feat(agent): add machine identity admin CLI #29

Merged

pdurlej merged 1 commit from codex/agent-identity-admin-cli into codex/agent-machine-identities

2026-05-10 13:35:16 +02:00

codex commented

2026-05-09 23:55:18 +02:00

Collaborator

Canary status: missing - fire 3+3 review before merge

Stacked on #28 (codex/agent-machine-identities). Implements #5.

Summary

Adds a maintainer-only machine identity admin CLI for create, rotate, pause, revoke, and inspect operations.

Scope

Adds pnpm agent:identity root command backed by packages/db/scripts/agent-identity-admin.mjs.
Verifies workspace:manage via active workspace membership before every command.
Requires --confirm for mutating commands and supports --dry-run for validation.
Writes setup-mode agent_audit_event rows for create/rotate/pause/revoke without storing raw tokens.
Documents safe operator usage and narrow scope defaults.

Non-goals

No production token issuance in this PR.
No web UI for identity administration yet.
No secret manager integration yet.
No broader MCP write surface.

Spec sources read

docs/kan-ductor-working-pr-plan.md
docs/agent-mcp-contract.md
Issue #5 acceptance criteria
Stacked machine identity contract from #28

Tests / smoke

node --check packages/db/scripts/agent-identity-admin.mjs
pnpm agent:identity help
pnpm agent:identity create --workspace-public-id workspace1234 --slug test-agent --display-name Test --token-name Test --scopes boards:read --admin-user-email test@example.com confirms the no---confirm guard fails closed before DB access.
pnpm exec prettier --check packages/db/scripts/agent-identity-admin.mjs docs/agent-machine-identity-admin.md docs/agent-mcp-contract.md package.json packages/db/package.json
pnpm --filter @kan/db build
pnpm --filter @kan/api typecheck
pnpm --filter @kan/mcp typecheck
pnpm --filter @kan/api test -- agent.test.ts integration-tests/agent.integration.test.ts

Rollback

Revert this commit. No schema changes and no runtime behavior changes unless the CLI is invoked manually.

Owner gates

Required before any production use: owner approval for create, rotate, pause, revoke, or storing generated tokens in the secret manager.

Canary status: missing - fire 3+3 review before merge Stacked on #28 (`codex/agent-machine-identities`). Implements #5. ## Summary Adds a maintainer-only machine identity admin CLI for create, rotate, pause, revoke, and inspect operations. ## Scope - Adds `pnpm agent:identity` root command backed by `packages/db/scripts/agent-identity-admin.mjs`. - Verifies `workspace:manage` via active workspace membership before every command. - Requires `--confirm` for mutating commands and supports `--dry-run` for validation. - Writes setup-mode `agent_audit_event` rows for create/rotate/pause/revoke without storing raw tokens. - Documents safe operator usage and narrow scope defaults. ## Non-goals - No production token issuance in this PR. - No web UI for identity administration yet. - No secret manager integration yet. - No broader MCP write surface. ## Spec sources read - `docs/kan-ductor-working-pr-plan.md` - `docs/agent-mcp-contract.md` - Issue #5 acceptance criteria - Stacked machine identity contract from #28 ## Tests / smoke - `node --check packages/db/scripts/agent-identity-admin.mjs` - `pnpm agent:identity help` - `pnpm agent:identity create --workspace-public-id workspace1234 --slug test-agent --display-name Test --token-name Test --scopes boards:read --admin-user-email test@example.com` confirms the no-`--confirm` guard fails closed before DB access. - `pnpm exec prettier --check packages/db/scripts/agent-identity-admin.mjs docs/agent-machine-identity-admin.md docs/agent-mcp-contract.md package.json packages/db/package.json` - `pnpm --filter @kan/db build` - `pnpm --filter @kan/api typecheck` - `pnpm --filter @kan/mcp typecheck` - `pnpm --filter @kan/api test -- agent.test.ts integration-tests/agent.integration.test.ts` ## Rollback Revert this commit. No schema changes and no runtime behavior changes unless the CLI is invoked manually. ## Owner gates Required before any production use: owner approval for create, rotate, pause, revoke, or storing generated tokens in the secret manager.

codex added 1 commit

2026-05-09 23:55:18 +02:00

feat(agent): add machine identity admin cli 6c2ed44ca6

codex referenced this pull request

2026-05-09 23:55:35 +02:00

agent/admin-identity-ui-or-cli #5

codex commented

2026-05-10 08:48:11 +02:00

Author

Collaborator

3+3 Review Result

Status: OK with residual risk

Review lanes completed: tech-ollama-1, tech-ollama-2, tech-codex, product-ollama-1, product-ollama-2, product-claude-opus.

Deterministic checks on current stack tip:

PASS: @kan/db typecheck/build
PASS: @kan/shared typecheck/build
PASS: @kan/mcp typecheck/build
PASS: @kan/api typecheck/build and focused agent tests: 28/28
FAIL: targeted web ESLint currently reports apps/web/src/views/card/components/ActivityList.tsx:374 unused isAdmin
FAIL, known broader baseline: @kan/web typecheck still has existing bootstrap/workspace typing errors

Canary gate: current automated canary is not green for the draft stack; treat this as a review/checkpoint result, not merge approval.

Review notes:

No 3+3 blocker found. Residual risk: direct DB admin CLI is powerful; keep production use dry-run first and operator-gated.

## 3+3 Review Result Status: **OK with residual risk** Review lanes completed: tech-ollama-1, tech-ollama-2, tech-codex, product-ollama-1, product-ollama-2, product-claude-opus. Deterministic checks on current stack tip: - PASS: `@kan/db` typecheck/build - PASS: `@kan/shared` typecheck/build - PASS: `@kan/mcp` typecheck/build - PASS: `@kan/api` typecheck/build and focused agent tests: 28/28 - FAIL: targeted web ESLint currently reports `apps/web/src/views/card/components/ActivityList.tsx:374` unused `isAdmin` - FAIL, known broader baseline: `@kan/web typecheck` still has existing bootstrap/workspace typing errors Canary gate: current automated canary is **not green** for the draft stack; treat this as a review/checkpoint result, not merge approval. Review notes: - No 3+3 blocker found. Residual risk: direct DB admin CLI is powerful; keep production use dry-run first and operator-gated.