@stigmer/server 3.39.1-dev.20260928194002 → 3.40.0

package/src/domain/agentshare/controller.ts

@@ -13,10 +13,15 @@
  * cascade of same-org shares lives in the AGENT domain (ported with #6);
  * share delete itself cascades nothing.
  *
- * Authorization posture (OSS): single-user and local, so handlers perform
- * no authorization — a documented no-op, not a silent divergence. The
- * cloud edition enforces the same contracts via FGA plus app-level gates
- * for the anonymous resolution paths.
+ * Every chain opens with Authorize. create asks can_edit on the referenced
+ * agent, then can_create_agent_share (AuthorizeResolvedTarget); create and
+ * delete run the shared tuple-lifecycle steps against the composed
+ * lifecycle; getByReference authorizes the loaded share as `get` would;
+ * getByAgent and list narrow through the composed list read scope. The
+ * public share-link read skips the Authorizer through is_public, and the
+ * member read asks can_view on the organization before the share loads
+ * (AuthorizeMemberAudience). Per-RPC posture:
+ * docs/authorization-coverage.md §9.
  *
  * Proven by agentshare.conformance.test.ts (CONFORMANCE_TARGET=local),
  * __tests__/agentshare.test.ts and __tests__/store-faults.test.ts.
@@ -657,9 +662,9 @@ function newLoadSharesByAgentStep(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * List — org + labels filter (AND semantics), newest first. Versus Cloud,
- * OSS excludes authorization filtering AND pagination, exactly as Go's
- * list.go records.
+ * List — org + labels filter (AND semantics), newest first, narrowed to
+ * the caller's authorized rows by the composed list read scope.
+ * Unpaginated, exactly as Go's list.go records.
  */
 async function list(
   deps: AgentShareControllerDeps,

package/src/domain/artifact/file-server.ts

@@ -1,9 +1,12 @@
 /**
  * The artifact HTTP file server — ports the local-download lane from Go
  * pkg/server/server.go (artifactDownloadHandler + the boot block, lines
- * 849–926): a second listener on 127.0.0.1:ARTIFACT_HTTP_PORT (default
- * grpcPort+1), started only when artifact storage is LOCAL, serving
- * GET /<key> as the exact bytes LocalArtifactStorage wrote. The lane
+ * 849–926): a second listener on 127.0.0.1:ARTIFACT_HTTP_PORT (unset: the
+ * unified port + 1, ephemeral beside an ephemeral unified port — the rule is
+ * boot/artifact-lane.ts), started only when artifact storage is LOCAL,
+ * serving GET /<key> as the exact bytes LocalArtifactStorage wrote. Unlike
+ * Go, a bind failure fails the boot: the composition binds the lane before
+ * SERVING and lets listen()'s rejection stand (stigmer#1089). The lane
  * dissolved into its owning domain per the ratified D4 decision — it is
  * NOT a unified-port lane (Go runs it as a separate listener, and so does
  * this port).
@@ -39,7 +42,8 @@ export interface ArtifactFileServerOptions {
 
 export interface ArtifactFileServer {
   /**
-   * Binds <host>:<port> (an explicit port 0 picks ephemeral for tests).
+   * Binds <host>:<port> (port 0 picks ephemeral) and resolves the port it
+   * bound; a bind failure rejects, and the composition fails the boot on it.
    * The host is the composition root's call: 127.0.0.1 everywhere by
    * default (ARTIFACT_HTTP_HOST, DD-013) — download URLs are minted for
    * the local machine — and 0.0.0.0 only inside the official container

package/src/domain/channelapp/controller.ts

@@ -14,9 +14,14 @@
  * not_search_indexed — configuration reached through its parent surface,
  * not a library artifact), so no index steps appear in any chain.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (single-user local posture); validation, secret handling,
- * and the referential delete block are byte-compatible.
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded app exactly as `get` would
+ * (AuthorizeResolvedTarget). listByOrg does not yet narrow through the
+ * list read scope, although the model restricts viewing to owners,
+ * explicit grants and organization admins
+ * (fga/model/agentic/channel_app.fga, stigmer/stigmer#1384). Per-RPC
+ * posture: docs/authorization-coverage.md §13.
  *
  * Proven by channelapp.conformance.test.ts (CONFORMANCE_TARGET=local)
  * and __tests__/channelapp.test.ts.

package/src/domain/environment/controller.ts

@@ -11,11 +11,14 @@
  * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local),
  * __tests__/environment.test.ts and __tests__/store-faults.test.ts.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * FGA-tuple, and Publish steps (no multi-tenant auth, IAM/FGA, or event
- * publishing here); the visibility ceiling (org — secrets never resolve
- * across the org boundary) and share restrictions run in BOTH editions
- * from the same proto config, keeping the error contract identical.
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference loads, then authorizes the loaded environment exactly as
+ * `get` would (AuthorizeResolvedTarget); list narrows through the composed
+ * list read scope. The visibility ceiling (org — secrets never resolve
+ * across the org boundary) and share restrictions come from the same proto
+ * config in every edition, keeping the error contract identical. Per-RPC
+ * posture: docs/authorization-coverage.md §3.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, fromBinary } from "@bufbuild/protobuf";
@@ -734,9 +737,9 @@ async function getSecretValue(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * List — org + labels filter with per-item redaction. Versus Cloud, OSS
- * excludes authorization filtering AND pagination (returns all matches),
- * exactly as Go's list.go records.
+ * List — org + labels filter with per-item redaction, narrowed to the
+ * caller's authorized rows by the composed list read scope. Unpaginated
+ * (returns all matches), exactly as Go's list.go records.
  */
 async function list(
   deps: EnvironmentControllerDeps,

package/src/domain/executioncontext/controller.ts

@@ -25,10 +25,13 @@
  * (the decrypt-lane matrix conformance deliberately never exercises —
  * its harness authenticates as a user).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing
- * here); the redaction and decrypt-lane contracts run in BOTH editions,
- * keeping the error contract identical.
+ * Every chain opens with Authorize; create asks can_create_execution_in on
+ * the organization (AuthorizeCreate), and create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded context exactly as `get` would
+ * (AuthorizeResolvedTarget). The redaction and decrypt-lane contracts are
+ * the same in every edition, keeping the error contract identical. Per-RPC
+ * posture: docs/authorization-coverage.md §5.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/mcpserver/controller.ts

@@ -19,8 +19,12 @@
  * managed-env wiring is a disclosed, deliberately unpinned composition
  * artifact).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference loads, then authorizes the loaded server exactly as `get`
+ * would (AuthorizeResolvedTarget). The connect/OAuth handlers evaluate
+ * their annotation through authorizeDirect, after the load where they load
+ * (#224). Per-RPC posture: docs/authorization-coverage.md §20.
  *
  * Proven by mcpserver.conformance.test.ts +
  * agent-mcpserver-references.conformance.test.ts +

package/src/domain/memory/__tests__/capture-credential.test.ts

@@ -42,7 +42,7 @@ function memoryCtx(spec: {
 }
 
 describe("ResolveMemoryDefaults with an admitted capture credential", () => {
-  it("writes the proved subject and overrides provenance.session_id", () => {
+  it("writes the proved subject and overrides provenance.session_id", async () => {
     const ctx = memoryCtx({
       provenance: {
         sessionId: "ses_runner_reported",
@@ -54,7 +54,7 @@ describe("ResolveMemoryDefaults with an admitted capture credential", () => {
       subjectIdentityAccountId: "ida_human",
       provedSessionId: "ses_proved",
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("ida_human");
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
     // The threaded agent id survives; the forged tool_call_id never does.
@@ -62,21 +62,21 @@ describe("ResolveMemoryDefaults with an admitted capture credential", () => {
     expect(ctx.newState.spec?.provenance?.toolCallId).toBe("");
   });
 
-  it("creates provenance when the request supplied none", () => {
+  it("creates provenance when the request supplied none", async () => {
     const ctx = memoryCtx({});
     ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
       subjectIdentityAccountId: "ida_human",
       provedSessionId: "ses_proved",
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
   });
 
-  it("without the handoff the OSS arms stand", () => {
+  it("without the handoff the OSS arms stand", async () => {
     const ctx = memoryCtx({
       provenance: { sessionId: "ses_supplied", toolCallId: "forged" },
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_supplied");
     expect(ctx.newState.spec?.provenance?.toolCallId).toBe("");

package/src/domain/memory/__tests__/person-consent-composed.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Pins memory's double opt-in and its subject at the composition root
+ * (stigmer#1387), over a real boot under the BUILT-IN posture (a unit that
+ * declares require-authentication and registers no Authorizer — the
+ * open-source self-host with sign-in), with two signed-in people on the
+ * wire:
+ *
+ *   - Carol founds an organization with memory on. With her own switch
+ *     still off (the default), her capture is refused with the account
+ *     copy — before this fix it was stored, filed under nobody.
+ *   - Once she turns her own switch on, her capture is filed under HER
+ *     account id, she can read and confirm it (the model's subject tuple
+ *     names her), and Dave, a member of the same organization, can
+ *     neither read it nor see it listed: memory is subject-only.
+ *   - Dave, whose own switch is off, is refused exactly as Carol was.
+ *
+ * Recall is not driven here: an execution create needs an engine, and the
+ * recall step runs after the engine check. Its gates are pinned
+ * step-for-step in domain/agentexecution/__tests__/create-steps.test.ts,
+ * over the same identity-account reads this boot composes.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { clone, create } from "@bufbuild/protobuf";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryCommandController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/command_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { MemoryQueryController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/query_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import {
+  IdentityAccountPreferencesSchema,
+  IdentityAccountSpecSchema,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import type { ServerExtension } from "../../../extensions/registry.js";
+import {
+  baseConfig,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "../../../extensions/__tests__/composed-support.js";
+import { MEMORY_ACCOUNT_DISABLED_MESSAGE } from "../constants.js";
+
+const CAROL = "fake|carol";
+const DAVE = "fake|dave";
+const ORG = "memory-person-org";
+
+async function failureOf(promise: Promise<unknown>): Promise<ConnectError> {
+  try {
+    await promise;
+  } catch (error) {
+    expect(error).toBeInstanceOf(ConnectError);
+    return error as ConnectError;
+  }
+  throw new Error("expected the call to fail");
+}
+
+function memoryInput(content: string) {
+  return create(MemorySchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "Memory",
+    metadata: { org: ORG },
+    spec: { content },
+  });
+}
+
+describe("memory where callers are persons (built-in posture, composed server)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+  let carolAccount: IdentityAccount;
+
+  const asCarol = () => transportFor(port, fakeJwt(CAROL, "carol@example.com"));
+  const asDave = () => transportFor(port, fakeJwt(DAVE, "dave@example.com"));
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "memory-person-consent-composed-"));
+    const unit: ServerExtension = {
+      name: "fake-oidc-only",
+      requireAuthentication: true,
+      identityVerifiers: [fakeVerifier],
+    };
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+
+    // Carol provisions and founds the organization with memory on; Dave
+    // provisions afterwards and is a member of it (the membership rules
+    // run at a person's first provisioning).
+    carolAccount = await createClient(
+      IdentityAccountCommandController,
+      asCarol(),
+    ).provisionMyAccount({});
+    await createClient(OrganizationCommandController, asCarol()).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: ORG, preferences: { memoryEnabled: true } },
+    });
+    await createClient(
+      IdentityAccountCommandController,
+      asDave(),
+    ).provisionMyAccount({});
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("refuses a person whose own switch is off, with the account's copy", async () => {
+    const failure = await failureOf(
+      createClient(MemoryCommandController, asCarol()).create(
+        memoryInput("Carol prefers OpenTofu."),
+      ),
+    );
+    expect(failure.code).toBe(Code.FailedPrecondition);
+    expect(failure.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+
+  it("files the fact under the person once they opt in, and it stays theirs alone", async () => {
+    const carolId = carolAccount.metadata?.id ?? "";
+    expect(carolId).not.toBe("");
+    const optedIn = clone(IdentityAccountSchema, carolAccount);
+    optedIn.spec ??= create(IdentityAccountSpecSchema);
+    optedIn.spec.preferences ??= create(IdentityAccountPreferencesSchema);
+    optedIn.spec.preferences.memoryEnabled = true;
+    await createClient(IdentityAccountCommandController, asCarol()).update(
+      optedIn,
+    );
+
+    const carolMemories = createClient(MemoryCommandController, asCarol());
+    const created = await carolMemories.create(
+      memoryInput("Carol prefers OpenTofu."),
+    );
+    const memoryId = created.metadata?.id ?? "";
+    expect(created.spec?.subjectIdentityAccountId).toBe(carolId);
+
+    // The subject tuple names Carol: she decides on her own memory.
+    const confirmed = await carolMemories.confirm({ value: memoryId });
+    expect(confirmed.status?.lifecycleState).toBe(
+      MemoryLifecycleState.lifecycle_state_confirmed,
+    );
+    const carolReads = createClient(MemoryQueryController, asCarol());
+    expect((await carolReads.get({ value: memoryId })).metadata?.id).toBe(
+      memoryId,
+    );
+    expect(
+      (await carolReads.list({ org: ORG })).items.map((m) => m.metadata?.id),
+    ).toContain(memoryId);
+
+    // Dave shares the organization, not the memory.
+    const daveReads = createClient(MemoryQueryController, asDave());
+    const failure = await failureOf(daveReads.get({ value: memoryId }));
+    expect(failure.code).toBe(Code.PermissionDenied);
+    expect(
+      (await daveReads.list({ org: ORG })).items.map((m) => m.metadata?.id),
+    ).not.toContain(memoryId);
+  });
+
+  it("refuses the second person exactly as the first, while their switch is off", async () => {
+    const failure = await failureOf(
+      createClient(MemoryCommandController, asDave()).create(
+        memoryInput("Dave deploys on Fridays."),
+      ),
+    );
+    expect(failure.code).toBe(Code.FailedPrecondition);
+    expect(failure.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+});

package/src/domain/memory/__tests__/person-consent.test.ts

@@ -0,0 +1,274 @@
+/**
+ * Pins memory capture where callers are persons (stigmer#1387): with the
+ * identity-account directory composed, ResolveMemoryDefaults files the
+ * memory under the id of the account it is about — the admitted capture
+ * credential's subject (an account id or a raw issuer subject, read the
+ * way accountForStamp reads a creator stamp), else the calling person —
+ * and hands that account to CheckMemoryEnablement, which requires the
+ * organization's switch and then the person's own (the Java
+ * MemoryCreateHandler's order and copy). A caller no account stands for is
+ * stamped "" and refused by the enablement step, behind the authorization
+ * bar. Without the directory — the single-operator posture — the org flag
+ * alone decides and the subject stays the "" sentinel.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import { MEMORY_CAPTURE_CREDENTIAL_KEY } from "../../../pipeline/steps/guard-memory-capture.js";
+import type { Store } from "../../../store/interface.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
+import type { AccountsByCaller } from "../../identityaccount/resolve.js";
+import { fakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
+import type { FakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
+import {
+  MEMORY_ACCOUNT_DISABLED_MESSAGE,
+  memoryDisabledMessage,
+} from "../constants.js";
+import {
+  memorySubjectAccountOf,
+  newCheckMemoryEnablementStep,
+  newResolveMemoryDefaultsStep,
+} from "../steps.js";
+
+const ORG = "org_acme";
+const CAROL = "ida_carol";
+const CAROL_SUBJECT = "auth0|carol";
+
+/** Carol at the console: a wire user whose identity is her account id. */
+const CAROL_AT_CONSOLE: CallerIdentity = {
+  identityId: CAROL,
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: "opaque",
+};
+
+/** A sandbox-lane caller; its capture credential names the subject. */
+const SANDBOX: CallerIdentity = {
+  identityId: CAROL,
+  callerClass: "sandbox",
+  issuer: "stigmer",
+  rawToken: "opaque",
+};
+
+/** A signed-in caller no account stands for yet (idp-shaped). */
+const STRANGER: CallerIdentity = {
+  identityId: "auth0|stranger",
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: "opaque",
+};
+
+let dir: string;
+let store: Store;
+let accounts: FakeIdentityAccountStore;
+
+beforeEach(async () => {
+  dir = mkdtempSync(path.join(tmpdir(), "memory-person-consent-"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+  accounts = fakeIdentityAccountStore();
+  seedCarol({ memoryEnabled: true });
+  await seedOrg(true);
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function seedCarol(preferences: { memoryEnabled: boolean }): void {
+  accounts.rows.set(
+    CAROL,
+    create(IdentityAccountSchema, {
+      metadata: { id: CAROL, name: "Carol" },
+      spec: { idpId: CAROL_SUBJECT, preferences },
+    }),
+  );
+}
+
+async function seedOrg(memoryEnabled: boolean): Promise<void> {
+  await store.saveResource(
+    ApiResourceKind.organization,
+    ORG,
+    OrganizationSchema,
+    create(OrganizationSchema, {
+      metadata: { id: ORG, name: ORG, org: ORG },
+      spec: { preferences: { memoryEnabled } },
+    }),
+  );
+}
+
+function memoryCtx(
+  caller: CallerIdentity,
+): RequestContext<typeof MemorySchema> {
+  return new RequestContext(
+    MemorySchema,
+    create(MemorySchema, {
+      metadata: { name: "m", org: ORG },
+      // A forged subject: the server always overwrites it.
+      spec: { content: "fact", subjectIdentityAccountId: "ida_forged" },
+    }),
+    caller,
+    ApiResourceKind.memory,
+  );
+}
+
+function withCredential(
+  ctx: RequestContext<typeof MemorySchema>,
+  subject: string,
+): RequestContext<typeof MemorySchema> {
+  ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
+    subjectIdentityAccountId: subject,
+    provedSessionId: "ses_proved",
+  });
+  return ctx;
+}
+
+/** Runs the create chain's two consent steps in their chain order. */
+async function capture(
+  ctx: RequestContext<typeof MemorySchema>,
+  personAccounts: AccountsByCaller | undefined,
+): Promise<void> {
+  await newResolveMemoryDefaultsStep(personAccounts).execute(ctx);
+  await newCheckMemoryEnablementStep(store, personAccounts).execute(ctx);
+}
+
+async function refusalOf(run: Promise<void>): Promise<ConnectError> {
+  try {
+    await run;
+  } catch (error) {
+    return ConnectError.from(error);
+  }
+  throw new Error("expected the capture to be refused");
+}
+
+describe("capture where callers are persons", () => {
+  it("files a direct capture under the calling person's account", async () => {
+    const ctx = memoryCtx(CAROL_AT_CONSOLE);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+    expect(memorySubjectAccountOf(ctx)?.metadata?.id).toBe(CAROL);
+  });
+
+  it("files a credentialed capture under the credential's subject", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), CAROL);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+    expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
+  });
+
+  it("normalises a credential subject that arrived as a raw issuer subject to the account id", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), CAROL_SUBJECT);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+  });
+
+  it("refuses with the person's copy when their own switch is off", async () => {
+    seedCarol({ memoryEnabled: false });
+    for (const ctx of [
+      memoryCtx(CAROL_AT_CONSOLE),
+      withCredential(memoryCtx(SANDBOX), CAROL),
+    ]) {
+      const refusal = await refusalOf(capture(ctx, accounts));
+      expect(refusal.code).toBe(Code.FailedPrecondition);
+      expect(refusal.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+    }
+  });
+
+  it("asks the organization first: its switch off refuses with the org's copy", async () => {
+    seedCarol({ memoryEnabled: false });
+    await seedOrg(false);
+    const refusal = await refusalOf(
+      capture(memoryCtx(CAROL_AT_CONSOLE), accounts),
+    );
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(refusal.rawMessage).toBe(memoryDisabledMessage(ORG));
+  });
+
+  it("stamps nobody and refuses in the enablement step when no account stands for the caller", async () => {
+    const ctx = memoryCtx(STRANGER);
+    await newResolveMemoryDefaultsStep(accounts).execute(ctx);
+    // Not refused here: the refusal belongs behind the authorization bar.
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+    expect(memorySubjectAccountOf(ctx)).toBeUndefined();
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newCheckMemoryEnablementStep(store, accounts).execute(ctx),
+      ),
+    );
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(refusal.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+
+  it("refuses a credential whose subject names no account", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), "chn_org_acme");
+    const refusal = await refusalOf(capture(ctx, accounts));
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+  });
+
+  it("answers a directory fault as an infrastructure fault, never a refusal", async () => {
+    const faulting: AccountsByCaller = {
+      findById: async () => {
+        throw new Error("simulated store fault");
+      },
+      findDirectByIdpId: async () => {
+        throw new Error("simulated store fault");
+      },
+    };
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newResolveMemoryDefaultsStep(faulting).execute(
+          memoryCtx(CAROL_AT_CONSOLE),
+        ),
+      ),
+    );
+    expect(refusal.code).toBe(Code.Internal);
+  });
+
+  it("refuses to file under an account row that carries no id", async () => {
+    const nameless: AccountsByCaller = {
+      findById: async () =>
+        create(IdentityAccountSchema, {
+          spec: { preferences: { memoryEnabled: true } },
+        }),
+      findDirectByIdpId: async () => undefined,
+    };
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newResolveMemoryDefaultsStep(nameless).execute(
+          memoryCtx(CAROL_AT_CONSOLE),
+        ),
+      ),
+    );
+    expect(refusal.code).toBe(Code.Internal);
+  });
+});
+
+describe("capture under the single-operator posture", () => {
+  it("keeps the sentinel subject and the org flag alone, whatever the account says", async () => {
+    seedCarol({ memoryEnabled: false });
+    const ctx = memoryCtx(CAROL_AT_CONSOLE);
+    await capture(ctx, undefined);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+    expect(memorySubjectAccountOf(ctx)).toBeUndefined();
+  });
+
+  it("still refuses with the org's copy when the organization is off", async () => {
+    await seedOrg(false);
+    const refusal = await refusalOf(
+      capture(memoryCtx(CAROL_AT_CONSOLE), undefined),
+    );
+    expect(refusal.rawMessage).toBe(memoryDisabledMessage(ORG));
+  });
+});