@stigmer/server 3.39.1-dev.20260928194002 → 3.40.1

package/src/domain/agentshare/controller.ts

@@ -13,10 +13,15 @@
  * cascade of same-org shares lives in the AGENT domain (ported with #6);
  * share delete itself cascades nothing.
  *
- * Authorization posture (OSS): single-user and local, so handlers perform
- * no authorization — a documented no-op, not a silent divergence. The
- * cloud edition enforces the same contracts via FGA plus app-level gates
- * for the anonymous resolution paths.
+ * Every chain opens with Authorize. create asks can_edit on the referenced
+ * agent, then can_create_agent_share (AuthorizeResolvedTarget); create and
+ * delete run the shared tuple-lifecycle steps against the composed
+ * lifecycle; getByReference authorizes the loaded share as `get` would;
+ * getByAgent and list narrow through the composed list read scope. The
+ * public share-link read skips the Authorizer through is_public, and the
+ * member read asks can_view on the organization before the share loads
+ * (AuthorizeMemberAudience). Per-RPC posture:
+ * docs/authorization-coverage.md §9.
  *
  * Proven by agentshare.conformance.test.ts (CONFORMANCE_TARGET=local),
  * __tests__/agentshare.test.ts and __tests__/store-faults.test.ts.
@@ -657,9 +662,9 @@ function newLoadSharesByAgentStep(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * List — org + labels filter (AND semantics), newest first. Versus Cloud,
- * OSS excludes authorization filtering AND pagination, exactly as Go's
- * list.go records.
+ * List — org + labels filter (AND semantics), newest first, narrowed to
+ * the caller's authorized rows by the composed list read scope.
+ * Unpaginated, exactly as Go's list.go records.
  */
 async function list(
   deps: AgentShareControllerDeps,

package/src/domain/artifact/file-server.ts

@@ -1,9 +1,12 @@
 /**
  * The artifact HTTP file server — ports the local-download lane from Go
  * pkg/server/server.go (artifactDownloadHandler + the boot block, lines
- * 849–926): a second listener on 127.0.0.1:ARTIFACT_HTTP_PORT (default
- * grpcPort+1), started only when artifact storage is LOCAL, serving
- * GET /<key> as the exact bytes LocalArtifactStorage wrote. The lane
+ * 849–926): a second listener on 127.0.0.1:ARTIFACT_HTTP_PORT (unset: the
+ * unified port + 1, ephemeral beside an ephemeral unified port — the rule is
+ * boot/artifact-lane.ts), started only when artifact storage is LOCAL,
+ * serving GET /<key> as the exact bytes LocalArtifactStorage wrote. Unlike
+ * Go, a bind failure fails the boot: the composition binds the lane before
+ * SERVING and lets listen()'s rejection stand (stigmer#1089). The lane
  * dissolved into its owning domain per the ratified D4 decision — it is
  * NOT a unified-port lane (Go runs it as a separate listener, and so does
  * this port).
@@ -39,7 +42,8 @@ export interface ArtifactFileServerOptions {
 
 export interface ArtifactFileServer {
   /**
-   * Binds <host>:<port> (an explicit port 0 picks ephemeral for tests).
+   * Binds <host>:<port> (port 0 picks ephemeral) and resolves the port it
+   * bound; a bind failure rejects, and the composition fails the boot on it.
    * The host is the composition root's call: 127.0.0.1 everywhere by
    * default (ARTIFACT_HTTP_HOST, DD-013) — download URLs are minted for
    * the local machine — and 0.0.0.0 only inside the official container

package/src/domain/channelapp/controller.ts

@@ -14,9 +14,15 @@
  * not_search_indexed — configuration reached through its parent surface,
  * not a library artifact), so no index steps appear in any chain.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (single-user local posture); validation, secret handling,
- * and the referential delete block are byte-compatible.
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded app exactly as `get` would
+ * (AuthorizeResolvedTarget). listByOrg narrows the organization's apps
+ * through the composed list read scope to the ones a `get` would return:
+ * the model shows a channel app to its owners, explicit grants and the
+ * organization's admins, never to plain members or viewers
+ * (fga/model/agentic/channel_app.fga, stigmer/stigmer#1384). Per-RPC
+ * posture: docs/authorization-coverage.md §13.
  *
  * Proven by channelapp.conformance.test.ts (CONFORMANCE_TARGET=local)
  * and __tests__/channelapp.test.ts.
@@ -42,6 +48,8 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
@@ -106,6 +114,8 @@ export interface ChannelAppControllerDeps {
   /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   readonly secretService: SecretService;
+  /** The composed list read scope — listByOrg narrows through it; undefined = the OSS full scan (stigmer/stigmer#1384). */
+  readonly listReadScope: ListReadScope | undefined;
 }
 
 /** Registers both channelapp services on the router (routes stage). */
@@ -389,8 +399,8 @@ async function getByReference(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * ListByOrg — all ChannelApps of an organization, newest-first, every
- * entry redacted. No pagination — the set is small by nature (typically
+ * ListByOrg — the ChannelApps of an organization the caller may view,
+ * newest-first, every entry redacted. No pagination — the set is small by nature (typically
  * one app per provider per org), the OAuthApp listByOrg posture.
  */
 async function listByOrg(
@@ -415,7 +425,7 @@ async function listByOrg(
       ),
     )
     .addStep(newValidateProtoStep())
-    .addStep(newListByOrgStep(deps.store, deps.logger))
+    .addStep(newListByOrgStep(deps.store, deps.listReadScope, deps.logger))
     .build()
     .execute(reqCtx);
 
@@ -431,12 +441,19 @@ async function listByOrg(
 
 /**
  * ListByOrg — Go list_by_org.go's domain step: full scan, malformed rows
- * skipped with a warning, org equality filter, per-item redaction, sorted
- * by spec-audit created_at descending (seconds then nanos; timestamped
- * entries before untimestamped ones).
+ * skipped with a warning, org equality filter, narrowed to the caller's
+ * apps, per-item redaction, sorted by spec-audit created_at descending
+ * (seconds then nanos; timestamped entries before untimestamped ones).
+ * The org predicate stays the step's own because with no scope composed
+ * the helper returns its input unchanged and never reads the org (the
+ * trusted-local full scan); with one, the scope is the last per-row
+ * predicate, so a composed driver is asked about the org's apps, never
+ * every tenant's, and only the kept apps are redacted (the OAuthApp
+ * list's order).
  */
 function newListByOrgStep(
   store: Store,
+  listReadScope: ListReadScope | undefined,
   logger: Logger,
 ): PipelineStep<typeof ChannelAppQueryController.method.listByOrg.input> {
   return {
@@ -455,7 +472,7 @@ function newListByOrgStep(
         throw internalError(error, "failed to list ChannelApps");
       }
 
-      const apps: ChannelApp[] = [];
+      const requested: ChannelApp[] = [];
       for (const bytes of rows) {
         let app: ChannelApp;
         try {
@@ -467,8 +484,18 @@ function newListByOrgStep(
         if ((app.metadata?.org ?? "") !== org) {
           continue;
         }
+        requested.push(app);
+      }
+
+      const apps = await restrictListByReadScope(
+        listReadScope,
+        ctx.callerIdentity,
+        ApiResourceKind.channel_app,
+        requested,
+        "",
+      );
+      for (const app of apps) {
         redactChannelApp(app);
-        apps.push(app);
       }
 
       apps.sort((a, b) =>

package/src/domain/environment/controller.ts

@@ -11,11 +11,14 @@
  * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local),
  * __tests__/environment.test.ts and __tests__/store-faults.test.ts.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * FGA-tuple, and Publish steps (no multi-tenant auth, IAM/FGA, or event
- * publishing here); the visibility ceiling (org — secrets never resolve
- * across the org boundary) and share restrictions run in BOTH editions
- * from the same proto config, keeping the error contract identical.
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference loads, then authorizes the loaded environment exactly as
+ * `get` would (AuthorizeResolvedTarget); list narrows through the composed
+ * list read scope. The visibility ceiling (org — secrets never resolve
+ * across the org boundary) and share restrictions come from the same proto
+ * config in every edition, keeping the error contract identical. Per-RPC
+ * posture: docs/authorization-coverage.md §3.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, fromBinary } from "@bufbuild/protobuf";
@@ -734,9 +737,9 @@ async function getSecretValue(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * List — org + labels filter with per-item redaction. Versus Cloud, OSS
- * excludes authorization filtering AND pagination (returns all matches),
- * exactly as Go's list.go records.
+ * List — org + labels filter with per-item redaction, narrowed to the
+ * caller's authorized rows by the composed list read scope. Unpaginated
+ * (returns all matches), exactly as Go's list.go records.
  */
 async function list(
   deps: EnvironmentControllerDeps,

package/src/domain/executioncontext/controller.ts

@@ -25,10 +25,13 @@
  * (the decrypt-lane matrix conformance deliberately never exercises —
  * its harness authenticates as a user).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing
- * here); the redaction and decrypt-lane contracts run in BOTH editions,
- * keeping the error contract identical.
+ * Every chain opens with Authorize; create asks can_create_execution_in on
+ * the organization (AuthorizeCreate), and create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded context exactly as `get` would
+ * (AuthorizeResolvedTarget). The redaction and decrypt-lane contracts are
+ * the same in every edition, keeping the error contract identical. Per-RPC
+ * posture: docs/authorization-coverage.md §5.
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 

package/src/domain/mcpserver/controller.ts

@@ -19,8 +19,12 @@
  * managed-env wiring is a disclosed, deliberately unpinned composition
  * artifact).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing).
+ * Every chain opens with Authorize; create, delete and updateVisibility run
+ * the shared tuple-lifecycle steps against the composed lifecycle;
+ * getByReference loads, then authorizes the loaded server exactly as `get`
+ * would (AuthorizeResolvedTarget). The connect/OAuth handlers evaluate
+ * their annotation through authorizeDirect, after the load where they load
+ * (#224). Per-RPC posture: docs/authorization-coverage.md §20.
  *
  * Proven by mcpserver.conformance.test.ts +
  * agent-mcpserver-references.conformance.test.ts +

package/src/domain/memory/__tests__/capture-credential.test.ts

@@ -42,7 +42,7 @@ function memoryCtx(spec: {
 }
 
 describe("ResolveMemoryDefaults with an admitted capture credential", () => {
-  it("writes the proved subject and overrides provenance.session_id", () => {
+  it("writes the proved subject and overrides provenance.session_id", async () => {
     const ctx = memoryCtx({
       provenance: {
         sessionId: "ses_runner_reported",
@@ -54,7 +54,7 @@ describe("ResolveMemoryDefaults with an admitted capture credential", () => {
       subjectIdentityAccountId: "ida_human",
       provedSessionId: "ses_proved",
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("ida_human");
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
     // The threaded agent id survives; the forged tool_call_id never does.
@@ -62,21 +62,21 @@ describe("ResolveMemoryDefaults with an admitted capture credential", () => {
     expect(ctx.newState.spec?.provenance?.toolCallId).toBe("");
   });
 
-  it("creates provenance when the request supplied none", () => {
+  it("creates provenance when the request supplied none", async () => {
     const ctx = memoryCtx({});
     ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
       subjectIdentityAccountId: "ida_human",
       provedSessionId: "ses_proved",
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_proved");
   });
 
-  it("without the handoff the OSS arms stand", () => {
+  it("without the handoff the OSS arms stand", async () => {
     const ctx = memoryCtx({
       provenance: { sessionId: "ses_supplied", toolCallId: "forged" },
     });
-    newResolveMemoryDefaultsStep().execute(ctx);
+    await newResolveMemoryDefaultsStep().execute(ctx);
     expect(ctx.newState.spec?.subjectIdentityAccountId).toBe("");
     expect(ctx.newState.spec?.provenance?.sessionId).toBe("ses_supplied");
     expect(ctx.newState.spec?.provenance?.toolCallId).toBe("");

package/src/domain/memory/__tests__/person-consent-composed.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Pins memory's double opt-in and its subject at the composition root
+ * (stigmer#1387), over a real boot under the BUILT-IN posture (a unit that
+ * declares require-authentication and registers no Authorizer — the
+ * open-source self-host with sign-in), with two signed-in people on the
+ * wire:
+ *
+ *   - Carol founds an organization with memory on. With her own switch
+ *     still off (the default), her capture is refused with the account
+ *     copy — before this fix it was stored, filed under nobody.
+ *   - Once she turns her own switch on, her capture is filed under HER
+ *     account id, she can read and confirm it (the model's subject tuple
+ *     names her), and Dave, a member of the same organization, can
+ *     neither read it nor see it listed: memory is subject-only.
+ *   - Dave, whose own switch is off, is refused exactly as Carol was.
+ *
+ * Recall is not driven here: an execution create needs an engine, and the
+ * recall step runs after the engine check. Its gates are pinned
+ * step-for-step in domain/agentexecution/__tests__/create-steps.test.ts,
+ * over the same identity-account reads this boot composes.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { clone, create } from "@bufbuild/protobuf";
+import { Code, ConnectError, createClient } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryCommandController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/command_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { MemoryQueryController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/query_pb";
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import {
+  IdentityAccountPreferencesSchema,
+  IdentityAccountSpecSchema,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import type { ServerExtension } from "../../../extensions/registry.js";
+import {
+  baseConfig,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "../../../extensions/__tests__/composed-support.js";
+import { MEMORY_ACCOUNT_DISABLED_MESSAGE } from "../constants.js";
+
+const CAROL = "fake|carol";
+const DAVE = "fake|dave";
+const ORG = "memory-person-org";
+
+async function failureOf(promise: Promise<unknown>): Promise<ConnectError> {
+  try {
+    await promise;
+  } catch (error) {
+    expect(error).toBeInstanceOf(ConnectError);
+    return error as ConnectError;
+  }
+  throw new Error("expected the call to fail");
+}
+
+function memoryInput(content: string) {
+  return create(MemorySchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "Memory",
+    metadata: { org: ORG },
+    spec: { content },
+  });
+}
+
+describe("memory where callers are persons (built-in posture, composed server)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+  let carolAccount: IdentityAccount;
+
+  const asCarol = () => transportFor(port, fakeJwt(CAROL, "carol@example.com"));
+  const asDave = () => transportFor(port, fakeJwt(DAVE, "dave@example.com"));
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "memory-person-consent-composed-"));
+    const unit: ServerExtension = {
+      name: "fake-oidc-only",
+      requireAuthentication: true,
+      identityVerifiers: [fakeVerifier],
+    };
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+
+    // Carol provisions and founds the organization with memory on; Dave
+    // provisions afterwards and is a member of it (the membership rules
+    // run at a person's first provisioning).
+    carolAccount = await createClient(
+      IdentityAccountCommandController,
+      asCarol(),
+    ).provisionMyAccount({});
+    await createClient(OrganizationCommandController, asCarol()).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: ORG, preferences: { memoryEnabled: true } },
+    });
+    await createClient(
+      IdentityAccountCommandController,
+      asDave(),
+    ).provisionMyAccount({});
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("refuses a person whose own switch is off, with the account's copy", async () => {
+    const failure = await failureOf(
+      createClient(MemoryCommandController, asCarol()).create(
+        memoryInput("Carol prefers OpenTofu."),
+      ),
+    );
+    expect(failure.code).toBe(Code.FailedPrecondition);
+    expect(failure.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+
+  it("files the fact under the person once they opt in, and it stays theirs alone", async () => {
+    const carolId = carolAccount.metadata?.id ?? "";
+    expect(carolId).not.toBe("");
+    const optedIn = clone(IdentityAccountSchema, carolAccount);
+    optedIn.spec ??= create(IdentityAccountSpecSchema);
+    optedIn.spec.preferences ??= create(IdentityAccountPreferencesSchema);
+    optedIn.spec.preferences.memoryEnabled = true;
+    await createClient(IdentityAccountCommandController, asCarol()).update(
+      optedIn,
+    );
+
+    const carolMemories = createClient(MemoryCommandController, asCarol());
+    const created = await carolMemories.create(
+      memoryInput("Carol prefers OpenTofu."),
+    );
+    const memoryId = created.metadata?.id ?? "";
+    expect(created.spec?.subjectIdentityAccountId).toBe(carolId);
+
+    // The subject tuple names Carol: she decides on her own memory.
+    const confirmed = await carolMemories.confirm({ value: memoryId });
+    expect(confirmed.status?.lifecycleState).toBe(
+      MemoryLifecycleState.lifecycle_state_confirmed,
+    );
+    const carolReads = createClient(MemoryQueryController, asCarol());
+    expect((await carolReads.get({ value: memoryId })).metadata?.id).toBe(
+      memoryId,
+    );
+    expect(
+      (await carolReads.list({ org: ORG })).items.map((m) => m.metadata?.id),
+    ).toContain(memoryId);
+
+    // Dave shares the organization, not the memory.
+    const daveReads = createClient(MemoryQueryController, asDave());
+    const failure = await failureOf(daveReads.get({ value: memoryId }));
+    expect(failure.code).toBe(Code.PermissionDenied);
+    expect(
+      (await daveReads.list({ org: ORG })).items.map((m) => m.metadata?.id),
+    ).not.toContain(memoryId);
+  });
+
+  it("refuses the second person exactly as the first, while their switch is off", async () => {
+    const failure = await failureOf(
+      createClient(MemoryCommandController, asDave()).create(
+        memoryInput("Dave deploys on Fridays."),
+      ),
+    );
+    expect(failure.code).toBe(Code.FailedPrecondition);
+    expect(failure.rawMessage).toBe(MEMORY_ACCOUNT_DISABLED_MESSAGE);
+  });
+});