@stigmer/server 3.40.0 → 3.41.0

package/src/pipeline/steps/defaults.ts

@@ -4,11 +4,26 @@
  *
  * BuildNewState (create-state builder, aligned with Cloud's
  * CreateOperationBuildNewStateStepV2): clears the client-provided status
- * (system-managed), mints metadata.id = {kind-prefix}_{lowercase ULID}
- * when unset, stamps spec_audit and status_audit identically with event
- * "created", and defaults metadata.visibility from the kind's proto
- * VisibilityConfig (blueprints → org, everything else → private; an
- * explicit level is never overwritten).
+ * (system-managed), assigns metadata.id = {kind-prefix}_{lowercase ULID},
+ * stamps spec_audit and status_audit identically with event "created",
+ * and defaults metadata.visibility from the kind's proto VisibilityConfig
+ * (blueprints → org, everything else → private; an explicit level is
+ * never overwritten).
+ *
+ * A create's id is the server's (metadata.proto `id`: "a generated,
+ * prefixed id"), so an id the request carries never survives: it is
+ * replaced, not refused, because an exported manifest applied again
+ * carries its id and must keep working (stigmer/stigmer#1266). For most
+ * kinds a chosen id is cosmetic; for a kind whose id other grants hang
+ * off, choosing it is a grant. The one exception is an id a step EARLIER
+ * in the chain assigned through `assignServerId` (a direct
+ * IdentityAccount's derived id, a Memory's early mint): the step records
+ * the exact id it chose under SERVER_ASSIGNED_ID_KEY, and BuildNewState
+ * keeps metadata.id only while it still equals that record. A claim is a
+ * value, not a flag, so a later step that rewrote the id, or a request
+ * that happened to carry the same string before any claim, keeps nothing.
+ * A kind that derives its id AFTER this step (Organization's CopySlugToId)
+ * needs no claim.
  *
  * SpecAudit/StatusAudit are SLOTS, not steps (stigmer/stigmer#540): every
  * setAuditFieldsForUpdate call site declares which slot it owns —
@@ -66,6 +81,32 @@ import {
   metadataOf,
 } from "./shapes.js";
 
+/**
+ * The context key under which a step records the create id it assigned
+ * before BuildNewState ran (`assignServerId`); its value is that id.
+ */
+export const SERVER_ASSIGNED_ID_KEY = "serverAssignedId";
+
+/**
+ * Assigns a create's id from a step that runs before BuildNewState and
+ * claims it, so BuildNewState keeps it instead of replacing it (module
+ * header). Setting and claiming are one call, so the two cannot drift.
+ */
+export function assignServerId<Desc extends DescMessage>(
+  ctx: RequestContext<Desc>,
+  id: string,
+): void {
+  const metadata = metadataOf(ctx.newState);
+  if (metadata === undefined) {
+    throw internalError(
+      new Error("resource metadata is nil"),
+      "assign server id",
+    );
+  }
+  metadata.id = id;
+  ctx.set(SERVER_ASSIGNED_ID_KEY, id);
+}
+
 export function newBuildNewStateStep<
   Desc extends DescMessage,
 >(): PipelineStep<Desc> {
@@ -86,8 +127,12 @@ export function newBuildNewStateStep<
         clearStatusField(ctx.schema, resource);
       }
 
-      // 2. Mint the id when unset (idempotent): {prefix}_{lowercase ULID}.
-      if (metadata.id === "") {
+      // 2. Assign the id, {prefix}_{lowercase ULID}, whatever the request
+      // carried; keep only an id an earlier step claimed (module header).
+      if (
+        metadata.id === "" ||
+        metadata.id !== ctx.get(SERVER_ASSIGNED_ID_KEY)
+      ) {
         metadata.id = generateId(getIdPrefix(ctx.apiResourceKind));
       }
 

package/src/pipeline/steps/guard-memory-capture.ts

@@ -9,17 +9,16 @@
  * embeds, channel senders, schedule runs — stay refused; "the label is
  * not authorization; the server refuses."
  *
- * The credential class is read from the VERIFIED token's own claims
- * (position 1 verified it; decoding here is a read of trusted state):
- * every Stigmer-minted non-first-party credential carries the
- * `platform_client_id` claim (StigmerJwtIssuer stamps it on user, guest,
- * channel, and schedule tokens alike), so its presence IS the exclusion
- * the Java RequestCallerIdentity.isFirstPartyHumanOperator computes. The
- * claim counts only on a platform token (`iss: "stigmer"`, read through
- * decodeVerifiedPlatformTokenPayload as the PlatformClient origin guard
- * reads it): a bearer another verifier claimed is some other issuer's,
- * whatever claims it carries, and is never taken for a Stigmer-minted
- * one (stigmer#1312).
+ * Who counts as that operator is stated ONCE, in
+ * `isFirstPartyHumanOperator` (extensions/identity.ts), the same
+ * allow-list recall and the person's declared preferences read on
+ * execution create, so the two halves of the memory loop cannot disagree
+ * about who a person is (stigmer#1406): a wire `user` that is not
+ * server-composed and whose bearer is not a PlatformClient token. Being
+ * an allow-list, it refuses a caller class this gate has never heard of
+ * — the half that must fail closed is capture (CheckMemoryEnablement's
+ * header). The PlatformClient arm reads the VERIFIED token's own claims,
+ * and only on a platform token (stigmer#1312, the predicate's own doc).
  *
  * RUNNER credentials carry neither the machine class nor that claim —
  * their eligibility is EDITION POLICY, so the gate consults the composed
@@ -34,16 +33,15 @@
  * below), `no-opinion` (not a credential the implementation classifies —
  * this gate's own logic applies). The capability throws its own
  * byte-pinned refusal for the org-mismatch arm. With no capability
- * composed the gate's logic is byte-identical to before the seam: OSS
- * trusted-local callers carry no token and OIDC console logins are not
- * platform tokens — the step admits both, so the single-user posture is
- * unchanged (proven by the rosters).
+ * composed only the allow-list runs: the OSS trusted-local identity and
+ * OIDC console logins are wire `user`s with no platform token, so the
+ * single-user posture is unchanged (proven by the rosters).
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 
 import {
-  carriesPlatformClientClaim,
+  isFirstPartyHumanOperator,
   isServerComposedRequest,
 } from "../../extensions/identity.js";
 import type { PipelineStep } from "../pipeline.js";
@@ -108,10 +106,7 @@ export function newGuardMemoryCaptureStep<Desc extends DescMessage>(
           }
         }
       }
-      if (
-        caller.callerClass === "machine" ||
-        carriesPlatformClientClaim(caller.rawToken)
-      ) {
+      if (!isFirstPartyHumanOperator(caller)) {
         throw new ConnectError(
           MEMORY_CAPTURE_CALLER_MESSAGE,
           Code.PermissionDenied,

package/src/runnerauth/__tests__/built-in-runner-credential-provider.test.ts

@@ -11,7 +11,7 @@
  *     — an agent execution, a workflow execution (the kind read off the
  *     bound id's prefix), an MCP connect (its own predicate), or nothing
  *     (a person; a token that is not ours; a forged one). One HMAC, no
- *     store read; the lane-admission decorator asks the same question. A
+ *     store read. A
  *     connect binding is answered BY NAME by every capability: it vouches
  *     nothing, captures nothing, and the exchange mints nothing for it.
  *   - `vouchRunnerLineageLabels`: a WORKFLOW-bound runner vouches the two

package/src/runnerauth/__tests__/runner-subject-composed.test.ts

@@ -61,6 +61,7 @@ import { WorkflowExecutionQueryController } from "@stigmer/protos/ai/stigmer/age
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
 import { PlatformQueryController } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
 
 import { loadConfig } from "../../boot/config.js";
 import { composeServer } from "../../boot/compose.js";
@@ -222,6 +223,18 @@ describe("the built-in posture (OIDC, no unit Authorizer): the runner acts as th
     );
     carolId = (await carol.provisionMyAccount({})).metadata?.id ?? "";
     expect(carolId).not.toBe("");
+    // Carol founds the organization her runs belong to, so she holds its
+    // owner role: the model admits a run's creator to it only while they
+    // are in the run's organization.
+    await createClient(
+      OrganizationCommandController,
+      transportFor(port, await issuer.mint("auth0|carol", "carol@example.com")),
+    ).create({
+      apiVersion: "tenancy.stigmer.ai/v1",
+      kind: "Organization",
+      metadata: { name: ORG, slug: ORG, org: "" },
+      spec: { description: "the runner-subject lane's organization" },
+    });
   });
 
   afterAll(async () => {

package/src/runnerauth/bound-execution.ts

@@ -29,8 +29,8 @@
  *     the connect predicate for the third — with no store read. A
  *     session's or an agent's id, a foreign prefix, or garbage is
  *     `undefined`, and the caller refuses with its own sentence. The
- *     lane-admission decorator asks only this, per run-gate check, so it
- *     must stay free of I/O.
+ *     lineage vouch asks only this, synchronously, so it must stay free
+ *     of I/O.
  *   - `loadBoundExecution(store, id)`: the row's facts the lane needs and
  *     nothing else — the creator stamp the verifier resolves a person
  *     from, the org and session the capture capability scopes with, and

package/src/runnerauth/built-in-runner-credential-provider.ts

@@ -11,21 +11,19 @@
  * default alone is composed and none of what follows exists.
  *
  * ONE reading of "what is this runner bound to" — `runnerBindingOf` —
- * feeds everything here and the Authorizer's lane admission
- * (authorization/lane-admission.ts). It re-verifies the caller's own
+ * feeds everything here. It re-verifies the caller's own
  * `rawToken` (the cloud's `verifiedClaims(caller.rawToken)` pattern: one
  * HMAC, no store read) and reads the kind off the bound id's prefix
  * through the contract's table (bound-execution.ts). It checks the
- * caller CLASS first: the lane admission runs on every run-gate check
- * for every caller, and only the runner-subject verifier mints `runner`,
+ * caller CLASS first: only the runner-subject verifier mints `runner`,
  * so a person costs nothing here. It never throws: a person, a runner
  * holding no token, a token this server did not sign, or a binding that
  * names no kind is simply "not a runner binding", and each caller
  * answers its own default for that. A CONNECT binding (`mcp-connect`, a
  * runner reading one discovery's secrets as the person who asked) IS a
- * runner binding, and every capability below answers it by name: it is
- * admitted on no run gate, vouches no lineage, captures no memory, and
- * the exchange mints nothing for it.
+ * runner binding, and every capability below answers it by name: it
+ * vouches no lineage, captures no memory, and the exchange mints nothing
+ * for it.
  *
  * The capabilities, and where they follow or narrow the cloud:
  *
@@ -35,14 +33,11 @@
  *     this, a self-host with sign-in on cannot run any workflow that
  *     calls an agent: the child create's GuardReservedLabels asks the
  *     Authorizer for `can_write_reserved_labels` on the platform object,
- *     which the built-in Authorizer denies for everyone. NARROWER than the
- *     cloud on purpose: the cloud vouches for every runner-class
- *     credential and binds only its workflow lane; here an agent-bound
+ *     which the built-in Authorizer denies for everyone. An agent-bound
  *     runner vouches nothing, because the workflow's `agent_call` activity
  *     is the only producer of the lineage labels and it runs under the
- *     workflow's credential (runner: activities/call-agent.ts). Nothing
- *     observable diverges; do not widen this toward the cloud without a
- *     producer that needs it.
+ *     workflow's credential (runner: activities/call-agent.ts); do not
+ *     widen this without a producer that needs it.
  *   - `authorizeMemoryCapture`: an AGENT-bound runner is ADMITTED with the
  *     human the verifier resolved as the memory's subject — the row's one
  *     principal under the model; without it every memory an enforcing
@@ -160,14 +155,6 @@ export function runnerBindingOf(
   return kind === undefined ? undefined : { kind, executionId };
 }
 
-/** The lane-admission predicate: a runner acting for a WORKFLOW execution (the cloud's `workflow_sandbox`). */
-export function isWorkflowBoundRunner(
-  service: RunnerAuthService,
-  caller: CallerIdentity,
-): boolean {
-  return runnerBindingOf(service, caller)?.kind === "workflow-execution";
-}
-
 /** The kind name the not-found copy carries, by the request's arm (what a `get` on that kind would say). */
 function requestedKindName(
   arm: "agent-execution" | "workflow-execution",

package/src/runnerauth/runner-credential-provider.ts

@@ -128,14 +128,24 @@ export interface RunnerBootstrapCredentials {
 }
 
 /**
- * What the sandbox ensure steps know when they mint the credential baked
- * into a provisioned sandbox (steps.ts). `sessionId` is empty on the
- * workflow scope; `callerIdentityId` is empty when the invocation site
+ * What the sandbox ensure steps (steps.ts) and the MCP connect lane
+ * (domain/mcpserver/connect-sandbox.ts) know when they mint the credential
+ * baked into a provisioned sandbox. `sessionId` is empty on the workflow
+ * and connect scopes; `callerIdentityId` is empty when the invocation site
  * has no caller (the Java ensure step's null-identity arm, which mints
  * nothing rather than minting unattributed).
+ *
+ * The connect scope binds `executionId` to one connect's synthetic id
+ * (domain/mcpserver/connect-execution-id.ts), whose ExecutionContext row
+ * the connect lane has already created AS `callerIdentityId`: the runner
+ * in a connect sandbox reads the McpServer, and classifies its tools
+ * through the proxy, with this credential, so it must act as the person
+ * who asked for the connect (stigmer/stigmer#1474). An implementation
+ * that switches on `scope` handles every arm; a scope it does not know is
+ * a refusal, never another scope's token.
  */
 export interface SandboxCredentialRequest {
-  readonly scope: "session" | "workflow";
+  readonly scope: "session" | "workflow" | "connect";
   readonly sessionId: string;
   readonly executionId: string;
   readonly org: string;
@@ -222,9 +232,9 @@ export interface RunnerCredentialProvider {
 
   /**
    * The credential baked into a provisioned sandbox (SandboxEnvironment.
-   * stigmerToken). When present, the ensure steps delegate here with the
-   * full provisioning context; absent, they mint on the execution_scoped
-   * lane exactly as before. Returns "" to launch tokenless (the
+   * stigmerToken). When present, the ensure steps and the connect lane
+   * delegate here with the full provisioning context; absent, they mint
+   * on the execution_scoped lane exactly as before. Returns "" to launch tokenless (the
    * redaction-fallback contract lane.ts documents); a thrown error
    * propagates to the invoking step's own failure posture.
    */

package/src/sandbox/__tests__/docker.integration.test.ts

@@ -46,6 +46,7 @@ describe.skipIf(!optedIn || !dockerAnswers())(
       // the smoke only needs the vars INJECTED, not a live server behind
       // them (the runner tolerates an unreachable backend at boot).
       backendEndpoint: "http://host.docker.internal:7234",
+      mcpPublicEndpoint: "https://api.example.com",
       temporalAddress: "host.docker.internal:7233",
       temporalNamespace: "default",
       temporalConnectionEnv: {},
@@ -89,6 +90,9 @@ describe.skipIf(!optedIn || !dockerAnswers())(
       );
       expect(container?.Config.Env).toContain("STIGMER_TOKEN=tok-docker-smoke");
       expect(container?.Config.Env).toContain("MODE=local");
+      expect(container?.Config.Env).toContain(
+        `STIGMER_MCP_PUBLIC_ENDPOINT=${config.mcpPublicEndpoint}`,
+      );
 
       // Idempotent fast path.
       await driver.ensureSessionSandbox(sessionId, {

package/src/sandbox/__tests__/kubernetes.test.ts

@@ -10,7 +10,9 @@
  *   - deprovision deletes Deployment + Secret (+ PVC when persistent);
  *   - the manifests carry the Java shapes: Recreate, the runner command,
  *     MODE=local, the secretKeyRef token env only when a token exists,
- *     the empty Secret for token-less sandboxes.
+ *     the empty Secret for token-less sandboxes;
+ *   - the server's public address rides as STIGMER_MCP_PUBLIC_ENDPOINT
+ *     only when configured (stigmer/stigmer#1447).
  */
 import { describe, expect, it } from "vitest";
 
@@ -33,6 +35,7 @@ const silentLogger = { info: () => {} };
 
 const config: SandboxDriverConfig = {
   backendEndpoint: "http://stigmer-server.stigmer.svc:7234",
+  mcpPublicEndpoint: "https://api.example.com",
   temporalAddress: "temporal.stigmer.svc:7233",
   temporalNamespace: "stigmer",
   temporalConnectionEnv: {},
@@ -209,6 +212,9 @@ describe("the manifest shapes (the Java SandboxManifestFactory pins)", () => {
     );
     expect(envByName.get("TEMPORAL_NAMESPACE")?.value).toBe("stigmer");
     expect(envByName.get("WORKSPACE_ROOT_DIR")?.value).toBe("/workspace");
+    expect(envByName.get("STIGMER_MCP_PUBLIC_ENDPOINT")?.value).toBe(
+      config.mcpPublicEndpoint,
+    );
     expect(envByName.get("STIGMER_TOKEN")?.valueFrom?.secretKeyRef?.name).toBe(
       `${sandboxBaseName("session", "ses_1")}-env`,
     );
@@ -217,6 +223,17 @@ describe("the manifest shapes (the Java SandboxManifestFactory pins)", () => {
     );
   });
 
+  it("a server with no public address hands the runner none", () => {
+    const deployment = buildSandboxDeployment("session", "ses_1", env, {
+      ...config,
+      mcpPublicEndpoint: "",
+    });
+    const names = (
+      deployment.spec?.template.spec?.containers[0]?.env ?? []
+    ).map((entry) => entry.name);
+    expect(names).not.toContain("STIGMER_MCP_PUBLIC_ENDPOINT");
+  });
+
   it("a token-less sandbox omits the token env but keeps the (empty) Secret", () => {
     const tokenless = {
       taskQueue: "session:ses_1",

package/src/sandbox/__tests__/local-process.integration.test.ts

@@ -53,6 +53,7 @@ describe.skipIf(process.platform === "win32")(
 
     const config: SandboxDriverConfig = {
       backendEndpoint: "http://127.0.0.1:7234",
+      mcpPublicEndpoint: "http://127.0.0.1:7234",
       temporalAddress: "127.0.0.1:7233",
       temporalNamespace: "stigmer-smoke",
       temporalConnectionEnv: { STIGMER_TEMPORAL_TLS: "true", STIGMER_TEMPORAL_API_KEY: "k-smoke" },
@@ -115,6 +116,9 @@ describe.skipIf(process.platform === "win32")(
       expect(dump).toContain(
         `TEMPORAL_SERVICE_ADDRESS=${config.temporalAddress}`,
       );
+      expect(dump).toContain(
+        `STIGMER_MCP_PUBLIC_ENDPOINT=${config.mcpPublicEndpoint}`,
+      );
       expect(dump).toMatch(/WORKSPACE_ROOT_DIR=.+session-ses_smoke/);
       expect(dump).toContain("TEMPORAL_NAMESPACE=stigmer-smoke");
       expect(dump).toContain("STIGMER_TEMPORAL_TLS=true");

package/src/sandbox/__tests__/provisioner.test.ts

@@ -33,6 +33,7 @@ const silentLogger = createLogger({
 
 const driverConfig: SandboxDriverConfig = {
   backendEndpoint: "http://host.docker.internal:7234",
+  mcpPublicEndpoint: "",
   temporalAddress: "host.docker.internal:7233",
   temporalNamespace: "default",
   temporalConnectionEnv: {},

package/src/sandbox/docker.ts

@@ -145,6 +145,9 @@ export const newDockerSandboxProvisioner: SandboxProvisionerFactory = ({
       `TEMPORAL_NAMESPACE=${config.temporalNamespace}`,
       "--env",
       `WORKSPACE_ROOT_DIR=${CONTAINER_WORKSPACE_DIR}`,
+      ...(config.mcpPublicEndpoint !== ""
+        ? ["--env", `STIGMER_MCP_PUBLIC_ENDPOINT=${config.mcpPublicEndpoint}`]
+        : []),
     ];
     // Value-less --env inherits from the CLI's environment (module header:
     // the token must never appear in argv). The Temporal connection

package/src/sandbox/kubernetes.ts

@@ -316,6 +316,9 @@ export function buildSandboxDeployment(
     { name: "TEMPORAL_NAMESPACE", value: config.temporalNamespace },
     { name: "WORKSPACE_ROOT_DIR", value: WORKSPACE_MOUNT_PATH },
   ];
+  if (config.mcpPublicEndpoint !== "") {
+    containerEnv.push({ name: "STIGMER_MCP_PUBLIC_ENDPOINT", value: config.mcpPublicEndpoint });
+  }
   if (env.stigmerToken !== "") {
     containerEnv.push({
       name: "STIGMER_TOKEN",

package/src/sandbox/local-process.ts

@@ -11,6 +11,7 @@
  * STIGMER_TASK_QUEUE (the one queue this sandbox serves),
  * STIGMER_BACKEND_ENDPOINT / TEMPORAL_SERVICE_ADDRESS (empty values fall
  * back to the runner's own local defaults and Temporal self-discovery),
+ * STIGMER_MCP_PUBLIC_ENDPOINT when the server names its public address,
  * STIGMER_TOKEN when minted ("" stays unset — optional in local mode),
  * and a per-sandbox WORKSPACE_ROOT_DIR so concurrent sandboxes never
  * share a workspace.
@@ -108,6 +109,9 @@ export const newLocalProcessSandboxProvisioner: SandboxProvisionerFactory = ({
     if (config.temporalAddress !== "") {
       childEnv["TEMPORAL_SERVICE_ADDRESS"] = config.temporalAddress;
     }
+    if (config.mcpPublicEndpoint !== "") {
+      childEnv["STIGMER_MCP_PUBLIC_ENDPOINT"] = config.mcpPublicEndpoint;
+    }
     if (env.stigmerToken !== "") {
       childEnv["STIGMER_TOKEN"] = env.stigmerToken;
     }

package/src/sandbox/provisioner.ts

@@ -19,10 +19,12 @@
  *     queue-override lane — dispatch.ts). Ensured critically BEFORE the
  *     execution persists; deprovisioned on the terminal phase transition.
  *   - CONNECT: request-scoped, NOT idempotent; the caller must
- *     deprovision in a finally block. Carried in the contract for the
- *     cloud implementation (its MCP connect lane) — OSS does not invoke
- *     it today because OSS connect runs on the shared runner queue (a
- *     named non-goal, T01 gate ruling Q7).
+ *     deprovision when the connect settles. Every MCP connect provisions
+ *     one when a provisioner is composed, and its workflow runs on the
+ *     queue that sandbox serves (domain/mcpserver/connect-sandbox.ts,
+ *     stigmer/stigmer#1474): with a provisioner the shared runner queue
+ *     has no poller, since boot requires a per-queue routing mode beside
+ *     one. Without a provisioner, connect keeps the shared queue.
  *
  * The probe is ensure-time LIVE-STATE inspection, never a boot-readiness
  * wait (gate ruling Q5): the verified cloud design has NO readiness
@@ -109,8 +111,8 @@ export interface SandboxProvisioner {
   deprovisionWorkflowSandbox(executionId: string): Promise<void>;
   /**
    * Creates a request-scoped connect sandbox and returns the provider's
-   * sandbox id. NOT idempotent — the caller owns deprovision in a
-   * finally block. Unused by OSS wiring today (module header).
+   * sandbox id. NOT idempotent — the caller owns deprovision when the
+   * connect settles (domain/mcpserver/connect-sandbox.ts).
    */
   createConnectSandbox(
     connectRequestId: string,
@@ -134,6 +136,16 @@ export interface SandboxDriverConfig {
    * STIGMER_BACKEND_ENDPOINT.
    */
   readonly backendEndpoint: string;
+  /**
+   * The server's PUBLIC address, the one a remote MCP server can dial back
+   * (STIGMER_SANDBOX_MCP_PUBLIC_ENDPOINT). Injected as
+   * STIGMER_MCP_PUBLIC_ENDPOINT, from which the runner fills a declared,
+   * missing STIGMER_SERVER_ADDRESS (the runner's platform-server-address
+   * module, stigmer/stigmer#1447). Empty injects nothing: the runner then
+   * fills only its stdio children, and a remote server's templated address
+   * stays unresolved rather than guessed.
+   */
+  readonly mcpPublicEndpoint: string;
   /** Temporal address as reachable from inside a sandbox (TEMPORAL_SERVICE_ADDRESS). */
   readonly temporalAddress: string;
   /** The Temporal namespace the sandbox's runner polls in (TEMPORAL_NAMESPACE). */

package/src/store/postgres/__tests__/support.ts

@@ -14,10 +14,19 @@ import { randomBytes } from "node:crypto";
 
 import pg from "pg";
 
-/** Admin URL; undefined disables (visible-skip) the DB-backed suites. */
+/**
+ * Admin URL; undefined disables (visible-skip) the DB-backed suites. Inside a
+ * test gate (`STIGMER_TEST_GATE=1`) the gate provides Postgres, so a missing
+ * URL is the gate's failure, not a skip: this throws, and every DB-backed
+ * file fails by name at collection.
+ */
 export function testDatabaseAdminUrl(): string | undefined {
   const value = process.env.TEST_DATABASE_URL;
-  return value !== undefined && value !== "" ? value : undefined;
+  const url = value !== undefined && value !== "" ? value : undefined;
+  if (url === undefined && process.env.STIGMER_TEST_GATE === "1") {
+    throw new Error("STIGMER_TEST_GATE=1 but TEST_DATABASE_URL is unset: the gate must provide Postgres");
+  }
+  return url;
 }
 
 export interface TestDatabase {

package/src/temporal/README.md

@@ -5,6 +5,7 @@ The shared worker infrastructure and the per-domain workers. Landed with D4 #18
 ## Layout
 
 - `manager.ts` — TemporalManager (ports pkg/server/temporal_manager.go): non-fatal initial connect, 15s health monitor, reconnect with worker recreation, reconnect hooks. Domain code observes the CURRENT client through providers — there is no Go-style creator re-injection.
+- `sdk-logger.ts` — routes the Temporal SDK's own log lines (activity failures, worker lifecycle, workflow `log.*`) through the server logger by installing the SDK's Runtime logger before the first native connect; the header holds the field-redaction table (#1037).
 - `payload-codec.ts` — the decode-only payload codec (ports pkg/encryption/payloadcodec): encode is the identity, decode delegates to @stigmer/temporal-codecs.
 - `workflow-source.ts` — prebuilt-bundle vs bundle-on-boot resolution (runner precedent); prebuilt bundles arrive with #24.
 - `runner-failure.ts` — worker-shutdown classification shared by the execution workflows (ports pkg/runnerfailure, #776).

package/src/temporal/__tests__/manager.test.ts

@@ -19,17 +19,22 @@
  *     (the finding-16 seam — factories never see the NativeConnection);
  *   - a worker's run() rejection logs at ERROR with its queue identity
  *     (a permanent death re-dies on every recreate while the worker
- *     reports RUNNING — the log line is the only signal).
+ *     reports RUNNING — the log line is the only signal);
+ *   - the manager's logger is attached to the SDK log bridge before
+ *     every native connect, first start and reconnect alike (#1037: the
+ *     first native connect creates the Runtime, after which its logger
+ *     cannot be installed).
  *
- * The manager's private dial and the SDK's NativeConnection/Worker.create
- * are stubbed (module mock + private-seam override): the real connect
+ * The manager's private dial, the SDK's NativeConnection/Worker.create and
+ * the process SDK log bridge are stubbed (module mock + private-seam
+ * override), so no test here creates the native Runtime: the real connect
  * path is proven end-to-end by local-execution; these tests pin the
  * manager's OWN state machine and wiring, which only misbehave in windows
  * no live harness can schedule deterministically.
  */
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { createLogger } from "../../boot/logger.js";
+import { createLogger, type Logger } from "../../boot/logger.js";
 import { TemporalManager, type WorkerFactory } from "../manager.js";
 
 const sdkSpy = vi.hoisted(() => ({
@@ -40,6 +45,19 @@ const sdkSpy = vi.hoisted(() => ({
   /** Options of every NativeConnection.connect and Connection.connect call. */
   nativeConnectCalls: [] as Record<string, unknown>[],
   clientConnectCalls: [] as Record<string, unknown>[],
+  /** Bridge attaches and native connects, in the order they happened. */
+  order: [] as Array<"attach" | "native-connect">,
+  /** The logger of every SDK log bridge attach, in order. */
+  attachedLoggers: [] as unknown[],
+}));
+
+vi.mock("../sdk-logger.js", () => ({
+  processSdkLogBridge: {
+    attach: (logger: unknown) => {
+      sdkSpy.order.push("attach");
+      sdkSpy.attachedLoggers.push(logger);
+    },
+  },
 }));
 
 vi.mock("@temporalio/client", async (importOriginal) => {
@@ -65,6 +83,7 @@ vi.mock("@temporalio/worker", async (importOriginal) => {
     NativeConnection: {
       connect: async (options: Record<string, unknown>) => {
         sdkSpy.nativeConnectCalls.push(options);
+        sdkSpy.order.push("native-connect");
         const connection = { close: async () => {} };
         sdkSpy.lastConnection = connection;
         return connection;
@@ -99,6 +118,8 @@ afterEach(async () => {
   sdkSpy.lastConnection = undefined;
   sdkSpy.nativeConnectCalls.length = 0;
   sdkSpy.clientConnectCalls.length = 0;
+  sdkSpy.order.length = 0;
+  sdkSpy.attachedLoggers.length = 0;
   for (const manager of managers.splice(0)) {
     await manager.close();
   }
@@ -381,3 +402,34 @@ describe("TemporalManager worker-death observability", () => {
     expect(death).toContain("poller exploded");
   });
 });
+
+describe("TemporalManager SDK log routing (#1037)", () => {
+  it("attaches its logger to the SDK log bridge before every native connect", async () => {
+    const logger: Logger = createLogger({
+      level: "error",
+      pretty: false,
+      write: () => {},
+    });
+    const manager = newManager([fakeWorkerFactory({ shutdowns: 0 })], {
+      logger,
+    });
+    stubDial(manager, async () => ({
+      connection: { close: async () => {} },
+      client: {},
+    }));
+
+    await manager.initialConnect();
+    await manager.startWorkers();
+    await (
+      manager as unknown as { attemptReconnection: () => Promise<void> }
+    ).attemptReconnection();
+
+    expect(sdkSpy.order).toEqual([
+      "attach",
+      "native-connect",
+      "attach",
+      "native-connect",
+    ]);
+    expect(sdkSpy.attachedLoggers).toEqual([logger, logger]);
+  });
+});

package/src/temporal/__tests__/sdk-log-workflows.ts

@@ -0,0 +1,26 @@
+/**
+ * Test-only workflow for sdk-logger.e2e.test.ts: one `log.warn` from the
+ * workflow body carrying a scalar and a nested field (a line our code
+ * wrote), then one activity that fails on its only attempt (the SDK's own
+ * `Activity failed` line).
+ *
+ * WORKFLOW-BUNDLE IMPORT DISCIPLINE applies (sandbox module).
+ */
+import { log, proxyActivities } from "@temporalio/workflow";
+
+export const SDK_LOG_PROBE_WORKFLOW = "sdkLogProbe";
+export const SDK_LOG_PROBE_ACTIVITY = "SdkLogProbeFailingActivity";
+export const SDK_LOG_PROBE_WARNING = "sdk log probe: workflow warning";
+
+const activities = proxyActivities<Record<string, () => Promise<void>>>({
+  startToCloseTimeout: "10 seconds",
+  retry: { maximumAttempts: 1 },
+});
+
+export async function sdkLogProbe(): Promise<void> {
+  log.warn(SDK_LOG_PROBE_WARNING, {
+    probeCount: 3,
+    outcomes: { reaped: 2, kept: 1 },
+  });
+  await activities[SDK_LOG_PROBE_ACTIVITY]!();
+}