[sx4im]

What this changes

After connecting a Shopify key, OpenBot checked it with SHOPIFY_COUNT_BLOGS, the first safe read alphabetically, which needs the read_content scope a store app with only order and product scopes does not have. The 403 made a working key look rejected. A store's own details are the identity, so _GET_SHOP_DETAILS now counts as an identity read and the check uses it instead.

Where it runs

No new state, no listeners, no schedules. The chooser is a pure function of the app's published actions; every replica picks the same probe.

• New state that outlives a request? None.
• What happens on the second replica? Identical probe choice, no shared state involved.
• Anything serialised? Nothing new.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act.
• New refusals and new failures each write a row. No new refusal paths; the probe decision is recorded as before.
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

New pure unit test server/tests/plugin-store-identity-action.test.ts: 3 pass. It fails without the fix (SHOPIFY_GET_SHOP_DETAILS not recognised) and passes with it; the existing identity suffixes still match and non-identity actions (SHOPIFY_COUNT_BLOGS, SLACK_PROFILE_SET) still do not. tsc --noEmit clean on server. The DB-backed probe suites need TEST_DATABASE_URL, not available here.

Fixes #886