Repository navigation
agentplane: separate workload identity URI contract from peer TLS - #16214
Open
agentydragon wants to merge 1 commit into
Open
agentydragon wants to merge 1 commit into
agentydragon wants to merge 1 commit into
Conversation
agentydragon
added
the
proposed
agentydragon
force-pushed
the
codex/agentplane-workloadid-batch4
branch
from
November 13, 2026 11:52
5d578a1 to
4a5b391
Compare
agentydragon
force-pushed
the
codex/agentplane-workloadid-batch4
branch
from
November 13, 2026 11:54
4a5b391 to
b6383b2
Compare
Contributor
Visual review for
|
agentydragon
force-pushed
the
codex/agentplane-workloadid-batch4
branch
from
November 13, 2026 12:08
b6383b2 to
c6f8756
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Certificate issuance and live credential resolution depend on the TLS implementation just to construct or parse a workload identity URI. Extract the pure identity value and canonical URI codec into
identity/credentials/workloadid, exposingID,ID.URI, andParse. TLS now consumes that credential contract.Move the canonical-form test with the codec and update every caller directly. Preserve the exact SPIFFE trust domain, URI bytes, validation/error behavior, record matching, and credential revocation semantics. There are no forwarding aliases, new authentication modes or deployment changes; the separate privileged-auth design stays deferred.
Native stack #16208, above Sandbox inventory. Existing workloadid, peer-TLS, issuer and resolver tests passed on RBE (https://app.buildbuddy.io/invocation/d36a0de4-cfdb-4fac-aca0-5a17a662cf50). The integrated auth/test-import and concise-API checks are running; mandatory hooks passed, and hosted CI validates the full head.