@stigmer/server 3.40.1 → 3.41.0

package/src/domain/agentexecution/__tests__/agentexecution.test.ts

@@ -36,24 +36,21 @@ import { createGrpcTransport } from "@connectrpc/connect-node";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
 import {
   ApprovalAction,
   ApprovalEventType,
-  DiffCompleteness,
   ExecutionPhase,
-  FileChangeKind,
   FileChangeSetStatus,
   FileDecisionAction,
   FileDecisionOrigin,
   FileDecisionScope,
-  FileReviewEventType,
   MessageType,
   ServiceTier,
   ToolCallStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { CapturedFileChangeSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
 import {
   SubmitApprovalInputSchema,
   SubmitFileDecisionInputSchema,
@@ -66,16 +63,18 @@ import { loadConfig } from "../../../boot/config.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
+import { trustedLocalIdentity } from "../../../pipeline/interceptors/auth.js";
 import type { AgentExecutionStatusTransition } from "../../../extensions/status-hooks.js";
 import type {
   ConnectedExecutionEngine,
   ExecutionEngineState,
 } from "../engine.js";
-import { EngineWorkflowNotFoundError } from "../engine.js";
-import { aggregateDigest, fileDigest } from "../filereview/digest.js";
+import { ENGINE_DISCONNECTED, EngineWorkflowNotFoundError } from "../engine.js";
 import { submitApproval } from "../submit-approval.js";
 import { submitFileDecision } from "../submit-file-decision.js";
 import { stubConnectedEngine } from "./engine-stub.js";
+import { fileReviewSeed } from "./file-review-seed.js";
+import { seedOrganizations } from "../../organization/__tests__/support.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -125,6 +124,15 @@ beforeAll(async () => {
   const transport: Transport = createGrpcTransport({
     baseUrl: `http://127.0.0.1:${port}`,
   });
+  await seedOrganizations(transport, [
+    ORG,
+    "org-a",
+    "org-b",
+    "org-report",
+    "org-summary",
+    "other-org",
+    "org-never-used",
+  ]);
   command = createClient(AgentExecutionCommandController, transport);
   query = createClient(AgentExecutionQueryController, transport);
 });
@@ -939,6 +947,16 @@ describe("submitApproval over the wire (submit_approval_contract_test.go arms)",
     expect(
       decided?.payload.case === "decided" ? decided.payload.value.comment : "",
     ).toBe("go ahead");
+
+    // A tokenless laptop request is decided by the trusted-local operator,
+    // recorded exactly as its audit actor is (#1385).
+    const operator = trustedLocalIdentity().identityId;
+    expect(tc?.approvedBy).toBe(operator);
+    expect(
+      decided?.payload.case === "decided"
+        ? decided.payload.value.decidedBy
+        : "",
+    ).toBe(operator);
   });
 
   it("is idempotent for a repeated identical submit and refuses a conflicting change", async () => {
@@ -1331,80 +1349,154 @@ describe("the engine-connected signal arms (stubbed engine, direct calls)", () =
   });
 });
 
+describe("the decider is the authorized caller (direct calls, #1385)", () => {
+  const decider = testCallerIdentity({ identityId: "usr_decider" });
+
+  function deps() {
+    return {
+      store: server.store,
+      logger: silentLogger,
+      authorizer: newPermissiveSingleTeamAuthorizer(),
+      broker: server.agentExecutionStreamBroker,
+      engineState: () => ENGINE_DISCONNECTED,
+      gateSteps: new Map(),
+      statusObservers: [],
+    };
+  }
+
+  function decidedByOf(
+    execution: AgentExecution,
+    toolCallId: string,
+  ): string | undefined {
+    const event = (execution.status?.approvalEventStream?.events ?? []).find(
+      (ev) =>
+        ev.approvalRequestId === toolCallId && ev.payload.case === "decided",
+    );
+    return event?.payload.case === "decided"
+      ? event.payload.value.decidedBy
+      : undefined;
+  }
+
+  it("an APPROVE records the caller on the tool call and its decision event", async () => {
+    const id = await seed(gatedSeed());
+
+    const result = await submitApproval(
+      deps(),
+      create(SubmitApprovalInputSchema, {
+        agentExecutionId: id,
+        toolCallId: "tc-1",
+        action: ApprovalAction.APPROVE,
+      }),
+      decider,
+    );
+
+    expect(result.status?.messages[0]?.toolCalls[0]?.approvedBy).toBe(
+      "usr_decider",
+    );
+    expect(decidedByOf(result, "tc-1")).toBe("usr_decider");
+  });
+
+  it("APPROVE_ALL records the caller on the clicked call and every co-pending call it settles", async () => {
+    const id = await seed(
+      gatedSeed({
+        toolCalls: [
+          { id: "tc-shell-1", name: "shell" },
+          { id: "tc-shell-2", name: "bash" },
+          { id: "tc-write", name: "Write" },
+        ],
+      }),
+    );
+
+    const result = await submitApproval(
+      deps(),
+      create(SubmitApprovalInputSchema, {
+        agentExecutionId: id,
+        toolCallId: "tc-shell-1",
+        action: ApprovalAction.APPROVE_ALL,
+      }),
+      decider,
+    );
+
+    const byId = new Map(
+      (result.status?.messages[0]?.toolCalls ?? []).map((tc) => [tc.id, tc]),
+    );
+    for (const settled of ["tc-shell-1", "tc-shell-2"]) {
+      expect(byId.get(settled)?.approvedBy, settled).toBe("usr_decider");
+      expect(decidedByOf(result, settled), settled).toBe("usr_decider");
+    }
+    // The call of another lease class is undecided, so nobody is recorded.
+    expect(byId.get("tc-write")?.approvedBy).toBe("");
+  });
+
+  it("a file decision records the caller as the reviewer, at either scope", async () => {
+    for (const scope of [
+      FileDecisionScope.CHANGE_SET,
+      FileDecisionScope.FILE,
+    ]) {
+      counter += 1;
+      const id = `aexec_reviewer_${counter}`;
+      const slug = `exec-${id.replaceAll("_", "-")}`;
+      const changeSetId = `cs_reviewer_${counter}`;
+      const { status, change, aggregate } = fileReviewSeed(id, changeSetId);
+      await seed({
+        apiVersion: API_VERSION,
+        kind: KIND,
+        metadata: { id, name: slug, slug, org: ORG },
+        spec: { message: "Say hello." },
+        status,
+      });
+
+      const result = await submitFileDecision(
+        deps(),
+        create(SubmitFileDecisionInputSchema, {
+          agentExecutionId: id,
+          changeSetId,
+          scope,
+          action: FileDecisionAction.APPROVE,
+          ...(scope === FileDecisionScope.FILE
+            ? { fileChangeId: change.id, expectedDigest: change.fileDigest }
+            : { expectedDigest: aggregate }),
+        }),
+        decider,
+      );
+
+      const decisions =
+        result.status?.fileChangeSets.find((cs) => cs.id === changeSetId)
+          ?.decisions ?? [];
+      expect(decisions, FileDecisionScope[scope]).toHaveLength(1);
+      expect(decisions[0]?.reviewerId, FileDecisionScope[scope]).toBe(
+        "usr_decider",
+      );
+    }
+  });
+});
+
 describe("submitFileDecision over the wire", () => {
   function ledgerSeed(): {
     init: MessageInitShape<typeof AgentExecutionSchema> & {
       metadata: { id: string };
     };
     changeSetId: string;
-    change: ReturnType<typeof buildChange>;
     aggregate: string;
   } {
     counter += 1;
     const id = `aexec_review_${counter}`;
     const slug = `exec-${id.replaceAll("_", "-")}`;
     const changeSetId = `cs_${counter}`;
-    const change = buildChange();
-    const aggregate = aggregateDigest([change]);
+    const { status, aggregate } = fileReviewSeed(id, changeSetId);
     return {
       init: {
         apiVersion: API_VERSION,
         kind: KIND,
         metadata: { id, name: slug, slug, org: ORG },
         spec: { message: "Say hello." },
-        status: {
-          phase: ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
-          fileReviewEventStream: {
-            executionId: id,
-            events: [
-              {
-                eventId: `${changeSetId}:${changeSetId}:BASELINE`,
-                changeSetId,
-                eventType: FileReviewEventType.BASELINE_CAPTURED,
-                actor: "runner",
-                payload: {
-                  case: "baselineCaptured",
-                  value: { turnId: "turn-1", harnessId: "harness-1" },
-                },
-              },
-              {
-                eventId: `${changeSetId}:${changeSetId}:CANDIDATE`,
-                changeSetId,
-                eventType: FileReviewEventType.CANDIDATE_CAPTURED,
-                actor: "runner",
-                payload: {
-                  case: "candidateCaptured",
-                  value: {
-                    changes: [change],
-                    aggregateDigest: aggregate,
-                    diffCompleteness: DiffCompleteness.COMPLETE,
-                  },
-                },
-              },
-            ],
-          },
-        },
+        status,
       },
       changeSetId,
-      change,
       aggregate,
     };
   }
 
-  function buildChange() {
-    const change = create(CapturedFileChangeSchema, {
-      id: "fc-1",
-      pathBefore: "src/a.ts",
-      pathAfter: "src/a.ts",
-      kind: FileChangeKind.MODIFY,
-      beforeSha256: "a".repeat(64),
-      afterSha256: "b".repeat(64),
-      diffComplete: true,
-    });
-    change.fileDigest = fileDigest(change);
-    return change;
-  }
-
   it("records a CHANGE_SET keep, projects DECIDED, and is idempotent on resubmit", async () => {
     const { init, changeSetId, aggregate } = ledgerSeed();
     const id = await seed(init);

package/src/domain/agentexecution/__tests__/create-steps.test.ts

@@ -12,11 +12,15 @@
  * (stigmer#1387, stigmer#1397): recall is the run's person's own
  * confirmed facts, behind the first-party gate, the org switch and the
  * person's own, and user_context is that person's standing context — the
- * retired Java steps' gates, in their order.
+ * retired Java steps' gates, in their order. The organization's half is
+ * pinned against the composed visitor classifier (stigmer/stigmer#1401):
+ * every lane keeps it but a visitor, whose run never reads the
+ * organization, and a classifier that throws withholds it.
  */
 import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
 import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import type { CallerIdentity } from "../../../extensions/identity.js";
+import type { VisitorClassifier } from "../../../extensions/visitor-classifier.js";
 import type { AccountsByCaller } from "../../identityaccount/resolve.js";
 import { fakeIdentityAccountStore } from "../../identityaccount/__tests__/support.js";
 import { mkdtempSync, rmSync } from "node:fs";
@@ -57,6 +61,7 @@ import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organizat
 
 import { createLogger } from "../../../boot/logger.js";
 import { RequestContext } from "../../../pipeline/request-context.js";
+import { LIST_INDEXES } from "../../../boot/list-indexes.js";
 import { SqliteStore } from "../../../store/sqlite/store.js";
 import type { Store } from "../../../store/interface.js";
 
@@ -86,7 +91,9 @@ let store: Store;
 
 beforeEach(() => {
   dir = mkdtempSync(path.join(tmpdir(), "aexec-create-test-"));
-  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"), undefined, {
+    listIndexes: LIST_INDEXES,
+  });
 });
 
 afterEach(() => {
@@ -403,11 +410,11 @@ function failingGetStore(): Store {
   });
 }
 
-/** Wraps the real store but fails every listResources (the scan-fault arm). */
-function failingListStore(): Store {
+/** Wraps the real store but fails every queryResources (the read-fault arm). */
+function failingQueryStore(): Store {
   return new Proxy(store, {
     get(target, prop, receiver) {
-      if (prop === "listResources") {
+      if (prop === "queryResources") {
         return async () => {
           throw new Error("simulated store fault");
         };
@@ -493,6 +500,108 @@ describe("newComposeDeclaredPreferencesStep", () => {
   }
 });
 
+describe("newComposeDeclaredPreferencesStep for visitors", () => {
+  const ORG_CONTEXT = "We deploy to us-east-1.";
+  const channelSender = testCallerIdentity({ callerClass: "channel" });
+  const member = testCallerIdentity();
+
+  /** The hosted edition's shape: a visitor is a caller of a visitor class. */
+  const channelIsVisitor: VisitorClassifier = {
+    isVisitor: (caller) => caller.callerClass === "channel",
+  };
+
+  /** Wraps the real store, counting organization reads. */
+  function countingStore(): { store: Store; orgReads: () => number } {
+    let reads = 0;
+    const counted = new Proxy(store, {
+      get(target, prop, receiver) {
+        if (prop === "getResource") {
+          return (kind: ApiResourceKind, ...rest: unknown[]) => {
+            if (kind === ApiResourceKind.organization) {
+              reads += 1;
+            }
+            return Reflect.apply(target.getResource, target, [kind, ...rest]);
+          };
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+    return { store: counted, orgReads: () => reads };
+  }
+
+  async function compose(
+    caller: CallerIdentity,
+    classifier: VisitorClassifier | undefined,
+    options: { store?: Store; logger?: typeof silentLogger } = {},
+  ) {
+    await seedOrg("test-org", ORG_CONTEXT);
+    const step = newComposeDeclaredPreferencesStep(
+      options.store ?? store,
+      options.logger ?? silentLogger,
+      undefined,
+      classifier,
+    );
+    const execution = newExecution("ses_1", "agt_1");
+    // The injection attempt: the field is server-owned on this path too.
+    execution.spec!.declaredPreferences = create(DeclaredPreferencesSchema, {
+      orgContext: "injected org context",
+    });
+    const ctx = newContext(execution, caller);
+    await step.execute(ctx);
+    return ctx.newState.spec?.declaredPreferences;
+  }
+
+  it("composes no organization context for a visitor, and never reads the organization", async () => {
+    const counted = countingStore();
+    const got = await compose(channelSender, channelIsVisitor, {
+      store: counted.store,
+    });
+    expect(got, "server-owned field stamped for a visitor").toBeDefined();
+    expect(got?.orgContext).toBe("");
+    expect(counted.orgReads()).toBe(0);
+  });
+
+  it("keeps the organization's context for a member when a classifier is composed", async () => {
+    const got = await compose(member, channelIsVisitor);
+    expect(got?.orgContext).toBe(ORG_CONTEXT);
+  });
+
+  it("keeps the organization's context for every caller when no classifier is composed", async () => {
+    const got = await compose(channelSender, undefined);
+    expect(got?.orgContext).toBe(ORG_CONTEXT);
+  });
+
+  it("classifies a propagated visitor as a visitor (in-process keeps the class)", async () => {
+    const got = await compose(
+      testCallerIdentity({ callerClass: "channel", origin: "in-process" }),
+      channelIsVisitor,
+    );
+    expect(got?.orgContext).toBe("");
+  });
+
+  it("withholds the organization's context when the classifier throws, and logs it at ERROR", async () => {
+    const lines: string[] = [];
+    const logger = createLogger({
+      level: "error",
+      pretty: false,
+      write: (line) => lines.push(line),
+    });
+    const got = await compose(
+      member,
+      {
+        isVisitor: () => {
+          throw new Error("classifier fault");
+        },
+      },
+      { logger },
+    );
+    expect(got?.orgContext).toBe("");
+    expect(lines).toHaveLength(1);
+    expect(lines[0]).toContain("Visitor classifier failed");
+    expect(lines[0]).toContain("classifier fault");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // ComposeRecalledMemories (compose_recalled_memories_step_test.go).
 // ---------------------------------------------------------------------------
@@ -567,7 +676,7 @@ describe("newComposeRecalledMemoriesStep", () => {
     memoryEnabled?: boolean;
     memories?: SeededMemory[];
     failingGet?: boolean;
-    failingList?: boolean;
+    failingQuery?: boolean;
     wantEnabled: boolean;
     wantMemoryIds: string[];
   }> = [
@@ -716,11 +825,11 @@ describe("newComposeRecalledMemoriesStep", () => {
       wantMemoryIds: [],
     },
     {
-      name: "memory scan fault -> DISABLED, never enabled-with-zero-facts",
+      name: "memory read fault -> DISABLED, never enabled-with-zero-facts",
       orgId: "test-org",
       seedOrg: true,
       memoryEnabled: true,
-      failingList: true,
+      failingQuery: true,
       wantEnabled: false,
       wantMemoryIds: [],
     },
@@ -748,8 +857,8 @@ describe("newComposeRecalledMemoriesStep", () => {
       if (tt.failingGet) {
         stepStore = failingGetStore();
       }
-      if (tt.failingList) {
-        stepStore = failingListStore();
+      if (tt.failingQuery) {
+        stepStore = failingQueryStore();
       }
       const step = newComposeRecalledMemoriesStep(stepStore, silentLogger);
 
@@ -895,6 +1004,26 @@ describe("the compose steps where callers are persons", () => {
       state: MemoryLifecycleState.lifecycle_state_proposed,
       createdAt: new Date("2026-09-04T00:00:00Z"),
     });
+    // Carol's own confirmed fact in another organization: the subject key
+    // reads her rows everywhere, and the org narrows them (stigmer#1405).
+    await seedMemory({
+      id: "mem_carol_elsewhere",
+      orgId: "other-org",
+      subject: CAROL,
+      content: "Carol's, elsewhere",
+      state: confirmed,
+      createdAt: new Date("2026-08-15T00:00:00Z"),
+    });
+    // Seeded last and dated first: recall's order is created_at, not the
+    // index's newest-first read or the write order.
+    await seedMemory({
+      id: "mem_carol_first",
+      orgId: "test-org",
+      subject: CAROL,
+      content: "Carol's first",
+      state: confirmed,
+      createdAt: new Date("2026-08-31T00:00:00Z"),
+    });
   }
 
   async function recall(
@@ -907,11 +1036,14 @@ describe("the compose steps where callers are persons", () => {
     return ctx.newState.spec?.recalledMemories;
   }
 
-  it("recalls exactly the run's person's confirmed facts", async () => {
+  it("recalls exactly the run's person's confirmed facts in its organization, oldest first", async () => {
     await seedRecallRows();
     const got = await recall(directory({ memoryEnabled: true }), carol);
     expect(got?.enabled).toBe(true);
-    expect(got?.facts.map((f) => f.memoryId)).toEqual(["mem_carol"]);
+    expect(got?.facts.map((f) => f.memoryId)).toEqual([
+      "mem_carol_first",
+      "mem_carol",
+    ]);
   });
 
   it("recalls nothing and offers no remember tool when the person's own switch is off", async () => {
@@ -954,12 +1086,14 @@ describe("the compose steps where callers are persons", () => {
   async function declared(
     accounts: AccountsByCaller | undefined,
     caller: CallerIdentity,
+    classifier?: VisitorClassifier,
   ) {
     await seedOrg("test-org", "We deploy to us-east-1.");
     const step = newComposeDeclaredPreferencesStep(
       store,
       silentLogger,
       accounts,
+      classifier,
     );
     const execution = newExecution("ses_1", "agt_1");
     execution.spec!.declaredPreferences = create(DeclaredPreferencesSchema, {
@@ -1001,6 +1135,35 @@ describe("the compose steps where callers are persons", () => {
       expect(got?.userContext).toBe("");
     });
   }
+
+  // The hosted edition's classifier composed beside the person directory:
+  // the channel sender is its one visitor here, so it alone loses the
+  // organization's half; every other lane keeps it (stigmer/stigmer#1401).
+  const hostedClassifier: VisitorClassifier = {
+    isVisitor: (caller) => caller.callerClass === "channel",
+  };
+  for (const [name, caller] of notFirstParty) {
+    const visitor = hostedClassifier.isVisitor(caller);
+    it(`${visitor ? "withholds" : "keeps"} the organization's context for ${name} under a visitor classifier`, async () => {
+      const got = await declared(
+        directory({ standingContext: "Call me Carol." }),
+        caller,
+        hostedClassifier,
+      );
+      expect(got?.orgContext).toBe(visitor ? "" : "We deploy to us-east-1.");
+      expect(got?.userContext).toBe("");
+    });
+  }
+
+  it("keeps both halves for Carol herself under a visitor classifier", async () => {
+    const got = await declared(
+      directory({ standingContext: "Call me Carol." }),
+      carol,
+      hostedClassifier,
+    );
+    expect(got?.orgContext).toBe("We deploy to us-east-1.");
+    expect(got?.userContext).toBe("Call me Carol.");
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/domain/agentexecution/__tests__/file-review-seed.ts

@@ -0,0 +1,91 @@
+/**
+ * Test seed for an agent execution parked on file review: the status block
+ * a runner leaves behind when it offers one captured change set — the
+ * BASELINE and CANDIDATE events on the file-review ledger, one complete
+ * MODIFY change with real digests, the execution WAITING_FOR_APPROVAL —
+ * so a submitFileDecision against it passes the completeness and digest
+ * gates. Shared by every suite that decides on a seeded change set (the
+ * agentexecution wire suite, the workflow forwarding suite, the forwarded
+ * attribution test) so the ledger shape lives once.
+ */
+import { create } from "@bufbuild/protobuf";
+import type { MessageInitShape } from "@bufbuild/protobuf";
+
+import type { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import {
+  DiffCompleteness,
+  ExecutionPhase,
+  FileChangeKind,
+  FileReviewEventType,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { CapturedFileChangeSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
+import type { CapturedFileChange } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
+
+import { aggregateDigest, fileDigest } from "../filereview/digest.js";
+
+export interface FileReviewSeed {
+  /** The execution status to seed: parked, with the change set captured. */
+  readonly status: MessageInitShape<typeof AgentExecutionStatusSchema>;
+  readonly change: CapturedFileChange;
+  /** The change set's aggregate digest — a CHANGE_SET decision's expected_digest. */
+  readonly aggregate: string;
+}
+
+/** One complete MODIFY of `src/a.ts`, its file digest computed. */
+export function reviewableChange(): CapturedFileChange {
+  const change = create(CapturedFileChangeSchema, {
+    id: "fc-1",
+    pathBefore: "src/a.ts",
+    pathAfter: "src/a.ts",
+    kind: FileChangeKind.MODIFY,
+    beforeSha256: "a".repeat(64),
+    afterSha256: "b".repeat(64),
+    diffComplete: true,
+  });
+  change.fileDigest = fileDigest(change);
+  return change;
+}
+
+export function fileReviewSeed(
+  executionId: string,
+  changeSetId: string,
+): FileReviewSeed {
+  const change = reviewableChange();
+  const aggregate = aggregateDigest([change]);
+  return {
+    status: {
+      phase: ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+      fileReviewEventStream: {
+        executionId,
+        events: [
+          {
+            eventId: `${changeSetId}:${changeSetId}:BASELINE`,
+            changeSetId,
+            eventType: FileReviewEventType.BASELINE_CAPTURED,
+            actor: "runner",
+            payload: {
+              case: "baselineCaptured",
+              value: { turnId: "turn-1", harnessId: "harness-1" },
+            },
+          },
+          {
+            eventId: `${changeSetId}:${changeSetId}:CANDIDATE`,
+            changeSetId,
+            eventType: FileReviewEventType.CANDIDATE_CAPTURED,
+            actor: "runner",
+            payload: {
+              case: "candidateCaptured",
+              value: {
+                changes: [change],
+                aggregateDigest: aggregate,
+                diffCompleteness: DiffCompleteness.COMPLETE,
+              },
+            },
+          },
+        ],
+      },
+    },
+    change,
+    aggregate,
+  };
+}

package/src/domain/agentexecution/controller.ts

@@ -39,6 +39,7 @@ import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import type { AccountsByCaller } from "../identityaccount/resolve.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
+import type { VisitorClassifier } from "../../extensions/visitor-classifier.js";
 import { stepsForSlot } from "../../extensions/gate-slots.js";
 import type {
   AgentExecutionResponseDecorator,
@@ -165,6 +166,12 @@ export interface AgentExecutionControllerDeps {
    * empty-string sentinel.
    */
   readonly personAccounts: AccountsByCaller | undefined;
+  /**
+   * The composed visitor classifier (stigmer/stigmer#1401) —
+   * ComposeDeclaredPreferences composes no organization standing context
+   * onto a visitor's run; undefined = nobody is a visitor (open source).
+   */
+  readonly visitorClassifier: VisitorClassifier | undefined;
   /**
    * The shared broadcast fabric for subscribe streams. ONE instance spans
    * both routers (serving + in-process) — see stream-broker.ts; the
@@ -379,6 +386,7 @@ async function createExecution(
         deps.store,
         deps.logger,
         deps.personAccounts,
+        deps.visitorClassifier,
       ),
     )
     .addStep(