pdurlej/kan-ductor

Fork 0

feat(agent): add machine identities #28

Merged

pdurlej merged 1 commit from codex/agent-machine-identities into main

2026-05-10 13:35:10 +02:00

codex commented

2026-05-09 23:47:40 +02:00

Collaborator

Canary status: missing — fire 3+3 review before merge

Summary

Closes #4.

Adds first-class machine identities above existing agent tokens. Tokens remain credentials; machine_identity becomes the stable actor and machine_identity_credential records rotatable token issuance. Agent audit can now be attributed by machine identity as well as token.

Scope

Add machine_identity and machine_identity_credential schema and migration.
Add machineIdentityId to agent_token and agent_audit_event.
Extend token creation to attach an existing machine identity or create a new one, including thread-scoped slugs such as codex-<thread-id>.
Reject agent requests when attached machine identity or credential is inactive/revoked/expired.
Include machine identity fields in get_recent_activity.agentAudit[].
Prefer machineIdentityDisplayName for agent display attribution when available.
Document the machine identity contract in docs/agent-mcp-contract.md.

Non-goals

No production migration execution.
No secret issuance or credential rotation in production.
No admin UI/CLI yet; that is #5.
No audit UI yet; that is #19.
No RS2000 deploy/restart.

Spec sources read

Existing Kan-ductor agent schema/router/repository implementation.
docs/kan-ductor-working-pr-plan.md issue #4 scope.
Existing agent MCP/audit contract in docs/agent-mcp-contract.md.

Tests / smoke

pnpm --filter @kan/db build
pnpm --filter @kan/db typecheck
pnpm --filter @kan/api typecheck
pnpm --filter @kan/mcp typecheck
pnpm --filter @kan/api test -- agent.test.ts integration-tests/agent.integration.test.ts
pnpm exec prettier --check packages/db/src/schema/agents.ts packages/db/src/repository/agent.repo.ts packages/api/src/routers/agent.ts packages/api/src/routers/agent.test.ts packages/api/integration-tests/agent.integration.test.ts docs/agent-mcp-contract.md packages/db/migrations/meta/_journal.json

Migration note:

pnpm drizzle-kit generate --name AddMachineIdentities was attempted first, but current main fails during schema loading with ReferenceError: Cannot access 'userBoardFavorites' before initialization from the existing boards/users schema cycle. The SQL migration was written manually and validated through the PGlite integration test migrator.

Rollback

Before production migration: revert commit a56e8b6.

After production migration: stop issuing new machine identity credentials, then apply a rollback migration that drops the added FK/indexes/columns/tables/enums only after confirming no production audit/token rows depend on them. Existing legacy agent_token rows still work because machine identity fields are nullable.

Owner gates

Required before operational use:

Piotr approval before running this DB migration on production.
Piotr approval before issuing, rotating, pausing, or revoking production machine identities/credentials.
Piotr approval before any production deploy/restart that consumes this schema.

Canary status: missing — fire 3+3 review before merge ## Summary Closes #4. Adds first-class machine identities above existing agent tokens. Tokens remain credentials; `machine_identity` becomes the stable actor and `machine_identity_credential` records rotatable token issuance. Agent audit can now be attributed by machine identity as well as token. ## Scope - Add `machine_identity` and `machine_identity_credential` schema and migration. - Add `machineIdentityId` to `agent_token` and `agent_audit_event`. - Extend token creation to attach an existing machine identity or create a new one, including thread-scoped slugs such as `codex-<thread-id>`. - Reject agent requests when attached machine identity or credential is inactive/revoked/expired. - Include machine identity fields in `get_recent_activity.agentAudit[]`. - Prefer `machineIdentityDisplayName` for agent display attribution when available. - Document the machine identity contract in `docs/agent-mcp-contract.md`. ## Non-goals - No production migration execution. - No secret issuance or credential rotation in production. - No admin UI/CLI yet; that is #5. - No audit UI yet; that is #19. - No RS2000 deploy/restart. ## Spec sources read - Existing Kan-ductor agent schema/router/repository implementation. - `docs/kan-ductor-working-pr-plan.md` issue #4 scope. - Existing agent MCP/audit contract in `docs/agent-mcp-contract.md`. ## Tests / smoke - `pnpm --filter @kan/db build` - `pnpm --filter @kan/db typecheck` - `pnpm --filter @kan/api typecheck` - `pnpm --filter @kan/mcp typecheck` - `pnpm --filter @kan/api test -- agent.test.ts integration-tests/agent.integration.test.ts` - `pnpm exec prettier --check packages/db/src/schema/agents.ts packages/db/src/repository/agent.repo.ts packages/api/src/routers/agent.ts packages/api/src/routers/agent.test.ts packages/api/integration-tests/agent.integration.test.ts docs/agent-mcp-contract.md packages/db/migrations/meta/_journal.json` Migration note: - `pnpm drizzle-kit generate --name AddMachineIdentities` was attempted first, but current `main` fails during schema loading with `ReferenceError: Cannot access 'userBoardFavorites' before initialization` from the existing boards/users schema cycle. The SQL migration was written manually and validated through the PGlite integration test migrator. ## Rollback Before production migration: revert commit `a56e8b6`. After production migration: stop issuing new machine identity credentials, then apply a rollback migration that drops the added FK/indexes/columns/tables/enums only after confirming no production audit/token rows depend on them. Existing legacy `agent_token` rows still work because machine identity fields are nullable. ## Owner gates Required before operational use: - Piotr approval before running this DB migration on production. - Piotr approval before issuing, rotating, pausing, or revoking production machine identities/credentials. - Piotr approval before any production deploy/restart that consumes this schema.

codex added 1 commit

2026-05-09 23:47:40 +02:00

feat(agent): add machine identities

Docker / build (pull_request) Failing after 14s

Details

a56e8b6cda

codex referenced this pull request

2026-05-09 23:47:46 +02:00

agent/machine-identities #4

codex referenced this pull request

2026-05-09 23:55:18 +02:00

feat(agent): add machine identity admin CLI #29

codex referenced this pull request

2026-05-09 23:55:35 +02:00

agent/admin-identity-ui-or-cli #5

codex referenced this pull request

2026-05-09 23:59:06 +02:00

feat(activity): harden recent activity recaps #30

codex referenced this pull request

2026-05-09 23:59:11 +02:00

activity/explain-what-changed-today #6

codex referenced this pull request

2026-05-10 00:04:37 +02:00

feat(activity): show agent attribution in card activity #31

codex referenced this pull request

2026-05-10 00:04:43 +02:00

activity/agent-visible-attribution #7

codex commented

2026-05-10 08:48:11 +02:00

Author

Collaborator

3+3 Review Result

Status: OK with residual risk

Review lanes completed: tech-ollama-1, tech-ollama-2, tech-codex, product-ollama-1, product-ollama-2, product-claude-opus.

Deterministic checks on current stack tip:

PASS: @kan/db typecheck/build
PASS: @kan/shared typecheck/build
PASS: @kan/mcp typecheck/build
PASS: @kan/api typecheck/build and focused agent tests: 28/28
FAIL: targeted web ESLint currently reports apps/web/src/views/card/components/ActivityList.tsx:374 unused isAdmin
FAIL, known broader baseline: @kan/web typecheck still has existing bootstrap/workspace typing errors

Canary gate: current automated canary is not green for the draft stack; treat this as a review/checkpoint result, not merge approval.

Review notes:

No 3+3 blocker found. Residual risk: large DB/auth surface; machine identity + token creation is not fully atomic; monitor legacy-token/null-credential edges.

## 3+3 Review Result Status: **OK with residual risk** Review lanes completed: tech-ollama-1, tech-ollama-2, tech-codex, product-ollama-1, product-ollama-2, product-claude-opus. Deterministic checks on current stack tip: - PASS: `@kan/db` typecheck/build - PASS: `@kan/shared` typecheck/build - PASS: `@kan/mcp` typecheck/build - PASS: `@kan/api` typecheck/build and focused agent tests: 28/28 - FAIL: targeted web ESLint currently reports `apps/web/src/views/card/components/ActivityList.tsx:374` unused `isAdmin` - FAIL, known broader baseline: `@kan/web typecheck` still has existing bootstrap/workspace typing errors Canary gate: current automated canary is **not green** for the draft stack; treat this as a review/checkpoint result, not merge approval. Review notes: - No 3+3 blocker found. Residual risk: large DB/auth surface; machine identity + token creation is not fully atomic; monitor legacy-token/null-credential edges.