pdurlej/platform

Fork 0

feat(agent-access): prune stopped and expired sessions #96

Closed

codex wants to merge 1 commit from codex/issues/79-prune-sessions into main

codex commented

2026-05-06 00:24:15 +02:00

Collaborator

Canary status: rewrite — 3-iteration cap reached on d4bc98280f530193bad594c3fba742e1756a8f63; high finding remains: prune must require private agent.env before trusting PID/socket. Do not merge.

Canary Context Pack

Product story

After #93 gave the operator safe visibility into non-secret ssh-agent sessions, the next step is controlled cleanup. The operator should be able to remove old stopped/expired session directories without touching active or unknown access-bearing state.

What changed

Added --prune to scripts/agent-access/codex-openclaw-ssh-agent.
Prunes only validated expired and stopped sessions.
Skips active, unknown, malformed, invalid, unsafe, and unconfirmed-agent sessions.
Before deleting an eligible session directory, requires the recorded PID to already be absent; if the PID is still present, the session is skipped rather than killed.
Documents the prune behavior in the Codex OpenClaw SSH runbook.
Adds tests for eligible pruning, unknown/active skip behavior, unconfirmed-agent skip, open-permission refusal, and private-key non-leakage.

Why it changed

This is the next child slice of #79 after #84/#90 startup cleanup and #93 non-secret listing. It deliberately avoids live probing and TTL-policy changes so the destructive cleanup behavior can be reviewed on its own.

Files touched

scripts/agent-access/codex-openclaw-ssh-agent
control-plane/platformctl/tests/test_agent_access_ssh_agent.py
docs/agent-access/codex-openclaw-ssh.md

Relevant context

Parent #79: session lifecycle hardening.
Child #95: prune stopped and expired sessions.
#93: non-secret --list contract merged.
Security-sensitive lane from #82 applies: smallest PR, explicit evidence, canary before merge.

Runtime evidence

PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_agent_access_ssh_agent.py -> 16 passed
PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests -> 174 passed
git diff --check origin/main -> pass
Current diff secret-pattern scan -> pass

Known constraints

--prune depends on persisted, validated metadata from --list. active still means metadata-unexpired, not live-socket verified. Sessions with missing/bad agent.env are skipped rather than deleted, because the wrapper cannot confirm agent absence. --prune also fails on group/world-open sessions/ instead of repairing permissions, emits explicit SKIP_ACTIVE/SKIP_UNKNOWN/SKIP_NO_AGENT_ENV/SKIP_AGENT_ALIVE lines, and wraps deletion errors as SKIP_ERROR.

Explicit out-of-scope

No live socket probing.
No TTL policy changes.
No Infisical, Forgejo PAT, CI, or OpenClaw runtime changes.
No generic Agent Access Plane catalog/resolver work.

Requested decision

Approve merge if canary confirms --prune removes only safe stopped/expired session state and preserves active/unknown/unconfirmed state.

Merge blockers

Deleting active or unknown sessions.
Deleting a session when recorded agent shutdown cannot be confirmed.
Mutating group/world-open sessions/ permissions instead of failing.
Any private-key material in stdout/stderr/session files.
Requiring the OpenClaw private-key env to prune.

Spec sources read

Issue #79 — parent lifecycle hardening scope.
Issue #95 — child scope and acceptance criteria.
scripts/agent-access/codex-openclaw-ssh-agent — implementation target.
control-plane/platformctl/tests/test_agent_access_ssh_agent.py — wrapper test harness.
docs/agent-access/codex-openclaw-ssh.md — operator runbook update.
PR #93 body/diff — current --list contract this prune slice builds on.

Closes #95
Refs #79

Canary status: rewrite — 3-iteration cap reached on `d4bc98280f530193bad594c3fba742e1756a8f63`; high finding remains: prune must require private `agent.env` before trusting PID/socket. Do not merge. ## Canary Context Pack ### Product story After #93 gave the operator safe visibility into non-secret ssh-agent sessions, the next step is controlled cleanup. The operator should be able to remove old stopped/expired session directories without touching active or unknown access-bearing state. ### What changed - Added `--prune` to `scripts/agent-access/codex-openclaw-ssh-agent`. - Prunes only validated `expired` and `stopped` sessions. - Skips `active`, `unknown`, malformed, invalid, unsafe, and unconfirmed-agent sessions. - Before deleting an eligible session directory, requires the recorded PID to already be absent; if the PID is still present, the session is skipped rather than killed. - Documents the prune behavior in the Codex OpenClaw SSH runbook. - Adds tests for eligible pruning, unknown/active skip behavior, unconfirmed-agent skip, open-permission refusal, and private-key non-leakage. ### Why it changed This is the next child slice of #79 after #84/#90 startup cleanup and #93 non-secret listing. It deliberately avoids live probing and TTL-policy changes so the destructive cleanup behavior can be reviewed on its own. ### Files touched - `scripts/agent-access/codex-openclaw-ssh-agent` - `control-plane/platformctl/tests/test_agent_access_ssh_agent.py` - `docs/agent-access/codex-openclaw-ssh.md` ### Relevant context - Parent #79: session lifecycle hardening. - Child #95: prune stopped and expired sessions. - #93: non-secret `--list` contract merged. - Security-sensitive lane from #82 applies: smallest PR, explicit evidence, canary before merge. ### Runtime evidence - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_agent_access_ssh_agent.py` -> `16 passed` - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests` -> `174 passed` - `git diff --check origin/main` -> pass - Current diff secret-pattern scan -> pass ### Known constraints `--prune` depends on persisted, validated metadata from `--list`. `active` still means metadata-unexpired, not live-socket verified. Sessions with missing/bad `agent.env` are skipped rather than deleted, because the wrapper cannot confirm agent absence. `--prune` also fails on group/world-open `sessions/` instead of repairing permissions, emits explicit SKIP_ACTIVE/SKIP_UNKNOWN/SKIP_NO_AGENT_ENV/SKIP_AGENT_ALIVE lines, and wraps deletion errors as SKIP_ERROR. ### Explicit out-of-scope - No live socket probing. - No TTL policy changes. - No Infisical, Forgejo PAT, CI, or OpenClaw runtime changes. - No generic Agent Access Plane catalog/resolver work. ### Requested decision Approve merge if canary confirms `--prune` removes only safe stopped/expired session state and preserves active/unknown/unconfirmed state. ### Merge blockers - Deleting `active` or `unknown` sessions. - Deleting a session when recorded agent shutdown cannot be confirmed. - Mutating group/world-open `sessions/` permissions instead of failing. - Any private-key material in stdout/stderr/session files. - Requiring the OpenClaw private-key env to prune. ## Spec sources read - Issue #79 — parent lifecycle hardening scope. - Issue #95 — child scope and acceptance criteria. - `scripts/agent-access/codex-openclaw-ssh-agent` — implementation target. - `control-plane/platformctl/tests/test_agent_access_ssh_agent.py` — wrapper test harness. - `docs/agent-access/codex-openclaw-ssh.md` — operator runbook update. - PR #93 body/diff — current `--list` contract this prune slice builds on. Closes #95 Refs #79

codex added 1 commit

2026-05-06 00:24:15 +02:00

feat(agent-access): prune stopped and expired sessions

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 27s

Details

python-ci / Python 3.12 (pull_request) Successful in 29s

Details

python-ci / Python 3.13 (pull_request) Successful in 29s

Details

canary-required / canary (pull_request) Successful in 12s

Details

53ec756d62

codex added the

class/security-sensitive

label

2026-05-06 00:24:38 +02:00

codex force-pushed codex/issues/79-prune-sessions from 53ec756d62

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 27s

Details

python-ci / Python 3.12 (pull_request) Successful in 29s

Details

python-ci / Python 3.13 (pull_request) Successful in 29s

Details

canary-required / canary (pull_request) Successful in 12s

Details

to 7b6563cc86

canary-required / collect-diff (pull_request) Successful in 4s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 33s

Details

python-ci / Python 3.12 (pull_request) Successful in 33s

Details

python-ci / Python 3.13 (pull_request) Successful in 33s

Details

canary-required / canary (pull_request) Successful in 14s

Details

2026-05-06 00:34:58 +02:00

Compare

codex force-pushed codex/issues/79-prune-sessions from 7b6563cc86

canary-required / collect-diff (pull_request) Successful in 4s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 33s

Details

python-ci / Python 3.12 (pull_request) Successful in 33s

Details

python-ci / Python 3.13 (pull_request) Successful in 33s

Details

canary-required / canary (pull_request) Successful in 14s

Details

to d4bc98280f

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 14s

Details

python-ci / Python 3.11 (pull_request) Successful in 30s

Details

python-ci / Python 3.12 (pull_request) Successful in 31s

Details

python-ci / Python 3.13 (pull_request) Successful in 31s

Details

canary-required / canary (pull_request) Successful in 12s

Details

2026-05-06 00:45:37 +02:00

Compare

codex commented

2026-05-06 00:51:18 +02:00

Author

Collaborator

Terminal action: rewrite on d4bc98280f530193bad594c3fba742e1756a8f63. The third canary iteration still had one high security finding: --prune can trust agent.env even if that file is group/world-open.

I am not asking for merge with this gap. I will close this PR and open a clean rewrite PR with an explicit private-file check for agent.env, then rerun canary from a fresh PR budget.

Terminal action: `rewrite` on `d4bc98280f530193bad594c3fba742e1756a8f63`. The third canary iteration still had one high security finding: `--prune` can trust `agent.env` even if that file is group/world-open. I am not asking for merge with this gap. I will close this PR and open a clean rewrite PR with an explicit private-file check for `agent.env`, then rerun canary from a fresh PR budget.

codex closed this pull request

2026-05-06 00:51:18 +02:00

codex referenced this pull request

2026-05-06 00:53:58 +02:00

feat(agent-access): prune stopped and expired sessions #108