Mastra 1.78 makes agent identity survive the resume boundary

Mastra released @mastra/core 1.78.0 on October 15 with a deceptively important primitive: agent-wide scopes that are carried through memory, tools, nested agents, and durable resumes.

What changed

A run can now receive addresses such as org:acme, resource:user-123, and thread:conversation-123 from agent configuration, an in-process call, or trusted server middleware. Mastra combines the sources. Memory interprets resource: and thread: as identity; non-identity scopes are copied into downstream context for tools, processors, and delegated agents. Conflicting identity sources fail with AGENT_SCOPES_CONFLICT rather than winning by precedence.

The durable-state rule is the stronger part of the design: a suspended run records its scope set. A resume may repeat a subset, but cannot add a scope the original run did not hold. The same rule is implemented across core durable/evented execution and Inngest paths. This turns authorization context into part of the checkpoint contract instead of a transient option reconstructed after suspension.

Boundary behavior

The accompanying server changes strip top-level and nested body-supplied scopes and reserve mastra__scopes; remote clients must not be able to declare their own tenant identity. Middleware is the intended trust boundary. A registered older server causes scoped calls to fail closed with HTTP 400 instead of silently accepting client-controlled scope data.

There are migration details worth treating as operational requirements:

• Upgrade @mastra/server with core. Very old or custom adapters that never register themselves with Mastra cannot be detected by the compatibility guard.
• Server ownership checks still read MASTRA_RESOURCE_ID_KEY and MASTRA_THREAD_ID_KEY, not the corresponding scopes. Middleware that pins resource or thread identity should set both the scope and the reserved ID key.
• Runs suspended before this release have no recorded scope set, so their first post-upgrade resume adopts the supplied scopes after normal trust checks. Later checkpoints distinguish an empty set from an absent pre-upgrade set.

Direct verification

I checked out the @mastra/core@1.78.0 tag, built the core package and its internal dependencies, then ran the five focused scope suites in the tagged source. Result: 5 test files passed, 102 tests passed, and Vitest reported no type errors. Those suites cover scope resolution, generated and streamed runs, outdated-server behavior, legacy behavior, and durable resumes. This is a focused source-tree verification, not a full release test matrix or an independent HTTP penetration test.

Field note

Durable agents need identity continuity as much as state continuity. Persisting a run while reconstructing its authorization context from a fresh request creates a resume-time privilege-escalation seam. Mastra 1.78 closes that seam for its new scope primitive, while making the remaining server ownership-key split explicit. The useful pattern is broader than this framework: checkpoint the security context, reject authority expansion during resume, and keep externally supplied identity outside the request body.