the OSS single-user subject (the OAuth grant store
- *     convention). Server-derived, never client-supplied (DD-005 D2):
- *     the cloud edition writes the caller's identity account here.
+ *  3. Overwrites spec.subject_identity_account_id, server-derived and
+ *     never client-supplied (DD-005 D2), by posture. Under the
+ *     single-operator posture (no `personAccounts` composed) it is the
+ *     empty-string sentinel — the laptop's one subject (the OAuth grant
+ *     store convention). Where callers are persons it is the id of the
+ *     identity account the memory is ABOUT (stigmer#1387, the Java
+ *     MemoryCreateHandler's subject): the admitted capture credential's
+ *     subject (point 5), else the calling person — each resolved through
+ *     the identity-account domain (accountForStamp / accountForCaller),
+ *     so a subject that arrived as a raw issuer subject is filed under
+ *     the account every FGA tuple names. The resolved account rides the
+ *     context under MEMORY_SUBJECT_ACCOUNT_KEY for CheckMemoryEnablement,
+ *     so the subject stamped and the consent checked are one row, read
+ *     once. A caller no account stands for is stamped "" and NOT refused
+ *     here: the refusal belongs behind AuthorizeResolvedTarget, which
+ *     runs between the two steps so a refused caller learns nothing.
  *  4. Stores spec.provenance as supplied (Stage 3 provenance decision,
  *     owner-ratified 2026-08-22): the capture path — the remember tool
  *     via the runner-synthesized attachment — threads the agent/session/
@@ -101,15 +121,15 @@ export const LIST_RESULT_KEY = "listResult";
  *     human ("the sub IS the human subject the session belongs to",
  *     Java MemoryCreateHandler) and provenance.session_id is overridden
  *     with the token's own session claim (server-proved beats
- *     runner-reported). Absent the handoff, the OSS arms above apply
+ *     runner-reported). Absent the handoff, the arms above apply
  *     unchanged.
  */
-export function newResolveMemoryDefaultsStep(): PipelineStep<
-  typeof MemorySchema
-> {
+export function newResolveMemoryDefaultsStep(
+  personAccounts?: AccountsByCaller,
+): PipelineStep<typeof MemorySchema> {
   return {
     name: "ResolveMemoryDefaults",
-    execute(ctx: RequestContext<typeof MemorySchema>): void {
+    async execute(ctx: RequestContext<typeof MemorySchema>): Promise<void> {
       const memory = ctx.newState;
       const metadata = memory.metadata;
 
@@ -138,11 +158,23 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
         );
       }
 
-      // The subject stays server-owned (DD-005 D2): the OSS sentinel, or
-      // the admitted capture credential's proved human (step doc point 5).
+      // The subject stays server-owned (DD-005 D2), by posture (step doc
+      // points 3 and 5).
       const captureCredential = memoryCaptureCredentialOf(ctx);
-      spec.subjectIdentityAccountId =
-        captureCredential?.subjectIdentityAccountId ?? "";
+      if (personAccounts === undefined) {
+        spec.subjectIdentityAccountId =
+          captureCredential?.subjectIdentityAccountId ?? "";
+      } else {
+        const account = await resolveSubjectAccount(
+          personAccounts,
+          ctx,
+          captureCredential?.subjectIdentityAccountId,
+        );
+        spec.subjectIdentityAccountId = account?.metadata?.id ?? "";
+        if (account !== undefined) {
+          ctx.set(MEMORY_SUBJECT_ACCOUNT_KEY, account);
+        }
+      }
 
       // Provenance is capture-path-supplied (see the step doc, point 4);
       // only tool_call_id is force-cleared — unreachable via MCP in v1, so
@@ -162,6 +194,54 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
   };
 }
 
+/**
+ * Context key carrying the identity account a memory is about, from
+ * ResolveMemoryDefaults to CheckMemoryEnablement — present exactly when
+ * callers are persons and the subject resolved (step doc point 3).
+ */
+export const MEMORY_SUBJECT_ACCOUNT_KEY = "memorySubjectAccount";
+
+/** The subject's account stashed by ResolveMemoryDefaults, if any. */
+export function memorySubjectAccountOf(
+  ctx: RequestContext<typeof MemorySchema>,
+): IdentityAccount | undefined {
+  const payload = ctx.get(MEMORY_SUBJECT_ACCOUNT_KEY);
+  return isMessage(payload, IdentityAccountSchema) ? payload : undefined;
+}
+
+/**
+ * The account the memory is about: the capture credential's subject read
+ * as a creator-style stamp (an account id, or a raw issuer subject), else
+ * the account the calling person stands for. `undefined` when nobody
+ * resolves. A store fault is an infrastructure fault; an account row with
+ * no id is a loud one, never an empty principal (the resolve.ts rule).
+ */
+async function resolveSubjectAccount(
+  personAccounts: AccountsByCaller,
+  ctx: RequestContext<typeof MemorySchema>,
+  credentialSubject: string | undefined,
+): Promise<IdentityAccount | undefined> {
+  let account: IdentityAccount | undefined;
+  try {
+    account =
+      credentialSubject !== undefined
+        ? await accountForStamp(personAccounts, credentialSubject)
+        : await accountForCaller(personAccounts, ctx.callerIdentity);
+  } catch (error) {
+    throw internalError(
+      error,
+      "failed to resolve the identity account a memory is about",
+    );
+  }
+  if (account !== undefined && (account.metadata?.id ?? "") === "") {
+    throw internalError(
+      new Error("identity account carries no id"),
+      "failed to resolve the identity account a memory is about",
+    );
+  }
+  return account;
+}
+
 /** The deny copy of the create lane's organization bar. */
 export const MEMORY_CREATE_DENIED_MESSAGE =
   "unauthorized to capture memory in this organization";
@@ -212,15 +292,22 @@ export function resolveMemoryCreateTargets(
  * authorization: "the label is not authorization; the server refuses"
  * (the conversation-attachment doctrine, applied verbatim).
  *
- * OSS checks the org flag alone — the user scope collapses in single-user
- * local mode (DD-006 D1). The cloud edition additionally requires the
- * caller's own memory_enabled and the strict first-party-human gate.
+ * The double opt-in (DD-006 D1), in the Java handler's order: the
+ * organization's switch first (the gate an admin controls), then — where
+ * callers are persons (`personAccounts` composed) — the switch of the
+ * person the memory is about, read from the account ResolveMemoryDefaults
+ * resolved and stashed (stigmer#1387). No stashed account under that
+ * posture refuses with the person's copy: nobody the server can name has
+ * consented. The single-operator posture checks the org flag alone — its
+ * one operator is the organization's decider. Who may capture at all is
+ * GuardMemoryCapture's question, not this step's.
  *
  * Reads the Organization row directly from the store, matching Go — no
  * cross-domain client.
  */
 export function newCheckMemoryEnablementStep(
   store: Store,
+  personAccounts?: AccountsByCaller,
 ): PipelineStep<typeof MemorySchema> {
   return {
     name: "CheckMemoryEnablement",
@@ -247,6 +334,14 @@ export function newCheckMemoryEnablementStep(
       if (org.spec?.preferences?.memoryEnabled !== true) {
         throw failedPreconditionError(memoryDisabledMessage(orgID));
       }
+
+      if (personAccounts === undefined) {
+        return;
+      }
+      const subject = memorySubjectAccountOf(ctx);
+      if (subject?.spec?.preferences?.memoryEnabled !== true) {
+        throw failedPreconditionError(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+      }
     },
   };
 }

package/src/domain/organization/controller.ts

@@ -20,10 +20,13 @@
  * carries the other two edition forks: find's enumeration posture and
  * findMyOrganizations' filtering (see organization-directory.ts).
  *
- * Versus Stigmer Cloud's Java service, plain OSS excludes the
- * CreateIamPolicies and Publish steps; with the C2 seam composed, the
- * CreateAuthorizationTuples/CleanupIamPolicies steps deliver the same
- * lifecycle through the resourceAuthorizationLifecycle driver.
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps (CreateAuthorizationTuples, CleanupIamPolicies)
+ * against the lifecycle compose.ts hands it: a composed
+ * resourceAuthorizationLifecycle driver when a unit registers one, else,
+ * under the built-in posture, open source's role lifecycle (the creator's
+ * `owner` row), and under trusted-local none, where the steps no-op.
+ * Per-RPC posture: docs/authorization-coverage.md §2.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { Code, ConnectError } from "@connectrpc/connect";

package/src/domain/plugin/__tests__/plugin.test.ts

@@ -104,6 +104,10 @@ beforeAll(async () => {
       STIGMER_MODEL_REGISTRY_REFRESH: "off",
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
       GRPC_PORT: String(grpcPort),
+      // The reserved port is the unified one only; its +1 neighbour is not
+      // reserved, and a lane that cannot bind fails the boot (#1089), so
+      // the artifact lane binds ephemeral.
+      ARTIFACT_HTTP_PORT: "0",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STORAGE_PATH: path.join(dir, "storage"),
@@ -801,6 +805,10 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
         STIGMER_MODEL_REGISTRY_REFRESH: "off",
         TEMPORAL_HOST_PORT: "127.0.0.1:1",
         GRPC_PORT: String(grpcPort),
+        // The reserved port is the unified one only; its +1 neighbour is not
+        // reserved, and a lane that cannot bind fails the boot (#1089), so
+        // the artifact lane binds ephemeral.
+        ARTIFACT_HTTP_PORT: "0",
         DB_PATH: path.join(enforcingDir, "stigmer.db"),
         ARTIFACT_LOCAL_BASE_PATH: path.join(enforcingDir, "artifacts"),
         STORAGE_PATH: path.join(enforcingDir, "storage"),

package/src/domain/session/controller.ts

@@ -13,9 +13,13 @@
  * Proven by session.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/session.test.ts.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing here)
- * and the FGA-authorized list filtering.
+ * Every chain opens with Authorize, and create also asks can_execute on
+ * the agent instance it binds to (AuthorizeRunTarget); create and delete
+ * run the shared tuple-lifecycle steps against the composed lifecycle;
+ * updateSubject evaluates its annotation through authorizeDirect after the
+ * load (#224); list, listByAgentInstance and listByChannel narrow through
+ * the composed list read scope. Per-RPC posture:
+ * docs/authorization-coverage.md §8.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/skill/__tests__/skill.test.ts

@@ -74,6 +74,10 @@ beforeAll(async () => {
       // a live local Temporal (the conformance CRUD harness does the same).
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
       GRPC_PORT: String(grpcPort),
+      // The reserved port is the unified one only; its +1 neighbour is not
+      // reserved, and a lane that cannot bind fails the boot (#1089), so
+      // the artifact lane binds ephemeral.
+      ARTIFACT_HTTP_PORT: "0",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STORAGE_PATH: path.join(dir, "storage"),

package/src/domain/skill/controller.ts

@@ -13,8 +13,14 @@
  * optional deps; every absent-surface answer is a deliberate arm, not an
  * accident.
  *
- * Versus Stigmer Cloud, OSS excludes the TransformResponse/SendResponse
- * steps (no response transformation). The transfer lane's capability
+ * Every chain opens with Authorize; push runs the tuple-lifecycle splice
+ * (SkillPushAuthorizationTuples), and updateVisibility and delete the
+ * shared tuple steps; getByReference and listVersions authorize the
+ * resolved skill as `get` would; getArtifact and getArtifactDownloadUrl
+ * skip authorization by design, the content-hash key being the capability
+ * (docs/authorization-coverage.md §21).
+ *
+ * The transfer lane's capability
  * URLs come from the blob driver through the staging port
  * (transfer/staging.ts): the local driver's point at this server's own
  * HTTP lane, a bucket driver's straight at the bucket — same

package/src/domain/workflow/controller.ts

@@ -13,8 +13,12 @@
  * Proven by workflow.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing here).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference and listVersions authorize the resolved workflow as `get`
+ * would. getVersion evaluates its annotation through authorizeDirect;
+ * validateSpec deliberately does not, since it persists nothing. Per-RPC
+ * posture: docs/authorization-coverage.md §17.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, enumToJson, fromBinary } from "@bufbuild/protobuf";

package/src/domain/workflowexecution/controller.ts

@@ -12,10 +12,14 @@
  * Proven by workflowexecution.conformance.test.ts
  * (CONFORMANCE_TARGET=local) and __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, Publish,
- * PublishToRedis, and TransformResponse steps (no multi-tenant auth,
- * event publishing, or Redis here — subscribe streams ride in-memory
- * channels per ADR 011).
+ * Every chain opens with Authorize, and create also authorizes its run
+ * target (AuthorizeRunTarget); create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle. The streams and
+ * the event log evaluate their annotation through authorizeDirect; the
+ * list, summary and pending-approval reads narrow through the composed
+ * list read scope. Subscribe streams ride the in-memory stream broker
+ * (ADR 011); there is no Redis. Per-RPC posture:
+ * docs/authorization-coverage.md §19.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/workflowexecution/update-status.ts

@@ -22,8 +22,9 @@
  * phase-transition-only statusAudit bump (heartbeats must not perpetually
  * re-sort long-running executions above new ones in the recents sidebar).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, PublishToRedis, and
- * Publish steps (broadcast rides in-memory channels per ADR 011).
+ * The chain opens with Authorize (can_edit on the execution); the
+ * broadcast rides the in-memory stream broker (ADR 011) — there is no
+ * Redis.
  */
 import { create, toBinary } from "@bufbuild/protobuf";
 import { timestampNow } from "@bufbuild/protobuf/wkt";

package/src/extensions/__tests__/identity.test.ts

@@ -13,10 +13,18 @@
  * in-process origin, and never a wire `machine` account — the one row
  * where the two predicates part, pinned so a step trusting server-composed
  * state can never be widened to the wire by picking the wrong one.
+ *
+ * And pins `isFirstPartyHumanOperator` (stigmer#1387), the allow-list
+ * memory recall and the person's declared preferences read: a wire `user`
+ * whose bearer is not a PlatformClient user token. Every other class, an
+ * in-process `user` (the open-source schedule fire's shape) and a
+ * platform token naming a PlatformClient are excluded; another issuer's
+ * token carrying the same claim is not a platform token (stigmer#1312).
  */
 import { describe, expect, it } from "vitest";
 
 import {
+  isFirstPartyHumanOperator,
   isPlatformPipelineCaller,
   isServerComposedRequest,
 } from "../identity.js";
@@ -103,3 +111,77 @@ describe("isServerComposedRequest", () => {
     );
   });
 });
+
+/** A JWT carrying `payload`, unsigned: the predicate reads, never verifies. */
+function jwtWith(payload: Record<string, unknown>): string {
+  const segment = (value: object) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${segment({ alg: "RS256", typ: "JWT" })}.${segment(payload)}.signature`;
+}
+
+describe("isFirstPartyHumanOperator", () => {
+  it("is true for a wire user — an OIDC login, an API key, the laptop's operator", () => {
+    expect(isFirstPartyHumanOperator(caller({}))).toBe(true);
+    expect(isFirstPartyHumanOperator(caller({ origin: "wire" }))).toBe(true);
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "https://issuer.example",
+          rawToken: jwtWith({ iss: "https://issuer.example", sub: "carol" }),
+        }),
+      ),
+    ).toBe(true);
+  });
+
+  it("is false for every other class, a composition's own included", () => {
+    for (const callerClass of [
+      "machine",
+      "runner",
+      "internal",
+      "guest",
+      "channel",
+      "schedule",
+      "sandbox",
+    ]) {
+      expect(
+        isFirstPartyHumanOperator(caller({ callerClass })),
+        callerClass,
+      ).toBe(false);
+    }
+  });
+
+  it("is false for a user the server composed a request for (the schedule fire)", () => {
+    expect(
+      isFirstPartyHumanOperator(
+        caller({ callerClass: "user", origin: "in-process" }),
+      ),
+    ).toBe(false);
+  });
+
+  it("is false for a PlatformClient user token, and true when another issuer stamps the claim", () => {
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "stigmer",
+          rawToken: jwtWith({
+            iss: "stigmer",
+            sub: "ida_x",
+            platform_client_id: "pc_1",
+          }),
+        }),
+      ),
+    ).toBe(false);
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "https://issuer.example",
+          rawToken: jwtWith({
+            iss: "https://issuer.example",
+            sub: "ida_x",
+            platform_client_id: "pc_1",
+          }),
+        }),
+      ),
+    ).toBe(true);
+  });
+});