@stigmer/server 3.40.0 → 3.41.0

package/src/domain/memory/steps.ts

@@ -12,12 +12,15 @@
  *
  * Deliberately NO search-extractor and NO index steps anywhere in this
  * domain: memory is not_search_indexed by design (privacy — content is
- * subject-only and must not surface in org-visible search).
+ * subject-only and must not surface in org-visible search). The list
+ * index the reads use (list-index.ts) is not search: the store keeps it
+ * beside the row, and it holds the org, the subject id and the creation
+ * instant, never content.
  *
  * Proven by memory.conformance.test.ts (CONFORMANCE_TARGET=local) and
  * __tests__/memory.test.ts.
  */
-import { create, equals, fromBinary, isMessage } from "@bufbuild/protobuf";
+import { create, equals, isMessage } from "@bufbuild/protobuf";
 import { timestampNow } from "@bufbuild/protobuf/wkt";
 import type { ConnectError } from "@connectrpc/connect";
 
@@ -48,11 +51,11 @@ import type { RequestContext } from "../../pipeline/request-context.js";
 import { isServerComposedRequest } from "../../extensions/identity.js";
 import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import {
+  assignServerId,
   generateId,
   setAuditFieldsForUpdate,
 } from "../../pipeline/steps/defaults.js";
 import { memoryCaptureCredentialOf } from "../../pipeline/steps/guard-memory-capture.js";
-import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import {
@@ -61,6 +64,7 @@ import {
 } from "../identityaccount/resolve.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
+import { listOrganizationMemories, listSubjectMemories } from "./queries.js";
 import {
   MAX_MEMORIES_PER_SUBJECT,
   MEMORY_ACCOUNT_DISABLED_MESSAGE,
@@ -80,11 +84,14 @@ export const LIST_RESULT_KEY = "listResult";
  *
  *  1. Requires metadata.org — memory records are org-scoped (DD-004), so
  *     the org can never be inferred.
- *  2. Mints metadata.id here (not in BuildNewState) when absent, so an
+ *  2. Mints metadata.id here (not in BuildNewState), always, so an
  *     unnamed record can default its name/slug from its own identity:
  *     memories are id-addressed records (the remember tool sends content
  *     only), and the platform's slug machinery requires a name. A
  *     client-supplied name still wins — the default only fills absence.
+ *     The id is claimed through `assignServerId`, so BuildNewState keeps
+ *     it; an id the request carried is replaced, as every create's is
+ *     (stigmer/stigmer#1266).
  *  3. Overwrites spec.subject_identity_account_id, server-derived and
  *     never client-supplied (DD-005 D2), by posture. Under the
  *     single-operator posture (no `personAccounts` composed) it is the
@@ -141,9 +148,7 @@ export function newResolveMemoryDefaultsStep(
         throw internalError(new Error("metadata is nil"), "metadata is nil");
       }
 
-      if (metadata.id === "") {
-        metadata.id = generateId("mem");
-      }
+      assignServerId(ctx, generateId("mem"));
       if (metadata.name === "" && metadata.slug === "") {
         metadata.name = metadata.id;
       }
@@ -349,10 +354,9 @@ export function newCheckMemoryEnablementStep(
 /**
  * CheckMemoryCap — Go checkMemoryCapStep: enforces the
  * per-subject-per-org record ceiling at create (DD-006 D5). Counted
- * across all lifecycle states. A full-scan count matches the store's
- * local/OSS posture at the kind's dozens-of-records scale (the schedule
- * list precedent); the cloud edition counts through an indexed
- * repository query.
+ * across all lifecycle states, from the subject's own rows in the org
+ * through the memory list index (queries.ts), so a capture never reads
+ * another person's or another organization's memories.
  */
 export function newCheckMemoryCapStep(
   store: Store,
@@ -364,28 +368,13 @@ export function newCheckMemoryCapStep(
       const org = newState.metadata?.org ?? "";
       const subject = newState.spec?.subjectIdentityAccountId ?? "";
 
-      let rows: Uint8Array[];
+      let count: number;
       try {
-        rows = await store.listResources(ApiResourceKind.memory);
+        count = (await listSubjectMemories(store, org, subject)).length;
       } catch (error) {
         throw internalError(error, "failed to count memories for cap check");
       }
 
-      let count = 0;
-      for (const bytes of rows) {
-        const existing = unmarshalMemory(bytes);
-        if (existing === undefined) {
-          continue;
-        }
-        if ((existing.metadata?.org ?? "") !== org) {
-          continue;
-        }
-        if ((existing.spec?.subjectIdentityAccountId ?? "") !== subject) {
-          continue;
-        }
-        count++;
-      }
-
       if (count >= MAX_MEMORIES_PER_SUBJECT) {
         throw failedPreconditionError(MEMORY_FULL_MESSAGE);
       }
@@ -643,12 +632,12 @@ export function newTransitionMemoryLifecycleStep(
 }
 
 /**
- * ListMemoriesByOrg — Go listMemoriesByOrgStep (list.go): loads all
- * memories and filters by org, sorted by created_at descending (newest
- * first) — the schedule list posture. Ordering is chronological only;
- * grouping pending proposals first is the console's presentation concern
- * (DD-005 D4), deliberately not an RPC parameter at the kind's
- * dozens-of-records scale.
+ * ListMemoriesByOrg — Go listMemoriesByOrgStep (list.go): reads the
+ * org's memories through the memory list index (queries.ts), created_at
+ * descending (newest first) — the index order, which the read scope
+ * keeps. Ordering is chronological only; grouping pending proposals first
+ * is the console's presentation concern (DD-005 D4), deliberately not an
+ * RPC parameter at the kind's dozens-of-records scale.
  */
 export function newListMemoriesByOrgStep(
   store: Store,
@@ -661,20 +650,13 @@ export function newListMemoriesByOrgStep(
     ): Promise<void> {
       const org = ctx.input.org;
 
-      let rows: Uint8Array[];
+      let orgMemories: Memory[];
       try {
-        rows = await store.listResources(ApiResourceKind.memory);
+        orgMemories = await listOrganizationMemories(store, org);
       } catch (error) {
         throw internalError(error, "failed to list memories");
       }
 
-      const decoded: Memory[] = [];
-      for (const bytes of rows) {
-        const memory = unmarshalMemory(bytes);
-        if (memory !== undefined) {
-          decoded.push(memory);
-        }
-      }
       // 20260830.01 census lane 11: the org equality serves the Java
       // handler's org arm in both editions and runs FIRST; the scope
       // narrows the org's rows last (the scope is the last per-row
@@ -683,17 +665,10 @@ export function newListMemoriesByOrgStep(
         listReadScope,
         ctx.callerIdentity,
         ApiResourceKind.memory,
-        decoded.filter((memory) => (memory.metadata?.org ?? "") === org),
+        orgMemories,
         "",
       );
 
-      memories.sort((a, b) =>
-        compareCreatedAtDesc(
-          a.status?.audit?.specAudit?.createdAt,
-          b.status?.audit?.specAudit?.createdAt,
-        ),
-      );
-
       ctx.set(
         LIST_RESULT_KEY,
         create(MemoryListSchema, {
@@ -704,15 +679,3 @@ export function newListMemoriesByOrgStep(
     },
   };
 }
-
-/**
- * Decodes a stored memory, skipping invalid entries (should not happen in
- * normal operation) — Go unmarshalMemory.
- */
-function unmarshalMemory(data: Uint8Array): Memory | undefined {
-  try {
-    return fromBinary(MemorySchema, data);
-  } catch {
-    return undefined;
-  }
-}

package/src/domain/oauthapp/__tests__/oauthapp.test.ts

@@ -53,6 +53,7 @@ import {
   deleteBlockedByMcpServerMessage,
 } from "../constants.js";
 import { resolveOAuthAppRef } from "../refresolution.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -94,6 +95,19 @@ async function startServer(env: Record<string, string>): Promise<TestServer> {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  // Not "stigmer" or "res-org-none": the ref-resolution cases need an org
+  // that does not exist here.
+  await seedOrganizations(transport, [
+    ORG,
+    "other-org",
+    "org-a",
+    "org-b",
+    "res-org-a",
+    "res-org-b",
+    "res-org-c",
+    "res-org-d",
+    "res-org-e",
+  ]);
   return {
     server,
     command: createClient(OAuthAppCommandController, transport),

package/src/domain/organization/__tests__/support.ts

@@ -0,0 +1,41 @@
+/**
+ * Test fixtures for the Organization domain, shared by every composed
+ * suite that writes into an Organization: `organizationInput` is the
+ * smallest create the chain accepts, and `seedOrganizations` creates each
+ * named Organization through the server's own create RPC, so the rows are
+ * exactly what a person's first create writes (the slug is the id,
+ * domain/organization/steps.ts).
+ *
+ * Why every such suite needs it: every org-scoped lane authorizes on the
+ * Organization it names, and under every posture a missing one answers
+ * NOT_FOUND before any other step (the trusted-local driver since
+ * stigmer#1163, authorization/trusted-local-authorizer.ts). A suite that
+ * writes under a slug nobody created is testing the phantom write that
+ * fix removed, so it seeds the slugs it uses in its `beforeAll`, once the
+ * server listens. A slug a test means to be absent is simply not seeded.
+ */
+import { createClient } from "@connectrpc/connect";
+import type { Transport } from "@connectrpc/connect";
+
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+
+/** The smallest Organization create: slug, name and description all `slug`. */
+export function organizationInput(slug: string) {
+  return {
+    apiVersion: "tenancy.stigmer.ai/v1",
+    kind: "Organization",
+    metadata: { name: slug, slug, org: "" },
+    spec: { description: slug },
+  };
+}
+
+/** Creates each Organization, in order, as the transport's caller. */
+export async function seedOrganizations(
+  transport: Transport,
+  slugs: ReadonlyArray<string>,
+): Promise<void> {
+  const organizations = createClient(OrganizationCommandController, transport);
+  for (const slug of slugs) {
+    await organizations.create(organizationInput(slug));
+  }
+}

package/src/domain/organization/steps.ts

@@ -174,6 +174,7 @@ export function newRevokeOrganizationPoliciesStep<Desc extends DescMessage>(
             kind: ApiResourceKind[ApiResourceKind.organization],
             id,
           }),
+          ctx.callerIdentity,
         );
       } catch (error) {
         throw internalError(

package/src/domain/platformclient/mint.ts

@@ -294,7 +294,7 @@ async function resolveOrProvisionAccount(
   }
 }
 
-/** The account under the subject, any mode; a store fault is INTERNAL, never "no account". */
+/** The account under the subject in any mode but federated; a store fault is INTERNAL, never "no account". */
 async function findAccount(
   deps: PlatformClientMintDeps,
   idpId: string,
@@ -390,7 +390,11 @@ async function grantAutoRole(
       ? DEFAULT_AUTO_GRANT_ROLE
       : configured;
   try {
-    await deps.grantPath.grant(organizationRole(accountId, role, org), actor);
+    await deps.grantPath.grant(
+      organizationRole(accountId, role, org),
+      actor,
+      "platform_client_grant",
+    );
   } catch (error) {
     deps.logger.error(
       "platform client auto-grant failed; nothing was provisioned",

package/src/domain/platformclient/verifier.ts

@@ -19,9 +19,12 @@
  * infrastructure fault it is, never as a revocation.
  *
  * Composed between `apikey` and `oidc`, only under an authentication
- * posture (compose.ts): the OIDC verifier claims every JWT-shaped token and
- * throws on one it cannot verify, so a platform token must be claimed
- * before it gets there (stigmer#1137's lesson).
+ * posture (compose.ts). Until 2026-09-29 the OIDC verifier claimed every
+ * JWT-shaped token and threw on one it could not verify, so a platform
+ * token had to be claimed before it got there (stigmer#1137's lesson); it
+ * now claims only its configured issuer's tokens, and the order is kept
+ * so a platform token is claimed by its own lane whatever issuer an
+ * operator configures.
  *
  * The identity is the account the token was minted for: `sub` IS the
  * account id (the mint signs it), so no account read is needed; class

package/src/domain/plugin/__tests__/plugin.test.ts

@@ -19,7 +19,6 @@
  * identical push refused before the slug is judged.
  */
 import { mkdtempSync, rmSync } from "node:fs";
-import net from "node:net";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -66,6 +65,7 @@ import {
   PLUGIN_VERSION_LABEL,
   SYSTEM_LABEL,
 } from "../../../pipeline/apiresource-labels.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -85,40 +85,31 @@ let mcpServers: Client<typeof McpServerCommandController>;
 let mcpServerQuery: Client<typeof McpServerQueryController>;
 let dir: string;
 
-async function reserveFreePort(): Promise<number> {
-  return new Promise((resolve, reject) => {
-    const probe = net.createServer();
-    probe.once("error", reject);
-    probe.listen(0, "127.0.0.1", () => {
-      const { port } = probe.address() as net.AddressInfo;
-      probe.close(() => resolve(port));
-    });
-  });
-}
-
 beforeAll(async () => {
   dir = mkdtempSync(path.join(tmpdir(), "plugin-domain-test-"));
-  const grpcPort = await reserveFreePort();
+  // An ephemeral port needs no reservation: the transfer lane mints its
+  // capability URLs for the port the listener actually binds
+  // (boot/skill-transfer-origin.ts, stigmer#1386), and the artifact lane
+  // binds ephemeral beside it (boot/artifact-lane.ts). A port probed and
+  // released first could be taken by another worker before the bind
+  // (stigmer#1353).
   server = await composeServer({
     config: loadConfig({
       STIGMER_MODEL_REGISTRY_REFRESH: "off",
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
-      GRPC_PORT: String(grpcPort),
-      // The reserved port is the unified one only; its +1 neighbour is not
-      // reserved, and a lane that cannot bind fails the boot (#1089), so
-      // the artifact lane binds ephemeral.
-      ARTIFACT_HTTP_PORT: "0",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STORAGE_PATH: path.join(dir, "storage"),
     }),
     logger: silentLogger,
+    portOverride: 0,
     host: "127.0.0.1",
   });
   const port = await server.start();
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [ORG]);
   plugins = createClient(PluginCommandController, transport);
   pluginQuery = createClient(PluginQueryController, transport);
   agents = createClient(AgentCommandController, transport);
@@ -786,7 +777,6 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
 
   beforeAll(async () => {
     enforcingDir = mkdtempSync(path.join(tmpdir(), "plugin-domain-enforcing-"));
-    const grpcPort = await reserveFreePort();
     const authorizer: Authorizer = {
       authorize(_caller, check) {
         if (check.permission === IamPermission.can_write_reserved_labels) {
@@ -804,16 +794,13 @@ describe("Plugin push under an authorizer that enforces reserved labels", () =>
       config: loadConfig({
         STIGMER_MODEL_REGISTRY_REFRESH: "off",
         TEMPORAL_HOST_PORT: "127.0.0.1:1",
-        GRPC_PORT: String(grpcPort),
-        // The reserved port is the unified one only; its +1 neighbour is not
-        // reserved, and a lane that cannot bind fails the boot (#1089), so
-        // the artifact lane binds ephemeral.
-        ARTIFACT_HTTP_PORT: "0",
         DB_PATH: path.join(enforcingDir, "stigmer.db"),
         ARTIFACT_LOCAL_BASE_PATH: path.join(enforcingDir, "artifacts"),
         STORAGE_PATH: path.join(enforcingDir, "storage"),
       }),
       logger: silentLogger,
+      // Ephemeral, as the composition above: no port is reserved ahead.
+      portOverride: 0,
       host: "127.0.0.1",
       extensions: [{ name: "reserved-labels-enforced", authorizer }],
     });

package/src/domain/plugin/push.ts

@@ -956,6 +956,7 @@ export function newPluginPushAuthorizationTuplesStep(
           kind: ctx.apiResourceKind,
           resourceId: plugin.metadata?.id ?? "",
           orgId: plugin.metadata?.org ?? "",
+          caller: ctx.callerIdentity,
           shapesToCreate,
           shapesToDelete,
         });

package/src/domain/schedule/__tests__/schedule.composed.test.ts

@@ -44,6 +44,7 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 import { TRIGGER_DISABLED_MESSAGE } from "../trigger.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -73,6 +74,7 @@ beforeAll(async () => {
   });
   const port = await server.start();
   transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+  await seedOrganizations(transport, ["acme", "other-org"]);
   command = createClient(ScheduleCommandController, transport);
   query = createClient(ScheduleQueryController, transport);
   agentCommand = createClient(AgentCommandController, transport);

package/src/domain/schedule/steps.ts

@@ -153,7 +153,9 @@ export const SCHEDULE_CREATE_DENIED_MESSAGE =
  * a slug, not a request field; and there is deliberately no organization
  * bar — a schedule is unattended spend on an agent, an editor's act, and
  * the same-org invariant the resolve step enforces already binds the
- * schedule's organization to the agent's (command.proto).
+ * schedule's organization to the agent's (command.proto). An editor, who
+ * maintains the definition, may run it on a clock: a schedule widens no
+ * one's access, and each fire re-checks its creator's can_execute.
  */
 export function resolveScheduleCreateTargets(
   ctx: RequestContext<typeof ScheduleSchema>,

package/src/domain/session/__tests__/session.test.ts

@@ -64,6 +64,7 @@ import {
   newConfigFromEnv,
 } from "../../agentexecution/temporal/config.js";
 import { newValidateExecutionTargetImmutabilityStep } from "../steps.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -107,6 +108,7 @@ beforeAll(async () => {
   });
   const port = await server.start();
   transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+  await seedOrganizations(transport, [ORG]);
   agentCommand = createClient(AgentCommandController, transport);
   command = createClient(SessionCommandController, transport);
   query = createClient(SessionQueryController, transport);

package/src/domain/skill/__tests__/skill.test.ts

@@ -12,7 +12,6 @@
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import http2 from "node:http2";
-import net from "node:net";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -31,6 +30,7 @@ import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -45,27 +45,12 @@ let query: QueryClient;
 let baseUrl: string;
 let dir: string;
 
-/**
- * Reserves a free port the way the CLI/conformance harness does: the
- * transfer lane mints capability URLs from CONFIG (base defaults to
- * http://localhost:{grpcPort}), so the server must boot with GRPC_PORT set
- * to its real port — a portOverride would leave minted URLs pointing at
- * the config default.
- */
-async function reserveFreePort(): Promise<number> {
-  return new Promise((resolve, reject) => {
-    const probe = net.createServer();
-    probe.once("error", reject);
-    probe.listen(0, "127.0.0.1", () => {
-      const { port } = probe.address() as net.AddressInfo;
-      probe.close(() => resolve(port));
-    });
-  });
-}
-
 beforeAll(async () => {
   dir = mkdtempSync(path.join(tmpdir(), "skill-domain-test-"));
-  const grpcPort = await reserveFreePort();
+  // An ephemeral port needs no reservation: the transfer lane mints its
+  // capability URLs for the port the listener actually binds
+  // (boot/skill-transfer-origin.ts, stigmer#1386), and the artifact lane
+  // binds ephemeral beside it (boot/artifact-lane.ts).
   server = await composeServer({
     config: loadConfig({
       STIGMER_MODEL_REGISTRY_REFRESH: "off",
@@ -73,21 +58,18 @@ beforeAll(async () => {
       // closed, so boots fail the non-fatal connect fast and can never touch
       // a live local Temporal (the conformance CRUD harness does the same).
       TEMPORAL_HOST_PORT: "127.0.0.1:1",
-      GRPC_PORT: String(grpcPort),
-      // The reserved port is the unified one only; its +1 neighbour is not
-      // reserved, and a lane that cannot bind fails the boot (#1089), so
-      // the artifact lane binds ephemeral.
-      ARTIFACT_HTTP_PORT: "0",
       DB_PATH: path.join(dir, "stigmer.db"),
       ARTIFACT_LOCAL_BASE_PATH: path.join(dir, "artifacts"),
       STORAGE_PATH: path.join(dir, "storage"),
     }),
     logger: silentLogger,
+    portOverride: 0,
     host: "127.0.0.1",
   });
   const port = await server.start();
   baseUrl = `http://127.0.0.1:${port}`;
   const transport: Transport = createGrpcTransport({ baseUrl });
+  await seedOrganizations(transport, [ORG, "other-org"]);
   command = createClient(SkillCommandController, transport);
   query = createClient(SkillQueryController, transport);
 });

package/src/domain/skill/push.ts

@@ -469,6 +469,7 @@ export function newSkillPushAuthorizationTuplesStep(
           kind: ctx.apiResourceKind,
           resourceId: skill.metadata?.id ?? "",
           orgId: skill.metadata?.org ?? "",
+          caller: ctx.callerIdentity,
           shapesToCreate,
           shapesToDelete,
         });

package/src/domain/workflow/__tests__/workflow.test.ts

@@ -46,6 +46,7 @@ import {
   SYSTEM_MANAGED_LABEL,
 } from "../../../pipeline/apiresource-labels.js";
 import { defaultWorkflowInstanceSlug } from "../../workflowinstance/defaultinstance.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -83,6 +84,7 @@ beforeAll(async () => {
   });
   const port = await server.start();
   transport = createGrpcTransport({ baseUrl: `http://127.0.0.1:${port}` });
+  await seedOrganizations(transport, [ORG, "other-org"]);
   command = createClient(WorkflowCommandController, transport);
   query = createClient(WorkflowQueryController, transport);
   instanceCommand = createClient(WorkflowInstanceCommandController, transport);

package/src/domain/workflow/registry/data/task-kind-registry.json

@@ -2325,6 +2325,10 @@
       "outputJsonSchema": {
         "description": "Reviewer response including selected outcome and form data.",
         "properties": {
+          "comment": {
+            "description": "Free-text comment the reviewer attached; absent when none was written, and on a timeout.",
+            "type": "string"
+          },
           "form_data": {
             "description": "Validated form response (when form_schema is configured).",
             "type": "object"
@@ -2338,8 +2342,30 @@
             "type": "string"
           },
           "reviewer": {
-            "description": "Identity of the user who responded.",
+            "description": "Identity-account id of the person who responded.",
             "type": "string"
+          },
+          "reviewer_actor": {
+            "description": "Display snapshot of the reviewer, taken when they responded.",
+            "properties": {
+              "avatar": {
+                "description": "Avatar URL; empty when unknown.",
+                "type": "string"
+              },
+              "display_name": {
+                "description": "Human-readable name; empty when unknown.",
+                "type": "string"
+              },
+              "email": {
+                "description": "Email address; empty when unknown.",
+                "type": "string"
+              },
+              "id": {
+                "description": "Identity-account id (the same value as reviewer).",
+                "type": "string"
+              }
+            },
+            "type": "object"
           }
         },
         "type": "object"