@stigmer/server 3.40.0 → 3.41.0

package/src/index.ts

@@ -66,8 +66,13 @@ export type {
   ExtensionServiceRegistration,
   ResolvedExtensions,
   ResolvedServiceRegistration,
+  ResolvedUnitHook,
   ServerExtension,
 } from "./extensions/registry.js";
+// What the composition hands a unit (ServerExtension.onComposed): its one
+// Authorizer, list read scope, policy check, tuple lifecycle and
+// in-process transport, whichever posture built them.
+export type { ComposedServices } from "./extensions/composed-services.js";
 export type {
   CallerClass,
   CallerIdentity,
@@ -107,6 +112,9 @@ export type { ResolvedExtensionDrivers } from "./extensions/registry.js";
 // tests pin against.
 export type {
   DefaultInstanceLinkedEvent,
+  ExecutionAudienceShape,
+  ExecutionVisibilityChangedEvent,
+  OrganizationAffiliationEvent,
   PolicyGrantedEvent,
   PolicyRevokedEvent,
   ResourceAuthorizationLifecycle,
@@ -156,6 +164,16 @@ export type {
   IdentityAccountStoreContractFixture,
 } from "./domain/identityaccount/store-contract.js";
 export { identityAccountStoreContract } from "./domain/identityaccount/store-contract.js";
+// The runner every kit is built on, for a composition whose own ports need
+// kits of the same shape: a fresh fixture per case, the body over it, the
+// cleanup after, and a failing body reported over a failing cleanup.
+export type {
+  PortContractBody,
+  PortContractCase,
+  PortContractDeclaration,
+  PortContractFixture,
+} from "./store/port-contract.js";
+export { portContractCases } from "./store/port-contract.js";
 // The 20260913.01 IamPolicy seams (Q-OR-1, Q-OR-10): the store PORT a
 // composition drives the domain's grant path through (drivers.iamPolicyStore;
 // a driver throws DuplicatePolicyError for a held id) and its vitest-free
@@ -167,6 +185,14 @@ export { identityAccountStoreContract } from "./domain/identityaccount/store-con
 // composition reaches it as in-process RPCs, the doctrine.
 export type { IamPolicyStore } from "./domain/iampolicy/store.js";
 export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
+// What the grant path hands the store beside every access row it writes or
+// deletes (who, through which door, in which organization), so an edition
+// that keeps a permission history writes it atomically with the row.
+export type {
+  PolicyActor,
+  PolicyChangeCause,
+  PolicyChangeRecord,
+} from "./domain/iampolicy/change.js";
 export type {
   IamPolicyStoreContractCase,
   IamPolicyStoreContractFixture,
@@ -182,9 +208,16 @@ export type { AuthorizationQueryEngine } from "./extensions/authorization-querie
 // How an access list names a grantee that is not a person
 // (drivers.principalDisplay): a team, in the editions that serve teams.
 export type { PrincipalDisplay } from "./extensions/principal-display.js";
+// Where the built-in authorizer reads the rows of a kind a unit keeps in a
+// store of its own (drivers.resourceRowReaders).
+export type { ResourceRowReader } from "./extensions/resource-row-reader.js";
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+// The derived id of the account under a subject. An edition's own per-org
+// system accounts take the id of their own subject, so the primary key holds
+// one row per subject there as it does for every account the library mints.
+export { accountIdFor } from "./domain/identityaccount/constants.js";
 // The PlatformClient seams: the store PORT a composition drives the domain
 // through (drivers.platformClientStore; a driver throws
 // DuplicatePlatformClientError for a held id, slug or client_id) and its
@@ -276,6 +309,10 @@ export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-calle
 // through the REAL boundary mechanism, never a re-derivation.
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
+// Which callers are visitors (drivers.visitorClassifier): admitted to the
+// organization's agents without belonging to it, so their runs never carry
+// the organization's standing context (stigmer/stigmer#1401).
+export type { VisitorClassifier } from "./extensions/visitor-classifier.js";
 // The tuple lifecycle's resolution, for a kind a composition serves outside
 // the generic chains (a cloud-served create): `resolveResourceCreatedEvent`
 // derives the creation event from the kind's `kind_meta` exactly as the
@@ -283,6 +320,7 @@ export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-bo
 // whichever chain created the row.
 export {
   diffVisibilityShapes,
+  executionAudienceShapes,
   resolveResourceCreatedEvent,
   visibilityShapesFor,
 } from "./pipeline/steps/authorization-tuples.js";
@@ -299,6 +337,7 @@ export {
   internalError,
   invalidArgumentError,
   notFoundError,
+  unauthenticatedWithReasonError,
   unavailableError,
 } from "./pipeline/errors.js";
 export type { RefusalReason } from "./pipeline/errors.js";
@@ -311,9 +350,14 @@ export { generateSlug } from "./pipeline/steps/slug.js";
 // composing requests through the in-process transport AS a caller rides
 // the same header the OSS asCaller adapters use. (callerIdentityOf and
 // callerIdentityKey ride the request-idiom export block below.)
+// serverActingFor is the one construction of "the server acting for" a
+// principal: an extension that writes on a person's behalf (an invitation,
+// a deleted team's cleanup) sends it so the write names that person while
+// the server's own admission rules apply.
 export {
   encodeInProcessCaller,
   IN_PROCESS_CALLER_HEADER,
+  serverActingFor,
 } from "./pipeline/interceptors/auth.js";
 
 // The request idiom for extension-REGISTERED services (C4 Stage 4): a
@@ -352,10 +396,10 @@ export {
 } from "./pipeline/interceptors/auth.js";
 export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
-// The run gate's check set (P1 sp.run-gate): an edition's Authorizer keys
-// its lane admission on this predicate — the runtime lanes it mints (a
-// guest share, a channel, a schedule fire, a workflow sandbox) were
-// admitted upstream by their own gate steps and are not re-asked here.
+// The run gate's check set: an edition's Authorizer keys its lane
+// admission on this predicate — the runtime lanes it mints (a guest
+// share, a channel, a schedule fire) were admitted upstream by their own
+// gate steps and are not re-asked here.
 // OSS defines the gate, so OSS defines which checks are the gate; a
 // composition never re-derives the set.
 export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
@@ -370,8 +414,15 @@ export { newValidateProtoStep } from "./pipeline/steps/validation.js";
 // constructor argument) for BuildNewState to pick the id prefix.
 // CheckDuplicate is deliberately not here: it reads this server's Store,
 // and a composition's own table answers that question in a step of the
-// same name over its own repo.
-export { newBuildNewStateStep } from "./pipeline/steps/defaults.js";
+// same name over its own repo. BuildNewState replaces any id a request
+// carries (stigmer/stigmer#1266); a composition step that derives a
+// create's id before it runs claims that id with assignServerId, the one
+// way an id survives the step.
+export {
+  assignServerId,
+  newBuildNewStateStep,
+  SERVER_ASSIGNED_ID_KEY,
+} from "./pipeline/steps/defaults.js";
 export { newResolveSlugStep } from "./pipeline/steps/slug.js";
 // The update and reference-read steps for the same kinds, on the same
 // terms. An update runs BuildUpdateState after the composition's own
@@ -409,6 +460,10 @@ export type {
   OrganizationSlugStore,
 } from "./store/interface.js";
 export { ORGANIZATION_SLUG_RESERVED } from "./domain/organization/slug-ledger.js";
+// The API-key verifier's refusal of a key created before sign-in was
+// turned on (stigmer/stigmer#1169): a client branches on the reason, not
+// the copy.
+export { API_KEY_CREATED_BEFORE_SIGN_IN } from "./domain/apikey/verifier.js";
 // The list index's read shapes, which `Store.queryResources` speaks
 // (store/list-index.ts). Declaring an index stays internal: the list is
 // the composition root's (boot/list-indexes.ts), one per server.

package/src/pipeline/__tests__/steps.test.ts

@@ -2,7 +2,8 @@
  * Pins the shared steps against their Go references (steps/*_test.go,
  * translated): slug generation (cloud-Java-identical, no truncation),
  * duplicate checking with the byte-pinned AlreadyExists copy, create/update
- * state building (status clearing, ULID minting, audit slots #540,
+ * state building (status clearing, ULID minting that replaces any id the
+ * request carried unless an earlier step claimed it #1266, audit slots #540,
  * visibility default + oss#573 immutability), the loaders' error copy, the
  * best-effort search indexing, visibility validation with cloud-identical
  * copy, reference normalization/validation, operator identity (#400), and
@@ -31,8 +32,10 @@ import type { SearchIndexEntry } from "../../store/interface.js";
 import { SqliteStore } from "../../store/sqlite/store.js";
 import { RequestContext } from "../request-context.js";
 import {
+  assignServerId,
   newBuildNewStateStep,
   generateId,
+  SERVER_ASSIGNED_ID_KEY,
   setOperatorIdentity,
   resetOperatorIdentityForTests,
   auditActorFor,
@@ -213,15 +216,39 @@ describe("BuildNewState", () => {
     );
   });
 
-  it("keeps a client-provided id and explicit visibility (idempotent)", async () => {
-    const ctx = orgCtx(org({ id: "acme" }));
+  it("replaces a client-provided id and keeps an explicit visibility", async () => {
+    const ctx = orgCtx(org({ id: "org_chosen" }));
     ctx.newState.metadata!.visibility = ApiResourceVisibility.visibility_org;
     await newBuildNewStateStep<typeof OrganizationSchema>().execute(ctx);
-    expect(ctx.newState.metadata?.id).toBe("acme");
+    expect(ctx.newState.metadata?.id).toMatch(/^org_[0-9a-hjkmnp-tv-z]{26}$/);
+    expect(ctx.newState.metadata?.id).not.toBe("org_chosen");
     expect(ctx.newState.metadata?.visibility).toBe(
       ApiResourceVisibility.visibility_org,
     );
   });
+
+  it("keeps an id an earlier step claimed through assignServerId", async () => {
+    const ctx = orgCtx(org({ id: "org_chosen" }));
+    assignServerId(ctx, "org_derived");
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(ctx);
+    expect(ctx.newState.metadata?.id).toBe("org_derived");
+    expect(ctx.get(SERVER_ASSIGNED_ID_KEY)).toBe("org_derived");
+  });
+
+  it("re-mints a claimed id a later step rewrote: a claim names one value", async () => {
+    const ctx = orgCtx(org());
+    assignServerId(ctx, "org_derived");
+    ctx.newState.metadata!.id = "org_rewritten";
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(ctx);
+    expect(ctx.newState.metadata?.id).toMatch(/^org_[0-9a-hjkmnp-tv-z]{26}$/);
+  });
+
+  it("mints for an empty id even when the claim recorded an empty one", async () => {
+    const ctx = orgCtx(org());
+    assignServerId(ctx, "");
+    await newBuildNewStateStep<typeof OrganizationSchema>().execute(ctx);
+    expect(ctx.newState.metadata?.id).toMatch(/^org_[0-9a-hjkmnp-tv-z]{26}$/);
+  });
 });
 
 describe("generateId", () => {

package/src/pipeline/errors.ts

@@ -65,14 +65,7 @@ export function alreadyExistsWithReasonError(
   reason: RefusalReason,
 ): ConnectError {
   return new ConnectError(message, Code.AlreadyExists, undefined, [
-    {
-      desc: ErrorInfoSchema,
-      value: create(ErrorInfoSchema, {
-        reason: reason.reason,
-        domain: ERROR_REASON_DOMAIN,
-        metadata: { ...reason.metadata },
-      }),
-    },
+    reasonDetail(reason),
   ]);
 }
 
@@ -89,17 +82,38 @@ export function failedPreconditionError(
     return new ConnectError(message, Code.FailedPrecondition);
   }
   return new ConnectError(message, Code.FailedPrecondition, undefined, [
-    {
-      desc: ErrorInfoSchema,
-      value: create(ErrorInfoSchema, {
-        reason: reason.reason,
-        domain: ERROR_REASON_DOMAIN,
-        metadata: { ...reason.metadata },
-      }),
-    },
+    reasonDetail(reason),
   ]);
 }
 
+/**
+ * An Unauthenticated refusal a client acts on without parsing text: a
+ * credential that was recognised but authenticates nobody, for a reason
+ * the caller can fix (stigmer/stigmer#1169, a key created before sign-in
+ * was turned on). The code stays Unauthenticated, so a client that keys on
+ * the code alone still treats it as a sign-in problem.
+ */
+export function unauthenticatedWithReasonError(
+  message: string,
+  reason: RefusalReason,
+): ConnectError {
+  return new ConnectError(message, Code.Unauthenticated, undefined, [
+    reasonDetail(reason),
+  ]);
+}
+
+/** The ErrorInfo detail every reasoned refusal carries beside its message. */
+function reasonDetail(reason: RefusalReason) {
+  return {
+    desc: ErrorInfoSchema,
+    value: create(ErrorInfoSchema, {
+      reason: reason.reason,
+      domain: ERROR_REASON_DOMAIN,
+      metadata: { ...reason.metadata },
+    }),
+  };
+}
+
 /** Go AbortedError — retryable conflict (e.g. an in-flight dedupe claim). */
 export function abortedError(message: string): ConnectError {
   return new ConnectError(message, Code.Aborted);

package/src/pipeline/interceptors/auth.ts

@@ -219,15 +219,23 @@ export function trustedLocalIdentityFor(operator: {
 /**
  * The server acting for a principal it has authenticated some other way —
  * the one construction of an `internal` caller outside the in-process
- * transport's own stamp. Its consumer is the PlatformClient mint
- * (domain/platformclient/mint.ts): the request is public and tokenless
- * (so the chain stamped the trusted-local operator), the client proved
- * itself with its secret, and the end-user account and role the mint
- * creates must name the CLIENT as their actor, never the operator.
- * `internal` because the server is the one acting — the create path's
- * Authorize skips it, as for every server-composed request — and never
- * reachable from the wire: no verifier produces it, and the serving
- * chassis overwrites position 1 on every request.
+ * transport's own stamp. Two consumers:
+ *
+ *   - The PlatformClient mint (domain/platformclient/mint.ts): the
+ *     request is public and tokenless (so the chain stamped the
+ *     trusted-local operator), the client proved itself with its secret,
+ *     and the end-user account and role the mint creates must name the
+ *     CLIENT as their actor, never the operator.
+ *   - The workflow HITL forwarding edges (boot/inprocess.ts): the
+ *     workflow chain authorized the person deciding, and the child
+ *     agent execution records them as its decider or reviewer
+ *     (stigmer/stigmer#1385) without authorizing them a second time
+ *     against a session they need not own.
+ *
+ * `internal` because the server is the one acting — Authorize skips it,
+ * as for every server-composed request — and never reachable from the
+ * wire: no verifier produces it, and the serving chassis overwrites
+ * position 1 on every request.
  */
 export function serverActingFor(principalId: string): CallerIdentity {
   if (principalId === "") {

package/src/pipeline/steps/__tests__/authorization-tuples.test.ts

@@ -2,6 +2,7 @@
  * Pins the edition-neutral half of the C2 tuple-lifecycle seam
  * (20260827.10, ruling Q2): the visibility shape policy and its set-diff
  * (re-pinning the Java VisibilityTupleReconcilerTest transition matrix),
+ * the run-audience policy of a workflow instance's execution visibility,
  * and the config-driven creation-event resolution
  * (CreateAuthorizationTuplesStepV2's scope/owner/parent semantics,
  * including every failure arm). The driver-facing behavior of the steps
@@ -16,6 +17,7 @@ import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentex
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
 import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
@@ -25,6 +27,7 @@ import { createLogger } from "../../../boot/logger.js";
 import type { CallerIdentity } from "../../../extensions/identity.js";
 import {
   diffVisibilityShapes,
+  executionAudienceShapes,
   resolveResourceCreatedEvent,
   visibilityShapesFor,
 } from "../authorization-tuples.js";
@@ -85,6 +88,23 @@ describe("visibilityShapesFor (the reconciler's level→shape policy)", () => {
   });
 });
 
+describe("executionAudienceShapes (a workflow instance's run audience)", () => {
+  it("ORGANIZATION names the organization's viewers", () => {
+    expect([
+      ...executionAudienceShapes(WorkflowExecutionVisibility.organization),
+    ]).toEqual(["org-viewer"]);
+  });
+
+  it("PRIVATE and the unset level name nobody, so each run stays its triggerer's", () => {
+    expect([
+      ...executionAudienceShapes(WorkflowExecutionVisibility.private),
+    ]).toEqual([]);
+    expect([
+      ...executionAudienceShapes(WorkflowExecutionVisibility.unspecified),
+    ]).toEqual([]);
+  });
+});
+
 describe("diffVisibilityShapes (the reconciler's transition matrix, re-pinned)", () => {
   const agent = ApiResourceKind.agent;
 

package/src/pipeline/steps/__tests__/guard-memory-capture.test.ts

@@ -3,14 +3,16 @@
  * stigmer-cloud#564): the authorizeMemoryCapture capability's three
  * verdicts (admit stashes the proved claims, refuse answers the
  * byte-pinned PERMISSION_DENIED copy, no-opinion falls through to the
- * gate's own machine/platform_client_id logic), the capture org handed to
- * the capability, the org-mismatch throw propagating untouched, and the
- * absent-capability posture staying byte-identical to the pre-seam gate
- * (trusted-local and OIDC callers admit; machine and
- * platform_client_id-carrying callers refuse). The claim counts only on a
- * platform token (stigmer#1312): the refusing cases carry tokens signed by
- * the envelope every Stigmer lane mints through, and another issuer's
- * token carrying the same claim is admitted.
+ * first-party allow-list), the capture org handed to the capability, the
+ * org-mismatch throw propagating untouched, and the allow-list itself
+ * (stigmer#1406): trusted-local and OIDC callers admit; machine,
+ * PlatformClient-token and every other caller class — runner, the hosted
+ * edition's guest / channel / schedule lanes, a class no edition has
+ * named yet — refuse, with the capability absent or answering
+ * no-opinion. The claim counts only on a platform token (stigmer#1312):
+ * the refusing cases carry tokens signed by the envelope every Stigmer
+ * lane mints through, and another issuer's token carrying the same claim
+ * is admitted.
  */
 import { generateKeyPairSync } from "node:crypto";
 
@@ -43,6 +45,20 @@ const LOCAL_USER: CallerIdentity = {
   rawToken: "",
 };
 
+/**
+ * Every caller class that is not a person at the console, CLI or SDK:
+ * the OSS runner and machine classes, the hosted edition's minted lanes
+ * (their class is their token_type), and a class no edition names yet.
+ */
+const NON_PERSON_CLASSES = [
+  "machine",
+  "runner",
+  "guest",
+  "channel",
+  "schedule",
+  "a_lane_added_later",
+];
+
 /** A cloud-shaped caller whose class is its token_type (sandbox lane). */
 const SANDBOX_CALLER: CallerIdentity = {
   identityId: "ida_human",
@@ -182,7 +198,11 @@ describe("GuardMemoryCapture with the capability composed", () => {
         return { verdict: "no-opinion" };
       }),
     );
-    await step.execute(memoryCtx(SANDBOX_CALLER, "org_zeta"));
+    // No opinion on a caller that is not a person: the allow-list refuses
+    // it after the capability has seen the request.
+    await expect(
+      step.execute(memoryCtx(SANDBOX_CALLER, "org_zeta")),
+    ).rejects.toThrowError(MEMORY_CAPTURE_CALLER_MESSAGE);
     expect(observed).toEqual([{ caller: SANDBOX_CALLER, org: "org_zeta" }]);
   });
 
@@ -216,6 +236,23 @@ describe("GuardMemoryCapture with the capability composed", () => {
     );
   });
 
+  it.each(NON_PERSON_CLASSES)(
+    "no-opinion falls through: a %s caller is refused, with or without the claim",
+    async (callerClass) => {
+      const step = newGuardMemoryCaptureStep<typeof MemorySchema>(
+        providerWith(() => ({ verdict: "no-opinion" })),
+      );
+      for (const rawToken of [
+        "",
+        mintedToken({ platform_client_id: "pc_1" }),
+      ]) {
+        await expect(
+          step.execute(memoryCtx({ ...LOCAL_USER, callerClass, rawToken })),
+        ).rejects.toThrowError(MEMORY_CAPTURE_CALLER_MESSAGE);
+      }
+    },
+  );
+
   it("no-opinion falls through: another issuer's platform_client_id claim is admitted", async () => {
     // Both editions' capabilities answer no-opinion for a person, so this
     // is the path an OIDC login takes in production.
@@ -243,7 +280,7 @@ describe("GuardMemoryCapture with the capability composed", () => {
   });
 });
 
-describe("GuardMemoryCapture without the capability (the pre-seam gate)", () => {
+describe("GuardMemoryCapture without the capability (the allow-list alone)", () => {
   it("admits trusted-local and OIDC callers", async () => {
     const step = newGuardMemoryCaptureStep<typeof MemorySchema>(providerWith());
     await step.execute(memoryCtx(LOCAL_USER));
@@ -288,11 +325,31 @@ describe("GuardMemoryCapture without the capability (the pre-seam gate)", () =>
     );
   });
 
-  it("admits a runner-shaped caller — the recorded pre-fix posture", async () => {
-    // With no capability composed the gate cannot classify runner
-    // credentials — the single-user OSS posture admits them (the #564
-    // narrowing is CLOUD policy, shipped in the cloud capability).
+  it("refuses a runner-shaped caller no capability classifies", async () => {
+    // A runner acting for a person captures only through a provider that
+    // proves whose run it is (the capability's admit). Unclassified, it is
+    // not the person, so the allow-list refuses it (stigmer#1406) — the
+    // trusted-local laptop's runner is not this caller: no verifier claims
+    // its token there, so it arrives as the operator (pipeline/interceptors/auth.ts).
     const step = newGuardMemoryCaptureStep<typeof MemorySchema>(providerWith());
-    await step.execute(memoryCtx(SANDBOX_CALLER));
+    await expect(step.execute(memoryCtx(SANDBOX_CALLER))).rejects.toThrowError(
+      MEMORY_CAPTURE_CALLER_MESSAGE,
+    );
   });
+
+  it.each(NON_PERSON_CLASSES)(
+    "refuses a %s caller, with or without the claim",
+    async (callerClass) => {
+      const step =
+        newGuardMemoryCaptureStep<typeof MemorySchema>(providerWith());
+      for (const rawToken of [
+        "",
+        mintedToken({ platform_client_id: "pc_1" }),
+      ]) {
+        await expect(
+          step.execute(memoryCtx({ ...LOCAL_USER, callerClass, rawToken })),
+        ).rejects.toThrowError(MEMORY_CAPTURE_CALLER_MESSAGE);
+      }
+    },
+  );
 });

package/src/pipeline/steps/authorization-tuples.ts

@@ -27,12 +27,16 @@
  *   - visibility: a driver throw fails the request as Internal — after
  *     persist; retrying the same transition converges (set-diff
  *     idempotency).
+ *   - execution visibility (a workflow instance's run audience): the same,
+ *     through `notifyExecutionVisibilityChanged`; the event is the target
+ *     audience, so a retry converges without the old level.
  *   - the PLATFORM scope arm is dead config in BOTH editions (no kind
  *     uses it; Java's switch falls through to a warn) — ported as the
  *     same conscious warn, never an implementation.
  */
 import type { DescMessage, Message } from "@bufbuild/protobuf";
 
+import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import {
@@ -48,6 +52,8 @@ import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import type {
   DefaultInstanceLinkedEvent,
+  ExecutionAudienceShape,
+  ExecutionVisibilityChangedEvent,
   ResolvedParentLink,
   ResourceAuthorizationLifecycle,
   ResourceCreatedEvent,
@@ -72,6 +78,29 @@ export async function notifyDefaultInstanceLinked(
   }
   await lifecycle.onDefaultInstanceLinked(event);
 }
+
+/**
+ * Fires the driver's run-audience event for a workflow instance whose
+ * `spec.execution_visibility` just persisted. No driver (or a driver
+ * without the optional method) = no-op — the OSS posture, where the
+ * relation is derived from the row at check time. A driver throw fails
+ * the request as Internal with `failureMessage`, after persist; the event
+ * is the whole target audience, so the retry converges.
+ */
+export async function notifyExecutionVisibilityChanged(
+  lifecycle: ResourceAuthorizationLifecycle | undefined,
+  event: ExecutionVisibilityChangedEvent,
+  failureMessage: string,
+): Promise<void> {
+  if (lifecycle?.onExecutionVisibilityChanged === undefined) {
+    return;
+  }
+  try {
+    await lifecycle.onExecutionVisibilityChanged(event);
+  } catch (error) {
+    throw internalError(error, failureMessage);
+  }
+}
 import { getKindEnum, getKindMeta, getKindName } from "../apiresource-meta.js";
 import { internalError } from "../errors.js";
 import type { PipelineStep } from "../pipeline.js";
@@ -153,6 +182,30 @@ export function diffVisibilityShapes(
   };
 }
 
+/**
+ * The run audience a workflow instance's execution visibility names — the
+ * one mapping both editions read: open source's check-time derivation
+ * (authorization/model/execution-viewer.ts) turns it into the tuple the
+ * check walks, and the lifecycle event hands it to an edition that stores
+ * tuples. ORGANIZATION names the organization's viewers; PRIVATE and the
+ * unset level name nobody, so each run stays its triggerer's.
+ */
+export function executionAudienceShapes(
+  level: WorkflowExecutionVisibility,
+): ReadonlySet<ExecutionAudienceShape> {
+  switch (level) {
+    case WorkflowExecutionVisibility.organization:
+      return new Set<ExecutionAudienceShape>(["org-viewer"]);
+    case WorkflowExecutionVisibility.private:
+    case WorkflowExecutionVisibility.unspecified:
+      return new Set<ExecutionAudienceShape>();
+    default: {
+      const exhaustive: never = level;
+      throw new Error(`unknown execution visibility: ${String(exhaustive)}`);
+    }
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Parent-id resolution — the ParentIdExtractorRegistry port. The spec-field
 // read itself is shapes.ts's `parentIdOf`, shared with the list read scope
@@ -437,6 +490,7 @@ export function newUpdateVisibilityTuplesStep<Desc extends DescMessage>(
           kind: ctx.apiResourceKind,
           resourceId: metadata.id,
           orgId: metadata.org,
+          caller: ctx.callerIdentity,
           shapesToCreate,
           shapesToDelete,
         });

package/src/pipeline/steps/authorize.ts

@@ -100,11 +100,12 @@ export const AUTHORIZATION_UNAVAILABLE_MESSAGE =
 export const AUTHORIZATION_DENIED_FALLBACK_MESSAGE = "permission denied";
 
 /**
- * The OSS default Authorizer: the permissive single-team posture (DD-007
- * §3) — one trust domain, every authenticated caller may do everything,
- * exactly the pre-O2 behavior. Installed by the composition root when no
- * extension registers an Authorizer (the default lives with the consumer
- * that defines its semantics — registry.ts contract).
+ * The permissive single-team Authorizer (DD-007 §3): one trust domain,
+ * every check allowed, exactly the pre-O2 behavior. Kept for the suites
+ * that need an Authorizer with no opinion at all; no posture composes it.
+ * A server without sign-in composes the trusted-local driver
+ * (authorization/trusted-local-authorizer.ts), which is this plus the
+ * not-found arm for an Organization that does not exist (stigmer#1163).
  */
 export function newPermissiveSingleTeamAuthorizer(): Authorizer {
   return {