agent/machine-identities #4

New issue

Closed

opened 2026-05-09 23:22:52 +02:00 by codex · 1 comment

codex commented

2026-05-09 23:22:52 +02:00

Collaborator

Parent: #2
Wave: 1 Maintainer Foundation

Summary

Replace token-as-identity with first-class machine identities following Agent Access Plane principles.

Scope

Add machine_identity and machine_identity_credential model.
Support thread-scoped identities like codex-<thread-id>.
Track workspace/board scope, allowed modes/actions, owner, status, expiry, last used, last rotated.
Attach audit events to machine identity as well as credential/token.

Non-goals

No production credential issuance.
No Infisical integration in this PR unless explicitly approved.
No UI unless trivial; management can follow in #5.

Acceptance

One agent thread can have a scoped identity and credential.
Credential can be revoked without deleting identity.
Audit can answer what a machine identity did.

Tests / smoke

DB schema/repository tests.
Agent auth tests for identity-linked audit.

Rollback

Revert PR before deployment; after migration, rollback requires migration-specific plan.

Owner gates

DB migration approval.
Any real credential rotation/issuance is a hard stop.

Parent: #2 Wave: 1 Maintainer Foundation ## Summary Replace token-as-identity with first-class machine identities following Agent Access Plane principles. ## Scope - Add `machine_identity` and `machine_identity_credential` model. - Support thread-scoped identities like `codex-<thread-id>`. - Track workspace/board scope, allowed modes/actions, owner, status, expiry, last used, last rotated. - Attach audit events to machine identity as well as credential/token. ## Non-goals - No production credential issuance. - No Infisical integration in this PR unless explicitly approved. - No UI unless trivial; management can follow in #5. ## Acceptance - One agent thread can have a scoped identity and credential. - Credential can be revoked without deleting identity. - Audit can answer what a machine identity did. ## Tests / smoke - DB schema/repository tests. - Agent auth tests for identity-linked audit. ## Rollback - Revert PR before deployment; after migration, rollback requires migration-specific plan. ## Owner gates - DB migration approval. - Any real credential rotation/issuance is a hard stop.

codex referenced this issue

2026-05-09 23:23:05 +02:00

agent/admin-identity-ui-or-cli #5

codex referenced this issue

2026-05-09 23:26:00 +02:00

web/machine-activity-audit-view #19

codex referenced this issue

2026-05-09 23:27:03 +02:00

swarmheart/leviathan-write-projection #26

codex referenced this issue

2026-05-09 23:27:13 +02:00

[meta] Kan-ductor maturity waves #2

codex referenced this issue from a pull request that will close it,

2026-05-09 23:47:40 +02:00

feat(agent): add machine identities #28

codex commented

2026-05-09 23:47:46 +02:00

Author

Collaborator

Implementation PR opened: #28 — feat(agent): add machine identities.

Notes:

Adds nullable machine identity links, so legacy agent_token rows keep working.
No production migration, deploy, restart, or credential issuance was performed.
drizzle-kit generate is currently blocked by an existing boards/users schema initialization cycle; PR uses a manual SQL migration and validates it through the PGlite integration migrator.
Owner gate remains required before running the migration or issuing production identities.

Implementation PR opened: #28 — `feat(agent): add machine identities`. Notes: - Adds nullable machine identity links, so legacy `agent_token` rows keep working. - No production migration, deploy, restart, or credential issuance was performed. - `drizzle-kit generate` is currently blocked by an existing boards/users schema initialization cycle; PR uses a manual SQL migration and validates it through the PGlite integration migrator. - Owner gate remains required before running the migration or issuing production identities.