>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3574877. --> Reported by: [scott falconer](https://www.drupal.org/user/52557) Related to !1234 >>> <p><strong>Problem/Motivation<br> </strong></p> <ul> <li>#3574662 rejects caller-supplied execution identity fields at /api/deepchat.</li> <li>#3574723 added runner-level executor enforcement (setExecutorUid() + validation + account switching) in AiAssistantApiRunner.php.</li> <li>However, /api/deepchat still does not propagate a server-resolved executor to the runner, so this path still depends on BC fallback behavior.</li> </ul> <p><strong>Proposed resolution<br> </strong></p> <ul> <li>In DeepChatApi.php, resolve executor server-side and call setExecutorUid() before processing.</li> <li>Do not accept caller-provided executor/initiator fields (already enforced by #3574662).</li> <li>Add regression tests that prove DeepChat passes server-resolved executor to runner before execution.</li> <li>Keep scope to DeepChat propagation only (no queue/messenger envelope work in this issue).</li> </ul> <p><strong>Acceptance criteria<br> </strong> </p><ul> <li>DeepChat calls setExecutorUid() with a server-resolved UID before runner process().</li> <li>Caller cannot override executor via request payload fields.</li> <li>Tests fail if DeepChat stops propagating executor UID.</li> <li>Existing DeepChat boundary rejection tests remain green.</li> </ul> <p><strong>Test plan<br> </strong><br> Kernel test with a runner spy/test-double service to assert call order + propagated UID.<br> Re-run existing DeepChat execution-envelope boundary tests to prevent regression.</p> > Related issue: [Issue #3574723](https://www.drupal.org/node/3574723) > Related issue: [Issue #3574662](https://www.drupal.org/node/3574662) > Related issue: [Issue #3573899](https://www.drupal.org/node/3573899)