@stigmer/server 3.40.1 → 3.41.0

package/src/extensions/registry.ts

@@ -42,6 +42,7 @@
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { ConnectRouter } from "@connectrpc/connect";
 
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 
 import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
@@ -62,21 +63,28 @@ import type { ListReadScope } from "./list-read-scope.js";
 import type { PolicyGrantScope } from "./policy-grant-scope.js";
 import type { PrincipalDisplay } from "./principal-display.js";
 import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
+import {
+  kindEnumName,
+  kindServedByEdition,
+} from "../pipeline/apiresource-meta.js";
 import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
 import type { PipelineStep } from "../pipeline/pipeline.js";
 import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
 import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
+import type { VisitorClassifier } from "./visitor-classifier.js";
 import { BUILT_IN_SANDBOX_PROVISIONER_TYPES } from "../sandbox/provisioner.js";
 import type { WorkerFactory } from "../temporal/manager.js";
 import type { Authorizer } from "./authorizer.js";
 import type { CallerGuard } from "./caller-guards.js";
+import type { ComposedServices } from "./composed-services.js";
 import type { ExtensionDrivers } from "./drivers.js";
 import { DECLARED_GATE_SLOTS } from "./gate-slots.js";
 import type { GateSlotName, ResolvedGateSteps } from "./gate-slots.js";
 import type { IdentityVerifier } from "./identity.js";
 import type { OrganizationDirectory } from "./organization-directory.js";
 import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
+import type { ResourceRowReader } from "./resource-row-reader.js";
 import type {
   AgentExecutionResponseDecorator,
   AgentExecutionStatusHooks,
@@ -172,6 +180,24 @@ export interface ServerExtension {
   readonly services?: ReadonlyArray<ExtensionServiceRegistration>;
   /** Temporal worker factories, appended to the manager's OSS factory list. */
   readonly workers?: ReadonlyArray<WorkerFactory>;
+  /**
+   * Receives the composition's own instances — the Authorizer, the list
+   * read scope, the policy check, the tuple lifecycle and the in-process
+   * transport — once, in unit order, at the end of `composeServer`
+   * (extensions/composed-services.ts carries the contract).
+   */
+  readonly onComposed?: (composed: ComposedServices) => void;
+  /**
+   * Boot work that must finish before anything serves, run in unit order
+   * first in the server's `start()`; a throw fails the start.
+   */
+  readonly start?: () => Promise<void>;
+}
+
+/** A unit's hand-over or start hook with the unit that contributed it, so a failing start names its unit. */
+export interface ResolvedUnitHook<T> {
+  readonly unit: string;
+  readonly hook: T;
 }
 
 /**
@@ -208,6 +234,12 @@ export interface ResolvedExtensions {
   readonly drivers: ResolvedExtensionDrivers;
   readonly services: ReadonlyArray<ResolvedServiceRegistration>;
   readonly workers: ReadonlyArray<WorkerFactory>;
+  /** The units' hand-over hooks, in unit order. */
+  readonly onComposed: ReadonlyArray<
+    ResolvedUnitHook<(composed: ComposedServices) => void>
+  >;
+  /** The units' start hooks, in unit order. */
+  readonly start: ReadonlyArray<ResolvedUnitHook<() => Promise<void>>>;
 }
 
 /**
@@ -320,6 +352,18 @@ export interface ResolvedExtensionDrivers {
    * UNIMPLEMENTED with the edition sentence.
    */
   readonly guestTokenMinting: GuestTokenMinting | undefined;
+  /**
+   * The visitor classifier — undefined = nobody is a visitor, so every
+   * run carries its organization's standing context.
+   */
+  readonly visitorClassifier: VisitorClassifier | undefined;
+  /**
+   * Kind → the reader of that kind's rows (extensions/resource-row-reader.ts),
+   * validated against the kinds open source keeps itself. Empty = the
+   * built-in authorizer reads every row from the generic Store and identity
+   * accounts through the account port, OSS behavior byte-identical.
+   */
+  readonly resourceRowReaders: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
 }
 
 /**
@@ -339,6 +383,9 @@ export function resolveExtensions(
   const responseDecorators: AgentExecutionResponseDecorator[] = [];
   const services: ResolvedServiceRegistration[] = [];
   const workers: WorkerFactory[] = [];
+  const onComposed: ResolvedUnitHook<(composed: ComposedServices) => void>[] =
+    [];
+  const start: ResolvedUnitHook<() => Promise<void>>[] = [];
 
   let edition: ServerEdition | undefined;
   let editionDeclaredBy: string | undefined;
@@ -385,6 +432,8 @@ export function resolveExtensions(
   let platformTokenKeysDeclaredBy: string | undefined;
   let guestTokenMinting: GuestTokenMinting | undefined;
   let guestTokenMintingDeclaredBy: string | undefined;
+  let visitorClassifier: VisitorClassifier | undefined;
+  let visitorClassifierDeclaredBy: string | undefined;
   const artifactStorageDrivers = new Map<
     string,
     ArtifactStorageDriverFactory
@@ -397,6 +446,8 @@ export function resolveExtensions(
   const sandboxDriverDeclaredBy = new Map<string, string>();
   const secretCodecs = new Map<string, SecretCodec>();
   const secretCodecDeclaredBy = new Map<string, string>();
+  const resourceRowReaders = new Map<ApiResourceKind, ResourceRowReader>();
+  const rowReaderDeclaredBy = new Map<ApiResourceKind, string>();
 
   for (const unit of units) {
     if (unit.name === "") {
@@ -636,6 +687,16 @@ export function resolveExtensions(
       guestTokenMintingDeclaredBy = unit.name;
     }
 
+    if (unit.drivers?.visitorClassifier !== undefined) {
+      if (visitorClassifierDeclaredBy !== undefined) {
+        throw new Error(
+          `extension '${unit.name}' registers a VisitorClassifier, but '${visitorClassifierDeclaredBy}' already did — exactly one may be composed`,
+        );
+      }
+      visitorClassifier = unit.drivers.visitorClassifier;
+      visitorClassifierDeclaredBy = unit.name;
+    }
+
     if (unit.drivers?.artifactStorageDrivers !== undefined) {
       for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
         if ((BUILT_IN_STORAGE_TYPES as ReadonlyArray<string>).includes(name)) {
@@ -703,6 +764,40 @@ export function resolveExtensions(
       }
     }
 
+    if (unit.drivers?.resourceRowReaders !== undefined) {
+      for (const [kind, reader] of unit.drivers.resourceRowReaders) {
+        if (kind === ApiResourceKind.api_resource_kind_unknown) {
+          throw new Error(
+            `extension '${unit.name}' registers a row reader for the unknown kind — a reader names the kind whose rows it reads`,
+          );
+        }
+        const name = kindEnumName(kind);
+        if (kind === ApiResourceKind.identity_account) {
+          // Accounts are read through the account port, the binding every
+          // other reader of accounts follows; a composition substitutes it
+          // as drivers.identityAccountStore, never as a second reader.
+          throw new Error(
+            `extension '${unit.name}' registers a row reader for '${name}', which is reserved — identity accounts are read through the account port (drivers.identityAccountStore)`,
+          );
+        }
+        if (kindServedByEdition(kind, ServerEdition.oss)) {
+          // Open source keeps its own kinds' rows in its own store; a
+          // reader would answer checks from rows its lanes never wrote.
+          throw new Error(
+            `extension '${unit.name}' registers a row reader for '${name}', which open source serves from its own store — readers are for kinds a unit keeps itself`,
+          );
+        }
+        const declaredBy = rowReaderDeclaredBy.get(kind);
+        if (declaredBy !== undefined) {
+          throw new Error(
+            `extension '${unit.name}' registers a row reader for '${name}', but '${declaredBy}' already did — one reader per kind across the composed set`,
+          );
+        }
+        resourceRowReaders.set(kind, reader);
+        rowReaderDeclaredBy.set(kind, unit.name);
+      }
+    }
+
     if (unit.gateSteps !== undefined) {
       for (const [slot, steps] of unit.gateSteps) {
         if (!DECLARED_GATE_SLOTS.has(slot)) {
@@ -734,6 +829,12 @@ export function resolveExtensions(
       })),
     );
     workers.push(...(unit.workers ?? []));
+    if (unit.onComposed !== undefined) {
+      onComposed.push({ unit: unit.name, hook: unit.onComposed });
+    }
+    if (unit.start !== undefined) {
+      start.push({ unit: unit.name, hook: unit.start });
+    }
   }
 
   return {
@@ -772,8 +873,12 @@ export function resolveExtensions(
       platformClientStore,
       platformTokenKeys,
       guestTokenMinting,
+      visitorClassifier,
+      resourceRowReaders,
     },
     services,
     workers,
+    onComposed,
+    start,
   };
 }

package/src/extensions/resource-authorization.ts

@@ -52,6 +52,17 @@
  *     before the row mirror existed.
  * Absent method = no mirror is written (the OSS posture: rows are the
  * record).
+ *
+ * One more structural relation rides the seam the way `default_of` does:
+ * a workflow instance's run audience, `execution_viewer`, which open
+ * source derives from `spec.execution_visibility` when a check asks
+ * (authorization/model/execution-viewer.ts) and an edition that stores
+ * tuples must write. `onExecutionVisibilityChanged` hands the driver the
+ * audience the stored level names, from the two doors that may set it
+ * (create, and updateExecutionVisibility; Update and Apply keep the
+ * stored level, domain/workflowinstance/steps.ts). Synchronous,
+ * post-persist; a throw fails the request with the level persisted, and a
+ * retry converges because the event is the whole target state.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
@@ -72,6 +83,16 @@ import type { CallerIdentity } from "./identity.js";
  */
 export type VisibilityTupleShape = "org-viewer" | "platform-viewer";
 
+/**
+ * The run-audience shapes of a workflow instance's execution visibility,
+ * named edition-neutrally. The driver maps each to its tuple:
+ *   - org-viewer: <instanceKind>:<id>#execution_viewer@organization:<org>#viewer
+ * The same word as the resource visibility's org shape, a different
+ * relation: making an instance's RUNS observable never widens who can see
+ * or run the instance itself (fga/model/agentic/workflow_instance.fga).
+ */
+export type ExecutionAudienceShape = "org-viewer";
+
 /**
  * One resolved structural link from the created resource to a parent
  * object — the scope link (relation `organization` for ORGANIZATION
@@ -160,6 +181,8 @@ export interface VisibilityChangedEvent {
   readonly kind: ApiResourceKind;
   readonly resourceId: string;
   readonly orgId: string;
+  /** Who changed the visibility — the audience rows a driver writes are theirs to answer for. */
+  readonly caller: CallerIdentity;
   /** Shapes present in the new level but not the old — to be written. */
   readonly shapesToCreate: ReadonlyArray<VisibilityTupleShape>;
   /** Shapes present in the old level but not the new — to be deleted. */
@@ -185,6 +208,22 @@ export interface DefaultInstanceLinkedEvent {
   readonly blueprintId: string;
 }
 
+/**
+ * Fired synchronously after a workflow instance's
+ * `spec.execution_visibility` is persisted at create (only when the level
+ * names an audience) or by updateExecutionVisibility (always). `shapes` is
+ * the audience the stored level names — ["org-viewer"] for ORGANIZATION,
+ * [] for PRIVATE and unset — never a diff: the driver makes its tuples
+ * match it, so a retry, a repeat, or a transition whose old level it never
+ * saw all converge.
+ */
+export interface ExecutionVisibilityChangedEvent {
+  readonly instanceKind: ApiResourceKind;
+  readonly instanceId: string;
+  readonly orgId: string;
+  readonly shapes: ReadonlyArray<ExecutionAudienceShape>;
+}
+
 /**
  * Fired synchronously AFTER an IamPolicy row is persisted by the domain's
  * grant path — and on the duplicate arm, when the triple was already held
@@ -210,6 +249,22 @@ export interface PolicyRevokedEvent {
   readonly policy: IamPolicy | undefined;
 }
 
+/**
+ * A person's organization rows are about to change, or have changed. The
+ * model's `organization#affiliated` (fga/model/tenancy/organization.fga)
+ * stands exactly while the person holds at least one row on the
+ * organization; the grant path announces every change of those rows and an
+ * edition that stores tuples keeps the relation from the announcements.
+ * The grant path never says whether the person is still affiliated: the
+ * driver derives that from the committed rows, so two changes racing on
+ * one person cannot leave the tuple standing on the word of the one that
+ * read first.
+ */
+export interface OrganizationAffiliationEvent {
+  readonly identityAccountId: string;
+  readonly organizationId: string;
+}
+
 /**
  * The driver interface (single-instance point, registered via
  * ExtensionDrivers.resourceAuthorizationLifecycle). Implementations must
@@ -227,6 +282,15 @@ export interface ResourceAuthorizationLifecycle {
    * (the OSS posture: local access control needs none).
    */
   onDefaultInstanceLinked?(event: DefaultInstanceLinkedEvent): Promise<void>;
+  /**
+   * OPTIONAL (stigmer-cloud#720): synchronous, post-persist; a throw fails
+   * the request (the level survives — retry converges, the event is the
+   * target state). Absent method = no run-audience tuple is written (the
+   * OSS posture: the relation is derived from the row at check time).
+   */
+  onExecutionVisibilityChanged?(
+    event: ExecutionVisibilityChangedEvent,
+  ): Promise<void>;
   /**
    * OPTIONAL (added 20260913.01 slice 2): synchronous, AFTER the row
    * persist, on the duplicate arm too; a throw fails the grant with the
@@ -239,4 +303,27 @@ export interface ResourceAuthorizationLifecycle {
    * rows are the record (the OSS posture).
    */
   onPolicyRevoked?(event: PolicyRevokedEvent): Promise<void>;
+  /**
+   * OPTIONAL: synchronous, BEFORE a row naming an account on an
+   * organization is deleted, ahead of that row's `onPolicyRevoked`. A
+   * driver removes the organization's `affiliated` tuple for the account
+   * here, so a crash anywhere after it leaves the person denied, never
+   * admitted. A throw leaves every row in place for the retry. Absent
+   * method = the edition derives the relation from rows (the OSS posture).
+   */
+  onOrganizationAffiliationChanging?(
+    event: OrganizationAffiliationEvent,
+  ): Promise<void>;
+  /**
+   * OPTIONAL: synchronous, AFTER a row naming an account on an organization
+   * is written (the duplicate arm too, the inline heal) or deleted, and
+   * after a revoke that found no row. A driver re-derives the
+   * organization's `affiliated` tuple for the account from the committed
+   * rows: written while one remains, removed when none does. A throw fails
+   * the request with the rows committed; the next change or the driver's
+   * own reconcile converges. Absent method = as above.
+   */
+  onOrganizationAffiliationChanged?(
+    event: OrganizationAffiliationEvent,
+  ): Promise<void>;
 }

package/src/extensions/resource-row-reader.ts

@@ -0,0 +1,43 @@
+/**
+ * The resource-row-reader driver point: where the built-in authorizer
+ * reads the rows of a kind a unit keeps in a store of its own. Keyed by
+ * kind, registered as `drivers.resourceRowReaders`.
+ *
+ * The built-in authorizer evaluates the one authorization model over the
+ * tuples each row stands for, derived from the row when a check asks
+ * (authorization/derived-tuples.ts). It reads open source's kinds from the
+ * generic Store and identity accounts through the account port. A kind an
+ * edition above open source serves (an identity provider, an invitation,
+ * a team) lives wherever the unit that serves it keeps it, so the unit
+ * says where: it registers a reader for each such kind, and the built-in
+ * loader asks that reader before the generic Store. A unit that keeps its
+ * rows in the generic Store registers a reader over it; one with tables of
+ * its own registers a reader over those. Under a composition's own
+ * Authorizer nothing reads them.
+ *
+ * The contract:
+ *   - `findById` answers the row decoded with the kind's model schema
+ *     (authorization/model/bindings.ts), or undefined when no row has the
+ *     id. Undefined is a real answer: the authorizer then denies, and never
+ *     reports the row missing, for the kinds whose existence it does not
+ *     disclose (authorization/authorizer.ts, NOT_FOUND_EXEMPT_KINDS).
+ *   - A fault it cannot answer through THROWS (the ListReadScope rule: an
+ *     absent row is never an outage in disguise), and the check answers
+ *     unavailable, never a denial.
+ *   - The row's organization, creator stamp and visibility are the ones
+ *     its unit wrote: the tuples derive from them, so a reader that hands
+ *     back a different organization grants that organization's members.
+ *
+ * The merge rules (extensions/registry.ts): one reader per kind across the
+ * composed set; never for an open-source kind, whose rows are open
+ * source's own store's; never for `identity_account`, whose rows are read
+ * through the account port a composition substitutes as
+ * `drivers.identityAccountStore`. Each is a boot throw naming the unit.
+ */
+import type { Message } from "@bufbuild/protobuf";
+
+/** The row-reader contract (keyed point, ExtensionDrivers.resourceRowReaders). */
+export interface ResourceRowReader {
+  /** The row with this id, decoded with the kind's model schema, or undefined when absent. */
+  findById(id: string): Promise<Message | undefined>;
+}

package/src/extensions/visitor-classifier.ts

@@ -0,0 +1,41 @@
+/**
+ * The visitor-classifier driver point: which callers are VISITORS, people
+ * the organization lets reach its agents without belonging to it.
+ * Single instance, registered as `drivers.visitorClassifier`.
+ *
+ * Open source has no visitor lanes: every caller it authenticates is the
+ * organization's own (a person, a runner, a machine account, the server
+ * itself). An edition that admits outsiders mints their credentials (the
+ * cloud's shared-agent guests and channel senders, each a caller class of
+ * its own) and says here which callers those are. OSS never learns the
+ * lane names (the guard-memory-capture.ts doctrine); it asks this point.
+ * Absent means nobody is a visitor, which is true of open source.
+ *
+ * A core step reads it wherever an outsider must be treated differently
+ * from a member. Today that is ComposeDeclaredPreferences: the
+ * organization's standing context, written by its admins for its own
+ * work, is never composed onto a visitor's run (stigmer/stigmer#1401).
+ * The error boundary's VisitorErrorPolicy stays its own seam: its
+ * eligibility is method-aware and must answer before an identity exists
+ * (pipeline/interceptors/error-boundary.ts).
+ *
+ * The contract:
+ *   - Synchronous and cheap: it runs on every execution create. The
+ *     classification keys on the verified identity alone (its class,
+ *     its raw token), never on a store read.
+ *   - It classifies the caller whatever the transport: in-process
+ *     propagation keeps the forwarded identity's class
+ *     (pipeline/interceptors/auth.ts), so a visitor's request the server
+ *     composes further stays a visitor's.
+ *   - A throw counts as a visitor at every consumer, which logs it:
+ *     withholding the organization's context from a member is
+ *     recoverable, handing it to an outsider is not (the error boundary's
+ *     posture).
+ */
+import type { CallerIdentity } from "./identity.js";
+
+/** The visitor-classifier contract (single-instance point, ExtensionDrivers.visitorClassifier). */
+export interface VisitorClassifier {
+  /** Whether `caller` is a visitor: admitted to the organization's agents without belonging to it. */
+  isVisitor(caller: CallerIdentity): boolean;
+}

package/src/identity/__tests__/oidc-verifier.test.ts

@@ -2,7 +2,8 @@
  * Pins the OIDC identity verifier against a hermetic local issuer (an
  * in-process HTTP server serving real discovery + JWKS documents, tokens
  * signed with a real RS256 keypair — no network, no mocks of jose):
- * claim-or-pass (non-JWT shapes pass, JWT shapes are claimed), the
+ * claim-or-pass (non-JWT shapes and JWTs naming another issuer pass;
+ * this issuer's JWTs are claimed, and a JWT naming no issuer is refused), the
  * identity mapping (sub/iss/email/name), the four byte-pinned Java
  * classifyAuthError arms, and the infrastructure-fault posture (discovery
  * failures are plain errors for the chassis's INTERNAL arm — never
@@ -151,6 +152,32 @@ describe("claim-or-pass", () => {
     expect(await verifier().verify("two.segments")).toBeNull();
     expect(await verifier().verify("a..c")).toBeNull();
   });
+
+  it("passes (null) on a JWT naming another issuer — a composition's own lane for that issuer stays reachable — and fetches nothing", async () => {
+    const token = await mintToken({
+      sub: "s",
+      issuerClaim: "https://tenant.example",
+    });
+    const before = { ...hits };
+    expect(await verifier().verify(token)).toBeNull();
+    expect(hits).toEqual(before);
+  });
+
+  it("passes (null) on an issuer that differs only by a trailing slash: the comparison is exact, as discovery's is", async () => {
+    const token = await mintToken({ sub: "s", issuerClaim: `${issuer}/` });
+    expect(await verifier().verify(token)).toBeNull();
+  });
+
+  it("refuses a JWT naming no issuer with 'invalid token': it is malformed, not another lane's", async () => {
+    const segment = (value: unknown): string =>
+      Buffer.from(JSON.stringify(value)).toString("base64url");
+    const noIssuer = `${segment({ alg: "RS256", kid: "test-key" })}.${segment({
+      sub: "s",
+    })}.${segment("sig")}`;
+    const error = await rejectionOf(verifier().verify(noIssuer));
+    expect(ConnectError.from(error).code).toBe(Code.Unauthenticated);
+    expect(ConnectError.from(error).rawMessage).toBe(INVALID_TOKEN_MESSAGE);
+  });
 });
 
 describe("identity mapping", () => {
@@ -204,15 +231,6 @@ describe("the byte-pinned classifyAuthError arms", () => {
     expect(ConnectError.from(error).rawMessage).toBe(TOKEN_SIGNATURE_MESSAGE);
   });
 
-  it("issuer-claim mismatch → 'invalid token' (the fallback arm)", async () => {
-    const token = await mintToken({
-      sub: "s",
-      issuerClaim: "https://evil.test",
-    });
-    const error = await rejectionOf(verifier().verify(token));
-    expect(ConnectError.from(error).rawMessage).toBe(INVALID_TOKEN_MESSAGE);
-  });
-
   it("a garbage three-segment token → 'invalid token'", async () => {
     const error = await rejectionOf(verifier().verify("aaa.bbb.ccc"));
     expect(ConnectError.from(error).code).toBe(Code.Unauthenticated);
@@ -375,7 +393,13 @@ describe("infrastructure faults are never credential rejections", () => {
       accounts: fakeIdentityAccountStore(),
       discovery: newIssuerDiscovery(),
     });
-    const error = await rejectionOf(dead.verify(await mintToken({ sub: "s" })));
+    // The token names the dead issuer, so this lane claims it and must
+    // reach the network: a token naming another issuer passes first.
+    const error = await rejectionOf(
+      dead.verify(
+        await mintToken({ sub: "s", issuerClaim: "http://127.0.0.1:1" }),
+      ),
+    );
     expect(error).not.toBeInstanceOf(ConnectError);
   });
 
@@ -389,7 +413,9 @@ describe("infrastructure faults are never credential rejections", () => {
       discovery: newIssuerDiscovery(),
     });
     const error = await rejectionOf(
-      misconfigured.verify(await mintToken({ sub: "s" })),
+      misconfigured.verify(
+        await mintToken({ sub: "s", issuerClaim: `${issuer}/` }),
+      ),
     );
     expect(error).not.toBeInstanceOf(ConnectError);
     expect(String(error)).toContain("does not match configured issuer");

package/src/identity/oidc-userinfo.ts

@@ -11,7 +11,12 @@
  * the cloud's verifiers name theirs on the CallerIdentity they mint. The
  * one issuer whose userinfo can answer for a token is the one that issued
  * it — and a verifier already trusted it, so the token goes only where it
- * came from.
+ * came from. The domain calls this only for a caller the platform's own
+ * sign-in vouched for (domain/identityaccount/resolve.ts
+ * `mayProvisionDirectAccount`), so the issuer is always the operator's own
+ * configuration: an issuer an organization admin registered, whose
+ * discovery document could name any address, never reaches this plain
+ * fetch.
  *
  * The endpoint is the discovery document's word, never a guessed
  * `<issuer>/userinfo`: a document that names no `userinfo_endpoint` is

package/src/identity/oidc-verifier.ts

@@ -6,11 +6,19 @@
  * Cloud points STIGMER_OIDC_ISSUER at Auth0 and registers NO code here;
  * any self-host points it at their own issuer (Keycloak, Okta, Dex, …).
  *
- * Claim rule: any JWT-shaped token (three non-empty dot-separated
- * segments). API keys never look like JWTs (`stk_` + one Base64URL run),
- * so ordering after the apikey verifier keeps both claims disjoint; a
- * JWT-shaped token that fails verification THROWS (identity.ts contract)
- * with the Java classifyAuthError copy, byte-pinned:
+ * Claim rule: a JWT-shaped token (three non-empty dot-separated segments)
+ * whose `iss` is this lane's issuer, compared exactly, as discovery
+ * compares it. API keys never look like JWTs (`stk_` + one Base64URL run),
+ * so ordering after the apikey verifier keeps both claims disjoint. A JWT
+ * naming another issuer PASSES, so a lane composed after this one (a
+ * composition's own sign-in lane for another issuer) can claim it, and a
+ * token no lane claims is refused by the verifier chain as unclaimed —
+ * UNAUTHENTICATED either way. The `iss` read before verification only
+ * routes the token; it grants nothing, because a claimed token is then
+ * verified whole against this issuer's keys. A JWT-shaped token with no
+ * readable string `iss` is malformed and THROWS "invalid token". A claimed
+ * token that fails verification THROWS (identity.ts contract) with the
+ * Java classifyAuthError copy, byte-pinned:
  *
  *   - expiry → "token has expired"
  *   - audience mismatch → "token audience does not match the expected audience"
@@ -41,10 +49,15 @@
  * issuer is the configured issuer; email/displayName come from the
  * standard `email`/`name` claims when present (the DD-007 Q5 addendum
  * added the fields for exactly these claims), whichever way the subject
- * resolved. Claim-or-pass runs before any of this: a non-JWT token
- * passes with no network.
+ * resolved. Claim-or-pass runs before any of this: a non-JWT token, and a
+ * JWT from another issuer, passes with no network.
  */
-import { createRemoteJWKSet, jwtVerify, errors as joseErrors } from "jose";
+import {
+  createRemoteJWKSet,
+  decodeJwt,
+  jwtVerify,
+  errors as joseErrors,
+} from "jose";
 import type { JWTPayload } from "jose";
 import { Code, ConnectError } from "@connectrpc/connect";
 
@@ -98,6 +111,9 @@ export function newOidcIdentityVerifier(
       if (!isJwtShaped(token)) {
         return null;
       }
+      if (unverifiedIssuerOf(token) !== config.issuer) {
+        return null;
+      }
       const keys = await jwksFor();
       let payload: JWTPayload;
       try {
@@ -127,6 +143,24 @@ export function newOidcIdentityVerifier(
   };
 }
 
+/**
+ * The `iss` a JWT-shaped token names, read without verifying it — only to
+ * decide which lane verifies it. A payload that does not decode, or names
+ * no string issuer, is a malformed credential this lane refuses outright.
+ */
+function unverifiedIssuerOf(token: string): string {
+  let issuer: unknown;
+  try {
+    issuer = decodeJwt(token).iss;
+  } catch {
+    throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+  }
+  if (typeof issuer !== "string" || issuer === "") {
+    throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+  }
+  return issuer;
+}
+
 /** Three non-empty dot-separated segments — the JWS compact shape. */
 function isJwtShaped(token: string): boolean {
   const segments = token.split(".");