@stigmer/server 3.39.1-dev.20260928194002 → 3.40.1

package/src/domain/plugin/__tests__/plugin.test.ts

@@ -104,6 +104,10 @@ beforeAll(async () => {
       STIGMER_MODEL_REGISTRY_REFRESH: "off",
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
       GRPC_PORT: String(grpcPort),
+      // The reserved port is the unified one only; its +1 neighbour is not
+      // reserved, and a lane that cannot bind fails the boot (#1089), so
+      // the artifact lane binds ephemeral.
+      ARTIFACT_HTTP_PORT: "0",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STORAGE_PATH: path.join(dir, "storage"),
@@ -801,6 +805,10 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
         STIGMER_MODEL_REGISTRY_REFRESH: "off",
         TEMPORAL_HOST_PORT: "127.0.0.1:1",
         GRPC_PORT: String(grpcPort),
+        // The reserved port is the unified one only; its +1 neighbour is not
+        // reserved, and a lane that cannot bind fails the boot (#1089), so
+        // the artifact lane binds ephemeral.
+        ARTIFACT_HTTP_PORT: "0",
         DB_PATH: path.join(enforcingDir, "stigmer.db"),
         ARTIFACT_LOCAL_BASE_PATH: path.join(enforcingDir, "artifacts"),
         STORAGE_PATH: path.join(enforcingDir, "storage"),

package/src/domain/session/controller.ts

@@ -13,9 +13,13 @@
  * Proven by session.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/session.test.ts.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing here)
- * and the FGA-authorized list filtering.
+ * Every chain opens with Authorize, and create also asks can_execute on
+ * the agent instance it binds to (AuthorizeRunTarget); create and delete
+ * run the shared tuple-lifecycle steps against the composed lifecycle;
+ * updateSubject evaluates its annotation through authorizeDirect after the
+ * load (#224); list, listByAgentInstance and listByChannel narrow through
+ * the composed list read scope. Per-RPC posture:
+ * docs/authorization-coverage.md §8.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/skill/__tests__/skill.test.ts

@@ -74,6 +74,10 @@ beforeAll(async () => {
       // a live local Temporal (the conformance CRUD harness does the same).
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
       GRPC_PORT: String(grpcPort),
+      // The reserved port is the unified one only; its +1 neighbour is not
+      // reserved, and a lane that cannot bind fails the boot (#1089), so
+      // the artifact lane binds ephemeral.
+      ARTIFACT_HTTP_PORT: "0",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STORAGE_PATH: path.join(dir, "storage"),

package/src/domain/skill/controller.ts

@@ -13,8 +13,14 @@
  * optional deps; every absent-surface answer is a deliberate arm, not an
  * accident.
  *
- * Versus Stigmer Cloud, OSS excludes the TransformResponse/SendResponse
- * steps (no response transformation). The transfer lane's capability
+ * Every chain opens with Authorize; push runs the tuple-lifecycle splice
+ * (SkillPushAuthorizationTuples), and updateVisibility and delete the
+ * shared tuple steps; getByReference and listVersions authorize the
+ * resolved skill as `get` would; getArtifact and getArtifactDownloadUrl
+ * skip authorization by design, the content-hash key being the capability
+ * (docs/authorization-coverage.md §21).
+ *
+ * The transfer lane's capability
  * URLs come from the blob driver through the staging port
  * (transfer/staging.ts): the local driver's point at this server's own
  * HTTP lane, a bucket driver's straight at the bucket — same

package/src/domain/workflow/controller.ts

@@ -13,8 +13,12 @@
  * Proven by workflow.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing here).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference and listVersions authorize the resolved workflow as `get`
+ * would. getVersion evaluates its annotation through authorizeDirect;
+ * validateSpec deliberately does not, since it persists nothing. Per-RPC
+ * posture: docs/authorization-coverage.md §17.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, enumToJson, fromBinary } from "@bufbuild/protobuf";

package/src/domain/workflowexecution/controller.ts

@@ -12,10 +12,14 @@
  * Proven by workflowexecution.conformance.test.ts
  * (CONFORMANCE_TARGET=local) and __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, Publish,
- * PublishToRedis, and TransformResponse steps (no multi-tenant auth,
- * event publishing, or Redis here — subscribe streams ride in-memory
- * channels per ADR 011).
+ * Every chain opens with Authorize, and create also authorizes its run
+ * target (AuthorizeRunTarget); create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle. The streams and
+ * the event log evaluate their annotation through authorizeDirect; the
+ * list, summary and pending-approval reads narrow through the composed
+ * list read scope. Subscribe streams ride the in-memory stream broker
+ * (ADR 011); there is no Redis. Per-RPC posture:
+ * docs/authorization-coverage.md §19.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/workflowexecution/update-status.ts

@@ -22,8 +22,9 @@
  * phase-transition-only statusAudit bump (heartbeats must not perpetually
  * re-sort long-running executions above new ones in the recents sidebar).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, PublishToRedis, and
- * Publish steps (broadcast rides in-memory channels per ADR 011).
+ * The chain opens with Authorize (can_edit on the execution); the
+ * broadcast rides the in-memory stream broker (ADR 011) — there is no
+ * Redis.
  */
 import { create, toBinary } from "@bufbuild/protobuf";
 import { timestampNow } from "@bufbuild/protobuf/wkt";

package/src/extensions/__tests__/identity.test.ts

@@ -13,10 +13,18 @@
  * in-process origin, and never a wire `machine` account — the one row
  * where the two predicates part, pinned so a step trusting server-composed
  * state can never be widened to the wire by picking the wrong one.
+ *
+ * And pins `isFirstPartyHumanOperator` (stigmer#1387), the allow-list
+ * memory recall and the person's declared preferences read: a wire `user`
+ * whose bearer is not a PlatformClient user token. Every other class, an
+ * in-process `user` (the open-source schedule fire's shape) and a
+ * platform token naming a PlatformClient are excluded; another issuer's
+ * token carrying the same claim is not a platform token (stigmer#1312).
  */
 import { describe, expect, it } from "vitest";
 
 import {
+  isFirstPartyHumanOperator,
   isPlatformPipelineCaller,
   isServerComposedRequest,
 } from "../identity.js";
@@ -103,3 +111,77 @@ describe("isServerComposedRequest", () => {
     );
   });
 });
+
+/** A JWT carrying `payload`, unsigned: the predicate reads, never verifies. */
+function jwtWith(payload: Record<string, unknown>): string {
+  const segment = (value: object) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${segment({ alg: "RS256", typ: "JWT" })}.${segment(payload)}.signature`;
+}
+
+describe("isFirstPartyHumanOperator", () => {
+  it("is true for a wire user — an OIDC login, an API key, the laptop's operator", () => {
+    expect(isFirstPartyHumanOperator(caller({}))).toBe(true);
+    expect(isFirstPartyHumanOperator(caller({ origin: "wire" }))).toBe(true);
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "https://issuer.example",
+          rawToken: jwtWith({ iss: "https://issuer.example", sub: "carol" }),
+        }),
+      ),
+    ).toBe(true);
+  });
+
+  it("is false for every other class, a composition's own included", () => {
+    for (const callerClass of [
+      "machine",
+      "runner",
+      "internal",
+      "guest",
+      "channel",
+      "schedule",
+      "sandbox",
+    ]) {
+      expect(
+        isFirstPartyHumanOperator(caller({ callerClass })),
+        callerClass,
+      ).toBe(false);
+    }
+  });
+
+  it("is false for a user the server composed a request for (the schedule fire)", () => {
+    expect(
+      isFirstPartyHumanOperator(
+        caller({ callerClass: "user", origin: "in-process" }),
+      ),
+    ).toBe(false);
+  });
+
+  it("is false for a PlatformClient user token, and true when another issuer stamps the claim", () => {
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "stigmer",
+          rawToken: jwtWith({
+            iss: "stigmer",
+            sub: "ida_x",
+            platform_client_id: "pc_1",
+          }),
+        }),
+      ),
+    ).toBe(false);
+    expect(
+      isFirstPartyHumanOperator(
+        caller({
+          issuer: "https://issuer.example",
+          rawToken: jwtWith({
+            iss: "https://issuer.example",
+            sub: "ida_x",
+            platform_client_id: "pc_1",
+          }),
+        }),
+      ),
+    ).toBe(true);
+  });
+});

package/src/extensions/__tests__/list-read-scope-composed.test.ts

@@ -6,6 +6,9 @@
  *
  *   - session.list (restrict verb, no org intersection — census lane 1),
  *   - apikey.findAll (restrict verb through the direct-read tail, lane 9),
+ *   - channelapp.listByOrg (restrict verb behind the domain's own org
+ *     predicate: the scope is offered the request org's rows only, the
+ *     listByOrg family's shape; stigmer/stigmer#1384),
  *   - workflowexecution.list (restrict verb + the org arm: non-blank
  *     narrows, blank spans orgs — lane 6),
  *   - activity.listRecentActivity (enumeration verb, two kinds — lane 22),
@@ -40,6 +43,8 @@ import { ActivityQueryController } from "@stigmer/protos/ai/stigmer/activity/v1/
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
+import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ChannelAppQueryController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/query_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
 import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
@@ -76,11 +81,13 @@ describe("list read scope (composed server, fake scope)", () => {
    * The switchable fake: "keep" narrows to `allowed` (both verbs, the
    * cloud driver's shape), "throw" simulates the FGA outage. Kinds seen
    * are recorded so the enumeration-lane assertions can verify which
-   * kind each consumer asked for.
+   * kind each consumer asked for, and the ids each restrict call was
+   * offered so a lane can show which rows reached the scope.
    */
   let mode: "keep" | "throw" = "keep";
   let allowed: ReadonlySet<string> = new Set();
   const seenKinds: ApiResourceKind[] = [];
+  const offeredIds: string[][] = [];
   const fakeScope: ListReadScope = {
     authorizedResourceIds(_caller, kind) {
       seenKinds.push(kind);
@@ -91,6 +98,7 @@ describe("list read scope (composed server, fake scope)", () => {
     },
     restrictListEntries(_caller, kind, entries) {
       seenKinds.push(kind);
+      offeredIds.push(entries.map((e) => e.id));
       if (mode === "throw") {
         return Promise.reject(new Error("fga unreachable"));
       }
@@ -202,6 +210,22 @@ describe("list read scope (composed server, fake scope)", () => {
         }),
       );
     }
+    for (const [id, org] of [
+      ["chap_mine", "acme"],
+      ["chap_foreign", "acme"],
+      ["chap_other_org", "rival"],
+    ] as const) {
+      await server.store.saveResource(
+        ApiResourceKind.channel_app,
+        id,
+        ChannelAppSchema,
+        create(ChannelAppSchema, {
+          apiVersion: "agentic.stigmer.ai/v1",
+          kind: "ChannelApp",
+          metadata: { id, name: id, org },
+        }),
+      );
+    }
     // The search lane: resources plus their index rows (list mode).
     for (const id of ["agt_mine", "agt_foreign"]) {
       await server.store.saveResource(
@@ -233,6 +257,7 @@ describe("list read scope (composed server, fake scope)", () => {
   beforeEach(() => {
     mode = "keep";
     seenKinds.length = 0;
+    offeredIds.length = 0;
   });
 
   it("session.list narrows to the scope's kept ids (org not consulted — lane 1)", async () => {
@@ -249,6 +274,19 @@ describe("list read scope (composed server, fake scope)", () => {
     expect(keys.entries.map((k) => k.metadata?.id)).toEqual(["key_mine"]);
   });
 
+  it("channelapp.listByOrg narrows the request org's apps to the scope's kept ids; no other org's app is offered (stigmer/stigmer#1384)", async () => {
+    // Allowing the other org's app too proves the org predicate is the
+    // domain's own, applied before the scope ever sees a row.
+    allowed = new Set(["chap_mine", "chap_other_org"]);
+    const query = createClient(ChannelAppQueryController, transport);
+    const list = await query.listByOrg({ org: "acme" });
+    expect(list.entries.map((a) => a.metadata?.id)).toEqual(["chap_mine"]);
+    expect(seenKinds).toEqual([ApiResourceKind.channel_app]);
+    expect(offeredIds.map((ids) => [...ids].sort())).toEqual([
+      ["chap_foreign", "chap_mine"],
+    ]);
+  });
+
   it("workflowexecution.list: non-blank org narrows AFTER the scope; blank org spans orgs (lane 6)", async () => {
     allowed = new Set(["wfe_mine", "wfe_other_org"]);
     const query = createClient(WorkflowExecutionQueryController, transport);

package/src/extensions/identity.ts

@@ -12,6 +12,11 @@
  * HandlerContext.values (never ambient state — the every-dependency-
  * explicit doctrine).
  */
+import { USER_TOKEN_CLAIMS } from "../domain/platformclient/constants.js";
+import {
+  decodeVerifiedPlatformTokenPayload,
+  stringClaim,
+} from "../platformtoken/envelope.js";
 
 /**
  * The caller-class discriminant. OSS knows user / machine / runner plus
@@ -152,3 +157,45 @@ export function isPlatformPipelineCaller(caller: CallerIdentity): boolean {
 export function isServerComposedRequest(caller: CallerIdentity): boolean {
   return caller.callerClass === "internal" || caller.origin === "in-process";
 }
+
+/**
+ * Whether `caller` is a FIRST-PARTY HUMAN OPERATOR: a person at the
+ * console, the CLI or an SDK, speaking for themselves on the wire — the
+ * TS rendering of the Java RequestCallerIdentity.isFirstPartyHumanOperator
+ * (not machine, not impersonated, no token_type, not a PlatformClient user
+ * token). Stated once for every consumer that must tell the person from a
+ * lane acting near them: memory recall and the person's declared
+ * preferences on execution create (domain/agentexecution/create-steps.ts).
+ *
+ * An ALLOW-list, so a lane this module has never heard of is excluded by
+ * construction: the class must be `user` (every human verifier stamps it —
+ * OIDC, API key, the cloud's direct and federated logins; runners, the
+ * cloud's token lanes and the platform's own pipelines each carry their
+ * own class), the request must come from the wire (the open-source
+ * schedule fire acts as its creator with class `user` but rides the
+ * in-process transport, which is exactly what `isServerComposedRequest`
+ * reads), and the bearer must not be a PlatformClient user token (a
+ * person, but spoken for by a third-party client — DD-002 D4 as amended).
+ */
+export function isFirstPartyHumanOperator(caller: CallerIdentity): boolean {
+  return (
+    caller.callerClass === "user" &&
+    !isServerComposedRequest(caller) &&
+    !carriesPlatformClientClaim(caller.rawToken)
+  );
+}
+
+/**
+ * Whether the bearer is a platform token naming a PlatformClient. Anything
+ * that is not a platform token (no token, an API key, another issuer's
+ * JWT) is not one, whatever claims it carries (stigmer#1312). Read from
+ * the raw token, never from `platformClientId`, which is audit provenance
+ * set by one verifier and not a guard vocabulary (see its field doc).
+ */
+export function carriesPlatformClientClaim(rawToken: string): boolean {
+  const payload = decodeVerifiedPlatformTokenPayload(rawToken);
+  return (
+    payload !== undefined &&
+    stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId) !== undefined
+  );
+}

package/src/pipeline/steps/guard-memory-capture.ts

@@ -42,14 +42,12 @@
 import type { DescMessage } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 
-import { USER_TOKEN_CLAIMS } from "../../domain/platformclient/constants.js";
-import { isServerComposedRequest } from "../../extensions/identity.js";
+import {
+  carriesPlatformClientClaim,
+  isServerComposedRequest,
+} from "../../extensions/identity.js";
 import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
-import {
-  decodeVerifiedPlatformTokenPayload,
-  stringClaim,
-} from "../../platformtoken/envelope.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
 import { metadataOf } from "./shapes.js";
 
@@ -147,16 +145,3 @@ export function memoryCaptureCredentialOf<Desc extends DescMessage>(
   }
   return undefined;
 }
-
-/**
- * Whether the bearer is a platform token naming a PlatformClient. Anything
- * that is not a platform token (no token, an API key, another issuer's
- * JWT) is not one, whatever claims it carries.
- */
-function carriesPlatformClientClaim(rawToken: string): boolean {
-  const payload = decodeVerifiedPlatformTokenPayload(rawToken);
-  return (
-    payload !== undefined &&
-    stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId) !== undefined
-  );
-}