okengine 0.3.6 → 0.5.0

package/src/kernel/app.ts

@@ -25,22 +25,28 @@ import {
 // when an app actually boots (AGENTS.md / unified-theory budget: cold start < 75 ms).
 import type { BootOptions, BootResult, ElementRuntimes } from "./boot.ts";
 import type { CapabilityToken } from "./capability.ts";
+import { createAppAuthBinding, verifyBearerToken, type AppAuthBinding } from "./auth-resolve.ts";
+import { createAuthHttpBindings, type AuthHttpMaterialization } from "../auth/bindings.ts";
+import { auth as authPlugin } from "../auth/plugin.ts";
+import { tokenFromCookieHeader } from "../auth/cookies.ts";
+import { setActiveGateAuthContext } from "../auth/method-context.ts";
 import {
-  createAppAuthBinding,
-  verifyBearerToken,
-  type AppAuthBinding,
-  type CreateAppAuthBindingOptions,
-} from "./auth-resolve.ts";
+  resolveGateConfig,
+  type GateOptions,
+  type ResolvedGateConfig,
+} from "../elements/gate/config.ts";
 import { runDurable } from "../elements/clock/durable.ts";
 import { isFlow, type AnyFlowDef } from "./flow.ts";
 import { fxRetry } from "./concurrency.ts";
 import {
   createFxContext,
+  freezePrincipal,
   resolveName,
   type CreateFxOptions,
   type Fx,
   type FxAuth,
   type FxOperator,
+  type FxPrincipal,
   type NamedRef,
 } from "./fx.ts";
 import {
@@ -149,8 +155,11 @@ export interface OkeOptions {
   readonly vault?: BootOptions["vault"];
   /** Vault secret contracts (shorthand for `vault.secrets`). */
   readonly secrets?: BootOptions["secrets"];
-  /** Gate declarations for the runtime. */
-  readonly gates?: BootOptions["gates"];
+  /**
+   * Nested Gate bag — auth, policies, rate limits, HTTP posture.
+   * Replaces root `auth` / `gates` / `unguardedHttp`.
+   */
+  readonly gate?: GateOptions;
   /** Signal declarations. */
   readonly signals?: BootOptions["signals"];
   /** Named clock declarations. */
@@ -163,8 +172,10 @@ export interface OkeOptions {
   readonly ai?: BootOptions["ai"];
   /**
    * Boot automatically on first {@link OkeApp.execute} / {@link OkeApp.fetch}
-   * call. Default `false` — call {@link OkeApp.boot} explicitly (tests
-   * usually want a fail-fast boot before serving any request).
+   * call. Default `true` — gate posture, vault, capabilities, and the element
+   * pipeline must run before any real traffic. Opt out only for intentional
+   * pre-boot unit tests: `oke({ autoBoot: false })` skips `doBoot` entirely
+   * (no gates / elements) and must never ship as a serving default.
    */
   readonly autoBoot?: boolean;
   /**
@@ -174,11 +185,6 @@ export interface OkeOptions {
   readonly startScheduler?: boolean;
   /** Scheduler tick period ms (default 1000). Forwarded to boot. */
   readonly schedulerIntervalMs?: number;
-  /**
-   * Builtin hybrid-session auth (HMAC access tokens).
-   * Required to accept `Authorization: Bearer` in production.
-   */
-  readonly auth?: CreateAppAuthBindingOptions;
 }
 
 /** Payload for a CDC invocation. */
@@ -405,6 +411,22 @@ export function oke(options: OkeOptions): OkeApp {
       ? [...(options.bindings ?? [])]
       : [...listBindings(), ...(options.bindings ?? [])];
   if (registry === "consume") resetBindings();
+
+  // Resolve Gate bag early so auth HTTP Bindings join `adopted` + the router
+  // before posture audit (same ensureBoot → doBoot path — never a side channel).
+  const gateConfig: ResolvedGateConfig = resolveGateConfig({
+    gate: options.gate,
+    env: options.env,
+  });
+  let authMaterialization: AuthHttpMaterialization | undefined;
+  if (gateConfig.auth?.http) {
+    authMaterialization = createAuthHttpBindings(gateConfig.auth, {
+      rateLimitEnabled: gateConfig.rateLimitEnabled,
+      sessions: gateConfig.auth.sessions,
+    });
+    adopted.push(...authMaterialization.bindings);
+  }
+
   /** Retained for test harness / boot merges. */
   const $options = options;
 
@@ -417,6 +439,29 @@ export function oke(options: OkeOptions): OkeApp {
   /** Runtime route table — types accumulate on the returned {@link OkeApp}. */
   const routes: RuntimeRouteMap = {};
 
+  // Absorb auth() tables into gate.auth — `.needs("auth")` sees plugin name.
+  if (gateConfig.auth) {
+    applyPlugin(
+      pluginRegistry,
+      authPlugin({
+        secret: gateConfig.auth.secret,
+        accessTtlMs: gateConfig.auth.session.accessTtlMs,
+        refreshTtlMs: gateConfig.auth.session.refreshTtlMs,
+        session: {
+          accessTtlMs: gateConfig.auth.session.accessTtlMs,
+          refreshTtlMs: gateConfig.auth.session.refreshTtlMs,
+          idleTtlMs: gateConfig.auth.session.idleTtlMs,
+          absoluteTtlMs: gateConfig.auth.session.absoluteTtlMs,
+          singleSessionPerUser: gateConfig.auth.session.singleSessionPerUser,
+        },
+        password: gateConfig.auth.password,
+        passwordPolicy: gateConfig.auth.passwordPolicy,
+        breachCheck: gateConfig.auth.breachCheck,
+      }),
+      appPluginScope,
+    );
+  }
+
   const smart = createRouter<Binding>(options.router ?? "default");
   for (const b of adopted) {
     if (b.trigger.kind === "http") {
@@ -424,9 +469,65 @@ export function oke(options: OkeOptions): OkeApp {
       compiled.set(b, compileHttpBinding(b, aot));
     }
   }
-  smart.build();
+  // Defer SmartRouter selection until first match so `.plug()` can still
+  // contribute auth-method Bindings before traffic (plan Phase 2).
   const router: Router<Binding> = smart;
 
+  function adoptBinding(b: Binding): void {
+    adopted.push(b);
+    registerFlow(b.flow);
+    if (b.trigger.kind === "http") {
+      smart.add(b.trigger.method, b.trigger.path, b);
+      compiled.set(b, compileHttpBinding(b, aot));
+    }
+  }
+
+  // Phase 1a: mirror tokens into Set-Cookie when gate.auth.cookies.enabled.
+  if (gateConfig.auth?.cookies.enabled) {
+    const cookieCfg = gateConfig.auth.cookies;
+    const basePath = gateConfig.auth.basePath;
+    const list = appHooks.afterHandle ?? (appHooks.afterHandle = []);
+    list.push(async (ctx) => {
+      const res = ctx.response;
+      if (!(res instanceof Response) || !ctx.request) return;
+      const url = new URL(ctx.request.url);
+      const path = url.pathname;
+      const underAuth = path === basePath || path.startsWith(`${basePath}/`);
+      const isRevoke = path === `${basePath}/revoke` || path.endsWith("/revoke");
+      const isIssue = underAuth && !isRevoke;
+      if (!isIssue && !isRevoke) return;
+      const { buildAuthSetCookies, clearAuthSetCookies } = await import("../auth/cookies.ts");
+      const { ACCESS_TTL_MS, REFRESH_TTL_MS } = await import("../auth/sessions.ts");
+      if (isRevoke || res.status >= 400) {
+        if (isRevoke) {
+          const headers = new Headers(res.headers);
+          for (const c of clearAuthSetCookies(cookieCfg)) headers.append("Set-Cookie", c);
+          ctx.response = new Response(res.body, { status: res.status, headers });
+        }
+        return;
+      }
+      try {
+        const body = (await res.clone().json()) as {
+          data?: { accessToken?: string; refreshToken?: string };
+        };
+        if (!body.data?.accessToken || !body.data?.refreshToken) return;
+        const headers = new Headers(res.headers);
+        const accessTtl = gateConfig.auth!.session.accessTtlMs ?? ACCESS_TTL_MS;
+        const refreshTtl = gateConfig.auth!.session.refreshTtlMs ?? REFRESH_TTL_MS;
+        for (const c of buildAuthSetCookies(
+          cookieCfg,
+          { accessToken: body.data.accessToken, refreshToken: body.data.refreshToken },
+          { access: Math.floor(accessTtl / 1000), refresh: Math.floor(refreshTtl / 1000) },
+        )) {
+          headers.append("Set-Cookie", c);
+        }
+        ctx.response = new Response(res.body, { status: res.status, headers });
+      } catch {
+        /* ignore non-JSON */
+      }
+    });
+  }
+
   function flushFlowPlugins(flowDef: AnyFlowDef): void {
     let done = flushedPlugins.get(flowDef);
     if (!done) {
@@ -454,12 +555,22 @@ export function oke(options: OkeOptions): OkeApp {
   let bootPromise: Promise<BootResult> | undefined;
   let bootEnv: BootOptions["env"] = options.env ?? "local";
   let authBinding: AppAuthBinding | undefined =
-    options.auth !== undefined
+    gateConfig.auth !== undefined
       ? createAppAuthBinding({
-          ...options.auth,
-          now: options.fx?.now,
+          secret: gateConfig.auth.secret,
+          sessions: authMaterialization?.ctx.sessions ?? gateConfig.auth.sessions,
+          now: gateConfig.auth.now ?? options.fx?.now,
         })
       : undefined;
+  if (authBinding) {
+    setActiveGateAuthContext({
+      secret: authBinding.secret,
+      sessions: authBinding.sessions,
+      now: authBinding.now,
+    });
+  } else {
+    setActiveGateAuthContext(undefined);
+  }
   const journalStore = createMemoryJournalStore();
   const sleepingRuns = new Map<
     string,
@@ -482,22 +593,108 @@ export function oke(options: OkeOptions): OkeApp {
   }
 
   async function doBoot(overrides?: Partial<BootOptions>): Promise<BootResult> {
-    const { bootApplication } = await import("./boot.ts");
+    const { bootApplication, resolveElementNeeds } = await import("./boot.ts");
+    const { assertHttpGatePosture } = await import("../elements/gate/boot.ts");
+    const { assertPluginNeeds, buildAvailableNeedTokens } = await import("./plugin-needs.ts");
     bootEnv = overrides?.env ?? options.env ?? "local";
-    const merged: BootOptions = {
+
+    // Prod without a real secret fails even if construction minted a dev secret.
+    if (gateConfig.auth?.secretMinted && bootEnv === "prod") {
+      throw new Error(
+        "gate.auth: secret is required in production (set gate.auth.secret or OKE_AUTH_SECRET)",
+      );
+    }
+
+    const unguardedHttp = overrides?.unguardedHttp ?? gateConfig.unguardedHttp ?? "deny";
+    // Auth bindings are in `adopted` — missing posture fails with GateBootError.
+    assertHttpGatePosture(adopted, { unguardedHttp, env: bootEnv });
+
+    const caps = pluginRegistry.capabilities();
+    const pluginNames = new Set(Object.keys(caps));
+    const authGates = authMaterialization?.authGates ?? [];
+    const baseGates = overrides?.gates ?? gateConfig.policies ?? [];
+    const elementNeeds = resolveElementNeeds({
       env: bootEnv,
       docker: overrides?.docker ?? options.docker,
       config: overrides?.config ?? options.config,
       elements: overrides?.elements ?? options.elements,
       secrets: overrides?.secrets ?? options.secrets,
       vault: overrides?.vault ?? options.vault,
-      gates: overrides?.gates ?? options.gates,
+      gates: [...baseGates, ...authGates],
       signals: overrides?.signals ?? options.signals,
       clocks: overrides?.clocks ?? options.clocks,
       stores: overrides?.stores ?? options.stores,
       channel: overrides?.channel ?? options.channel,
       ai: overrides?.ai ?? options.ai,
       runs: overrides?.runs ?? options.runs,
+      bindings: adopted,
+      flows: [...flowsByName.values()],
+    });
+    const driverIds: string[] = [];
+    for (const c of Object.values(caps)) {
+      for (const d of c.declares) {
+        if (d.startsWith("driver:")) driverIds.push(d.slice("driver:".length));
+      }
+    }
+    const stores = overrides?.stores ?? options.stores ?? [];
+    const available = buildAvailableNeedTokens({
+      elements: {
+        storeSql:
+          elementNeeds.store ||
+          stores.some((s) => s.facet === "sql") ||
+          pluginRegistry.tableContributions().length > 0,
+        storeKv:
+          elementNeeds.store ||
+          stores.some((s) => s.facet === "kv") ||
+          gateConfig.auth?.secondaryStorage.enabled === true,
+        storeFiles: elementNeeds.store || stores.some((s) => s.facet === "files"),
+        storeIndex: elementNeeds.store || stores.some((s) => s.facet === "index"),
+        signal: elementNeeds.signal,
+        clock: elementNeeds.clock,
+        gate: elementNeeds.gate || baseGates.length > 0 || authGates.length > 0,
+        vault: elementNeeds.vault,
+        channel: elementNeeds.channel,
+        ai: elementNeeds.ai,
+      },
+      driverIds,
+    });
+    const pluginSecrets = pluginRegistry.vaultContributions();
+    const pluginGates = pluginRegistry.gateContributions();
+    const pluginSignals = pluginRegistry.signalContributions();
+    const pluginClocks = pluginRegistry.clockContributions();
+    const pluginChannelTemplates = pluginRegistry.channelTemplateContributions();
+    if (pluginSecrets.length > 0) available.add("vault");
+    if (pluginGates.length > 0) available.add("gate");
+    if (pluginSignals.length > 0) available.add("signal");
+    if (pluginClocks.length > 0) available.add("clock");
+    if (pluginChannelTemplates.length > 0) available.add("channel");
+    // gate.auth (auto-absorbed auth plugin) satisfies `.needs("auth")`.
+    if (gateConfig.auth) available.add("auth");
+    assertPluginNeeds(caps, { pluginNames, available });
+
+    const baseSecrets = overrides?.secrets ?? options.secrets ?? [];
+    const baseSignals = overrides?.signals ?? options.signals ?? [];
+    const baseClocks = overrides?.clocks ?? options.clocks ?? [];
+    const baseChannel = overrides?.channel ?? options.channel;
+
+    const merged: BootOptions = {
+      env: bootEnv,
+      docker: overrides?.docker ?? options.docker,
+      config: overrides?.config ?? options.config,
+      elements: overrides?.elements ?? options.elements,
+      secrets: [...baseSecrets, ...pluginSecrets],
+      vault: overrides?.vault ?? options.vault,
+      gates: [...baseGates, ...authGates, ...pluginGates],
+      unguardedHttp,
+      signals: [...baseSignals, ...pluginSignals],
+      clocks: [...baseClocks, ...pluginClocks],
+      stores: overrides?.stores ?? options.stores,
+      channel: {
+        ...(baseChannel ?? {}),
+        templates: [...(baseChannel?.templates ?? []), ...pluginChannelTemplates],
+      },
+      ai: overrides?.ai ?? options.ai,
+      runs: overrides?.runs ?? options.runs,
       now: overrides?.now ?? options.fx?.now,
       instanceId: overrides?.instanceId,
       startScheduler: overrides?.startScheduler ?? options.startScheduler,
@@ -521,13 +718,14 @@ export function oke(options: OkeOptions): OkeApp {
   }
 
   /**
-   * Boot lazily when `autoBoot` is enabled; otherwise legacy (pre-boot)
-   * execution continues to work without gates / element runtimes — existing
-   * callers that never call {@link OkeApp.boot} see unchanged behavior.
+   * Boot lazily on first execute/fetch unless {@link OkeOptions.autoBoot} is
+   * explicitly `false` (legacy pre-boot escape hatch for unit tests).
+   * Default is on — security posture and element runtimes are not optional
+   * for traffic-serving apps.
    */
   async function ensureBoot(): Promise<BootResult | undefined> {
     if (bootResult) return bootResult;
-    if (options.autoBoot !== true) return undefined;
+    if (options.autoBoot === false) return undefined;
     if (!bootPromise) {
       bootPromise = doBoot();
     }
@@ -554,6 +752,8 @@ export function oke(options: OkeOptions): OkeApp {
       readonly auth?: ResolvedPrincipal | FxAuth;
       readonly operator?: FxOperator;
       readonly principal?: ResolvedPrincipal;
+      /** Frozen origin identity for {@link Fx.principal} across `fx.call`. */
+      readonly originPrincipal?: FxPrincipal;
     },
   ): Promise<ExecuteResult> {
     registerFlow(flowDef);
@@ -588,8 +788,8 @@ export function oke(options: OkeOptions): OkeApp {
     const startedAt = now();
     const telemetry = createRunTelemetry();
 
-    // Element pipeline wiring only kicks in once booted — pre-boot execution
-    // (existing tests) runs exactly as before, with no gates / elements.
+    // Element pipeline wiring only kicks in once booted — `autoBoot: false`
+    // keeps intentional pre-boot unit tests ungated (no elements either).
     let principals: PrincipalBag | undefined;
     let hooks: HookMap = composedHooks;
     let capability: CapabilityToken | undefined;
@@ -615,12 +815,24 @@ export function oke(options: OkeOptions): OkeApp {
       }
 
       const binding = authBinding;
+      const cookieOpts = gateConfig.auth?.cookies;
       const elementHooks = createElementPipelineHooks({
         gates: booted.gate,
         principals,
         telemetry,
         allowTestPrincipals: testMode,
-        verifyBearer: binding ? (token) => verifyBearerToken(binding, token) : undefined,
+        verifyBearer: binding ? async (token) => verifyBearerToken(binding, token) : undefined,
+        // Phase 1a: opt-in cookie → Bearer when Authorization is absent.
+        resolveToken:
+          binding && cookieOpts?.enabled
+            ? (request) => {
+                const header = request.headers.get("authorization");
+                if (header?.startsWith("Bearer ")) {
+                  return header.slice("Bearer ".length).trim() || undefined;
+                }
+                return tokenFromCookieHeader(request.headers.get("cookie"), cookieOpts);
+              }
+            : undefined,
       });
 
       // Element hooks run first in the app-level onAuth/beforeHandle chain —
@@ -649,6 +861,7 @@ export function oke(options: OkeOptions): OkeApp {
       runTelemetry: telemetry,
       now,
       ...(principals ? { auth: principals.auth as FxAuth, operator: principals.operator } : {}),
+      ...(extras?.originPrincipal ? { principal: extras.originPrincipal } : {}),
       ...(capability ? { capability } : {}),
       ...(booted
         ? {
@@ -665,9 +878,12 @@ export function oke(options: OkeOptions): OkeApp {
         if (!target) {
           return undefined;
         }
-        const inner = await execute(target, callInput, {
-          kind: "internal",
-        } satisfies InternalTrigger);
+        const inner = await execute(
+          target,
+          callInput,
+          { kind: "internal" } satisfies InternalTrigger,
+          { originPrincipal: freezePrincipal(fx.principal) },
+        );
         if (inner.failure) return inner.failure;
         return inner.output;
       },
@@ -842,8 +1058,13 @@ export function oke(options: OkeOptions): OkeApp {
       }
     },
     plug(pluginDef) {
+      const before = new Set(pluginRegistry.bindingContributions().map((b) => b.flow.name));
       applyPlugin(pluginRegistry, pluginDef, appPluginScope);
-      // Decoration accumulate on the interface; runtime object is unchanged.
+      for (const b of pluginRegistry.bindingContributions()) {
+        if (before.has(b.flow.name)) continue;
+        adoptBinding(b);
+      }
+      // Decorations accumulate on the interface; runtime object is unchanged.
       return app as never;
     },
     pluginCapabilities() {

package/src/kernel/boot-bind/store.test.ts

@@ -114,6 +114,15 @@ describe("bindStore index driver resolution", () => {
     expect(indexDriverFor("libsql").id).toBe("libsql");
   });
 
+  test("meilisearch resolves from config as a fourth id", () => {
+    const options = {
+      config: { drivers: { store: { index: { local: "meilisearch", docker: "meilisearch" } } } },
+    };
+    expect(resolveIndexDriverId(options, "local", false)).toBe("meilisearch");
+    expect(resolveIndexDriverId(options, "docker", true)).toBe("meilisearch");
+    expect(indexDriverFor("meilisearch").id).toBe("meilisearch");
+  });
+
   test("docker mode honours OKE_INDEX_DRIVER override", () => {
     process.env.OKE_INDEX_DRIVER = "pgvector";
     expect(resolveIndexDriverId({}, "docker", true)).toBe("pgvector");

package/src/kernel/boot-bind/store.ts

@@ -5,6 +5,7 @@
 import { resolveDomainDdlMode, resolveDriverId, type ConfigEnv } from "../../config/index.ts";
 import { fsDriver } from "../../drivers/fs.ts";
 import { libsqlDriver, libsqlIndexDriver } from "../../drivers/libsql.ts";
+import { meilisearchDriver } from "../../drivers/meilisearch.ts";
 import { memoryDrivers } from "../../drivers/memory.ts";
 import { pgliteDriver } from "../../drivers/pglite.ts";
 import { pgvectorDriver } from "../../drivers/pgvector.ts";
@@ -45,7 +46,7 @@ export function bindStore(
   const sqlBindings: Record<string, { name: string; primary: { url: string } }> = {};
   const kvBindings: Record<string, { url?: string }> = {};
   const filesBindings: Record<string, { root?: string }> = {};
-  const indexBindings: Record<string, { url?: string }> = {};
+  const indexBindings: Record<string, { url?: string; apiKey?: string }> = {};
 
   for (const decl of options.stores ?? []) {
     if (isSqlDecl(decl)) {
@@ -60,7 +61,14 @@ export function bindStore(
     } else if (isIndexDecl(decl)) {
       // SQL-backed index drivers share the sql facet's URL — the runtime opens
       // one connection and hands it to both (never a second, redundant one).
-      indexBindings[decl.name] = indexId === "memory" ? {} : { url: sqlUrl };
+      // Meilisearch is a standalone HTTP service: its own URL + key, never sqlUrl.
+      if (indexId === "memory") {
+        indexBindings[decl.name] = {};
+      } else if (indexId === "meilisearch") {
+        indexBindings[decl.name] = { url: indexUrlFor(docker), apiKey: indexApiKeyFor() };
+      } else {
+        indexBindings[decl.name] = { url: sqlUrl };
+      }
     }
   }
 
@@ -216,6 +224,8 @@ export function indexDriverFor(id: string): IndexDriver {
       return pgvectorDriver;
     case "libsql":
       return libsqlIndexDriver;
+    case "meilisearch":
+      return meilisearchDriver;
     default:
       throw new Error(`oke boot: unknown index driver "${id}"`);
   }
@@ -263,6 +273,24 @@ function filesRootFor(filesId: string): string | undefined {
   return process.env.S3_BUCKET ?? process.env.OKE_STORE_FILES_DB ?? undefined;
 }
 
+/** Meilisearch base URL — standalone HTTP service, fail loud when missing. */
+function indexUrlFor(docker: boolean): string {
+  const url = process.env.OKE_STORE_INDEX_URL ?? undefined;
+  if (!url) {
+    throw new Error(
+      docker
+        ? "oke boot: meilisearch index needs OKE_STORE_INDEX_URL (did `oke dev -d` write docker/.env.docker?)"
+        : "oke boot: meilisearch index needs OKE_STORE_INDEX_URL",
+    );
+  }
+  return url;
+}
+
+/** Meilisearch API / master key. */
+function indexApiKeyFor(): string | undefined {
+  return process.env.OKE_STORE_INDEX_KEY ?? process.env.MEILI_MASTER_KEY ?? undefined;
+}
+
 function isSqlDecl(decl: StoreDecl): decl is Extract<StoreDecl, { facet: "sql" }> {
   return decl.facet === "sql";
 }

package/src/kernel/boot.test.ts

@@ -190,8 +190,8 @@ describe("boot — cron fires without manual dispatch", () => {
   });
 });
 
-describe("boot — HTTP gate wiring lives behind boot", () => {
-  test("unbooted app still serves without gates (legacy)", async () => {
+describe("boot — HTTP gate wiring on the default path", () => {
+  test("autoBoot: false still serves without gates (explicit escape hatch)", async () => {
     resetBindings();
     resetFlowSeq();
     on(
@@ -201,9 +201,46 @@ describe("boot — HTTP gate wiring lives behind boot", () => {
         do: () => ({ ok: true }),
       }),
     );
-    const app = oke({ name: "legacy" });
+    const app = oke({ name: "legacy", autoBoot: false });
     const res = await app.fetch(new Request("http://localhost/ping", { method: "GET" }));
     expect(res.status).toBe(200);
+    expect(app.booted).toBe(false);
+  });
+
+  test("bare oke().fetch() enforces gate posture by default (no flags)", async () => {
+    resetBindings();
+    resetFlowSeq();
+    const { GateBootError } = await import("../elements/gate/boot.ts");
+    on(
+      http.get("/ping"),
+      flow({
+        name: "ping",
+        do: () => ({ ok: true }),
+      }),
+    );
+    const app = oke({ name: "default-posture" });
+    await expect(
+      app.fetch(new Request("http://localhost/ping", { method: "GET" })),
+    ).rejects.toThrow(GateBootError);
+    expect(app.booted).toBe(false);
+  });
+
+  test("bare oke().fetch() with gate.public boots and serves", async () => {
+    resetBindings();
+    resetFlowSeq();
+    const { gate } = await import("../elements/gate.ts");
+    on(
+      http.get("/ping").gate(gate.public),
+      flow({
+        name: "ping-public",
+        do: () => ({ ok: true }),
+      }),
+    );
+    const app = oke({ name: "default-public", env: "test", startScheduler: false });
+    const res = await app.fetch(new Request("http://localhost/ping", { method: "GET" }));
+    expect(res.status).toBe(200);
+    expect(app.booted).toBe(true);
+    await app.stop();
   });
 });
 

package/src/kernel/boot.ts

@@ -75,6 +75,14 @@ export interface BootOptions {
   };
   /** Gate declarations for the runtime. */
   readonly gates?: readonly GateDecl[];
+  /**
+   * HTTP auth-posture enforcement at boot.
+   * - `"deny"` (default) — every HTTP trigger must carry a gate or `gate.public`
+   * - `"allow"` — skips the audit **only** when {@link env} is `"test"`;
+   *   ignored in local/prod/docker (never a production-wide bypass).
+   *   Migrate real apps with per-trigger `gate.public`.
+   */
+  readonly unguardedHttp?: "deny" | "allow";
   /** Signal declarations. */
   readonly signals?: readonly SignalDecl[];
   /** Named clock declarations. */

package/src/kernel/call.test.ts

@@ -28,7 +28,7 @@ describe("fx.call — untriggered flows", () => {
       }),
     );
 
-    const app = oke({ name: "call" }).adopt(stats);
+    const app = oke({ autoBoot: false, name: "call" }).adopt(stats);
 
     // Direct call (Linkly ⑤)
     await expect(app.call(stats, { code: "sa" })).resolves.toEqual({
@@ -53,6 +53,50 @@ describe("fx.call — untriggered flows", () => {
     expect(stats.triggers).toHaveLength(0);
   });
 
+  test("fx.call propagates fx.principal without filling fx.auth", async () => {
+    const audit = flow({
+      name: "audit.log",
+      do: (_input: { event: string }, fx) => ({
+        authUserId: fx.auth.userId,
+        principalUserId: fx.principal.userId,
+        principalScopes: [...fx.principal.scopes],
+      }),
+    });
+
+    const act = on(
+      http.post("/act"),
+      flow({
+        name: "act",
+        effects: { calls: ["audit.log"] },
+        do: async (_input: Record<string, never>, fx) => {
+          return fx.call("audit.log", { event: "act" });
+        },
+      }),
+    );
+
+    const app = oke({
+      autoBoot: false,
+      name: "principal-call",
+      gate: { unguardedHttp: "allow" },
+    }).adopt(audit);
+    await app.boot({ env: "test", unguardedHttp: "allow" });
+
+    const result = await app.execute(act, {}, act.$trigger ?? act.triggers[0]!, {
+      principal: {
+        userId: "user-1",
+        scopes: ["booking:create"],
+        verified: true,
+      },
+    });
+
+    expect(result.failure).toBeUndefined();
+    expect(result.output).toEqual({
+      authUserId: null,
+      principalUserId: "user-1",
+      principalScopes: ["booking:create"],
+    });
+  });
+
   test("http and signal invocations of the same flow execute identically", async () => {
     let runs = 0;
     const work = flow({
@@ -66,7 +110,7 @@ describe("fx.call — untriggered flows", () => {
     on(http.post("/work"), work);
     on({ name: "tick", delivery: "broadcast" }, work);
 
-    const app = oke({ name: "identical" });
+    const app = oke({ autoBoot: false, name: "identical" });
 
     const a = await app.fetch(
       new Request("http://localhost/work", {