@tpsdev-ai/flair 0.22.0 → 0.23.0

package/dist/resources/OrgEvent.js

@@ -11,12 +11,16 @@
  * distinguishes internal/agent/anonymous explicitly.
  */
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
-const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
-const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+import { makeAuthGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { RECORD_TYPES } from "./record-types.js";
+// See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
+// prototype method below, never a class-field assignment — Harper's
+// relationship-traversal RBAC path reads allowRead off the prototype.
+const orgEventAuthGate = makeAuthGate();
 export class OrgEvent extends databases.flair.OrgEvent {
-    allowRead() { return allowVerified(this.getContext?.()); }
+    allowRead() { return orgEventAuthGate.call(this); }
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
@@ -24,19 +28,21 @@ export class OrgEvent extends databases.flair.OrgEvent {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
             return UNAUTH();
-        // No-forge attribution: a non-admin agent's events are ALWAYS attributed to
-        // its authenticated identity (from the Ed25519 signature), never the body —
-        // an agent can only publish AS itself. We overwrite `authorId` rather than
-        // 403'ing a mismatch so a CLI client never has to echo its own id into the
-        // body (mirrors A2A message/send's "sender must match params.agentId" guard
-        // and Presence's "agentId from signature, NOT from body"). Admin agents may
-        // publish on behalf of another agent (body authorId honored, else their own).
-        if (auth.kind === "agent" && !auth.isAdmin) {
-            content.authorId = auth.agentId;
-        }
-        else if (auth.kind === "agent" && auth.isAdmin) {
-            content.authorId ||= auth.agentId;
-        }
+        // No-forge attribution — mode/field drawn from RECORD_TYPES.OrgEvent
+        // (record-types slice 2, flair#520) rather than hand-typed literals.
+        // "stamp-default" (see record-type-kit.ts's stampAttribution doc): a
+        // non-admin agent's events are ALWAYS attributed to its authenticated
+        // identity (from the Ed25519 signature), never the body — an agent can
+        // only publish AS itself. We overwrite `authorId` rather than 403'ing a
+        // mismatch so a CLI client never has to echo its own id into the body
+        // (mirrors A2A message/send's "sender must match params.agentId" guard
+        // and Presence's "agentId from signature, NOT from body"). Admin agents
+        // may publish on behalf of another agent (body authorId honored, else
+        // their own).
+        // "stamp-default" never denies (no rejection branch for non-admin) —
+        // the forbiddenMessage arg is dead for this mode, passed for signature
+        // completeness only.
+        stampAttribution(auth, content, RECORD_TYPES.OrgEvent.ownerField, RECORD_TYPES.OrgEvent.attribution.post, "forbidden: unreachable for stamp-default");
         if (!content.id)
             content.id = `${content.authorId}-${new Date().toISOString()}`;
         content.createdAt = new Date().toISOString();
@@ -53,9 +59,13 @@ export class OrgEvent extends databases.flair.OrgEvent {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
             return UNAUTH();
-        if (auth.kind === "agent" && !auth.isAdmin && content.authorId !== auth.agentId) {
-            return FORBIDDEN("forbidden: authorId must match authenticated agent");
-        }
+        // No-forge attribution — mode/field drawn from RECORD_TYPES.OrgEvent.
+        // "validate-strict" (see record-type-kit.ts's stampAttribution doc):
+        // rejects a mismatch INCLUDING when authorId is absent (a bare `!==`
+        // compare, no truthy guard).
+        const attr = stampAttribution(auth, content, RECORD_TYPES.OrgEvent.ownerField, RECORD_TYPES.OrgEvent.attribution.put, "forbidden: authorId must match authenticated agent");
+        if (attr.denied)
+            return attr.denied;
         // attention-plane vocabulary gate (flair#675) — same as post() above.
         const entitiesError = invalidEntitiesResponse(content.entities);
         if (entitiesError)
@@ -63,16 +73,17 @@ export class OrgEvent extends databases.flair.OrgEvent {
         return databases.flair.OrgEvent.put(content);
     }
     async delete(id, context) {
-        const auth = await this._auth();
-        if (auth.kind === "anonymous")
-            return UNAUTH();
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+        // Dispatch shape shared via record-type-kit.ts's resolveAuthGate — same
+        // three-way branch Memory.ts/Relationship.ts/WorkspaceState.ts use.
+        const gate = await resolveAuthGate(this.getContext?.(), UNAUTH());
+        if (gate.kind === "denied")
+            return gate.response;
+        if (gate.kind === "unfiltered")
             return super.delete(id, context);
-        }
         const record = await this.get(id);
         if (!record)
             return super.delete(id, context);
-        if (record.authorId !== auth.agentId) {
+        if (record.authorId !== gate.agentId) {
             return FORBIDDEN("forbidden: cannot delete events authored by another agent");
         }
         return super.delete(id, context);

package/dist/resources/Relationship.js

@@ -1,11 +1,22 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 import { localInstanceId } from "./instance-identity.js";
-import { buildProvenance } from "./provenance.js";
-const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
-const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
-const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { RECORD_TYPES } from "./record-types.js";
+// Parameterized from RECORD_TYPES.Relationship (record-types slice 2,
+// flair#520) rather than a hand-typed "owner-only" literal — the registry is
+// now the single source of truth this class draws its read-scope mode from.
+// Exported solely so test/unit/record-types-registry.test.ts's drift
+// tripwire can introspect the composed resolver's tagged `.mode`/
+// `.ownerField` against RECORD_TYPES.Relationship — not for any other
+// runtime consumer.
+export const relationshipReadScope = makeReadScope(RECORD_TYPES.Relationship.readScope, RECORD_TYPES.Relationship.ownerField);
+const relationshipByIdReadGate = makeByIdReadGate(relationshipReadScope);
+// See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
+// prototype method below, never a class-field assignment — Harper's
+// relationship-traversal RBAC path reads allowRead off the prototype.
+const relationshipAuthGate = makeAuthGate();
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
  *
@@ -28,13 +39,14 @@ export class Relationship extends databases.flair.Relationship {
      * ownership scoping happens in get() below; the collection scope is still
      * in search().
      */
-    allowRead() { return allowVerified(this.getContext?.()); }
+    allowRead() { return relationshipAuthGate.call(this); }
     /**
      * Override get() to scope by-id reads the same way search() scopes
      * collection reads (memory-soul-read-gate family fix). Never distinguishes
      * "doesn't exist" from "exists but not yours" — both return 404, never
      * 403, so a denied caller can't use get() to enumerate other agents'
-     * relationship ids.
+     * relationship ids. Wired through record-type-kit.ts's makeByIdReadGate,
+     * scoped "owner-only" — same dispatch shape Memory.ts's get() uses.
      */
     async get(target) {
         // Collection / query reads arrive as a RequestTarget with
@@ -47,39 +59,23 @@ export class Relationship extends databases.flair.Relationship {
         if (!target || (typeof target === "object" && target.isCollection)) {
             return this.search(target);
         }
-        const auth = await resolveAgentAuth(this.getContext?.());
-        // Anonymous by-id read is already blocked at the allowRead() gate (403);
-        // this is defense-in-depth if get() is ever reached directly.
-        if (auth.kind === "anonymous") {
-            return NOT_FOUND();
-        }
-        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
-            return super.get(target);
-        }
-        // Non-admin agent: only its own relationships.
-        const record = await super.get(target);
-        if (!record)
-            return NOT_FOUND();
-        if (record.agentId !== auth.agentId)
-            return NOT_FOUND();
-        return record;
+        return relationshipByIdReadGate.call(this, target, (t) => super.get(t));
     }
     async search(query) {
-        const auth = await resolveAgentAuth(this.getContext?.());
+        const ctx = this.getContext?.();
         // Anonymous HTTP must NOT read relationships (previously `!authAgent` was
-        // treated as unfiltered — the anonymous-read leak).
-        if (auth.kind === "anonymous") {
-            return new Response(JSON.stringify({ error: "authentication required" }), {
-                status: 401, headers: { "content-type": "application/json" },
-            });
-        }
-        // Trusted internal call or admin agent → unfiltered.
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+        // treated as unfiltered — the anonymous-read leak). Trusted internal call
+        // or admin agent → unfiltered. Dispatch shape shared via
+        // record-type-kit.ts's resolveAuthGate — same three-way branch Memory.ts/
+        // WorkspaceState.ts's search() use.
+        const gate = await resolveAuthGate(ctx, UNAUTH());
+        if (gate.kind === "denied")
+            return gate.response;
+        if (gate.kind === "unfiltered")
             return super.search(query);
-        }
         // Non-admin agent: scope to own relationships.
-        const agentCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
+        const scope = await relationshipReadScope(gate.agentId);
+        const agentCondition = scope.condition;
         if (!query?.conditions) {
             return super.search({ conditions: [agentCondition], ...(query || {}) });
         }
@@ -130,16 +126,15 @@ export class Relationship extends databases.flair.Relationship {
         if (auth.kind === "anonymous") {
             return UNAUTH();
         }
-        if (auth.kind === "agent") {
-            if (!auth.isAdmin) {
-                if (content?.agentId && content.agentId !== auth.agentId) {
-                    return FORBIDDEN("cannot write a relationship owned by another agent");
-                }
-                content.agentId = auth.agentId;
-            }
-            // admin: content.agentId left as provided (unfiltered) — see doc above.
-        }
-        // internal: content.agentId left as provided (unfiltered) — see doc above.
+        // No-forge attribution — mode/field drawn from RECORD_TYPES.Relationship
+        // (record-types slice 2, flair#520) rather than a hand-typed literal.
+        // "stamp-strict" (see record-type-kit.ts's stampAttribution doc): reject
+        // a PRESENT, mismatched agentId, else unconditionally stamp with the
+        // verified identity. Admin/internal: content.agentId left as provided
+        // (unfiltered) — see doc above.
+        const attr = stampAttribution(auth, content, RECORD_TYPES.Relationship.ownerField, RECORD_TYPES.Relationship.attribution.put, "cannot write a relationship owned by another agent");
+        if (attr.denied)
+            return attr.denied;
         if (!content.agentId || typeof content.agentId !== "string") {
             return new Response(JSON.stringify({ error: "agentId is required" }), {
                 status: 400, headers: { "content-type": "application/json" },
@@ -190,6 +185,11 @@ export class Relationship extends databases.flair.Relationship {
         // pre-existing row with no provenance field reads back `undefined`,
         // unchanged behavior (migration-equivalence gate).
         content.provenance = buildProvenance(auth, content.createdAt, content);
+        // flair#718 authorship-provenance — same contract as resources/Memory.ts's
+        // post()/put(): `claimedClient` is a write-body-only passthrough, already
+        // folded into `provenance.claimed.client` above. Strip it so it is NEVER
+        // persisted as a row field.
+        delete content.claimedClient;
         // Write-time originatorInstanceId stamp (federation-edge-hardening slice
         // 1) — see resources/Memory.ts's stampOriginatorInstanceId doc for the
         // full contract. No-op if already set (never fires for a genuine local
@@ -214,17 +214,16 @@ export class Relationship extends databases.flair.Relationship {
      */
     async delete(_) {
         const ctx = this.getContext?.();
-        const auth = await resolveAgentAuth(ctx);
-        if (auth.kind === "anonymous") {
-            return UNAUTH();
-        }
-        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+        // Dispatch shape shared via record-type-kit.ts's resolveAuthGate — same
+        // three-way branch put()/get()/search() above use.
+        const gate = await resolveAuthGate(ctx, UNAUTH());
+        if (gate.kind === "denied")
+            return gate.response;
+        if (gate.kind === "unfiltered")
             return super.delete(_);
-        }
         // Non-admin agent: verify ownership before delete.
         const existing = await super.get();
-        if (existing?.agentId && existing.agentId !== auth.agentId) {
+        if (existing?.agentId && existing.agentId !== gate.agentId) {
             return FORBIDDEN("cannot delete another agent's relationship");
         }
         return super.delete(_);

package/dist/resources/Soul.js

@@ -1,24 +1,32 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { localInstanceId } from "./instance-identity.js";
-const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
-const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+import { makeAuthGate, stampAttribution, UNAUTH } from "./record-type-kit.js";
+import { RECORD_TYPES } from "./record-types.js";
 /**
  * Deny anonymous; enforce per-agent write ownership for non-admin agents.
  * The previous header-based check only fired when an agent WAS present (it read
  * x-tps-agent), so an anonymous request — which carries no x-tps-agent — slipped
  * through. With the non-rejecting gate, each write path self-enforces (resolveAgentAuth
  * distinguishes internal/agent/anonymous). Mirrors the WorkspaceState pattern.
+ *
+ * No-forge attribution — mode/field drawn from RECORD_TYPES.Soul (record-
+ * types slice 2, flair#520) rather than hand-typed literals. "validate-
+ * truthy" (see record-type-kit.ts's stampAttribution doc) — rejects a
+ * PRESENT, mismatched agentId; passes through untouched when absent. Same
+ * idiom as Memory.post()/put().
  */
 async function enforceWriteAuth(self, data) {
     const auth = await resolveAgentAuth(self.getContext?.());
     if (auth.kind === "anonymous")
         return UNAUTH();
-    if (auth.kind === "agent" && !auth.isAdmin && data?.agentId && data.agentId !== auth.agentId) {
-        return FORBIDDEN("forbidden: agentId must match authenticated agent");
-    }
-    return null;
+    const attr = stampAttribution(auth, data, RECORD_TYPES.Soul.ownerField, RECORD_TYPES.Soul.attribution.post, "forbidden: agentId must match authenticated agent");
+    return attr.denied ?? null;
 }
+// See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
+// prototype method below, never a class-field assignment — Harper's
+// relationship-traversal RBAC path reads allowRead off the prototype.
+const soulAuthGate = makeAuthGate();
 export class Soul extends databases.flair.Soul {
     /**
      * Self-authorize now that the global gate is non-rejecting. Closes the P0
@@ -30,7 +38,7 @@ export class Soul extends databases.flair.Soul {
      * verified agent — same posture as Agent.ts's allowRead. Write ownership
      * is unaffected — enforceWriteAuth() below already gates post()/put().
      */
-    allowRead() { return allowVerified(this.getContext?.()); }
+    allowRead() { return soulAuthGate.call(this); }
     async post(content, context) {
         const denied = await enforceWriteAuth(this, content);
         if (denied)

package/dist/resources/WorkspaceState.js

@@ -8,11 +8,23 @@
  * Use this.getContext() to access request context (tpsAgent, tpsAgentIsAdmin).
  */
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
-const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
-const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
-const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+import { makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { RECORD_TYPES } from "./record-types.js";
+// Parameterized from RECORD_TYPES.WorkspaceState (record-types slice 2,
+// flair#520) rather than a hand-typed "owner-only" literal — the registry is
+// now the single source of truth this class draws its read-scope mode from.
+// Exported solely so test/unit/record-types-registry.test.ts's drift
+// tripwire can introspect the composed resolver's tagged `.mode`/
+// `.ownerField` against RECORD_TYPES.WorkspaceState — not for any other
+// runtime consumer.
+export const workspaceReadScope = makeReadScope(RECORD_TYPES.WorkspaceState.readScope, RECORD_TYPES.WorkspaceState.ownerField);
+const workspaceByIdReadGate = makeByIdReadGate(workspaceReadScope);
+// See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
+// prototype method below, never a class-field assignment — Harper's
+// relationship-traversal RBAC path reads allowRead off the prototype.
+const workspaceAuthGate = makeAuthGate();
 export class WorkspaceState extends databases.flair.WorkspaceState {
     /** Auth verdict from the request context. internal = trusted in-process call;
      *  agent = verified Ed25519; anonymous = HTTP with no valid agent → deny. */
@@ -29,13 +41,15 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
      * full record content. Per-record ownership scoping happens in get() below;
      * the collection scope is still in search().
      */
-    allowRead() { return allowVerified(this.getContext?.()); }
+    allowRead() { return workspaceAuthGate.call(this); }
     /**
      * Override get() to scope by-id reads the same way search() scopes
      * collection reads (memory-soul-read-gate family fix). Never distinguishes
      * "doesn't exist" from "exists but not yours" — both return 404, never
      * 403, so a denied caller can't use get() to enumerate other agents'
-     * workspace-state ids.
+     * workspace-state ids. Wired through record-type-kit.ts's
+     * makeByIdReadGate, scoped "owner-only" — same dispatch shape
+     * Memory.ts/Relationship.ts's get() use.
      */
     async get(target) {
         // Collection / query reads — the `GET /WorkspaceState/?<query>` form and
@@ -49,23 +63,7 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         if (!target || (typeof target === "object" && target.isCollection)) {
             return this.search(target);
         }
-        const auth = await this._auth();
-        // Anonymous by-id read is already blocked at the allowRead() gate (403);
-        // this is defense-in-depth if get() is ever reached directly.
-        if (auth.kind === "anonymous") {
-            return NOT_FOUND();
-        }
-        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
-            return super.get(target);
-        }
-        // Non-admin agent: only its own workspace-state records.
-        const record = await super.get(target);
-        if (!record)
-            return NOT_FOUND();
-        if (record.agentId !== auth.agentId)
-            return NOT_FOUND();
-        return record;
+        return workspaceByIdReadGate.call(this, target, (t) => super.get(t));
     }
     /**
      * Override search() to scope collection GETs to the authenticated agent's own
@@ -73,13 +71,15 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
      * (previously `!authAgent` was treated as unfiltered — the anonymous-read leak).
      */
     async search(query) {
-        const auth = await this._auth();
-        if (auth.kind === "anonymous")
-            return UNAUTH();
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+        // Dispatch shape shared via record-type-kit.ts's resolveAuthGate — same
+        // three-way branch Memory.ts/Relationship.ts's search() use.
+        const gate = await resolveAuthGate(this.getContext?.(), UNAUTH());
+        if (gate.kind === "denied")
+            return gate.response;
+        if (gate.kind === "unfiltered")
             return super.search(query);
-        }
-        const agentIdCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
+        const scope = await workspaceReadScope(gate.agentId);
+        const agentIdCondition = scope.condition;
         // Harper passes `query` as a request target object (pathname, id, isCollection…).
         // Inject the scope condition into its `.conditions` array.
         if (query && typeof query === "object" && !Array.isArray(query)) {
@@ -100,19 +100,20 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         // there was no authenticated agent, so anonymous could write any record).
         if (auth.kind === "anonymous")
             return UNAUTH();
-        // No-forge: a non-admin agent's workspace record is ALWAYS attributed to the
-        // authenticated identity (from the Ed25519 signature), never the body. We do
-        // NOT trust `content.agentId` — overwriting it (rather than 403'ing a
-        // mismatch) mirrors Presence.post(): "agentId from signature, NOT from body".
-        // An admin may write on behalf of another agent (content.agentId honored if
-        // present, else defaults to the admin's own id). Internal in-process callers
-        // keep whatever agentId they pass.
-        if (auth.kind === "agent" && !auth.isAdmin) {
-            content.agentId = auth.agentId;
-        }
-        else if (auth.kind === "agent" && auth.isAdmin) {
-            content.agentId ||= auth.agentId;
-        }
+        // No-forge attribution — mode/field drawn from RECORD_TYPES.WorkspaceState
+        // (record-types slice 2, flair#520) rather than hand-typed literals.
+        // "stamp-default" (see record-type-kit.ts's stampAttribution doc): a
+        // non-admin agent's workspace record is ALWAYS attributed to the
+        // authenticated identity (from the Ed25519 signature), never the body.
+        // We do NOT trust `content.agentId` — overwriting it (rather than
+        // 403'ing a mismatch) mirrors Presence.post(): "agentId from signature,
+        // NOT from body". An admin may write on behalf of another agent
+        // (content.agentId honored if present, else defaults to the admin's own
+        // id). Internal in-process callers keep whatever agentId they pass.
+        // "stamp-default" never denies (no rejection branch for non-admin) —
+        // the forbiddenMessage arg is dead for this mode, passed for signature
+        // completeness only.
+        stampAttribution(auth, content, RECORD_TYPES.WorkspaceState.ownerField, RECORD_TYPES.WorkspaceState.attribution.post, "forbidden: unreachable for stamp-default");
         content.createdAt = new Date().toISOString();
         content.timestamp ||= content.createdAt;
         // attention-plane vocabulary gate (flair#675): `entities`, if present,
@@ -127,9 +128,13 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
             return UNAUTH();
-        if (auth.kind === "agent" && !auth.isAdmin && content.agentId !== auth.agentId) {
-            return FORBIDDEN("forbidden: cannot write workspace state for another agent");
-        }
+        // No-forge attribution — mode/field drawn from RECORD_TYPES.WorkspaceState.
+        // "validate-strict" (see record-type-kit.ts's stampAttribution doc):
+        // rejects a mismatch INCLUDING when agentId is absent (a bare `!==`
+        // compare, no truthy guard).
+        const attr = stampAttribution(auth, content, RECORD_TYPES.WorkspaceState.ownerField, RECORD_TYPES.WorkspaceState.attribution.put, "forbidden: cannot write workspace state for another agent");
+        if (attr.denied)
+            return attr.denied;
         // attention-plane vocabulary gate (flair#675) — same as post() above.
         const entitiesError = invalidEntitiesResponse(content.entities);
         if (entitiesError)
@@ -137,15 +142,14 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         return super.put(content);
     }
     async delete(id) {
-        const auth = await this._auth();
-        // Anonymous must NOT delete (previously `!agentId → super.delete` let anonymous
-        // delete any record).
-        if (auth.kind === "anonymous")
-            return UNAUTH();
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+        // Dispatch shape shared via record-type-kit.ts's resolveAuthGate — same
+        // three-way branch get()/search() above use.
+        const gate = await resolveAuthGate(this.getContext?.(), UNAUTH());
+        if (gate.kind === "denied")
+            return gate.response;
+        if (gate.kind === "unfiltered")
             return super.delete(id);
-        }
-        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // Use super.get(id), NOT this.get(id): the get() override above 404s
         // (a truthy Response) for a non-owner id, which would otherwise defeat
         // the `if (!record)` check below and mis-route a genuinely-missing
         // record into the FORBIDDEN branch instead of a clean super.delete(id)
@@ -153,7 +157,7 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         const record = await super.get(id);
         if (!record)
             return super.delete(id);
-        if (record.agentId !== auth.agentId) {
+        if (record.agentId !== gate.agentId) {
             return FORBIDDEN("forbidden: cannot delete workspace state for another agent");
         }
         return super.delete(id);

package/dist/resources/mcp-handler.js

@@ -65,12 +65,21 @@ function jitProvisionEnabled() {
  * XAA's ID-JAG path uses (resources/XAA.ts resolveOrCreatePrincipal) — one
  * identity model, keyed on the IdP subject.
  *
+ * `clientId` (flair#718 authorship-provenance) is NOT part of sub resolution —
+ * it rides along from the verified token's `client_id` claim (see
+ * handleToolCall's stamp-site comment for why `client_id` and never
+ * `client_name`) and is copied onto the resolved agent unchanged so downstream
+ * write tools (memory_store/memory_update) can thread it into `claimedClient`.
+ * Omitted from the returned object entirely when absent — never stamped as
+ * `undefined` — so existing callers/tests that don't pass one see the exact
+ * same `{ agentId, isAdmin }` shape as before this field existed.
+ *
  * Returns:
- *   - `{ agentId, isAdmin }` when a Credential maps the sub to an Agent.
+ *   - `{ agentId, isAdmin, clientId? }` when a Credential maps the sub to an Agent.
  *   - null when no Credential maps the sub AND JIT-provisioning is disabled or
  *     failed → the handler denies the tool call (sub is unresolvable).
  */
-export async function resolveAgentFromSub(sub) {
+export async function resolveAgentFromSub(sub, clientId) {
     if (!sub)
         return null;
     // 1. Existing IdP credential → its principalId is the Agent id.
@@ -87,7 +96,10 @@ export async function resolveAgentFromSub(sub) {
                     await databases.flair.Credential.put({ ...cred, lastUsedAt: new Date().toISOString() });
                 }
                 catch { /* non-fatal */ }
-                return { agentId: String(cred.principalId), isAdmin: await isAgentAdmin(cred.principalId) };
+                const resolved = { agentId: String(cred.principalId), isAdmin: await isAgentAdmin(cred.principalId) };
+                if (clientId)
+                    resolved.clientId = clientId;
+                return resolved;
             }
         }
     }
@@ -98,7 +110,10 @@ export async function resolveAgentFromSub(sub) {
     try {
         const principalId = await jitProvisionPrincipal(sub);
         // A JIT-provisioned principal is a fresh, non-admin agent by construction.
-        return { agentId: principalId, isAdmin: false };
+        const resolved = { agentId: principalId, isAdmin: false };
+        if (clientId)
+            resolved.clientId = clientId;
+        return resolved;
     }
     catch {
         return null;
@@ -221,7 +236,16 @@ async function handleToolCall(request, id, params) {
     if (!sub) {
         return rpcError(id, -32001, "unauthorized: no verified token subject");
     }
-    const agent = await resolveAgentFromSub(String(sub));
+    // flair#718 authorship-provenance, Sherlock's binding refinement: source
+    // the authorship stamp from `client_id` (the server-generated
+    // `flair_cl_...` machine id — resources/OAuth.ts, an RS256-verified JWT
+    // claim, not a secret) — NEVER `client_name` (a free-text label the client
+    // supplied at Dynamic Client Registration time and fully controls). Do NOT
+    // "helpfully" switch this to `client_name` for a prettier label; that would
+    // turn a server-verified, stable id into caller-forgeable data landing in
+    // stored provenance. Absent/non-string client_id → omitted, not invented.
+    const clientId = typeof request?.mcp?.client_id === "string" ? request.mcp.client_id : undefined;
+    const agent = await resolveAgentFromSub(String(sub), clientId);
     if (!agent) {
         // Sub verified by the AS but not mapped to a flair Agent (and JIT disabled /
         // failed). Deny — do NOT fall back to anonymous or admin.