@stigmer/server 3.39.1-dev.20260928194002 → 3.40.1

package/src/domain/memory/__tests__/person-consent.test.ts

@@ -0,0 +1,274 @@
+/**
+ * Pins memory capture where callers are persons (stigmer#1387): with the
+ * identity-account directory composed, ResolveMemoryDefaults files the
+ * memory under the id of the account it is about — the admitted capture
+ * credential's subject (an account id or a raw issuer subject, read the
+ * way accountForStamp reads a creator stamp), else the calling person —
+ * and hands that account to CheckMemoryEnablement, which requires the
+ * organization's switch and then the person's own (the Java
+ * MemoryCreateHandler's order and copy). A caller no account stands for is
+ * stamped "" and refused by the enablement step, behind the authorization
+ * bar. Without the directory — the single-operator posture — the org flag
+ * alone decides and the subject stays the "" sentinel.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { RequestContext } from "../../../pipeline/request-context.js";
+import { MEMORY_CAPTURE_CREDENTIAL_KEY } from "../../../pipeline/steps/guard-memory-capture.js";
+import type { Store } from "../../../store/interface.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
+import type { AccountsByCaller } from "../../identityaccount/resolve.js";
+import { fakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
+import type { FakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
+import {
+  MEMORY_ACCOUNT_DISABLED_MESSAGE,
+  memoryDisabledMessage,
+} from "../constants.js";
+import {
+  memorySubjectAccountOf,
+  newCheckMemoryEnablementStep,
+  newResolveMemoryDefaultsStep,
+} from "../steps.js";
+
+const ORG = "org_acme";
+const CAROL = "ida_carol";
+const CAROL_SUBJECT = "auth0|carol";
+
+/** Carol at the console: a wire user whose identity is her account id. */
+const CAROL_AT_CONSOLE: CallerIdentity = {
+  identityId: CAROL,
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: "opaque",
+};
+
+/** A sandbox-lane caller; its capture credential names the subject. */
+const SANDBOX: CallerIdentity = {
+  identityId: CAROL,
+  callerClass: "sandbox",
+  issuer: "stigmer",
+  rawToken: "opaque",
+};
+
+/** A signed-in caller no account stands for yet (idp-shaped). */
+const STRANGER: CallerIdentity = {
+  identityId: "auth0|stranger",
+  callerClass: "user",
+  issuer: "https://issuer.example",
+  rawToken: "opaque",
+};
+
+let dir: string;
+let store: Store;
+let accounts: FakeIdentityAccountStore;
+
+beforeEach(async () => {
+  dir = mkdtempSync(path.join(tmpdir(), "memory-person-consent-"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+  accounts = fakeIdentityAccountStore();
+  seedCarol({ memoryEnabled: true });
+  await seedOrg(true);
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function seedCarol(preferences: { memoryEnabled: boolean }): void {
+  accounts.rows.set(
+    CAROL,
+    create(IdentityAccountSchema, {
+      metadata: { id: CAROL, name: "Carol" },
+      spec: { idpId: CAROL_SUBJECT, preferences },
+    }),
+  );
+}
+
+async function seedOrg(memoryEnabled: boolean): Promise<void> {
+  await store.saveResource(
+    ApiResourceKind.organization,
+    ORG,
+    OrganizationSchema,
+    create(OrganizationSchema, {
+      metadata: { id: ORG, name: ORG, org: ORG },
+      spec: { preferences: { memoryEnabled } },
+    }),
+  );
+}
+
+function memoryCtx(
+  caller: CallerIdentity,
+): RequestContext<typeof MemorySchema> {
+  return new RequestContext(
+    MemorySchema,
+    create(MemorySchema, {
+      metadata: { name: "m", org: ORG },
+      // A forged subject: the server always overwrites it.
+      spec: { content: "fact", subjectIdentityAccountId: "ida_forged" },
+    }),
+    caller,
+    ApiResourceKind.memory,
+  );
+}
+
+function withCredential(
+  ctx: RequestContext<typeof MemorySchema>,
+  subject: string,
+): RequestContext<typeof MemorySchema> {
+  ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
+    subjectIdentityAccountId: subject,
+    provedSessionId: "ses_proved",
+  });
+  return ctx;
+}
+
+/** Runs the create chain's two consent steps in their chain order. */
+async function capture(
+  ctx: RequestContext<typeof MemorySchema>,
+  personAccounts: AccountsByCaller | undefined,
+): Promise<void> {
+  await newResolveMemoryDefaultsStep(personAccounts).execute(ctx);
+  await newCheckMemoryEnablementStep(store, personAccounts).execute(ctx);
+}
+
+async function refusalOf(run: Promise<void>): Promise<ConnectError> {
+  try {
+    await run;
+  } catch (error) {
+    return ConnectError.from(error);
+  }
+  throw new Error("expected the capture to be refused");
+}
+
+describe("capture where callers are persons", () => {
+  it("files a direct capture under the calling person's account", async () => {
+    const ctx = memoryCtx(CAROL_AT_CONSOLE);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+    expect(memorySubjectAccountOf(ctx)?.metadata?.id).toBe(CAROL);
+  });
+
+  it("files a credentialed capture under the credential's subject", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), CAROL);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+    expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
+  });
+
+  it("normalises a credential subject that arrived as a raw issuer subject to the account id", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), CAROL_SUBJECT);
+    await capture(ctx, accounts);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe(CAROL);
+  });
+
+  it("refuses with the person's copy when their own switch is off", async () => {
+    seedCarol({ memoryEnabled: false });
+    for (const ctx of [
+      memoryCtx(CAROL_AT_CONSOLE),
+      withCredential(memoryCtx(SANDBOX), CAROL),
+    ]) {
+      const refusal = await refusalOf(capture(ctx, accounts));
+      expect(refusal.code).toBe(Code.FailedPrecondition);
+      expect(refusal.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+    }
+  });
+
+  it("asks the organization first: its switch off refuses with the org's copy", async () => {
+    seedCarol({ memoryEnabled: false });
+    await seedOrg(false);
+    const refusal = await refusalOf(
+      capture(memoryCtx(CAROL_AT_CONSOLE), accounts),
+    );
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(refusal.rawMessage).toBe(memoryDisabledMessage(ORG));
+  });
+
+  it("stamps nobody and refuses in the enablement step when no account stands for the caller", async () => {
+    const ctx = memoryCtx(STRANGER);
+    await newResolveMemoryDefaultsStep(accounts).execute(ctx);
+    // Not refused here: the refusal belongs behind the authorization bar.
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+    expect(memorySubjectAccountOf(ctx)).toBeUndefined();
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newCheckMemoryEnablementStep(store, accounts).execute(ctx),
+      ),
+    );
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(refusal.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+
+  it("refuses a credential whose subject names no account", async () => {
+    const ctx = withCredential(memoryCtx(SANDBOX), "chn_org_acme");
+    const refusal = await refusalOf(capture(ctx, accounts));
+    expect(refusal.code).toBe(Code.FailedPrecondition);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+  });
+
+  it("answers a directory fault as an infrastructure fault, never a refusal", async () => {
+    const faulting: AccountsByCaller = {
+      findById: async () => {
+        throw new Error("simulated store fault");
+      },
+      findDirectByIdpId: async () => {
+        throw new Error("simulated store fault");
+      },
+    };
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newResolveMemoryDefaultsStep(faulting).execute(
+          memoryCtx(CAROL_AT_CONSOLE),
+        ),
+      ),
+    );
+    expect(refusal.code).toBe(Code.Internal);
+  });
+
+  it("refuses to file under an account row that carries no id", async () => {
+    const nameless: AccountsByCaller = {
+      findById: async () =>
+        create(IdentityAccountSchema, {
+          spec: { preferences: { memoryEnabled: true } },
+        }),
+      findDirectByIdpId: async () => undefined,
+    };
+    const refusal = await refusalOf(
+      Promise.resolve(
+        newResolveMemoryDefaultsStep(nameless).execute(
+          memoryCtx(CAROL_AT_CONSOLE),
+        ),
+      ),
+    );
+    expect(refusal.code).toBe(Code.Internal);
+  });
+});
+
+describe("capture under the single-operator posture", () => {
+  it("keeps the sentinel subject and the org flag alone, whatever the account says", async () => {
+    seedCarol({ memoryEnabled: false });
+    const ctx = memoryCtx(CAROL_AT_CONSOLE);
+    await capture(ctx, undefined);
+    expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
+    expect(memorySubjectAccountOf(ctx)).toBeUndefined();
+  });
+
+  it("still refuses with the org's copy when the organization is off", async () => {
+    await seedOrg(false);
+    const refusal = await refusalOf(
+      capture(memoryCtx(CAROL_AT_CONSOLE), undefined),
+    );
+    expect(refusal.rawMessage).toBe(memoryDisabledMessage(ORG));
+  });
+});

package/src/domain/memory/constants.ts

@@ -30,6 +30,17 @@ export function memoryDisabledMessage(org: string): string {
   return `memory is not enabled for organization ${org} — an organization admin can enable it in organization preferences`;
 }
 
+/**
+ * Refuses a create while the PERSON the memory would be about has not
+ * enabled memory on their own account — the member half of the double
+ * opt-in (DD-006 D1), and the answer for a caller no account stands for,
+ * since only an unprovisioned person reaches that arm. The Java
+ * MemoryPolicy.MEMORY_ACCOUNT_DISABLED_MESSAGE, byte-pinned: the hosted
+ * edition's clients have rendered it since the Java handler shipped.
+ */
+export const MEMORY_ACCOUNT_DISABLED_MESSAGE =
+  "memory is not enabled for your account — enable it in account preferences";
+
 /**
  * Refuses confirming a rejected memory: the decision is auditable and
  * stands; a fresh proposal is the way back. Go

package/src/domain/memory/controller.ts

@@ -35,12 +35,15 @@
  *
  * Authorization posture (OSS): this edition is single-user and local, so
  * handlers perform no authorization — a documented no-op, not a silent
- * divergence. The subject is the empty-string sentinel (the OAuth grant
- * store convention); enablement is the org flag alone (the user scope
- * collapses — DD-002 D1). The cloud edition derives the subject from the
- * calling credential, enforces the strict first-party-human gate, checks
- * both memory_enabled flags, and gates every RPC through FGA (subject-only
- * can_view/can_edit/can_delete).
+ * divergence. The subject and the double opt-in follow the POSTURE, not
+ * the edition (stigmer#1387): where callers are persons (the
+ * require-authentication posture composes `personAccounts` — the hosted
+ * edition, a self-host with sign-in) the subject is the identity account
+ * the memory is about and both memory_enabled flags must be on; under the
+ * single-operator posture (trusted-local) the subject is the empty-string
+ * sentinel (the OAuth grant store convention) and enablement is the org
+ * flag alone (the user scope collapses — DD-002 D1). Every RPC's FGA
+ * question is subject-only (can_view/can_edit/can_delete).
  *
  * Memory is deliberately NOT search-indexed (privacy — subject-only
  * content must not surface in org-visible search): no search-extractor,
@@ -70,6 +73,7 @@ import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
 import { internalError } from "../../pipeline/errors.js";
@@ -131,6 +135,14 @@ export interface MemoryControllerDeps {
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed list read scope — list narrows through it; undefined = the OSS full scan (20260830.01). */
   readonly listReadScope: ListReadScope | undefined;
+  /**
+   * The directory of the persons callers stand for (stigmer#1387) — the
+   * composed identity-account port, bound under the require-authentication
+   * posture; undefined = the single-operator posture (trusted-local),
+   * where memory is the organization's switch alone and the subject the
+   * empty-string sentinel.
+   */
+  readonly personAccounts: AccountsByCaller | undefined;
   /**
    * The composed runner-credential provider — GuardMemoryCapture consults
    * its authorizeMemoryCapture capability for the runner-credential
@@ -172,10 +184,13 @@ function kindOf(ctx: HandlerContext): ApiResourceKind {
  * No search-index step: memory is not_search_indexed by design (privacy —
  * content is subject-only and must not surface in org-visible search).
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the strict
- * first-party-human-operator gate and the caller's own memory_enabled
- * check (no per-request user identity — the user scope collapses, DD-006
- * D1) and creates no FGA tuples.
+ * Authorization: GuardMemoryCapture decides WHO may capture (the composed
+ * RunnerCredentialProvider), AuthorizeResolvedTarget decides WHERE
+ * (can_create_session on the organization), and CreateAuthorizationTuples
+ * runs against the composed lifecycle. ResolveMemoryDefaults names the
+ * person the memory is about and CheckMemoryEnablement requires both
+ * halves of the double opt-in where callers are persons (both step docs;
+ * stigmer#1387).
  */
 async function createMemory(
   deps: MemoryControllerDeps,
@@ -195,7 +210,7 @@ async function createMemory(
     .addStep(newValidateProtoStep())
     .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
     .addStep(newValidateVisibilityStep())
-    .addStep(newResolveMemoryDefaultsStep())
+    .addStep(newResolveMemoryDefaultsStep(deps.personAccounts))
     // Before the enablement and cap checks, so a refused caller learns
     // nothing about the organization's settings (steps.ts,
     // resolveMemoryCreateTargets).
@@ -205,7 +220,7 @@ async function createMemory(
         resolveMemoryCreateTargets,
       ),
     )
-    .addStep(newCheckMemoryEnablementStep(deps.store))
+    .addStep(newCheckMemoryEnablementStep(deps.store, deps.personAccounts))
     .addStep(newCheckMemoryCapStep(deps.store))
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
@@ -236,8 +251,7 @@ async function createMemory(
  * owners (create, confirm, reject) last wrote it, even against a
  * concurrent confirm landing between this pipeline's load and persist.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_edit on the memory — FGA subject-only).
+ * Authorize evaluates can_edit on the memory (subject-only in the model).
  */
 async function update(
   deps: MemoryControllerDeps,
@@ -332,9 +346,8 @@ async function reject(
  * runTransition: one contract with opposite verdicts (DD-005 D3),
  * answering with the post-image row.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_edit on the memory — FGA subject-only, loading before
- * authorizing so a missing memory answers NOT_FOUND, #224).
+ * Authorize evaluates can_edit on the memory (subject-only in the model)
+ * against the request's id, before the load.
  */
 async function runTransition(
   deps: MemoryControllerDeps,
@@ -381,8 +394,7 @@ async function runTransition(
  *
  * No search-index cleanup: memory is not_search_indexed.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_delete on the memory — FGA subject-only).
+ * Authorize evaluates can_delete on the memory (subject-only in the model).
  *
  * The deleted memory is returned for audit trail purposes (gRPC
  * convention).
@@ -425,9 +437,8 @@ async function deleteMemory(
 /**
  * Get — chain per Go buildGetPipeline (ExtractResourceId → LoadTarget).
  *
- * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
- * requires can_view — FGA subject-only: only the person a memory is about
- * can read it).
+ * Authorize evaluates can_view on the memory: in the model only the person
+ * a memory is about can read it.
  */
 async function get(
   deps: MemoryControllerDeps,
@@ -466,11 +477,9 @@ async function get(
  * console's presentation concern (DD-005 D4), deliberately not an RPC
  * parameter at the kind's dozens-of-records scale.
  *
- * Note: Unlike Stigmer Cloud, OSS excludes:
- *   - Authorization filtering (single user — every record is the
- *     caller's; cloud filters to can_view via FGA, which resolves to the
- *     subject)
- *   - Pagination (returns all matching results)
+ * Narrowed to the caller's authorized rows (can_view, which resolves to
+ * the subject) by the composed list read scope. Unpaginated (returns all
+ * matching results).
  */
 async function list(
   deps: MemoryControllerDeps,

package/src/domain/memory/steps.ts

@@ -17,7 +17,7 @@
  * Proven by memory.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/memory.test.ts.
  */
-import { create, equals, fromBinary } from "@bufbuild/protobuf";
+import { create, equals, fromBinary, isMessage } from "@bufbuild/protobuf";
 import { timestampNow } from "@bufbuild/protobuf/wkt";
 import type { ConnectError } from "@connectrpc/connect";
 
@@ -30,6 +30,8 @@ import { MemoryListSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/i
 import { MemoryProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/spec_pb";
 import { MemoryStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/status_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 
@@ -52,10 +54,16 @@ import {
 import { memoryCaptureCredentialOf } from "../../pipeline/steps/guard-memory-capture.js";
 import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
+import {
+  accountForCaller,
+  accountForStamp,
+} from "../identityaccount/resolve.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import {
   MAX_MEMORIES_PER_SUBJECT,
+  MEMORY_ACCOUNT_DISABLED_MESSAGE,
   MEMORY_FULL_MESSAGE,
   MEMORY_PROVENANCE_IMMUTABLE_MESSAGE,
   MEMORY_SUBJECT_IMMUTABLE_MESSAGE,
@@ -77,10 +85,22 @@ export const LIST_RESULT_KEY = "listResult";
  *     memories are id-addressed records (the remember tool sends content
  *     only), and the platform's slug machinery requires a name. A
  *     client-supplied name still wins — the default only fills absence.
- *  3. Overwrites spec.subject_identity_account_id with the empty-string
- *     sentinel — the OSS single-user subject (the OAuth grant store
- *     convention). Server-derived, never client-supplied (DD-005 D2):
- *     the cloud edition writes the caller's identity account here.
+ *  3. Overwrites spec.subject_identity_account_id, server-derived and
+ *     never client-supplied (DD-005 D2), by posture. Under the
+ *     single-operator posture (no `personAccounts` composed) it is the
+ *     empty-string sentinel — the laptop's one subject (the OAuth grant
+ *     store convention). Where callers are persons it is the id of the
+ *     identity account the memory is ABOUT (stigmer#1387, the Java
+ *     MemoryCreateHandler's subject): the admitted capture credential's
+ *     subject (point 5), else the calling person — each resolved through
+ *     the identity-account domain (accountForStamp / accountForCaller),
+ *     so a subject that arrived as a raw issuer subject is filed under
+ *     the account every FGA tuple names. The resolved account rides the
+ *     context under MEMORY_SUBJECT_ACCOUNT_KEY for CheckMemoryEnablement,
+ *     so the subject stamped and the consent checked are one row, read
+ *     once. A caller no account stands for is stamped "" and NOT refused
+ *     here: the refusal belongs behind AuthorizeResolvedTarget, which
+ *     runs between the two steps so a refused caller learns nothing.
  *  4. Stores spec.provenance as supplied (Stage 3 provenance decision,
  *     owner-ratified 2026-08-22): the capture path — the remember tool
  *     via the runner-synthesized attachment — threads the agent/session/
@@ -101,15 +121,15 @@ export const LIST_RESULT_KEY = "listResult";
  *     human ("the sub IS the human subject the session belongs to",
  *     Java MemoryCreateHandler) and provenance.session_id is overridden
  *     with the token's own session claim (server-proved beats
- *     runner-reported). Absent the handoff, the OSS arms above apply
+ *     runner-reported). Absent the handoff, the arms above apply
  *     unchanged.
  */
-export function newResolveMemoryDefaultsStep(): PipelineStep<
-  typeof MemorySchema
-> {
+export function newResolveMemoryDefaultsStep(
+  personAccounts?: AccountsByCaller,
+): PipelineStep<typeof MemorySchema> {
   return {
     name: "ResolveMemoryDefaults",
-    execute(ctx: RequestContext<typeof MemorySchema>): void {
+    async execute(ctx: RequestContext<typeof MemorySchema>): Promise<void> {
       const memory = ctx.newState;
       const metadata = memory.metadata;
 
@@ -138,11 +158,23 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
         );
       }
 
-      // The subject stays server-owned (DD-005 D2): the OSS sentinel, or
-      // the admitted capture credential's proved human (step doc point 5).
+      // The subject stays server-owned (DD-005 D2), by posture (step doc
+      // points 3 and 5).
       const captureCredential = memoryCaptureCredentialOf(ctx);
-      spec.subjectIdentityAccountId =
-        captureCredential?.subjectIdentityAccountId ?? "";
+      if (personAccounts === undefined) {
+        spec.subjectIdentityAccountId =
+          captureCredential?.subjectIdentityAccountId ?? "";
+      } else {
+        const account = await resolveSubjectAccount(
+          personAccounts,
+          ctx,
+          captureCredential?.subjectIdentityAccountId,
+        );
+        spec.subjectIdentityAccountId = account?.metadata?.id ?? "";
+        if (account !== undefined) {
+          ctx.set(MEMORY_SUBJECT_ACCOUNT_KEY, account);
+        }
+      }
 
       // Provenance is capture-path-supplied (see the step doc, point 4);
       // only tool_call_id is force-cleared — unreachable via MCP in v1, so
@@ -162,6 +194,54 @@ export function newResolveMemoryDefaultsStep(): PipelineStep<
   };
 }
 
+/**
+ * Context key carrying the identity account a memory is about, from
+ * ResolveMemoryDefaults to CheckMemoryEnablement — present exactly when
+ * callers are persons and the subject resolved (step doc point 3).
+ */
+export const MEMORY_SUBJECT_ACCOUNT_KEY = "memorySubjectAccount";
+
+/** The subject's account stashed by ResolveMemoryDefaults, if any. */
+export function memorySubjectAccountOf(
+  ctx: RequestContext<typeof MemorySchema>,
+): IdentityAccount | undefined {
+  const payload = ctx.get(MEMORY_SUBJECT_ACCOUNT_KEY);
+  return isMessage(payload, IdentityAccountSchema) ? payload : undefined;
+}
+
+/**
+ * The account the memory is about: the capture credential's subject read
+ * as a creator-style stamp (an account id, or a raw issuer subject), else
+ * the account the calling person stands for. `undefined` when nobody
+ * resolves. A store fault is an infrastructure fault; an account row with
+ * no id is a loud one, never an empty principal (the resolve.ts rule).
+ */
+async function resolveSubjectAccount(
+  personAccounts: AccountsByCaller,
+  ctx: RequestContext<typeof MemorySchema>,
+  credentialSubject: string | undefined,
+): Promise<IdentityAccount | undefined> {
+  let account: IdentityAccount | undefined;
+  try {
+    account =
+      credentialSubject !== undefined
+        ? await accountForStamp(personAccounts, credentialSubject)
+        : await accountForCaller(personAccounts, ctx.callerIdentity);
+  } catch (error) {
+    throw internalError(
+      error,
+      "failed to resolve the identity account a memory is about",
+    );
+  }
+  if (account !== undefined && (account.metadata?.id ?? "") === "") {
+    throw internalError(
+      new Error("identity account carries no id"),
+      "failed to resolve the identity account a memory is about",
+    );
+  }
+  return account;
+}
+
 /** The deny copy of the create lane's organization bar. */
 export const MEMORY_CREATE_DENIED_MESSAGE =
   "unauthorized to capture memory in this organization";
@@ -212,15 +292,22 @@ export function resolveMemoryCreateTargets(
  * authorization: "the label is not authorization; the server refuses"
  * (the conversation-attachment doctrine, applied verbatim).
  *
- * OSS checks the org flag alone — the user scope collapses in single-user
- * local mode (DD-006 D1). The cloud edition additionally requires the
- * caller's own memory_enabled and the strict first-party-human gate.
+ * The double opt-in (DD-006 D1), in the Java handler's order: the
+ * organization's switch first (the gate an admin controls), then — where
+ * callers are persons (`personAccounts` composed) — the switch of the
+ * person the memory is about, read from the account ResolveMemoryDefaults
+ * resolved and stashed (stigmer#1387). No stashed account under that
+ * posture refuses with the person's copy: nobody the server can name has
+ * consented. The single-operator posture checks the org flag alone — its
+ * one operator is the organization's decider. Who may capture at all is
+ * GuardMemoryCapture's question, not this step's.
  *
  * Reads the Organization row directly from the store, matching Go — no
  * cross-domain client.
  */
 export function newCheckMemoryEnablementStep(
   store: Store,
+  personAccounts?: AccountsByCaller,
 ): PipelineStep<typeof MemorySchema> {
   return {
     name: "CheckMemoryEnablement",
@@ -247,6 +334,14 @@ export function newCheckMemoryEnablementStep(
       if (org.spec?.preferences?.memoryEnabled !== true) {
         throw failedPreconditionError(memoryDisabledMessage(orgID));
       }
+
+      if (personAccounts === undefined) {
+        return;
+      }
+      const subject = memorySubjectAccountOf(ctx);
+      if (subject?.spec?.preferences?.memoryEnabled !== true) {
+        throw failedPreconditionError(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+      }
     },
   };
 }

package/src/domain/organization/controller.ts

@@ -20,10 +20,13 @@
  * carries the other two edition forks: find's enumeration posture and
  * findMyOrganizations' filtering (see organization-directory.ts).
  *
- * Versus Stigmer Cloud's Java service, plain OSS excludes the
- * CreateIamPolicies and Publish steps; with the C2 seam composed, the
- * CreateAuthorizationTuples/CleanupIamPolicies steps deliver the same
- * lifecycle through the resourceAuthorizationLifecycle driver.
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps (CreateAuthorizationTuples, CleanupIamPolicies)
+ * against the lifecycle compose.ts hands it: a composed
+ * resourceAuthorizationLifecycle driver when a unit registers one, else,
+ * under the built-in posture, open source's role lifecycle (the creator's
+ * `owner` row), and under trusted-local none, where the steps no-op.
+ * Per-RPC posture: docs/authorization-coverage.md §2.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { Code, ConnectError } from "@connectrpc/connect";