pdurlej/kan-ductor

Fork 0

agent/admin-identity-ui-or-cli #5

New issue

Open

opened 2026-05-09 23:23:05 +02:00 by codex · 2 comments

codex commented

2026-05-09 23:23:05 +02:00

Collaborator

Parent: #2
Wave: 1 Maintainer Foundation
Depends on: #4

Summary

Provide an operator-safe way to create, rotate, pause/revoke, and inspect machine identities.

Scope

Start with CLI or protected admin-only UI, whichever is smallest and safest.
Support create identity, create/rotate credential, pause/revoke, inspect scopes/expiry/last-used/recent audit.
Avoid exposing raw credential values after creation.

Non-goals

No broad admin console.
No production credential issuance without Piotr approval.
No Infisical sync unless split into a separate issue.

Acceptance

Normal token lifecycle no longer requires direct SQL.
Revoked credentials stop authenticating.
Audit clearly records management actions.

Tests / smoke

Unit/API tests for lifecycle transitions.
Manual smoke in local/dev only.

Rollback

git revert <PR-commit> if no migration; migration PR must include rollback notes.

Owner gates

Any credential created for production is a hard stop.

Parent: #2 Wave: 1 Maintainer Foundation Depends on: #4 ## Summary Provide an operator-safe way to create, rotate, pause/revoke, and inspect machine identities. ## Scope - Start with CLI or protected admin-only UI, whichever is smallest and safest. - Support create identity, create/rotate credential, pause/revoke, inspect scopes/expiry/last-used/recent audit. - Avoid exposing raw credential values after creation. ## Non-goals - No broad admin console. - No production credential issuance without Piotr approval. - No Infisical sync unless split into a separate issue. ## Acceptance - Normal token lifecycle no longer requires direct SQL. - Revoked credentials stop authenticating. - Audit clearly records management actions. ## Tests / smoke - Unit/API tests for lifecycle transitions. - Manual smoke in local/dev only. ## Rollback - `git revert <PR-commit>` if no migration; migration PR must include rollback notes. ## Owner gates - Any credential created for production is a hard stop.

codex referenced this issue

2026-05-09 23:27:13 +02:00

[meta] Kan-ductor maturity waves #2

codex referenced this issue

2026-05-09 23:47:40 +02:00

feat(agent): add machine identities #28

codex referenced this issue

2026-05-09 23:55:18 +02:00

feat(agent): add machine identity admin CLI #29

codex commented

2026-05-09 23:55:35 +02:00

Author

Collaborator

Implemented in stacked PR #29: #29

Notes:

Base branch is codex/agent-machine-identities because this depends on #28.
Adds pnpm agent:identity maintainer CLI for create, rotate, pause, revoke, and inspect.
Mutations require --confirm, support --dry-run, verify workspace:manage, and write setup-mode audit events without storing raw tokens.
No production identity or credential was created.

Implemented in stacked PR #29: https://git.pdurlej.com/pdurlej/kan-ductor/pulls/29 Notes: - Base branch is `codex/agent-machine-identities` because this depends on #28. - Adds `pnpm agent:identity` maintainer CLI for create, rotate, pause, revoke, and inspect. - Mutations require `--confirm`, support `--dry-run`, verify `workspace:manage`, and write setup-mode audit events without storing raw tokens. - No production identity or credential was created.

glm referenced this issue

2026-05-15 19:32:23 +02:00

WIP: fix: harden kan-ductor agent safety gates #60

codex referenced this issue

2026-05-15 19:37:53 +02:00

fix: harden kan-ductor agent safety gates #61

codex referenced this issue

2026-05-28 01:20:38 +02:00

gemini(w1): audit machine identity CLI dry-run and execute confirmation UX #98

codex referenced this issue

2026-05-28 01:20:39 +02:00

gemini(w1): document thread-scoped Codex machine identity examples #99

Iskra commented

2026-06-08 03:14:33 +02:00

Collaborator

{
"confidence": 5,
"effort_hint": "medium",
"escalation": {
"kind": "operator",
"reason": "Machine identity lifecycle controls affect credential issuance and production access boundaries."
},
"evidence_refs": [
{
"note": "Issue adds operator-safe machine identity lifecycle management for Kan-ductor.",
"type": "forgejo",
"value": "issue-title-body-labels-and-target-snapshot"
},
{
"note": "Scope covers create, rotate, pause, revoke, inspect scopes, expiry, last-used, and recent audit.",
"type": "forgejo",
"value": "issue-body-scope"
},
{
"note": "Owner gates state production credential creation is a hard stop requiring approval.",
"type": "forgejo",
"value": "issue-body-owner-gates"
}
],
"impact": 5,
"judge_actor": {
"name": "iskra",
"runtime": "openclaw"
},
"judged_at": "2026-06-08T01:12:00Z",
"labels_to_apply": [
"judge/p1",
"judge/operator-needed"
],
"piotr_fit": "high",
"priority": "p1",
"rationale_summary": "This is P1 operator-shaped security work because machine identity lifecycle controls are foundational but production credential issuance must stay owner-gated.",
"reach": 5,
"recommended_next_action": "operator_needed",
"rerun_reason": "no_prior_judgment",
"schema": "openclaw.judge.v0",
"target": {
"kind": "issue",
"number": 5,
"repo": "pdurlej/kan-ductor"
},
"target_snapshot": {
"body_hash": "sha256:b1bb2d8bf0d3f892ee4559ec532a682cdb3d7f40392bfe2bf6a8aa9fff089a34",
"commit_count": null,
"evidence_hash": "sha256:1cbd5ac4c8a9a7d0524eec9052db219e483fe8ffc9261b965cfc2301e65fff08",
"head_sha": null,
"labels": [],
"labels_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"state": "open",
"title_hash": "sha256:b5e71698762dede07ac91c09742609a61525525ec0ea8384229ce35374d01931",
"updated_at": "2026-05-28T01:20:39+02:00"
},
"top_caveat": "Do not expose raw credentials after creation or issue production credentials without explicit owner approval."
}

{ "confidence": 5, "effort_hint": "medium", "escalation": { "kind": "operator", "reason": "Machine identity lifecycle controls affect credential issuance and production access boundaries." }, "evidence_refs": [ { "note": "Issue adds operator-safe machine identity lifecycle management for Kan-ductor.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Scope covers create, rotate, pause, revoke, inspect scopes, expiry, last-used, and recent audit.", "type": "forgejo", "value": "issue-body-scope" }, { "note": "Owner gates state production credential creation is a hard stop requiring approval.", "type": "forgejo", "value": "issue-body-owner-gates" } ], "impact": 5, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-08T01:12:00Z", "labels_to_apply": [ "judge/p1", "judge/operator-needed" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This is P1 operator-shaped security work because machine identity lifecycle controls are foundational but production credential issuance must stay owner-gated.", "reach": 5, "recommended_next_action": "operator_needed", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 5, "repo": "pdurlej/kan-ductor" }, "target_snapshot": { "body_hash": "sha256:b1bb2d8bf0d3f892ee4559ec532a682cdb3d7f40392bfe2bf6a8aa9fff089a34", "commit_count": null, "evidence_hash": "sha256:1cbd5ac4c8a9a7d0524eec9052db219e483fe8ffc9261b965cfc2301e65fff08", "head_sha": null, "labels": [], "labels_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "state": "open", "title_hash": "sha256:b5e71698762dede07ac91c09742609a61525525ec0ea8384229ce35374d01931", "updated_at": "2026-05-28T01:20:39+02:00" }, "top_caveat": "Do not expose raw credentials after creation or issue production credentials without explicit owner approval." }

Iskra added the

judge/operator-needed

judge/p1

labels

2026-06-08 03:14:33 +02:00