@stigmer/server 3.40.0 → 3.41.0

package/src/boot/compose.ts

@@ -33,12 +33,19 @@ import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_inf
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 
 import { newBuiltInAuthorizer } from "../authorization/authorizer.js";
-import { newLaneAdmittedAuthorizer } from "../authorization/lane-admission.js";
 import { newBuiltInListReadScope } from "../authorization/list-read-scope.js";
 import { newBuiltInOrganizationDirectory } from "../authorization/organization-directory.js";
-import { authorizationPostureOf } from "../authorization/posture.js";
+import { newBuiltInPolicyCheck } from "../authorization/policy-check.js";
+import { builtInModel } from "../authorization/model/index.js";
+import {
+  authorizationPostureOf,
+  kindsWithoutRows,
+} from "../authorization/posture.js";
+import { newStoreResourceCreators } from "../authorization/resource-creators.js";
 import { newBuiltInScheduleFireCaller } from "../authorization/schedule-fire-caller.js";
+import { newTrustedLocalAuthorizer } from "../authorization/trusted-local-authorizer.js";
 import type { Authorizer } from "../extensions/authorizer.js";
+import type { ComposedServices } from "../extensions/composed-services.js";
 import { ABSENT_LICENSE_STATUS } from "../extensions/license-status.js";
 import { relaxedEgressPolicy } from "../extensions/outbound-egress.js";
 import type { ListReadScope } from "../extensions/list-read-scope.js";
@@ -162,16 +169,14 @@ import {
   initRpcMetrics,
   metricsExportPosture,
 } from "../observability/rpc-metrics.js";
+import { kindEnumName } from "../pipeline/apiresource-meta.js";
+import { quoteJoin } from "../domain/mcpserver/enabledtools/enabledtools.js";
 import { buildInterceptorChain } from "../pipeline/chain.js";
 import { createVerifierChainInterceptor } from "../pipeline/interceptors/auth.js";
 import { operatorIdentitySnapshot } from "../pipeline/steps/defaults.js";
 import { createErrorBoundaryInterceptor } from "../pipeline/interceptors/error-boundary.js";
 import { createRequestMetricsInterceptor } from "../pipeline/interceptors/request-metrics.js";
-import { newPermissiveSingleTeamAuthorizer } from "../pipeline/steps/authorize.js";
-import {
-  isWorkflowBoundRunner,
-  newBuiltInRunnerCredentialProvider,
-} from "../runnerauth/built-in-runner-credential-provider.js";
+import { newBuiltInRunnerCredentialProvider } from "../runnerauth/built-in-runner-credential-provider.js";
 import { newExecutionScopedRunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import { newRunnerSubjectIdentityVerifier } from "../runnerauth/runner-subject-verifier.js";
 import { RunnerAuthService } from "../runnerauth/runnerauth.js";
@@ -185,7 +190,10 @@ import {
   resolveArtifactServeUrl,
 } from "./artifact-lane.js";
 import { resolveOAuthRedirectUri } from "./oauth-redirect-uri.js";
-import { assessSkillTransferOrigin } from "./skill-transfer-origin.js";
+import {
+  assessSkillTransferOrigin,
+  resolveSkillTransferBaseUrl,
+} from "./skill-transfer-origin.js";
 import type { ServerExtension } from "../extensions/registry.js";
 import { registerWorkflowServices } from "../domain/workflow/controller.js";
 import {
@@ -387,27 +395,40 @@ export async function composeServer(
   // authorizer, so the identity stage installs the built-in role
   // lifecycle and the membership rules under both; a composition with its
   // own Authorizer has its own onboarding and gets neither.
+  // An edition above open source serves many organizations; without the
+  // require-authentication posture a request carrying no credential would
+  // act as the laptop's one operator on every one of them. Refused at boot,
+  // before any side effect, whichever authorizer the composition runs.
+  if (!requireAuthentication && extensions.edition !== ServerEdition.oss) {
+    throw new Error(
+      `the composition serves edition '${ServerEdition[extensions.edition]}' without the require-authentication posture — an edition above open source must sign its callers in: declare requireAuthentication on a unit that registers a verifier, or configure STIGMER_OIDC_ISSUER`,
+    );
+  }
   const authorizationPosture = authorizationPostureOf({
     unitAuthorizer: extensions.authorizer !== undefined,
     requireAuthentication,
   });
   const builtInAuthorization = authorizationPosture !== "unit-authorizer";
   // The built-in authorizer evaluates the one model every edition reads,
-  // but it derives each resource's tuples from the rows in this server's
-  // store. A wider edition's kinds are served by extensions that keep
-  // their rows in stores of their own, which the built-in tuple source
-  // cannot read, so a composition that serves a wider edition must bring
-  // its own Authorizer rather than get answers derived from rows that are
-  // not there. Refused at boot, the same class as a misconfigured
-  // registry and the verifierless posture below: caught before any side
-  // effect.
-  if (
-    authorizationPosture === "built-in" &&
-    extensions.edition !== ServerEdition.oss
-  ) {
-    throw new Error(
-      `the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer — the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`,
-    );
+  // and derives each resource's tuples from its row. A wider edition's
+  // kinds are served by units that keep their rows in stores of their own,
+  // so each such unit registers a reader for its kinds
+  // (drivers.resourceRowReaders), and the built-in posture serves a wider
+  // edition only when every kind it serves has rows the derivation can
+  // read — never answers derived from rows that are not there. Refused at
+  // boot, the same class as a misconfigured registry and the verifierless
+  // posture below: caught before any side effect.
+  if (authorizationPosture === "built-in") {
+    const unreadable = kindsWithoutRows({
+      edition: extensions.edition,
+      model: builtInModel,
+      readers: extensions.drivers.resourceRowReaders,
+    });
+    if (unreadable.length > 0) {
+      throw new Error(
+        `the composition serves edition '${ServerEdition[extensions.edition]}' under the built-in authorizer but registers no row reader for ${quoteJoin(unreadable.map(kindEnumName))} — register a reader for each kind a unit serves (drivers.resourceRowReaders), or register an Authorizer`,
+      );
+    }
   }
 
   // Stage: identity accounts (20260911.11) — the first domain whose
@@ -442,6 +463,7 @@ export async function composeServer(
     newResourcePlatformClientStore(store);
   const iamPolicyGrantPath = newIamPolicyGrantPath({
     policies: iamPolicies,
+    creators: newStoreResourceCreators(store),
     lifecycle: extensions.drivers.resourceAuthorizationLifecycle,
     logger,
   });
@@ -496,15 +518,13 @@ export async function composeServer(
   // source's built-in provider (runnerauth/built-in-runner-credential-
   // provider.ts — the execution-scoped default plus the lineage-vouching,
   // memory-capture and exchange-gating capabilities an enforcing
-  // self-host needs, and the one reading of a runner's binding the
-  // Authorizer below admits a workflow-bound runner on); otherwise the
+  // self-host needs); otherwise the
   // execution-scoped default, byte-identical to the wiring this seam
   // replaced. Both open-source providers also mint the RUN credential the
   // two execution engines put on every dispatch (the engines below take
   // this object; runnerauth/dispatch-credential.ts) — a composed driver
   // that leaves that capability undefined dispatches without one, its
-  // runners being credentialed another way. Bound HERE, before the
-  // Authorizer, because the lane admission reads the binding.
+  // runners being credentialed another way.
   const runnerAuthService = RunnerAuthService.fromEnv();
   const runnerCredentials =
     extensions.drivers.runnerCredentialProvider ??
@@ -520,12 +540,15 @@ export async function composeServer(
   // controller as an explicit dependency; the Authorize step at position 1
   // of every chain calls it (O2). By posture: an extension's registration;
   // open source's built-in Authorizer (authorization/authorizer.ts — the
-  // cloud's model evaluated over the tuples the row would have had),
-  // decorated with the lane admission (authorization/lane-admission.ts) so
-  // a runner acting for a WORKFLOW execution passes the run gate on the
-  // child executions its `agent_call` creates — the parent workflow
-  // already passed its own, the cloud's `workflow_sandbox` posture; or
-  // the permissive single-team default. The organization directory and the
+  // cloud's model evaluated over the tuples the row would have had), which
+  // checks every caller on the run gate as the person it acts for: a
+  // runner acting for a workflow creates the workflow's child executions
+  // as the workflow's person, who must be able to view the agents the
+  // workflow calls (the runner's own read of each callee already asks
+  // that); or, trusted-local, open source's permissive driver
+  // (authorization/trusted-local-authorizer.ts), which separates no callers
+  // and answers only whether a named Organization exists, as the other two
+  // do (stigmer#1163). The organization directory and the
   // schedule fire caller are bound beside it under the same posture, so
   // `findMyOrganizations` lists what a person may view and a scheduled run
   // belongs to the person who scheduled it — a fire the internal lane
@@ -533,17 +556,15 @@ export async function composeServer(
   const authorizer: Authorizer =
     extensions.authorizer ??
     (authorizationPosture === "built-in"
-      ? newLaneAdmittedAuthorizer(
-          newBuiltInAuthorizer({
-            store,
-            policies: iamPolicies,
-            accounts: identityAccounts,
-            edition: extensions.edition,
-            logger,
-          }),
-          (caller) => isWorkflowBoundRunner(runnerAuthService, caller),
-        )
-      : newPermissiveSingleTeamAuthorizer());
+      ? newBuiltInAuthorizer({
+          store,
+          policies: iamPolicies,
+          accounts: identityAccounts,
+          rowReaders: extensions.drivers.resourceRowReaders,
+          edition: extensions.edition,
+          logger,
+        })
+      : newTrustedLocalAuthorizer({ store }));
   const organizationDirectory: OrganizationDirectory | undefined =
     extensions.drivers.organizationDirectory ??
     (authorizationPosture === "built-in"
@@ -551,6 +572,7 @@ export async function composeServer(
           store,
           policies: iamPolicies,
           accounts: identityAccounts,
+          rowReaders: extensions.drivers.resourceRowReaders,
         })
       : undefined);
   const scheduleFireCaller: ScheduleFireCallerMint | undefined =
@@ -573,6 +595,7 @@ export async function composeServer(
           store,
           policies: iamPolicies,
           accounts: identityAccounts,
+          rowReaders: extensions.drivers.resourceRowReaders,
           logger,
         })
       : undefined);
@@ -777,6 +800,7 @@ export async function composeServer(
     {
       config: {
         backendEndpoint: config.sandboxBackendEndpoint,
+        mcpPublicEndpoint: config.sandboxMcpPublicEndpoint,
         temporalAddress: config.sandboxTemporalAddress,
         temporalNamespace: config.temporalNamespace,
         temporalConnectionEnv: temporalConnectionEnv(config.temporalConnection),
@@ -1025,6 +1049,21 @@ export async function composeServer(
   // controllers cannot tell which. The slots are constructed on every
   // arm so the HTTP lane always has a registry to consult; on a bucket
   // arm nothing is ever reserved in it.
+  //
+  // Both URLs render from one base (boot/skill-transfer-origin.ts): the
+  // configured SKILL_TRANSFER_BASE_URL, or the unified port's loopback
+  // origin, read from the port the listener actually bound in start() when
+  // that port is ephemeral (stigmer#1386).
+  let unifiedBoundPort: number | undefined;
+  const skillTransferBase = resolveSkillTransferBaseUrl({
+    configured: config.skillTransferBaseUrl,
+    unifiedPort: options.portOverride ?? config.grpcPort,
+    boundPort: () => unifiedBoundPort,
+  });
+  const renderSkillTransferBase = (): string =>
+    typeof skillTransferBase === "function"
+      ? skillTransferBase()
+      : skillTransferBase;
   const skillUploadSlots = new UploadSlots(
     config.storagePath,
     STAGING_KEY_PREFIX,
@@ -1052,15 +1091,14 @@ export async function composeServer(
       // the very URL the lane dispatches.
       return new LocalArtifactStorage(
         config.storagePath,
-        transferServeUrl(config.skillTransferBaseUrl),
+        typeof skillTransferBase === "function"
+          ? () => transferServeUrl(skillTransferBase())
+          : transferServeUrl(skillTransferBase),
         {
           reserve: (key, declaredSizeBytes) => {
             const { ttlMs } = skillUploadSlots.reserve(key, declaredSizeBytes);
             return {
-              url: skillUploadUrl(
-                config.skillTransferBaseUrl,
-                uploadRefOf(key),
-              ),
+              url: skillUploadUrl(renderSkillTransferBase(), uploadRefOf(key)),
               ttlMs,
             };
           },
@@ -1107,7 +1145,7 @@ export async function composeServer(
   // inline push and every other RPC work, and a self-host behind a tunnel
   // it forgot to name deserves a pointer, not an outage.
   const transferOrigin = assessSkillTransferOrigin({
-    baseUrl: config.skillTransferBaseUrl,
+    configured: config.skillTransferBaseUrl,
     relaysThroughServer: skillType === "local",
     requireAuthentication,
   });
@@ -1222,14 +1260,17 @@ export async function composeServer(
     logger,
   });
   // The OAuth callback: configured, or derived from the served console's
-  // own origin when it serves one on a known port (boot/oauth-redirect-uri.ts
-  // carries the posture). Absent is WARN-degrade, not boot-fatal (Go
+  // own origin when it serves one — the public origin the skill transfer
+  // lane already renders on, else the known port's loopback
+  // (boot/oauth-redirect-uri.ts carries the posture; stigmer#1200). Absent
+  // is WARN-degrade, not boot-fatal (Go
   // server.go:722-729): every OAuth RPC except initiateOAuthConnect works
   // without the redirect URI, and initiate refuses with the pinned
   // FailedPrecondition copy.
   const oauthRedirect = resolveOAuthRedirectUri({
     configured: config.oauthRedirectUri,
     servesConsole: consoleAssets !== undefined,
+    publicOrigin: config.skillTransferBaseUrl,
     port: options.portOverride ?? config.grpcPort,
   });
   switch (oauthRedirect.kind) {
@@ -1240,6 +1281,7 @@ export async function composeServer(
         "STIGMER_OAUTH_REDIRECT_URI is not set — deriving the served console's callback for MCP server OAuth Connect",
         {
           redirectUri: oauthRedirect.uri,
+          from: oauthRedirect.from,
         },
       );
       break;
@@ -1467,6 +1509,7 @@ export async function composeServer(
       authorizer,
       secretService,
       authorizationLifecycle,
+      listReadScope,
     });
     // Schedule registers between channelapp and memory (Go server.go
     // 417 → 426 → 436). The clock and runner ride constant providers —
@@ -1499,6 +1542,7 @@ export async function composeServer(
       authorizationLifecycle,
       listReadScope,
       personAccounts,
+      visitorClassifier: extensions.drivers.visitorClassifier,
       runnerCredentialProvider: runnerCredentials,
       broker: agentExecutionStreamBroker,
       engineState: executionEngineState,
@@ -1612,6 +1656,7 @@ export async function composeServer(
         pendingOAuthStates: store.pendingOAuthStates,
         secretService,
         oauthRedirectUri,
+        sandboxLane,
         outboundFetch,
       },
     });
@@ -1696,10 +1741,12 @@ export async function composeServer(
   //     the issuer left a posture-declaring composition minting keys
   //     nothing verified.
   //   - the OIDC verifier rides the ISSUER alone: it is open source's
-  //     single-issuer lane, and a composition with verifiers of its own
-  //     names their issuers and audiences itself and declares the posture
-  //     instead — so the knob and the extension entries never both claim
-  //     one JWT.
+  //     operator lane, and it claims only tokens its issuer signed
+  //     (identity/oidc-verifier.ts), passing every other JWT on. So the
+  //     knob and a composition's own lanes for other issuers compose side
+  //     by side: the operator signs in through the knob, and a unit's lane
+  //     claims the tokens of the issuers it names. A unit lane must refuse
+  //     to route the operator's issuer (it is claimed here first).
   //   - both OSS verifiers resolve their subject through the identity-
   //     account domain (20260911.11 Q-IA-2, A6): a provisioned user is
   //     stamped with the account id whichever credential they present,
@@ -1712,11 +1759,13 @@ export async function composeServer(
   //     admits the bearer of the server's own execution-scoped runner
   //     token as the human whose run it is, which only means something
   //     when the server enforces who may report on a run. Its place in
-  //     the chain is the contract: BETWEEN `apikey` and `oidc`, because
-  //     the OIDC verifier claims any JWT-shaped token and throws on one
-  //     it cannot verify — composed after it, ours would never see its
-  //     own token, and every runner call would fail as the OIDC verifier's
-  //     fault (stigmer#1137). Until 2026-09-16 this comment read "the
+  //     the chain is the contract: BETWEEN `apikey` and `oidc`. Until
+  //     2026-09-29 the OIDC verifier claimed any JWT-shaped token and threw
+  //     on one it could not verify, so composed after it, ours never saw
+  //     its own token and every runner call failed as the OIDC verifier's
+  //     fault (stigmer#1137); it now claims only its own issuer's tokens,
+  //     and the server's own token is still claimed first, by its own
+  //     lane, whatever issuer an operator configures. Until 2026-09-16 this comment read "the
   //     runner's credential in either posture is an operator-minted API
   //     token via STIGMER_TOKEN — no runner-specific verifier"; that
   //     described a server whose Authorizer was permissive. The operator's
@@ -1845,6 +1894,32 @@ export async function composeServer(
     consoleLane,
   });
 
+  // The hand-over (extensions/composed-services.ts): every unit receives
+  // the composition's own instances — the one Authorizer the Authorize
+  // step calls, the list read scope, the policy check, the tuple lifecycle
+  // and the in-process transport — before composeServer returns, because a
+  // unit's lanes may be called by anyone from then on. The policy check is
+  // the registered engine's, or under the built-in posture the evaluator's.
+  const composedServices: ComposedServices = {
+    authorizer,
+    listReadScope,
+    authorizationQueries:
+      extensions.drivers.authorizationQueries ??
+      (authorizationPosture === "built-in"
+        ? newBuiltInPolicyCheck({
+            store,
+            policies: iamPolicies,
+            accounts: identityAccounts,
+            rowReaders: extensions.drivers.resourceRowReaders,
+          })
+        : undefined),
+    resourceAuthorizationLifecycle: authorizationLifecycle,
+    inProcessTransport: inProcessWiring.transport,
+  };
+  for (const { hook } of extensions.onComposed) {
+    hook(composedServices);
+  }
+
   return {
     healthState,
     store,
@@ -1858,6 +1933,20 @@ export async function composeServer(
     routes,
 
     async start(): Promise<number> {
+      // The units' own boot work first, in unit order, before any worker,
+      // reconciler or listener can reach their lanes: a repair of a unit's
+      // rows must finish before anything serves, and a failed one fails
+      // the start, naming its unit.
+      for (const { unit, hook } of extensions.start) {
+        try {
+          await hook();
+        } catch (error) {
+          throw new Error(
+            `extension '${unit}' failed to start: ${error instanceof Error ? error.message : String(error)}`,
+            { cause: error },
+          );
+        }
+      }
       // Temporal boot is NON-fatal end to end (Go server.go): a failed
       // initial connect leaves the engine unavailable and the monitor
       // retrying; a failed worker start is a warning. Health below flips
@@ -1935,6 +2024,10 @@ export async function composeServer(
         options.portOverride ?? config.grpcPort,
         options.host,
       );
+      // Recorded in the listen continuation, a microtask that runs before
+      // the first accepted connection is dispatched, so no wire request
+      // can mint a skill transfer URL before the port it names is known.
+      unifiedBoundPort = port;
       logger.info("stigmer-server listening", { port });
       return port;
     },

package/src/boot/config.ts

@@ -139,9 +139,11 @@ export interface ServerConfig {
    * The OAuth callback URL for the McpServer OAuth Connect flows
    * (STIGMER_OAUTH_REDIRECT_URI; Go config.go OAuthRedirectURI). Unset, a
    * server that serves the web console on its unified port derives the
-   * console's own callback page at `http://localhost:<port>` (the
-   * `trusted-local` reading; boot/oauth-redirect-uri.ts), so a local
-   * install signs in without being told. Unset on a server that serves no
+   * console's own callback page on the origin browsers reach it on:
+   * SKILL_TRANSFER_BASE_URL when set (the address a team install was told
+   * its clients use, stigmer#1200), else `http://localhost:<port>`
+   * (boot/oauth-redirect-uri.ts), so neither a team install nor a local one
+   * has to be told. Unset on a server that serves no
    * console is a WARN at wiring time, not a boot failure — every RPC except
    * initiateOAuthConnect works without it, and initiate refuses with a
    * FailedPrecondition naming the variable (the pinned copy).
@@ -168,10 +170,14 @@ export interface ServerConfig {
   readonly skillArtifactStorageType: string;
   /**
    * Externally-reachable base of the skill artifact transfer lane's
-   * capability URLs (#675). Defaults to the server's own port on
-   * localhost; SKILL_TRANSFER_BASE_URL overrides when the server is
-   * reached through a tunnel or reverse proxy (the ARTIFACT_LOCAL_SERVE_URL
-   * idiom, Go config.go:52-58).
+   * capability URLs (#675; SKILL_TRANSFER_BASE_URL), set when the server
+   * is reached through a tunnel or reverse proxy (the
+   * ARTIFACT_LOCAL_SERVE_URL idiom, Go config.go:52-58). "" = unset: the
+   * base is the server's own port on localhost, read from the port the
+   * unified listener actually binds (boot/skill-transfer-origin.ts), so a
+   * server on an ephemeral port mints URLs that reach it (stigmer#1386).
+   * It is the unified port's public origin, so the served console's MCP
+   * OAuth callback derives on it too (boot/oauth-redirect-uri.ts).
    */
   readonly skillTransferBaseUrl: string;
   /**
@@ -236,6 +242,15 @@ export interface ServerConfig {
    * container-based provisioner is selected; ignored on the default arm.
    */
   readonly sandboxBackendEndpoint: string;
+  /**
+   * The server's public address as a remote MCP server reaches it
+   * (STIGMER_SANDBOX_MCP_PUBLIC_ENDPOINT), handed to every provisioned
+   * sandbox's runner as STIGMER_MCP_PUBLIC_ENDPOINT
+   * (sandbox/provisioner.ts, SandboxDriverConfig.mcpPublicEndpoint).
+   * Optional: empty hands nothing, and remote servers that template
+   * STIGMER_SERVER_ADDRESS get no address.
+   */
+  readonly sandboxMcpPublicEndpoint: string;
   /**
    * Temporal address as reachable from inside a sandbox
    * (STIGMER_SANDBOX_TEMPORAL_ADDRESS). Defaults to TEMPORAL_HOST_PORT —
@@ -359,11 +374,7 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): ServerConfig {
     databaseUrl: envString(env, "DATABASE_URL", ""),
     storagePath: envString(env, "STORAGE_PATH", defaultStoragePath()),
     skillArtifactStorageType,
-    skillTransferBaseUrl: envString(
-      env,
-      "SKILL_TRANSFER_BASE_URL",
-      `http://localhost:${grpcPort}`,
-    ),
+    skillTransferBaseUrl: envString(env, "SKILL_TRANSFER_BASE_URL", ""),
     operatorEmail,
     operatorName,
     gitHubOAuthClientId: envString(
@@ -386,6 +397,11 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): ServerConfig {
       "STIGMER_SANDBOX_BACKEND_ENDPOINT",
       "",
     ),
+    sandboxMcpPublicEndpoint: envString(
+      env,
+      "STIGMER_SANDBOX_MCP_PUBLIC_ENDPOINT",
+      "",
+    ),
     sandboxTemporalAddress: envString(
       env,
       "STIGMER_SANDBOX_TEMPORAL_ADDRESS",

package/src/boot/inprocess.ts

@@ -80,6 +80,7 @@ import {
   createInProcessCallerInterceptor,
   encodeInProcessCaller,
   IN_PROCESS_CALLER_HEADER,
+  serverActingFor,
 } from "../pipeline/interceptors/auth.js";
 import type { CallerIdentity } from "../extensions/identity.js";
 import type { Logger } from "./logger.js";
@@ -340,13 +341,26 @@ export function createInProcessClients(
     },
     // The two HITL forwarding edges — Go's method-segregated
     // AgentExecutionApprovalClient / AgentExecutionFileDecisionClient,
-    // both satisfied by the in-process agentexecution controller.
+    // both satisfied by the in-process agentexecution controller. The
+    // forward runs as the SERVER acting for the workflow's authorized
+    // caller (serverActingFor, never asCaller(caller)): the child's
+    // Authorize keeps the internal skip it always had — the workflow chain
+    // already authorized the decision, and the person need not own the
+    // child's session — while the child's writer records that person as
+    // the decider (stigmer/stigmer#1385).
     workflowExecutionApprovalForwarder: {
-      submitApproval: (input) => agentExecutionCommand.submitApproval(input),
+      submitApproval: (input, caller) =>
+        agentExecutionCommand.submitApproval(
+          input,
+          asCaller(serverActingFor(caller.identityId)),
+        ),
     },
     workflowExecutionFileDecisionForwarder: {
-      submitFileDecision: (input) =>
-        agentExecutionCommand.submitFileDecision(input),
+      submitFileDecision: (input, caller) =>
+        agentExecutionCommand.submitFileDecision(
+          input,
+          asCaller(serverActingFor(caller.identityId)),
+        ),
     },
     // The schedule clock's fire edge — the plain Create RPC (Go's
     // ExecutionCreator). Since O2 every call through this transport

package/src/boot/list-indexes.ts

@@ -13,11 +13,15 @@
  * A kind also joins when a port read on every authorization check would
  * otherwise decode the whole kind: `iam_policy`, whose adapter reads a
  * person's rows by principal (measured 2026-09-24: about 4.6 microseconds
- * per row per read, 47 ms a check at ten thousand rows on sqlite).
+ * per row per read, 47 ms a check at ten thousand rows on sqlite). And a
+ * kind joins when the execution create path reads it: `memory`, whose
+ * recall reads one person's rows on every create in a memory-on
+ * organization (stigmer#1405).
  */
 import { agentExecutionListIndex } from "../domain/agentexecution/list-index.js";
 import { artifactListIndex } from "../domain/artifact/list-index.js";
 import { iamPolicyListIndex } from "../domain/iampolicy/list-index.js";
+import { memoryListIndex } from "../domain/memory/list-index.js";
 import { sessionListIndex } from "../domain/session/list-index.js";
 import { workflowExecutionListIndex } from "../domain/workflowexecution/list-index.js";
 import type { ListIndexDeclaration } from "../store/list-index.js";
@@ -26,6 +30,7 @@ export const LIST_INDEXES: ReadonlyArray<ListIndexDeclaration> = [
   agentExecutionListIndex,
   artifactListIndex,
   iamPolicyListIndex,
+  memoryListIndex,
   sessionListIndex,
   workflowExecutionListIndex,
 ];

package/src/boot/logger.ts

@@ -19,7 +19,9 @@
  * or not; the sink is called after the write, so a stderr fault skips the
  * export of that line rather than the reverse. This module stays free of
  * runtime dependencies on purpose: the SDK that turns an entry into a
- * record belongs to the deployable that chose a collector.
+ * record belongs to the deployable that chose a collector. The Temporal
+ * SDK's own lines ride the same seam: temporal/sdk-logger.ts installs this
+ * logger as the SDK's Runtime logger.
  *
  * The level tiering CONTRACT lives in the logging interceptor
  * (pipeline/interceptors/logging.ts) — this module only provides the