@stigmer/server 3.40.0 → 3.41.0

package/src/domain/agentexecution/create-steps.ts

@@ -11,7 +11,7 @@
  * resolves an agent-less blueprint. Nothing here resolves a stored default
  * agent into that shape.
  */
-import { create, fromBinary } from "@bufbuild/protobuf";
+import { create } from "@bufbuild/protobuf";
 
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
@@ -28,8 +28,6 @@ import {
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
 import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
-import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
-import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
 import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import type { SessionSpec } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
@@ -43,6 +41,7 @@ import { clone } from "@bufbuild/protobuf";
 import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import { isFirstPartyHumanOperator } from "../../extensions/identity.js";
+import type { VisitorClassifier } from "../../extensions/visitor-classifier.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { notifyDefaultInstanceLinked } from "../../pipeline/steps/authorization-tuples.js";
 import {
@@ -61,6 +60,7 @@ import type { Store } from "../../store/interface.js";
 import { buildDefaultInstanceRequest } from "../agentinstance/defaultinstance.js";
 import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import { accountForCaller } from "../identityaccount/resolve.js";
+import { listSubjectMemories } from "../memory/queries.js";
 
 import type { AgentExecutionStatusObserver } from "../../extensions/status-hooks.js";
 
@@ -424,24 +424,38 @@ export function newCreateSessionIfNeededStep(deps: {
  * Snapshots the declared standing context onto the execution spec
  * (DD-002, stigmer/stigmer#293). SERVER-OWNED: stamped unconditionally,
  * overwriting anything the caller supplied. Two independent halves:
- * org_context, the organization's, for every run; and user_context, the
- * run's person's own (stigmer#1397) — composed only where callers are
- * persons (`personAccounts`, the require-authentication posture) and only
- * for a first-party human operator (runPersonOf), as the Java step did.
- * The single-operator posture composes org_context alone: its one
- * operator's context is the organization's. The org half deliberately
- * keeps running for every lane (schedule and channel runs carry the
- * organization's instructions today); only the person's half is about a
- * person. BEST-EFFORT: an execution must never fail to start because its
+ *
+ *   - org_context, the organization's, for every run but a VISITOR's
+ *     (stigmer/stigmer#1401). Its admins wrote it for the organization's
+ *     own work, so the organization's own lanes keep it — a person, a
+ *     schedule, a workflow's agent_call, the platform's pipelines — and
+ *     a caller the composed classifier names a visitor (the hosted
+ *     edition's shared-agent guests and channel senders) never gets it;
+ *     the organization is not even read. Open source composes no
+ *     classifier and has no visitors. Not first-party-only like the
+ *     person's half: that would strip it from every schedule and
+ *     workflow run, and from the single operator, whose only standing
+ *     context this is.
+ *   - user_context, the run's person's own (stigmer#1397), composed only
+ *     where callers are persons (`personAccounts`, the
+ *     require-authentication posture) and only for a first-party human
+ *     operator (runPersonOf), as the Java step did. The single-operator
+ *     posture composes org_context alone: its one operator's context is
+ *     the organization's.
+ *
+ * BEST-EFFORT: an execution must never fail to start because its
  * optional preferences could not load — genuine failures log at ERROR
  * (quiet degradation of a should-work path must stay visible) and degrade
- * that half to empty. Snapshot-at-create is the point: preferences are
- * mutable, executions are immutable audit records.
+ * that half to empty; a classifier that throws withholds the org half,
+ * logged the same way (extensions/visitor-classifier.ts, fail-closed).
+ * Snapshot-at-create is the point: preferences are mutable, executions
+ * are immutable audit records.
  */
 export function newComposeDeclaredPreferencesStep(
   store: Store,
   logger: Logger,
   personAccounts?: AccountsByCaller,
+  visitorClassifier?: VisitorClassifier,
 ): PipelineStep<CreateDesc> {
   return {
     name: "ComposeDeclaredPreferences",
@@ -453,8 +467,15 @@ export function newComposeDeclaredPreferencesStep(
 
       // Verbatim per DD-002 D2: the server stamps content only;
       // blank-is-absent is the runner's read-side convention.
-      execution.spec.declaredPreferences.orgContext =
-        await loadOrgStandingContext(store, logger, orgIdOf(ctx));
+      if (isVisitor(visitorClassifier, ctx.callerIdentity, logger)) {
+        logger.debug(
+          "Caller is a visitor, composing no organization standing context",
+          { identityId: ctx.callerIdentity.identityId },
+        );
+      } else {
+        execution.spec.declaredPreferences.orgContext =
+          await loadOrgStandingContext(store, logger, orgIdOf(ctx));
+      }
 
       if (personAccounts === undefined) {
         return;
@@ -471,6 +492,32 @@ export function newComposeDeclaredPreferencesStep(
   };
 }
 
+/**
+ * Whether the composed classifier names `caller` a visitor: absent, nobody
+ * is; a throw is one, logged at ERROR (the point's fail-closed contract).
+ */
+function isVisitor(
+  classifier: VisitorClassifier | undefined,
+  caller: CallerIdentity,
+  logger: Logger,
+): boolean {
+  if (classifier === undefined) {
+    return false;
+  }
+  try {
+    return classifier.isVisitor(caller);
+  } catch (error) {
+    logger.error(
+      "Visitor classifier failed - composing no organization standing context (fail-closed contract)",
+      {
+        identityId: caller.identityId,
+        error: error instanceof Error ? error.message : String(error),
+      },
+    );
+    return true;
+  }
+}
+
 /** The org a create addresses: the execution's metadata, else the input's. */
 function orgIdOf(ctx: RequestContext<CreateDesc>): string {
   const orgId = ctx.newState.metadata?.org ?? "";
@@ -678,40 +725,23 @@ export function newComposeRecalledMemoriesStep(
 }
 
 /**
- * Scans the memory kind for `subject`'s confirmed records in the org,
- * oldest-first — the run's person's account id, or the single-operator
- * "" sentinel. Facts carry only memory_id + content (the id is the
- * transparency link back to the addressable record). Undecodable rows are
- * skipped — one bad record must not take recall down.
+ * Reads `subject`'s confirmed records in the org through the memory list
+ * index (domain/memory/queries.ts), oldest-first — the run's person's
+ * account id, or the single-operator "" sentinel. Facts carry only
+ * memory_id + content (the id is the transparency link back to the
+ * addressable record). Undecodable rows are skipped — one bad record must
+ * not take recall down.
  */
 async function loadConfirmedFacts(
   store: Store,
   orgId: string,
   subject: string,
 ) {
-  const rows = await store.listResources(ApiResourceKind.memory);
-  const memories: Memory[] = [];
-  for (const data of rows) {
-    let memory: Memory;
-    try {
-      memory = fromBinary(MemorySchema, data);
-    } catch {
-      continue;
-    }
-    if ((memory.metadata?.org ?? "") !== orgId) {
-      continue;
-    }
-    if ((memory.spec?.subjectIdentityAccountId ?? "") !== subject) {
-      continue;
-    }
-    if (
-      memory.status?.lifecycleState !==
-      MemoryLifecycleState.lifecycle_state_confirmed
-    ) {
-      continue;
-    }
-    memories.push(memory);
-  }
+  const memories = (await listSubjectMemories(store, orgId, subject)).filter(
+    (memory) =>
+      memory.status?.lifecycleState ===
+      MemoryLifecycleState.lifecycle_state_confirmed,
+  );
 
   // Oldest-first on created_at (seconds then nanos; untimestamped rows
   // first) — mirrors the cloud repo's ORDER BY created_at ASC.

package/src/domain/agentexecution/submit-approval.ts

@@ -223,10 +223,14 @@ export async function submitApproval(
         const action = ctx.input.action;
         const comment = ctx.input.comment;
         const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-        // Decider identity for the approval ledger. OSS is single-user
-        // with no multi-tenant auth context, so the principal is empty;
-        // the Cloud edition populates it from the authenticated caller.
-        const decidedBy = "";
+        // The decider is the principal this chain authorized at position
+        // 1 — the same id auditActorFor stamps as created_by.id, so the
+        // approval ledger and the audit trail name one person the same
+        // way in every edition (the trusted-local operator on a laptop,
+        // the account on a signed-in server; stigmer/stigmer#1385). A
+        // decision forwarded by a workflow arrives as the server acting
+        // for that workflow's caller, so the person is named there too.
+        const decidedBy = ctx.callerIdentity.identityId;
 
         let updated: AgentExecution;
         try {
@@ -385,8 +389,6 @@ export async function submitApproval(
       name: "BuildResponse",
       execute(ctx) {
         const execution = ctx.get(TARGET_RESOURCE_KEY) as AgentExecution;
-        // Audit log the approval decision (caller identity arrives with
-        // the cloud edition's auth context).
         const tc = findToolCallInExecution(execution, ctx.input.toolCallId);
         deps.logger.info("AUDIT: Approval decision submitted", {
           executionId: execution.metadata?.id ?? "",
@@ -394,6 +396,7 @@ export async function submitApproval(
           toolCallId: ctx.input.toolCallId,
           toolName: tc?.name ?? "unknown",
           action: protoName(ApprovalActionSchema, ctx.input.action),
+          decidedBy: ctx.callerIdentity.identityId,
           comment: ctx.input.comment,
         });
       },

package/src/domain/agentexecution/submit-file-decision.ts

@@ -173,10 +173,10 @@ export async function submitFileDecision(
         }
         const executionId = ctx.input.agentExecutionId;
         const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-        // OSS is single-user with no multi-tenant auth context, so the
-        // reviewer is empty; the Cloud edition populates reviewer_id from
-        // the authenticated caller.
-        const reviewerId = "";
+        // The reviewer is the principal this chain authorized, recorded
+        // exactly as the approval writer records its decider (see
+        // submit-approval.ts RecordApprovalDecision; stigmer/stigmer#1385).
+        const reviewerId = ctx.callerIdentity.identityId;
 
         let updated: AgentExecution;
         try {
@@ -310,6 +310,7 @@ export async function submitFileDecision(
           fileChangeId: ctx.input.fileChangeId,
           scope: enumToJson(FileDecisionScopeSchema, ctx.input.scope),
           action: enumToJson(FileDecisionActionSchema, ctx.input.action),
+          reviewerId: ctx.callerIdentity.identityId,
         });
       },
     })

package/src/domain/agentinstance/__tests__/agentinstance.test.ts

@@ -50,6 +50,7 @@ import {
   buildDefaultInstanceRequest,
   defaultInstanceSlug,
 } from "../defaultinstance.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -94,6 +95,7 @@ beforeAll(async () => {
   });
   const port = await server.start();
   transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+  await seedOrganizations(transport, [ORG]);
   agentCommand = createClient(AgentCommandController, transport);
   command = createClient(AgentInstanceCommandController, transport);
   query = createClient(AgentInstanceQueryController, transport);

package/src/domain/agentshare/__tests__/agentshare.test.ts

@@ -52,6 +52,7 @@ import {
   sameOrgInvariantMessage,
 } from "../constants.js";
 import { findShareByOrgAndSlug, sharingLinkTokenAllowed } from "../steps.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -96,6 +97,22 @@ beforeAll(async () => {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  // Every Organization a describe below writes into (each names its own).
+  await seedOrganizations(transport, [
+    "create-test-org",
+    "launchgate-test-org",
+    "update-test-org",
+    "profile-test-org",
+    "audience-test-org",
+    "rotate-test-org",
+    "apply-isolation-org",
+    "apply-sem-org",
+    "gba-bystander-org",
+    "gba-provider-org",
+    "gba-org",
+    "provider-org",
+    "consumer-org",
+  ]);
   shares = createClient(AgentShareCommandController, transport);
   query = createClient(AgentShareQueryController, transport);
   agents = createClient(AgentCommandController, transport);

package/src/domain/agentshare/__tests__/create-authorization.test.ts

@@ -1,10 +1,11 @@
 /**
  * Pins the create lane's two questions (steps.ts, resolveShareCreateTargets):
- * can_edit on the referenced agent, then can_create_agent_share on the
+ * can_manage_audience on the referenced agent, then can_create_agent_share on the
  * share's organization, in that order, each with its byte-pinned copy. A
  * share's agent lives in the share's organization (the resolve step refuses
  * anything else before this runs), so the two bars are one organization's:
- * sharing puts the agent in front of a wider audience (an editor's act) and
+ * sharing puts the agent in front of a wider audience (the owner's act, not
+ * an editor's) and
  * spends the organization's credits on the open internet (an admin's). A
  * missing referenced agent throws.
  */
@@ -46,10 +47,10 @@ function ctxFor(shareOrg: string, stash = true) {
 }
 
 describe("resolveShareCreateTargets", () => {
-  it("asks can_edit on the referenced agent, then can_create_agent_share on the share's organization", () => {
+  it("asks can_manage_audience on the referenced agent, then can_create_agent_share on the share's organization", () => {
     expect(resolveShareCreateTargets(ctxFor("publisher-org"))).toEqual([
       {
-        permission: IamPermission.can_edit,
+        permission: IamPermission.can_manage_audience,
         resourceKind: ApiResourceKind.agent,
         resourceId: "agt_01helper",
         deniedMessage: SHARE_AGENT_DENIED_MESSAGE,

package/src/domain/agentshare/steps.ts

@@ -86,9 +86,11 @@ export const SHARE_ORGANIZATION_DENIED_MESSAGE =
 
 /**
  * The create lane's authorization questions, for AuthorizeResolvedTarget
- * after ResolveShareDefaults, agent first: can_edit on the agent (sharing
- * puts it in front of a wider audience, an editor's act) and then
- * can_create_agent_share on the organization (a share spends the
+ * after ResolveShareDefaults, agent first: can_manage_audience on the
+ * agent (sharing puts it in front of a wider audience, so it decides who
+ * reaches the agent: the owner's act, never an editor's, who may change the
+ * definition but not its audience) and then can_create_agent_share on the
+ * organization (a share spends the
  * organization's credits on the open internet, an admin-level act). The
  * RPC is is_skip_authorization because the target is the referenced agent,
  * resolved from a slug, not a request field. The resolve step has already
@@ -104,7 +106,7 @@ export function resolveShareCreateTargets(
   }
   return [
     {
-      permission: IamPermission.can_edit,
+      permission: IamPermission.can_manage_audience,
       resourceKind: ApiResourceKind.agent,
       resourceId: agent.metadata?.id ?? "",
       deniedMessage: SHARE_AGENT_DENIED_MESSAGE,

package/src/domain/apikey/__tests__/verifier.test.ts

@@ -16,6 +16,15 @@
  * in, so what is pinned is the production pair; only the fault arm
  * substitutes a one-method lookup that rejects.
  *
+ * A key created before sign-in was turned on is refused by name
+ * (stigmer/stigmer#1169): its stamp is the trusted-local operator's email
+ * (or "system"), which names nobody once sign-in is on, so the verifier
+ * answers UNAUTHENTICATED with the sentence and the
+ * API_KEY_CREATED_BEFORE_SIGN_IN reason instead of admitting the email
+ * and letting every later check fail as "Permission denied". An issuer
+ * subject that merely looks like an email is still admitted idp-shaped,
+ * and an account-stamped key costs no extra read.
+ *
  * An accepted key's use lands on its own row (stigmer/stigmer#1255):
  * stamped on the first verify, left alone inside the resolution, moved
  * forward after it; a refused key records nothing; a stamp that cannot be
@@ -28,6 +37,7 @@ import path from "node:path";
 import { create } from "@bufbuild/protobuf";
 import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
 import { Code, ConnectError } from "@connectrpc/connect";
+import { ErrorInfoSchema } from "@stigmer/protos/google/rpc/error_details_pb";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -40,12 +50,17 @@ import type { Logger } from "../../../boot/logger.js";
 import { LAST_USED_RESOLUTION_MS } from "../../../identity/credential-use.js";
 import type { Store } from "../../../store/interface.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
-import { accountIdFor } from "../../identityaccount/constants.js";
+import {
+  accountIdFor,
+  localIdpIdFor,
+} from "../../identityaccount/constants.js";
 import type { AccountsBySubject } from "../../identityaccount/resolve.js";
 import { newResourceIdentityAccountStore } from "../../identityaccount/resource-store.js";
 import type { IdentityAccountStore } from "../../identityaccount/store.js";
 import { generateApiKeyPlaintext, hashApiKey } from "../keymaterial.js";
 import {
+  API_KEY_CREATED_BEFORE_SIGN_IN,
+  API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE,
   INVALID_TOKEN_MESSAGE,
   TOKEN_EXPIRED_MESSAGE,
   newApiKeyIdentityVerifier,
@@ -326,6 +341,63 @@ describe("creator stamp → account resolution (20260911.11 A6)", () => {
   });
 });
 
+describe("a key created before sign-in was turned on (stigmer/stigmer#1169)", () => {
+  /** The refusal a pre-sign-in key must answer: the code, the copy, the reason. */
+  function expectRefusedBeforeSignIn(error: unknown): true {
+    const refusal = ConnectError.from(error);
+    expect(refusal.code).toBe(Code.Unauthenticated);
+    expect(refusal.rawMessage).toBe(API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE);
+    const [info] = refusal.findDetails(ErrorInfoSchema);
+    expect(info?.reason).toBe(API_KEY_CREATED_BEFORE_SIGN_IN);
+    expect(info?.domain).toBe("stigmer.ai");
+    return true;
+  }
+
+  it("a key stamped with the configured operator's email is refused by name and records no use", async () => {
+    await provisionAccount(localIdpIdFor("laptop@example.com"), "laptop@example.com");
+    const { plaintext, id } = await seedKey({
+      ownerId: "laptop@example.com",
+      email: "laptop@example.com",
+    });
+
+    await expect(verifier().verify(plaintext)).rejects.toSatisfy(
+      expectRefusedBeforeSignIn,
+    );
+    expect((await storedKey(id)).status?.lastUsedAt).toBeUndefined();
+  });
+
+  it("a key stamped \"system\" by the unconfigured laptop is refused by name", async () => {
+    const { plaintext } = await seedKey({ ownerId: "system", email: "" });
+
+    await expect(verifier().verify(plaintext)).rejects.toSatisfy(
+      expectRefusedBeforeSignIn,
+    );
+  });
+
+  it("an unprovisioned issuer subject that looks like an email is still admitted idp-shaped", async () => {
+    const { plaintext } = await seedKey({ ownerId: "stranger@example.com" });
+
+    expect((await verifier().verify(plaintext))?.identityId).toBe(
+      "stranger@example.com",
+    );
+  });
+
+  it("an account-stamped key makes exactly the one read it made before", async () => {
+    const reads: string[] = [];
+    const counting: AccountsBySubject = {
+      findDirectByIdpId: async (idpId) => {
+        reads.push(idpId);
+        return accounts.findDirectByIdpId(idpId);
+      },
+    };
+    const owner = accountIdFor("auth0|steady");
+    const { plaintext } = await seedKey({ ownerId: owner });
+
+    expect((await verifier(counting).verify(plaintext))?.identityId).toBe(owner);
+    expect(reads).toEqual([owner]);
+  });
+});
+
 describe("last use (stigmer/stigmer#1255)", () => {
   it("an accepted key stamps its last use on its own row, once per resolution, forward after it", async () => {
     const { plaintext, id } = await seedKey();

package/src/domain/apikey/verifier.ts

@@ -34,6 +34,27 @@
  * actor the key recorded at minting. The credential checks run first, so
  * a revoked or expired key never reaches the account store.
  *
+ * One stamp names nobody by construction: the operator's from before
+ * sign-in was turned on (stigmer/stigmer#1169). A key created while the
+ * server trusted every caller carries the operator's email, or "system",
+ * and once sign-in is on the operator is a different account, derived
+ * from the issuer's subject. Carrying the key to either account was
+ * weighed and refused. Carried to the pre-sign-in account, it would be a
+ * live credential no signed-in person could see or revoke, since only a
+ * key's owner may. Carried to the signed-in account, a credential would
+ * change hands on an email match. So such a key is refused by name:
+ * UNAUTHENTICATED, API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE and the
+ * API_KEY_CREATED_BEFORE_SIGN_IN reason, which the CLI turns into the two
+ * commands that fix it. The alternative, admitting a bare email, made
+ * every later check fail as a misleading "Permission denied". The
+ * question is asked only of a stamp that resolved to nobody, through the
+ * identity-account domain's `isPreSignInOperatorStamp`, which makes no
+ * read for an account-id stamp. This verifier is composed only under an
+ * authentication posture (boot/compose.ts), so a server that trusts every
+ * caller never reaches the refusal. The reason is documented where a
+ * key's authentication is (apis/ai/stigmer/iam/apikey/v1/README.md): it
+ * can refuse any RPC, so no single RPC comment owns it.
+ *
  * An accepted key's use is then recorded on its status.last_used_at
  * (identity/credential-use.ts): at most once a resolution, judged from the
  * row this read already holds, written atomically through
@@ -55,8 +76,12 @@ import type {
   IdentityVerifier,
 } from "../../extensions/identity.js";
 import { recordCredentialUse } from "../../identity/credential-use.js";
+import { unauthenticatedWithReasonError } from "../../pipeline/errors.js";
 import type { Store } from "../../store/interface.js";
-import { identityIdForSubject } from "../identityaccount/resolve.js";
+import {
+  identityIdForSubject,
+  isPreSignInOperatorStamp,
+} from "../identityaccount/resolve.js";
 import type { AccountsBySubject } from "../identityaccount/resolve.js";
 import { hashApiKey, isApiKeyToken } from "./keymaterial.js";
 import { findApiKeyByHash } from "./lookup.js";
@@ -67,6 +92,16 @@ export const INVALID_TOKEN_MESSAGE = "invalid token";
 /** Java classifyAuthError's "expired" arm. */
 export const TOKEN_EXPIRED_MESSAGE = "token has expired";
 
+/**
+ * The ErrorInfo reason a key created before sign-in was turned on is
+ * refused with (stigmer/stigmer#1169). Wire contract, no metadata.
+ */
+export const API_KEY_CREATED_BEFORE_SIGN_IN = "API_KEY_CREATED_BEFORE_SIGN_IN";
+
+/** The copy of that refusal: what happened and what to do. */
+export const API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE =
+  "this API key was created before sign-in was turned on and no longer authenticates anyone; sign in and create a new key";
+
 export interface ApiKeyVerifierDeps {
   /** Where the keys live — the generic Store, by hash (lookup.ts). */
   readonly store: Store;
@@ -105,6 +140,15 @@ export function newApiKeyIdentityVerifier(
         throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
       }
       const identityId = await identityIdForSubject(accounts, owner.id);
+      if (
+        identityId === owner.id &&
+        (await isPreSignInOperatorStamp(accounts, owner.id))
+      ) {
+        throw unauthenticatedWithReasonError(
+          API_KEY_CREATED_BEFORE_SIGN_IN_MESSAGE,
+          { reason: API_KEY_CREATED_BEFORE_SIGN_IN },
+        );
+      }
       await recordKeyUse(store, logger, key, now);
       return {
         identityId,

package/src/domain/artifact/__tests__/artifact.test.ts

@@ -1,7 +1,8 @@
 /**
  * Pins the artifact domain against Go's artifact_controller_test.go —
- * through the real stack (composed server, native gRPC client, the port+1
- * file server on a pre-picked free port).
+ * through the real stack (composed server, native gRPC client, the file
+ * server on the ephemeral port it binds beside the server's, reached through
+ * the download URLs the server mints).
  *
  * The load-bearing pins the conformance suite CANNOT cover:
  *   - the 50MB domain cap → ResourceExhausted with Go's copy (sits behind
@@ -19,7 +20,6 @@
 import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { createHash } from "node:crypto";
-import net from "node:net";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -59,29 +59,13 @@ const silentLogger = createLogger({
 type CommandClient = Client<typeof ArtifactCommandController>;
 type QueryClient = Client<typeof ArtifactQueryController>;
 
-/** A free loopback port, picked ahead so the file server can pin it. */
-async function freePort(): Promise<number> {
-  return new Promise((resolve, reject) => {
-    const probe = net.createServer();
-    probe.once("error", reject);
-    probe.listen(0, "127.0.0.1", () => {
-      const address = probe.address();
-      const port =
-        address !== null && typeof address === "object" ? address.port : 0;
-      probe.close(() => resolve(port));
-    });
-  });
-}
-
 let server: ComposedServer;
 let command: CommandClient;
 let query: QueryClient;
 let dir: string;
-let artifactPort: number;
 
 beforeAll(async () => {
   dir = mkdtempSync(path.join(tmpdir(), "artifact-domain-test-"));
-  artifactPort = await freePort();
   vi.stubEnv("STIGMER_ENCRYPTION_KEY", Buffer.alloc(32, 3).toString("base64"));
   vi.stubEnv(
     "STIGMER_RUNNER_TOKEN_KEY",
@@ -96,7 +80,6 @@ beforeAll(async () => {
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
-      ARTIFACT_HTTP_PORT: String(artifactPort),
     }),
     logger: silentLogger,
     portOverride: 0,
@@ -397,14 +380,20 @@ describe("artifact domain — the local file-server lane", () => {
   });
 
   it("answers 404 for missing keys and refuses path traversal out of the root", async () => {
-    const missing = await fetch(`http://127.0.0.1:${artifactPort}/nope`);
+    // The lane binds an ephemeral port; a minted URL is how a caller learns
+    // its origin, so the probes below address the same listener.
+    const created = await command.create(artifactInput());
+    const download = await query.getDownloadUrl({
+      value: created.metadata!.id,
+    });
+    const lane = new URL(download.url).origin;
+
+    const missing = await fetch(`${lane}/nope`);
     expect(missing.status).toBe(404);
 
     // The SQLite db sits one level above the artifact root — a traversal
     // escape would serve it.
-    const traversal = await fetch(
-      `http://127.0.0.1:${artifactPort}/..%2Fstigmer.db`,
-    );
+    const traversal = await fetch(`${lane}/..%2Fstigmer.db`);
     expect(traversal.status).toBe(404);
   });
 });

package/src/domain/channelapp/__tests__/channelapp.test.ts

@@ -50,6 +50,7 @@ import {
   noExistingSecretMessage,
   plaintextRequiredMessage,
 } from "../constants.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -100,6 +101,12 @@ beforeAll(async () => {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [
+    ORG,
+    "some-other-org",
+    "acme-slack-queries",
+    "acme-wa-queries",
+  ]);
   command = createClient(ChannelAppCommandController, transport);
   query = createClient(ChannelAppQueryController, transport);
 });