@stigmer/server 3.40.0 → 3.41.0

package/src/domain/workflowexecution/__tests__/forward-attribution-composed.test.ts

@@ -0,0 +1,270 @@
+/**
+ * Pins who a workflow-forwarded HITL decision names (stigmer#1385), over a
+ * real boot: a composition verifier and no require-authentication, so the
+ * posture stays trusted-local while a presented token is a signed-in
+ * person. One boot then holds both identities the forward could carry:
+ *
+ *   - Erin decides through the workflow with her token. The workflow chain
+ *     forwards over the in-process transport as the server acting for her,
+ *     so the child agent execution records HER as the approver and the
+ *     file reviewer — not the in-process default, which is the
+ *     trusted-local operator and is what every forward named before this
+ *     fix (the workflow API promises the caller identity propagates).
+ *   - A tokenless decision on an agent run directly is the laptop's
+ *     operator, recorded as its audit actor is (the trusted-local arm).
+ *
+ * The child's authorization is not re-run as Erin — the forward stays the
+ * server's own act — so the seeded child needs no session she owns. The
+ * direct-call arms (every action, APPROVE_ALL's co-pending calls, both
+ * file-decision scopes) are pinned in
+ * domain/agentexecution/__tests__/agentexecution.test.ts.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { create } from "@bufbuild/protobuf";
+import type { MessageInitShape } from "@bufbuild/protobuf";
+import { createClient } from "@connectrpc/connect";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type {
+  AgentExecution,
+  AgentExecutionStatusSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
+import {
+  ApprovalAction,
+  ExecutionPhase as AgentExecutionPhase,
+  FileDecisionAction,
+  FileDecisionScope,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import {
+  WorkflowExecutionSchema,
+  WorkflowPendingApprovalSchema,
+  WorkflowPendingFileReviewSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import type { WorkflowExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { WorkflowExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/command_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { loadConfig } from "../../../boot/config.js";
+import { composeServer } from "../../../boot/compose.js";
+import type { ComposedServer } from "../../../boot/compose.js";
+import type { ServerExtension } from "../../../extensions/registry.js";
+import {
+  baseConfig,
+  fakeJwt,
+  fakeVerifier,
+  silentLogger,
+  transportFor,
+} from "../../../extensions/__tests__/composed-support.js";
+import { trustedLocalIdentity } from "../../../pipeline/interceptors/auth.js";
+import { fileReviewSeed } from "../../agentexecution/__tests__/file-review-seed.js";
+
+const ERIN = "fake|erin";
+const ORG = "forward-attribution-org";
+
+describe("a workflow-forwarded decision names the person who made it (composed server)", () => {
+  let dir: string;
+  let server: ComposedServer;
+  let port: number;
+  let counter = 0;
+
+  const asErin = () =>
+    createClient(
+      WorkflowExecutionCommandController,
+      transportFor(port, fakeJwt(ERIN, "erin@example.com")),
+    );
+
+  beforeAll(async () => {
+    dir = mkdtempSync(path.join(tmpdir(), "wfexec-forward-attribution-"));
+    // A verifier and nothing else: no require-authentication and no
+    // Authorizer, so the posture is trusted-local and tokenless requests
+    // still reach the laptop's operator.
+    const unit: ServerExtension = {
+      name: "fake-verifier-only",
+      identityVerifiers: [fakeVerifier],
+    };
+    server = await composeServer({
+      config: loadConfig(baseConfig(dir)),
+      logger: silentLogger,
+      extensions: [unit],
+      portOverride: 0,
+      host: "127.0.0.1",
+    });
+    port = await server.start();
+  });
+
+  afterAll(async () => {
+    await server.shutdown();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  function nextId(prefix: string): string {
+    counter += 1;
+    return `${prefix}_${counter}`;
+  }
+
+  async function saveChild(
+    id: string,
+    status: MessageInitShape<typeof AgentExecutionStatusSchema>,
+  ): Promise<void> {
+    const slug = id.replaceAll("_", "-");
+    await server.store.saveResource(
+      ApiResourceKind.agent_execution,
+      id,
+      AgentExecutionSchema,
+      create(AgentExecutionSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "AgentExecution",
+        metadata: { id, name: slug, slug, org: ORG },
+        spec: { message: "Say hello." },
+        status,
+      }),
+    );
+  }
+
+  async function saveParent(
+    status: MessageInitShape<typeof WorkflowExecutionStatusSchema>,
+  ): Promise<string> {
+    const id = nextId("wfexec_fwd");
+    const slug = id.replaceAll("_", "-");
+    await server.store.saveResource(
+      ApiResourceKind.workflow_execution,
+      id,
+      WorkflowExecutionSchema,
+      create(WorkflowExecutionSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "WorkflowExecution",
+        metadata: { id, name: slug, slug, org: ORG },
+        spec: { workflowId: `wf_${id}`, workflowInstanceId: `wfi_${id}` },
+        status,
+      }),
+    );
+    return id;
+  }
+
+  async function loadChild(id: string): Promise<AgentExecution> {
+    return server.store.getResource(
+      ApiResourceKind.agent_execution,
+      id,
+      AgentExecutionSchema,
+    );
+  }
+
+  it("an approval forwarded through the workflow records the person on the child", async () => {
+    const childId = nextId("aexec_fwd_gated");
+    await saveChild(childId, {
+      phase: AgentExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+      messages: [
+        {
+          toolCalls: [
+            {
+              id: "tc-fwd",
+              name: "Write",
+              status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+              requiresApproval: true,
+            },
+          ],
+        },
+      ],
+    });
+    const parentId = await saveParent({
+      phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+      pendingApprovals: [
+        create(WorkflowPendingApprovalSchema, {
+          approval: { toolCallId: "tc-fwd", toolName: "Write" },
+          childAgentExecutionId: childId,
+        }),
+      ],
+    });
+
+    await asErin().submitApproval({
+      executionId: parentId,
+      toolCallId: "tc-fwd",
+      action: ApprovalAction.APPROVE,
+    });
+
+    const child = await loadChild(childId);
+    const tc = child.status?.messages[0]?.toolCalls[0];
+    expect(tc?.approvalAction).toBe(ApprovalAction.APPROVE);
+    expect(tc?.approvedBy, "the person, not the in-process default").toBe(ERIN);
+    const decided = (child.status?.approvalEventStream?.events ?? []).find(
+      (ev) =>
+        ev.approvalRequestId === "tc-fwd" && ev.payload.case === "decided",
+    );
+    expect(
+      decided?.payload.case === "decided"
+        ? decided.payload.value.decidedBy
+        : undefined,
+    ).toBe(ERIN);
+  });
+
+  it("a file decision forwarded through the workflow records the person as the reviewer", async () => {
+    const childId = nextId("aexec_fwd_review");
+    const changeSetId = nextId("cs_fwd");
+    const { status, aggregate } = fileReviewSeed(childId, changeSetId);
+    await saveChild(childId, status);
+    const parentId = await saveParent({
+      phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+      pendingFileReviews: [
+        create(WorkflowPendingFileReviewSchema, {
+          childAgentExecutionId: childId,
+          changeSetId: [changeSetId],
+        }),
+      ],
+    });
+
+    await asErin().submitFileDecision({
+      executionId: parentId,
+      childAgentExecutionId: childId,
+      changeSetId,
+      scope: FileDecisionScope.CHANGE_SET,
+      action: FileDecisionAction.APPROVE,
+      expectedDigest: aggregate,
+    });
+
+    const child = await loadChild(childId);
+    const decisions =
+      child.status?.fileChangeSets.find((cs) => cs.id === changeSetId)
+        ?.decisions ?? [];
+    expect(decisions).toHaveLength(1);
+    expect(decisions[0]?.reviewerId).toBe(ERIN);
+  });
+
+  it("a tokenless decision on the agent run is the laptop's operator", async () => {
+    const childId = nextId("aexec_local");
+    await saveChild(childId, {
+      phase: AgentExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+      messages: [
+        {
+          toolCalls: [
+            {
+              id: "tc-local",
+              name: "Write",
+              status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+              requiresApproval: true,
+            },
+          ],
+        },
+      ],
+    });
+
+    const result = await createClient(
+      AgentExecutionCommandController,
+      transportFor(port),
+    ).submitApproval({
+      agentExecutionId: childId,
+      toolCallId: "tc-local",
+      action: ApprovalAction.APPROVE,
+    });
+
+    expect(result.status?.messages[0]?.toolCalls[0]?.approvedBy).toBe(
+      trustedLocalIdentity().identityId,
+    );
+  });
+});

package/src/domain/workflowexecution/__tests__/submit-workflow-task-approval.test.ts

@@ -0,0 +1,196 @@
+/**
+ * Pins who a workflow human_input decision names (stigmer#1415): the
+ * reviewer and reviewer_actor that submitWorkflowTaskApproval puts on the
+ * relay signal are the caller the chain authorized, never the client's
+ * `reviewer` field. One arm per caller shape the editions produce — a
+ * person with and without a client-supplied name, a PlatformClient user
+ * token (a person spoken for by a third-party client), and a composition's
+ * own lane class — each read from the payload the stub engine recorded.
+ * The validation and phase arms, and the engineless refusal, are pinned
+ * over the wire in workflowexecution.test.ts.
+ */
+import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { create } from "@bufbuild/protobuf";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import {
+  ExecutionPhase,
+  WorkflowTaskStatus,
+  WorkflowTaskType,
+} from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import { SubmitWorkflowTaskApprovalInputSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import type { CallerIdentity } from "../../../extensions/identity.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
+
+import {
+  HUMAN_INPUT_SIGNAL_PREFIX,
+  RELAY_SIGNAL_CHANNEL_NAME,
+} from "../constants.js";
+import { submitWorkflowTaskApproval } from "../submit-workflow-task-approval.js";
+import { stubConnectedEngine } from "./engine-stub.js";
+
+const GATE = "manager_approval";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+let dir: string;
+let store: SqliteStore;
+let counter = 0;
+
+beforeAll(() => {
+  dir = mkdtempSync(path.join(tmpdir(), "wfexec-task-approval-"));
+  store = SqliteStore.open(path.join(dir, "test.db"));
+});
+
+afterAll(async () => {
+  await store.close();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+/** A running execution whose one task is a human_input gate awaiting a decision. */
+async function seedGate(): Promise<string> {
+  counter += 1;
+  const id = `wfx_gate_${counter}`;
+  await store.saveResource(
+    ApiResourceKind.workflow_execution,
+    id,
+    WorkflowExecutionSchema,
+    create(WorkflowExecutionSchema, {
+      metadata: { id, name: id, org: "acme" },
+      spec: {
+        workflowId: `wf_${counter}`,
+        workflowInstanceId: `wfi_${counter}`,
+      },
+      status: {
+        phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+        temporalWorkflowId: `temporal_${counter}`,
+        tasks: [
+          {
+            taskName: GATE,
+            taskType: WorkflowTaskType.WORKFLOW_TASK_APPROVAL,
+            status: WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL,
+          },
+        ],
+      },
+    }),
+  );
+  return id;
+}
+
+/** Submits a decision as `caller` and returns the human_input payload the engine was handed. */
+async function decide(
+  caller: CallerIdentity,
+  clientReviewer = "",
+): Promise<Record<string, unknown>> {
+  const engine = stubConnectedEngine();
+  await submitWorkflowTaskApproval(
+    {
+      store,
+      logger: silentLogger,
+      authorizer: newPermissiveSingleTeamAuthorizer(),
+      engineState: () => engine.state,
+    },
+    create(SubmitWorkflowTaskApprovalInputSchema, {
+      executionId: await seedGate(),
+      taskName: GATE,
+      outcome: "approve",
+      reviewer: clientReviewer,
+    }),
+    caller,
+  );
+
+  const starts = engine.calls.filter(
+    (call) => call.method === "signalWithStart",
+  );
+  expect(starts).toHaveLength(1);
+  const [, channel, envelope] = starts[0]!.args as [
+    unknown,
+    string,
+    { signalName: string; payload: Record<string, unknown> },
+  ];
+  expect(channel).toBe(RELAY_SIGNAL_CHANNEL_NAME);
+  expect(envelope.signalName).toBe(HUMAN_INPUT_SIGNAL_PREFIX + GATE);
+  return envelope.payload;
+}
+
+describe("submitWorkflowTaskApproval reviewer attribution (stigmer#1415)", () => {
+  it("a person who names no reviewer is recorded as themselves, with their display snapshot", async () => {
+    const payload = await decide(
+      testCallerIdentity({
+        identityId: "ia_erin",
+        email: "erin@example.com",
+        displayName: "Erin Example",
+      }),
+    );
+
+    expect(payload["outcome"]).toBe("approve");
+    expect(payload["reviewer"]).toBe("ia_erin");
+    expect(payload["reviewer_actor"]).toEqual({
+      id: "ia_erin",
+      display_name: "Erin Example",
+      email: "erin@example.com",
+      avatar: "",
+    });
+  });
+
+  it("a person who names someone else is still recorded as themselves", async () => {
+    const payload = await decide(
+      testCallerIdentity({ identityId: "ia_erin", email: "erin@example.com" }),
+      "ia_someone_else",
+    );
+
+    expect(payload["reviewer"]).toBe("ia_erin");
+    expect(payload["reviewer_actor"]).toEqual({
+      id: "ia_erin",
+      display_name: "",
+      email: "erin@example.com",
+      avatar: "",
+    });
+  });
+
+  it("a PlatformClient user token records the end user it names, not the client", async () => {
+    const payload = await decide(
+      testCallerIdentity({
+        identityId: "ia_end_user",
+        email: "user@partner.example",
+        platformClientId: "pcl_partner",
+      }),
+    );
+
+    expect(payload["reviewer"]).toBe("ia_end_user");
+    expect(payload["reviewer_actor"]).toEqual({
+      id: "ia_end_user",
+      display_name: "",
+      email: "user@partner.example",
+      avatar: "",
+    });
+  });
+
+  it("a composition's own lane class is attributed to its principal, whatever it sends", async () => {
+    const payload = await decide(
+      testCallerIdentity({ identityId: "ia_broker", callerClass: "channel" }),
+      "U_SLACK_USER",
+    );
+
+    expect(payload["reviewer"]).toBe("ia_broker");
+    expect(payload["reviewer_actor"]).toEqual({
+      id: "ia_broker",
+      display_name: "",
+      email: "",
+      avatar: "",
+    });
+  });
+});

package/src/domain/workflowexecution/__tests__/workflowexecution.test.ts

@@ -41,14 +41,9 @@ import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ApprovalAction,
-  DiffCompleteness,
-  ExecutionPhase as AgentExecutionPhase,
-  FileChangeKind,
   FileDecisionAction,
   FileDecisionScope,
-  FileReviewEventType,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { CapturedFileChangeSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import {
   WorkflowExecutionSchema,
@@ -77,10 +72,7 @@ import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
-import {
-  aggregateDigest,
-  fileDigest,
-} from "../../agentexecution/filereview/digest.js";
+import { fileReviewSeed } from "../../agentexecution/__tests__/file-review-seed.js";
 import type { WorkflowExecutionEventRecord } from "../../../store/interface.js";
 
 const silentLogger = createLogger({
@@ -1254,20 +1246,6 @@ describe("submitApproval over the wire (forwarding through the REAL in-process e
 });
 
 describe("submitFileDecision over the wire (propagation through the REAL in-process edge)", () => {
-  function buildChange() {
-    const change = create(CapturedFileChangeSchema, {
-      id: "fc-1",
-      pathBefore: "src/a.ts",
-      pathAfter: "src/a.ts",
-      kind: FileChangeKind.MODIFY,
-      beforeSha256: "a".repeat(64),
-      afterSha256: "b".repeat(64),
-      diffComplete: true,
-    });
-    change.fileDigest = fileDigest(change);
-    return change;
-  }
-
   async function seedChildWithLedger(): Promise<{
     childId: string;
     changeSetId: string;
@@ -1276,8 +1254,7 @@ describe("submitFileDecision over the wire (propagation through the REAL in-proc
     counter += 1;
     const childId = `aexec_wf_child_${counter}`;
     const changeSetId = `cs_wf_${counter}`;
-    const change = buildChange();
-    const aggregate = aggregateDigest([change]);
+    const { status, aggregate } = fileReviewSeed(childId, changeSetId);
     await server.store.saveResource(
       ApiResourceKind.agent_execution,
       childId,
@@ -1292,38 +1269,7 @@ describe("submitFileDecision over the wire (propagation through the REAL in-proc
           org: ORG,
         },
         spec: { message: "Say hello." },
-        status: {
-          phase: AgentExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
-          fileReviewEventStream: {
-            executionId: childId,
-            events: [
-              {
-                eventId: `${changeSetId}:${changeSetId}:BASELINE`,
-                changeSetId,
-                eventType: FileReviewEventType.BASELINE_CAPTURED,
-                actor: "runner",
-                payload: {
-                  case: "baselineCaptured",
-                  value: { turnId: "turn-1", harnessId: "harness-1" },
-                },
-              },
-              {
-                eventId: `${changeSetId}:${changeSetId}:CANDIDATE`,
-                changeSetId,
-                eventType: FileReviewEventType.CANDIDATE_CAPTURED,
-                actor: "runner",
-                payload: {
-                  case: "candidateCaptured",
-                  value: {
-                    changes: [change],
-                    aggregateDigest: aggregate,
-                    diffCompleteness: DiffCompleteness.COMPLETE,
-                  },
-                },
-              },
-            ],
-          },
-        },
+        status,
       }),
     );
     return { childId, changeSetId, aggregate };

package/src/domain/workflowexecution/submit-approval.ts

@@ -45,10 +45,16 @@ import type { Store } from "../../store/interface.js";
  * The narrow agentexecution forwarding edge (Go
  * AgentExecutionApprovalClient) — method-segregated from the
  * file-decision edge so each handler depends only on the RPC it uses;
- * the in-process agentexecution controller satisfies both.
+ * the in-process agentexecution controller satisfies both. `caller` is
+ * the identity this chain authorized: the child records it as the
+ * decider (stigmer/stigmer#1385), so a decision made through a workflow
+ * names the same person as one made on the agent run directly.
  */
 export interface AgentExecutionApprovalForwarder {
-  submitApproval(input: AgentSubmitApprovalInput): Promise<AgentExecution>;
+  submitApproval(
+    input: AgentSubmitApprovalInput,
+    caller: CallerIdentity,
+  ): Promise<AgentExecution>;
 }
 export type AgentExecutionApprovalForwarderProvider =
   () => AgentExecutionApprovalForwarder;
@@ -159,6 +165,7 @@ export async function submitApproval(
               action: ctx.input.action,
               comment: ctx.input.comment,
             }),
+            ctx.callerIdentity,
           );
         } catch (error) {
           // Flattened to Unavailable; Go's %v embeds the child's grpc-go

package/src/domain/workflowexecution/submit-file-decision.ts

@@ -42,11 +42,15 @@ import type { Store } from "../../store/interface.js";
 /**
  * The narrow agentexecution file-decision edge (Go
  * AgentExecutionFileDecisionClient) — method-segregated from the approval
- * edge; the in-process agentexecution controller satisfies both.
+ * edge; the in-process agentexecution controller satisfies both. `caller`
+ * is the identity this chain authorized, which the child records as the
+ * reviewer (the contract on SubmitWorkflowFileDecisionInput: the caller
+ * identity propagates; stigmer/stigmer#1385).
  */
 export interface AgentExecutionFileDecisionForwarder {
   submitFileDecision(
     input: AgentSubmitFileDecisionInput,
+    caller: CallerIdentity,
   ): Promise<AgentExecution>;
 }
 export type AgentExecutionFileDecisionForwarderProvider =
@@ -154,6 +158,7 @@ export async function submitFileDecision(
               reason: ctx.input.reason,
               acknowledgeUnreviewable: ctx.input.acknowledgeUnreviewable,
             }),
+            ctx.callerIdentity,
           );
         } catch (error) {
           // Propagate the child's STATUS unchanged (code + message) — its

package/src/domain/workflowexecution/submit-workflow-task-approval.ts

@@ -10,10 +10,17 @@
  * carries status.temporal_workflow_id (NOT spec.workflow_id — every other
  * sender passes the spec reference).
  *
- * Reviewer attribution: OSS is single-user; an explicit client-supplied
- * reviewer is honored, otherwise it stays empty ("Empty when not
- * attributed"). Cloud attributes server-side from the authenticated
- * caller.
+ * Reviewer attribution (stigmer#1415): the decision names the principal
+ * the chain authorized, the id `auditActorFor` stamps as `created_by.id`,
+ * with that caller's display snapshot as `reviewer_actor`, in every
+ * edition and for every caller class. The client-supplied
+ * `SubmitWorkflowTaskApprovalInput.reviewer` is never read: a person's
+ * value is spoofable, and no caller in either edition decides on someone
+ * else's behalf, so delegated attribution waits for the lane that needs it
+ * and is keyed on that lane's own class (the io.proto field comment). On a
+ * laptop the reviewer is the trusted-local operator, exactly as every
+ * laptop resource's `created_by` is. The runner carries both keys opaquely
+ * into the task output and the approval_resolved event.
  */
 import type { JsonValue } from "@bufbuild/protobuf";
 
@@ -38,6 +45,7 @@ import {
 import { newPipeline } from "../../pipeline/pipeline.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { auditActorFor } from "../../pipeline/steps/defaults.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
@@ -160,9 +168,18 @@ export async function submitWorkflowTaskApproval(
         const humanInputSignalName =
           HUMAN_INPUT_SIGNAL_PREFIX + ctx.input.taskName;
 
+        const reviewer = auditActorFor(ctx.callerIdentity);
         const signalPayload: Record<string, JsonValue> = {
           outcome: ctx.input.outcome,
-          reviewer: ctx.input.reviewer,
+          reviewer: reviewer.id,
+          // The runner's HumanInputReviewerActor keys (snake_case, as the
+          // rest of the payload); the actor's platform_client_id has no slot.
+          reviewer_actor: {
+            id: reviewer.id,
+            display_name: reviewer.displayName,
+            email: reviewer.email,
+            avatar: reviewer.avatar,
+          },
           // Go time.Now().UTC().Format(time.RFC3339): seconds precision.
           responded_at: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
         };
@@ -204,6 +221,7 @@ export async function submitWorkflowTaskApproval(
             executionId,
             taskName: ctx.input.taskName,
             outcome: ctx.input.outcome,
+            reviewer: reviewer.id,
             signalName: humanInputSignalName,
           },
         );