@stigmer/server 3.39.1-dev.20260928194002 → 3.40.1

package/src/domain/agentexecution/__tests__/create-steps.test.ts

@@ -7,8 +7,18 @@
  * direct-step shape as Go). Go's nil-client skip proofs map to throwing
  * providers — reaching the client would fail the test just as a nil
  * dereference would panic Go.
+ *
+ * The two compose steps are also pinned where callers are persons
+ * (stigmer#1387, stigmer#1397): recall is the run's person's own
+ * confirmed facts, behind the first-party gate, the org switch and the
+ * person's own, and user_context is that person's standing context — the
+ * retired Java steps' gates, in their order.
  */
 import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import type { AccountsByCaller } from "../../identityaccount/resolve.js";
+import { fakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -94,11 +104,12 @@ function newExecution(sessionId: string, agentId: string): AgentExecution {
 
 function newContext(
   execution: AgentExecution,
+  caller: CallerIdentity = testCallerIdentity(),
 ): RequestContext<typeof AgentExecutionSchema> {
   return new RequestContext(
     AgentExecutionSchema,
     execution,
-    testCallerIdentity(),
+    caller,
     ApiResourceKind.agent_execution,
   );
 }
@@ -476,7 +487,7 @@ describe("newComposeDeclaredPreferencesStep", () => {
         "server-owned field must be stamped on every path",
       ).toBeDefined();
       expect(got?.orgContext).toBe(tt.wantOrgContext);
-      // user_context must stay empty in OSS (no per-request user identity).
+      // user_context stays empty under the single-operator posture.
       expect(got?.userContext).toBe("");
     });
   }
@@ -775,6 +786,223 @@ describe("newComposeRecalledMemoriesStep", () => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Where callers are persons (stigmer#1387, stigmer#1397).
+// ---------------------------------------------------------------------------
+
+describe("the compose steps where callers are persons", () => {
+  const CAROL = "ida_carol";
+  const DAVE = "ida_dave";
+
+  /** Carol at the console: a wire user whose identity is her account id. */
+  const carol = testCallerIdentity({ identityId: CAROL });
+
+  function directory(preferences: {
+    memoryEnabled?: boolean;
+    standingContext?: string;
+  }): AccountsByCaller {
+    const accounts = fakeIdentityAccountStore();
+    accounts.rows.set(
+      CAROL,
+      create(IdentityAccountSchema, {
+        metadata: { id: CAROL, name: "Carol" },
+        spec: { idpId: "auth0|carol", preferences },
+      }),
+    );
+    return accounts;
+  }
+
+  const faultingDirectory: AccountsByCaller = {
+    findById: async () => {
+      throw new Error("simulated store fault");
+    },
+    findDirectByIdpId: async () => {
+      throw new Error("simulated store fault");
+    },
+  };
+
+  /** A JWT carrying `payload`, unsigned: the gate reads, never verifies. */
+  function jwtWith(payload: Record<string, unknown>): string {
+    const segment = (value: object) =>
+      Buffer.from(JSON.stringify(value)).toString("base64url");
+    return `${segment({ alg: "RS256", typ: "JWT" })}.${segment(payload)}.signature`;
+  }
+
+  /** Every lane that is not a person speaking for themselves. */
+  const notFirstParty: Array<[string, CallerIdentity]> = [
+    [
+      "a runner acting as Carol",
+      testCallerIdentity({ identityId: CAROL, callerClass: "runner" }),
+    ],
+    [
+      "a machine account",
+      testCallerIdentity({ identityId: CAROL, callerClass: "machine" }),
+    ],
+    [
+      "a cloud channel sender",
+      testCallerIdentity({ identityId: CAROL, callerClass: "channel" }),
+    ],
+    [
+      "the schedule fire acting as Carol (in-process)",
+      testCallerIdentity({ identityId: CAROL, origin: "in-process" }),
+    ],
+    [
+      "Carol through a PlatformClient user token",
+      testCallerIdentity({
+        identityId: CAROL,
+        issuer: "stigmer",
+        rawToken: jwtWith({
+          iss: "stigmer",
+          sub: CAROL,
+          platform_client_id: "pc_1",
+        }),
+      }),
+    ],
+  ];
+
+  async function seedRecallRows(): Promise<void> {
+    await seedMemoryOrg("test-org", true);
+    const confirmed = MemoryLifecycleState.lifecycle_state_confirmed;
+    await seedMemory({
+      id: "mem_carol",
+      orgId: "test-org",
+      subject: CAROL,
+      content: "Carol's",
+      state: confirmed,
+      createdAt: new Date("2026-09-01T00:00:00Z"),
+    });
+    await seedMemory({
+      id: "mem_dave",
+      orgId: "test-org",
+      subject: DAVE,
+      content: "Dave's",
+      state: confirmed,
+      createdAt: new Date("2026-09-02T00:00:00Z"),
+    });
+    await seedMemory({
+      id: "mem_sentinel",
+      orgId: "test-org",
+      subject: "",
+      content: "nobody's",
+      state: confirmed,
+      createdAt: new Date("2026-09-03T00:00:00Z"),
+    });
+    await seedMemory({
+      id: "mem_carol_proposed",
+      orgId: "test-org",
+      subject: CAROL,
+      content: "unconfirmed",
+      state: MemoryLifecycleState.lifecycle_state_proposed,
+      createdAt: new Date("2026-09-04T00:00:00Z"),
+    });
+  }
+
+  async function recall(
+    accounts: AccountsByCaller | undefined,
+    caller: CallerIdentity,
+  ) {
+    const step = newComposeRecalledMemoriesStep(store, silentLogger, accounts);
+    const ctx = newContext(newExecution("ses_1", "agt_1"), caller);
+    await step.execute(ctx);
+    return ctx.newState.spec?.recalledMemories;
+  }
+
+  it("recalls exactly the run's person's confirmed facts", async () => {
+    await seedRecallRows();
+    const got = await recall(directory({ memoryEnabled: true }), carol);
+    expect(got?.enabled).toBe(true);
+    expect(got?.facts.map((f) => f.memoryId)).toEqual(["mem_carol"]);
+  });
+
+  it("recalls nothing and offers no remember tool when the person's own switch is off", async () => {
+    await seedRecallRows();
+    const got = await recall(directory({ memoryEnabled: false }), carol);
+    expect(got?.enabled).toBe(false);
+    expect(got?.facts).toEqual([]);
+  });
+
+  it("recalls nothing when the organization's switch is off, whatever the person's", async () => {
+    await seedMemoryOrg("test-org", false);
+    const got = await recall(directory({ memoryEnabled: true }), carol);
+    expect(got?.enabled).toBe(false);
+  });
+
+  it("recalls nothing for a caller no account stands for", async () => {
+    await seedRecallRows();
+    const got = await recall(
+      directory({ memoryEnabled: true }),
+      testCallerIdentity({ identityId: "auth0|stranger" }),
+    );
+    expect(got?.enabled).toBe(false);
+  });
+
+  it("degrades to disabled on a directory fault (best-effort)", async () => {
+    await seedRecallRows();
+    const got = await recall(faultingDirectory, carol);
+    expect(got?.enabled).toBe(false);
+  });
+
+  for (const [name, caller] of notFirstParty) {
+    it(`recalls nothing for ${name}`, async () => {
+      await seedRecallRows();
+      const got = await recall(directory({ memoryEnabled: true }), caller);
+      expect(got?.enabled).toBe(false);
+      expect(got?.facts).toEqual([]);
+    });
+  }
+
+  async function declared(
+    accounts: AccountsByCaller | undefined,
+    caller: CallerIdentity,
+  ) {
+    await seedOrg("test-org", "We deploy to us-east-1.");
+    const step = newComposeDeclaredPreferencesStep(
+      store,
+      silentLogger,
+      accounts,
+    );
+    const execution = newExecution("ses_1", "agt_1");
+    execution.spec!.declaredPreferences = create(DeclaredPreferencesSchema, {
+      userContext: "injected user context",
+    });
+    const ctx = newContext(execution, caller);
+    await step.execute(ctx);
+    return ctx.newState.spec?.declaredPreferences;
+  }
+
+  it("composes the run's person's standing context beside the organization's", async () => {
+    const got = await declared(
+      directory({ standingContext: "Call me Carol." }),
+      carol,
+    );
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("Call me Carol.");
+  });
+
+  it("keeps the organization's context and composes no person's on a directory fault", async () => {
+    const got = await declared(faultingDirectory, carol);
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("");
+  });
+
+  it("composes no person's context under the single-operator posture", async () => {
+    const got = await declared(undefined, carol);
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("");
+  });
+
+  for (const [name, caller] of notFirstParty) {
+    it(`composes no person's context for ${name}, and keeps the organization's`, async () => {
+      const got = await declared(
+        directory({ standingContext: "Call me Carol." }),
+        caller,
+      );
+      expect(got?.orgContext).toBe("We deploy to us-east-1.");
+      expect(got?.userContext).toBe("");
+    });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // agentCallTaskEnvironmentRefs (create_execution_context_workflow_refs_test.go).
 // ---------------------------------------------------------------------------

package/src/domain/agentexecution/controller.ts

@@ -8,10 +8,15 @@
  * Proven by agentexecution.conformance.test.ts
  * (CONFORMANCE_TARGET=local) and __tests__/.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * Publish, PublishToRedis, and TransformResponse steps (no multi-tenant
- * auth, IAM/FGA, event publishing, or Redis here — subscribe streams ride
- * in-memory channels per ADR 011).
+ * Every chain opens with Authorize, and create also authorizes its run
+ * target (AuthorizeRunTarget); create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle. The direct
+ * handlers — subscribe and the two artifact reads — evaluate their
+ * annotation through authorizeDirect; uploadAttachment is authorized at
+ * the create its storage key feeds. list, listBySession and
+ * getExecutionSummary narrow through the composed list read scope.
+ * Subscribe streams ride the in-memory stream broker (ADR 011); there is
+ * no Redis. Per-RPC posture: docs/authorization-coverage.md §16.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 
@@ -31,6 +36,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
 import { stepsForSlot } from "../../extensions/gate-slots.js";
@@ -151,6 +157,14 @@ export interface AgentExecutionControllerDeps {
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   /** The composed summary read scope — undefined = the OSS full scan (C2 Stage 4). */
   readonly listReadScope: ListReadScope | undefined;
+  /**
+   * The directory of the persons callers stand for (stigmer#1387) — the
+   * composed identity-account port, bound under the require-authentication
+   * posture; undefined = the single-operator posture (trusted-local),
+   * where memory is the organization's switch alone and the subject the
+   * empty-string sentinel.
+   */
+  readonly personAccounts: AccountsByCaller | undefined;
   /**
    * The shared broadcast fabric for subscribe streams. ONE instance spans
    * both routers (serving + in-process) — see stream-broker.ts; the
@@ -360,8 +374,20 @@ async function createExecution(
         sessionCreator: deps.sessionCreator,
       }),
     )
-    .addStep(newComposeDeclaredPreferencesStep(deps.store, deps.logger))
-    .addStep(newComposeRecalledMemoriesStep(deps.store, deps.logger))
+    .addStep(
+      newComposeDeclaredPreferencesStep(
+        deps.store,
+        deps.logger,
+        deps.personAccounts,
+      ),
+    )
+    .addStep(
+      newComposeRecalledMemoriesStep(
+        deps.store,
+        deps.logger,
+        deps.personAccounts,
+      ),
+    )
     .addStep(newSetInitialPhaseStep())
     .addStep(newCreateExecutionContextStep(deps.executionContextBuilder))
     .addStep(newProcessAttachmentsStep(deps.logger))

package/src/domain/agentexecution/create-steps.ts

@@ -34,6 +34,7 @@ import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import type { SessionSpec } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
 import { SessionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -41,6 +42,7 @@ import { clone } from "@bufbuild/protobuf";
 
 import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
+import { isFirstPartyHumanOperator } from "../../extensions/identity.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { notifyDefaultInstanceLinked } from "../../pipeline/steps/authorization-tuples.js";
 import {
@@ -53,9 +55,12 @@ import {
 } from "../../pipeline/errors.js";
 import { ConnectError } from "@connectrpc/connect";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { RequestContext } from "../../pipeline/request-context.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { buildDefaultInstanceRequest } from "../agentinstance/defaultinstance.js";
+import type { AccountsByCaller } from "../identityaccount/resolve.js";
+import { accountForCaller } from "../identityaccount/resolve.js";
 
 import type { AgentExecutionStatusObserver } from "../../extensions/status-hooks.js";
 
@@ -416,19 +421,27 @@ export function newCreateSessionIfNeededStep(deps: {
 // ---------------------------------------------------------------------------
 
 /**
- * Snapshots the organization's declared standing context onto the
- * execution spec (DD-002, stigmer/stigmer#293). SERVER-OWNED: stamped
- * unconditionally, overwriting anything the caller supplied. OSS composes
- * org_context only (the local server has no per-request user identity).
- * BEST-EFFORT: an execution must never fail to start because its optional
- * preferences could not load — genuine failures log at ERROR (quiet
- * degradation of a should-work path must stay visible) and degrade to an
- * empty snapshot. Snapshot-at-create is the point: preferences are
+ * Snapshots the declared standing context onto the execution spec
+ * (DD-002, stigmer/stigmer#293). SERVER-OWNED: stamped unconditionally,
+ * overwriting anything the caller supplied. Two independent halves:
+ * org_context, the organization's, for every run; and user_context, the
+ * run's person's own (stigmer#1397) — composed only where callers are
+ * persons (`personAccounts`, the require-authentication posture) and only
+ * for a first-party human operator (runPersonOf), as the Java step did.
+ * The single-operator posture composes org_context alone: its one
+ * operator's context is the organization's. The org half deliberately
+ * keeps running for every lane (schedule and channel runs carry the
+ * organization's instructions today); only the person's half is about a
+ * person. BEST-EFFORT: an execution must never fail to start because its
+ * optional preferences could not load — genuine failures log at ERROR
+ * (quiet degradation of a should-work path must stay visible) and degrade
+ * that half to empty. Snapshot-at-create is the point: preferences are
  * mutable, executions are immutable audit records.
  */
 export function newComposeDeclaredPreferencesStep(
   store: Store,
   logger: Logger,
+  personAccounts?: AccountsByCaller,
 ): PipelineStep<CreateDesc> {
   return {
     name: "ComposeDeclaredPreferences",
@@ -438,50 +451,103 @@ export function newComposeDeclaredPreferencesStep(
       // Claim the server-owned field first, before any load can fail.
       execution.spec.declaredPreferences = create(DeclaredPreferencesSchema);
 
-      let orgId = execution.metadata?.org ?? "";
-      if (orgId === "") {
-        orgId = ctx.input.metadata?.org ?? "";
-      }
-      if (orgId === "") {
-        logger.debug(
-          "No org on execution metadata, composing no declared preferences",
-        );
-        return;
-      }
-
-      let org: Organization;
-      try {
-        org = await store.getResource(
-          ApiResourceKind.organization,
-          orgId,
-          OrganizationSchema,
-        );
-      } catch (error) {
-        if (error instanceof ResourceNotFoundError) {
-          logger.debug(
-            "Org not found in store, composing no declared preferences",
-            { orgId },
-          );
-          return;
-        }
-        logger.error(
-          "Failed to load org for declared preferences - degrading to none (best-effort contract)",
-          {
-            orgId,
-            error: error instanceof Error ? error.message : String(error),
-          },
-        );
-        return;
-      }
-
       // Verbatim per DD-002 D2: the server stamps content only;
       // blank-is-absent is the runner's read-side convention.
       execution.spec.declaredPreferences.orgContext =
-        org.spec?.preferences?.standingContext ?? "";
+        await loadOrgStandingContext(store, logger, orgIdOf(ctx));
+
+      if (personAccounts === undefined) {
+        return;
+      }
+      const person = await runPersonOf(
+        personAccounts,
+        ctx.callerIdentity,
+        logger,
+        "Failed to load the run's person for declared preferences - degrading user context to none (best-effort contract)",
+      );
+      execution.spec.declaredPreferences.userContext =
+        person?.spec?.preferences?.standingContext ?? "";
     },
   };
 }
 
+/** The org a create addresses: the execution's metadata, else the input's. */
+function orgIdOf(ctx: RequestContext<CreateDesc>): string {
+  const orgId = ctx.newState.metadata?.org ?? "";
+  return orgId !== "" ? orgId : (ctx.input.metadata?.org ?? "");
+}
+
+/** The organization's standing context, best-effort ("" on every degrade). */
+async function loadOrgStandingContext(
+  store: Store,
+  logger: Logger,
+  orgId: string,
+): Promise<string> {
+  if (orgId === "") {
+    logger.debug(
+      "No org on execution metadata, composing no declared preferences",
+    );
+    return "";
+  }
+
+  let org: Organization;
+  try {
+    org = await store.getResource(
+      ApiResourceKind.organization,
+      orgId,
+      OrganizationSchema,
+    );
+  } catch (error) {
+    if (error instanceof ResourceNotFoundError) {
+      logger.debug(
+        "Org not found in store, composing no declared preferences",
+        {
+          orgId,
+        },
+      );
+      return "";
+    }
+    logger.error(
+      "Failed to load org for declared preferences - degrading to none (best-effort contract)",
+      {
+        orgId,
+        error: error instanceof Error ? error.message : String(error),
+      },
+    );
+    return "";
+  }
+  return org.spec?.preferences?.standingContext ?? "";
+}
+
+/**
+ * The person a run is created by, where callers are persons
+ * (stigmer#1387): the account a first-party human operator stands for
+ * (extensions/identity.ts states who that is, once). `undefined` for every
+ * other lane — runner, schedule, channel, guest, machine, a PlatformClient
+ * token, anything server-composed — for a caller no account stands for,
+ * and, best-effort, on a store fault (logged at ERROR with the caller's
+ * copy: the compose steps degrade, they never fail a create).
+ */
+async function runPersonOf(
+  personAccounts: AccountsByCaller,
+  caller: CallerIdentity,
+  logger: Logger,
+  faultMessage: string,
+): Promise<IdentityAccount | undefined> {
+  if (!isFirstPartyHumanOperator(caller)) {
+    return undefined;
+  }
+  try {
+    return await accountForCaller(personAccounts, caller);
+  } catch (error) {
+    logger.error(faultMessage, {
+      identityId: caller.identityId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // ComposeRecalledMemories — compose_recalled_memories_step.go.
 // ---------------------------------------------------------------------------
@@ -492,18 +558,25 @@ export function newComposeDeclaredPreferencesStep(
  * memory loop, sibling of ComposeDeclaredPreferences in every invariant:
  * server-owned (enabled=false stamped on every ineligible/degraded path),
  * best-effort (degrading to DISABLED, never enabled-with-zero-facts, so a
- * broken recall never falsely offers the remember tool). OSS gates on the
- * org flag alone with the empty-string subject sentinel; confirmed-only
+ * broken recall never falsely offers the remember tool); confirmed-only
  * (the consent gate is meaningless otherwise); no compose-time truncation
  * (the runner's retriever selects at prompt build, recorded on
  * status.recalled_memories_report). Facts order oldest-first on
- * created_at — identical prompt order in both editions. The Organization
- * is loaded independently of the preferences step: step independence over
- * one saved read.
+ * created_at — identical prompt order in every posture.
+ *
+ * WHOSE memories follows the posture (stigmer#1387, the Java step's
+ * gates in its order): where callers are persons (`personAccounts`) the
+ * run must be created by a first-party human operator (runPersonOf), the
+ * organization's memory_enabled must be on, then that person's own — and
+ * the snapshot is that person's confirmed facts in the organization. The
+ * single-operator posture gates on the org flag alone with the
+ * empty-string subject sentinel. The Organization is loaded independently
+ * of the preferences step: step independence over one saved read.
  */
 export function newComposeRecalledMemoriesStep(
   store: Store,
   logger: Logger,
+  personAccounts?: AccountsByCaller,
 ): PipelineStep<CreateDesc> {
   return {
     name: "ComposeRecalledMemories",
@@ -513,16 +586,21 @@ export function newComposeRecalledMemoriesStep(
       // Claim the server-owned field first.
       execution.spec.recalledMemories = create(RecalledMemoriesSchema);
 
-      let orgId = execution.metadata?.org ?? "";
-      if (orgId === "") {
-        orgId = ctx.input.metadata?.org ?? "";
-      }
+      const orgId = orgIdOf(ctx);
       if (orgId === "") {
         logger.debug(
           "No org on execution metadata, composing no recalled memories",
         );
         return;
       }
+      // Only a person's own run recalls (the Java gate order: the caller
+      // first, before any read).
+      if (
+        personAccounts !== undefined &&
+        !isFirstPartyHumanOperator(ctx.callerIdentity)
+      ) {
+        return;
+      }
 
       let org: Organization;
       try {
@@ -555,9 +633,27 @@ export function newComposeRecalledMemoriesStep(
         return;
       }
 
+      // The subject whose facts are recalled: the run's person, whose own
+      // switch must be on too, or the single-operator sentinel.
+      let subject = "";
+      if (personAccounts !== undefined) {
+        const person = await runPersonOf(
+          personAccounts,
+          ctx.callerIdentity,
+          logger,
+          "Failed to load the run's person for recalled memories - degrading to disabled (best-effort contract)",
+        );
+        if (person?.spec?.preferences?.memoryEnabled !== true) {
+          // A person who has not opted in is normal operation, not
+          // degradation; no log.
+          return;
+        }
+        subject = person.metadata?.id ?? "";
+      }
+
       let facts;
       try {
-        facts = await loadConfirmedFacts(store, orgId);
+        facts = await loadConfirmedFacts(store, orgId, subject);
       } catch (error) {
         // Enabled stays false: a broken recall must not offer the
         // remember tool (the enabled bit doubles as the tool signal).
@@ -582,13 +678,17 @@ export function newComposeRecalledMemoriesStep(
 }
 
 /**
- * Scans the memory kind for the OSS single-user subject's (the ""
- * sentinel) confirmed records in the org, oldest-first. Facts carry only
- * memory_id + content (the id is the transparency link back to the
- * addressable record). Undecodable rows are skipped — one bad record must
- * not take recall down.
+ * Scans the memory kind for `subject`'s confirmed records in the org,
+ * oldest-first — the run's person's account id, or the single-operator
+ * "" sentinel. Facts carry only memory_id + content (the id is the
+ * transparency link back to the addressable record). Undecodable rows are
+ * skipped — one bad record must not take recall down.
  */
-async function loadConfirmedFacts(store: Store, orgId: string) {
+async function loadConfirmedFacts(
+  store: Store,
+  orgId: string,
+  subject: string,
+) {
   const rows = await store.listResources(ApiResourceKind.memory);
   const memories: Memory[] = [];
   for (const data of rows) {
@@ -601,7 +701,7 @@ async function loadConfirmedFacts(store: Store, orgId: string) {
     if ((memory.metadata?.org ?? "") !== orgId) {
       continue;
     }
-    if ((memory.spec?.subjectIdentityAccountId ?? "") !== "") {
+    if ((memory.spec?.subjectIdentityAccountId ?? "") !== subject) {
       continue;
     }
     if (

package/src/domain/agentinstance/controller.ts

@@ -10,8 +10,14 @@
  * Proven by agentinstance.conformance.test.ts (CONFORMANCE_TARGET=local),
  * __tests__/agentinstance.test.ts and __tests__/store-faults.test.ts.
  *
- * Versus Stigmer Cloud, OSS excludes the CreateIamPolicies and Publish
- * steps. Deliberately NO same-org rule on create, unlike WorkflowInstance:
+ * Every chain opens with Authorize, and create asks
+ * can_create_agent_instance on the organization, then can_create_instance
+ * on the parent agent (AuthorizeResolvedTarget); create, delete and
+ * updateVisibility run the shared tuple-lifecycle steps against the
+ * composed lifecycle; getByAgent and list narrow through the composed list
+ * read scope (docs/authorization-coverage.md §7).
+ *
+ * Deliberately NO same-org rule on create, unlike WorkflowInstance:
  * an agent is a shareable blueprint, and one agent legitimately has
  * instances in several orgs (the marketplace case). What governs a
  * cross-org instance in both editions is the create lane's authorization