Repository navigation
Admit native Identity Sessions with explicit environment binding grants - #16351
Open
agentydragon-agent wants to merge 1 commit into
Open
agentydragon-agent wants to merge 1 commit into
agentydragon-agent wants to merge 1 commit into
Conversation
agentydragon-agent
force-pushed
the
environment-bind-session
branch
from
November 14, 2026 06:17
ccb879c to
1769e7e
Compare
Contributor
Visual review for
|
agentydragon-agent
force-pushed
the
environment-bind-session
branch
from
November 14, 2026 06:44
1769e7e to
d8e1898
Compare
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
Adds the first released environment-rule slice: explicit Identity `resume` grants with Sandbox/boundIdentity selectors, CEL admission, typed policy reader and `EnvironmentReady`. EnvironmentService/lifecycle check the effective caller, current target and live Identity on admission and conflict retries. Self-reads, Pod-bound operator resume (including requested stops), and automatic wake retain their existing authority. The evaluator is a library. Resume owns its reader instance; the subsequent native-session slice will construct an independent reader, consistent with the selected Environments/Sessions binary split. Validation: all five focused Go suites passed in [d21c20cb](https://app.buildbuddy.io/invocation/d21c20cb-cec1-4965-b130-445854c3a8f2): `//agentplane/policy/reader:reader_test`, `//agentplane/runner_gateway/environmentaccess:environmentaccess_test`, `//agentplane/runner_gateway/environments:environments_test`, `//agentplane/runner_gateway/environments/lifecycle:lifecycle_test`, `//agentplane/runner_gateway/dispatcher:store_integration_test`. Commit hooks passed, including the generated CRD/RBAC commit. The five listed build targets passed in [9d5c3efd](https://app.buildbuddy.io/invocation/9d5c3efd-42ce-4694-bd7e-1d1e60b00bb3): `//agentplane/policy/api/v1alpha1:generated_crds`, `//agentplane/policy/api/v1alpha1:policy_types_proto`, `//agentplane/runner_gateway:main_lib`, `//agentplane/system_tests/scenarios:suspend_resume`, `//cluster/cdk8s/agentplane:runner_gateway_workload`. Both generated snapshot tests passed in [56b0ad15](https://app.buildbuddy.io/invocation/56b0ad15-3ae1-4383-abc7-c32c14f78baf): `//agentplane/crds:test_generate` and `//cluster/cdk8s:test_generate_manifests`. PolicySet API admission and both full system suites passed in [b2db6a6f](https://app.buildbuddy.io/invocation/b2db6a6f-8741-4df5-b9cc-9988d146428e): `//agentplane/crds:test_policyset_admission`, `//agentplane/system_tests/suites:test_pod`, `//agentplane/system_tests/suites:test_dispatcher`. Current review head: `4013d3367655b76ff6455e98e4c442a3c6c8752a`. Rollout: ship the expanded CRD, required reader RBAC and enforcing Gateway image/pin before authoring an environment PolicySet. Audited pinned Action/egress/Notification readers skip unknown rule types; MCP edge watches only Identities and old Gateway has no environment reader. No standing PolicySet uses the new type in this PR. Details: `agentplane/docs/environment_policy_rollout.md`. Rollback: remove environment rules/dedicated bindings first, preserving other rules in mixed sets, then revert the Gateway pin/CRD. After Flux reconciles, verify inventory self-reads, direct operator requested-stop resume, automatic wake and other reader conditions. No retained state needs deletion. System coverage before merge: `//agentplane/system_tests/suites:test_pod` (Identity denial/explicit grant/EnvironmentReady plus operator resume and retained History) and `//agentplane/system_tests/suites:test_dispatcher` (automatic wake/queue behavior). Deliberately leaves out `bind_session` (slice 2), read/suspend/delete/attach operations, environment-free Session creation, parent-over-child grants, launch-written grants (`ORCHESTRATION_V1_BACKEND_GRANTS`), retirement of orchestration_v1, and Action Service launcher admission changes. Native GitHub Stacks cannot span a fork, so the bind_session slice is an ordinary PR, #16351, merging after this one. This resume PR remains independent. --------- Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon-agent
force-pushed
the
environment-bind-session
branch
2 times, most recently
from
November 14, 2026 07:02
1dde770 to
72315ca
Compare
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
This is the single open batch PR for the Agentplane organization plan. Further plan updates go here as commits until it merges, instead of one PR each. ## Commit 1: re-pin to devel `1f3e26cc58` and place `environmentaccess` Eight Agentplane commits landed after `02dc3c7a2e`: #16345, #16346, #16340, #16350, #16352, #16342, #16347 and #16359. They added five Go files and removed or moved none. None of them finishes a plan track. - **New package `runner_gateway/environmentaccess`.** It holds the environment rules from #16346. - It moves with EnvironmentService to `environments/access` (package `access`). - It stays outside `internal/` because the open slice #16351 makes Session admission enforce `bind_session` with it, so both binaries import it. - It is a rule parser over the shared policy reader, like `inboxaccess` and egress `policy`. - **New files in existing packages.** They take their package siblings' dispositions: - `identity/auth/service{,_test}.go` is retained. - `environments/environment_grants_test.go` moves with EnvironmentService. - **Landed steps recorded:** - `transition-tolerance-removal`: #16340 dropped the pre-Identity Dispatcher rows, and #16341 removes the branches. History's empty Sandbox UID is no longer listed as "not a leftover": #16356 refuses writers without one, ahead of the #16336 drop, which is on hold. - `gateway-connection-lease-removal`: #16345 has merged and #16361 is open. - **Cut line, explicit resume.** Since #16346 an Identity with a `resume` grant may resume, and every explicit resume reserves the Dispatcher-database wake budget. After the split, EnvironmentService has no database, so this crossing needs either its own bound or a call back to Sessions. It is queued as an operator question, after the identity fence. - **Counts and freshness.** The ledger, counts, freshness evidence and listing counts are updated: 1,275 files in 223 packages. ## Checks - Structural check against the `1f3e26cc58` inventory: PASS (42 tracks, 1,275 files, 223 packages). - `prettier@3.9.10 --check`: clean. - Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors. The binaries section still shows all seven cut-line cards. - No source behaviour tests run; this is a planning-only change. --- _Generated by [Claude Code](https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm)_ Co-authored-by: Claude <noreply@anthropic.com>
agentydragon-agent
force-pushed
the
environment-bind-session
branch
2 times, most recently
from
November 14, 2026 07:35
e5c392f to
c5b4c6d
Compare
agentydragon
enabled auto-merge (squash)
November 14, 2026 07:36
agentydragon
disabled auto-merge
November 14, 2026 07:36
agentydragon-agent
force-pushed
the
environment-bind-session
branch
from
November 14, 2026 07:53
c5b4c6d to
c2b0567
Compare
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
<!-- claude-projects-attribution: {"github_login":"agentydragon"} -->
_Requested by **Rai** · [project
thread](https://claude.ai/code/project/chan_01RbvEzrs8Yi8YhNnHoSLtMy?thread=cmsg_01RbvEzrs8Yi8YhNnHoSLtMy2SHUu9XsCD6ej526Bhqzxa)_
Doc-only update of `agentplane/plans/task_dag.md` (and one link in
`plans/environment_rules.md`) for the last day's plans and decisions.
**Added**
- **Released 2026-11-14:** each track the operator released today, with
the quoted release, its node and its PRs' state at 07:40 UTC.
- **Sandbox-free central Sessions:** orders the existing sections 5, 13
and 14 nodes for a central Session with no Sandbox attached, from the
three #15436 decisions through the zero-Environment path and its
follow-ons. New decision node `CODE_MODE_HOST_DESIGN` for whether to
keep Codex's pinned JavaScript host or own a V8 host; it is recorded as
not a prerequisite, since the host runs in the sampler Pod and needs no
executor.
- **Section 17, two binaries and the Go layout:** the agreed
Environments/Sessions split with its decided cards (automatic wake,
directories, identity re-check, no budget for explicit resume), a stage
table mapping the gh-pages Go plan onto DAG nodes, and nodes for the
stage 3 moves, keep-alive holds, stage 2 layout fixes and stage 4 local
extractions.
**Updated**
- 2026-10-30 sprint priorities marked stale; no new priorities are
stated.
- `NOTIFICATION_SERVICE_SPLIT` carries the operator's 01:11–01:12
direction (inbox service plus GitHub actor; subscription seam open).
- `SESSION_TOOL_SURFACE_CONVERGENCE_DESIGN`: direction agreed at 01:10;
interface review open.
- `DISPATCHER_PERSISTENCE_MODEL_DESIGN`: topology selected; delivery
ownership and the Dispatcher's ownership Lease remain open.
- `RUNNER_GATEWAY_RENAME`: the Environment Gateway name is dropped; the
node now covers deployed names after the split.
- `PRIVILEGED_BACKEND_AUTH_DESIGN`, `APP_AGENT_TOKEN_DECISION`,
`ENVIRONMENT_LIFECYCLE_RULES`, `ENVIRONMENT_IDENTITY_BIND_SESSION` and
`REFACTOR_COHERENCE_AUDIT` carry their merged and in-review PRs.
**Deleted as finished:** `ENVIRONMENT_RULE_TYPE_DESIGN` (selected
04:58), `ENVIRONMENT_IDENTITY_RESUME` (#16346 merged),
`TRANSPORT_PACKAGE_RENAME` (the package lives only at `net/peertls`).
**Left out on purpose**
- Section 12 is untouched: the open Lease stack (#16361, #16362, #16365)
edits it. Section 17 refers only to `RUNNER_CONNECTION_LEASE_CLEANUP`,
which exists in both versions; whichever lands second rebases.
- `plans/environment_rules.md` status line: #16351 edits it.
- No priority changes and no new dispatch.
**Checks:** a local script parsed every Mermaid block (no unknown IDs or
cycles introduced), node headings (no duplicates) and local anchors; the
remaining findings, such as links to `central_session_contract.md` from
open #15436, predate this PR. `pre-commit run --files` on both files
passes.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01AYUnw2srgM3L5WxRM4C2Kt)_
Co-authored-by: Claude <noreply@anthropic.com>
agentydragon-agent
force-pushed
the
environment-bind-session
branch
from
November 14, 2026 08:00
c2b0567 to
353246a
Compare
agentydragon-agent
force-pushed
the
environment-bind-session
branch
from
November 14, 2026 08:08
353246a to
41cf2ae
Compare
agentydragon-agent
force-pushed
the
environment-bind-session
branch
from
November 14, 2026 08:20
41cf2ae to
2879fac
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the released native
CreateSessionbind_sessionslice. An Identity caller needs a current explicit environment grant, and a selector naming a Sandbox must also name its bound Identity. The new Session records the exact live Identity of the placed Sandbox; creators do not receive authority over another Identity's Sessions. The Dispatcher constructs its own index and watches from the shared environment-rule library, independently of EnvironmentService/lifecycle.Review commit:
2879facb15540be0e93692941e5e28fe67fa8a9a.Native admission checks target incarnation, current grant and policy readiness again after the shared Sandbox lock. Identity rebind, operator-stop intent and deletion cannot acquire a new binding through a stale preflight. ServiceAccount privileges remain unchanged. Exact creation retries preserve the original admission and can recover only the retained creator's receipt after grant removal; ordinary Session reads and commands remain scoped to the execution Identity. An additive startup migration retains delegated creator, actor and Action correlation separately.
Validation (all via remote Bazel):
Current-head post-Admit independent service SVID roles on Gateway receivers #16364 validation:
bbr test //agentplane/runner_gateway/dispatcher:store_integration_test //agentplane/action_service/session_delegation:dispatcher_integration_test //agentplane/runner_gateway/migrations:upgrade_integration_test //agentplane/runner_gateway/migrations:test_migrations --test_output=errors— all four executed and passed (6495d0c9). This includes service-delegated native creation with a matching Identity grant, direct service creation/receipts, receipt recovery after grant revocation, and migration 17 → 18 → 19 → 20. Full current-head CI pending.bbr test //agentplane/policy/reader:reader_test //agentplane/runner_gateway/environmentaccess:environmentaccess_test //agentplane/runner_gateway/environments:environments_test //agentplane/runner_gateway/environments/lifecycle:lifecycle_test //agentplane/crds:test_policyset_admission //agentplane/system_tests/scenarios:test_suspend_resume— all passed (invocation).bbr build //agentplane/policy/api/v1alpha1:generated_crds //agentplane/policy/api/v1alpha1:policy_types_proto //agentplane/runner_gateway:main_lib //agentplane/system_tests/scenarios:suspend_resume //agentplane/system_tests/suites:pod_cases— passed (invocation).Rebased build
bbr build //agentplane/runner_gateway:main_lib //agentplane/system_tests/scenarios:suspend_resume //agentplane/system_tests/suites:pod_cases— passed (invocation).bbr test //agentplane/crds:test_generate //cluster/cdk8s:test_generate_manifests— passed (invocation).bbr test //agentplane/system_tests/suites:test_pod //agentplane/system_tests/suites:test_dispatcher— both executed and passed (invocation). The Pod suite exercises direct workload SVID denial without a grant, admission with a grant, target execution Identity, and exact receipt recovery after removing the binding. Existing suites retain operator resume, automatic wake, queue, idempotency and History coverage.bbr test //agentplane/runner_gateway/migrations:upgrade_integration_test //agentplane/runner_gateway/internal/sandboxinventory:sandboxinventory_test— both passed in b09d174d.bbr test --test_output=streamed //agentplane/runner_gateway/dispatcher:store_integration_test— passed in eab1b8c5, including grant expiry/UID/readiness, post-lock rebind/deletion, delegated actor vs creator vs execution Identity, and exact creator receipt recovery after revocation/target loss.CI corrections:
bbr test //agentplane/runner_gateway/migrations:test_migrations //agentplane/action_service/session_delegation:dispatcher_integration_test --test_output=errors— both passed in 7fa35a8d. The migration test checks the new column instead of a stale maximum version; the Dispatcher fixture supplies a live Sandbox and a healthy empty policy index to exercise the intended grant denial.bbr test //agentplane/system_tests/suites/mcp:test_delegation— passed in 9bea23f7, with the unreadable-target expectation updated toTARGET_NOT_FOUND.Final rebased
bbr build //agentplane/runner_gateway:main_lib //agentplane/system_tests/scenarios:suspend_resume //agentplane/system_tests/suites:pod_cases— passed in 49f9045d.Latest pre-rebase CI e9ce8139: all four previously red targets passed:
//agentplane/action_service/session_delegation:dispatcher_integration_test(35s),//agentplane/runner_gateway/migrations:test_migrations(67s),//agentplane/system_tests/suites/mcp:test_delegation(122s), and//agentplane/system_tests/suites:test_vm(317s). Full//agentplane/system_tests/suites:test_pod(412s) and//agentplane/system_tests/suites:test_dispatcher(304s) passed too. That execution preceded the post-merge migration-19 rebase; current-head CI will validate the new migration ordering.Post-[agentplane] discard pre-Identity Dispatcher rows #16340 validation:
bbr test //agentplane/runner_gateway/migrations:upgrade_integration_test //agentplane/runner_gateway/migrations:test_migrations //agentplane/runner_gateway/dispatcher:store_integration_test //agentplane/action_service/session_delegation:dispatcher_integration_test --test_output=errors— all four executed and passed in ae91159a, including the migration-17 → 18 → 19 path and retained-evidence checks.Full migration-19 CI passed: test invocation 7d5fdfc7 and build invocation f879d2f8. All four previously red targets and the full Pod/Dispatcher system suites passed. Pre-commit, Nix, artifact imports and visual review passed too. The subsequent devel rebases now include [agentplane] remove pre-Identity Dispatcher reader fallbacks #16341 at
63ce9dc3. Its Store conflicts were resolved by preserving its attribution validation and applying creator-specific receipt authorization; all four post-rebase focused targets passed in 393f0559:bbr test //agentplane/runner_gateway/dispatcher:store_integration_test //agentplane/action_service/session_delegation:dispatcher_integration_test //agentplane/runner_gateway/migrations:upgrade_integration_test //agentplane/runner_gateway/migrations:test_migrations --test_output=errors(upgrade cached, other three executed). Current-head CI is pending. No new row-shape requirement is introduced by this PR.PYTHON_CPU_COUNT=2 pre-commit run --files <all changed files>— passed, including after the migration-19 rebase; commit hooks passed.The original CI VM failure was during PKI setup: cert-manager rejected trust-manager's CSR/private-key pair, backed off issuance for an hour, and the missing TLS Secret left trust-manager unable to start. The trigger for the mismatched pair is not established; no environment-rule code ran in that failed setup. No manual CI rerun, test skip, timeout increase or certificate retry was used. Evidence is retained in
agentplane/system_tests/debug/test_vm_trust_manager_issuance_failure_2026_11_14.md. This remains an open infrastructure concern even if a later CI execution passes.Migration sequencing: #16340 has landed
00018_discard_pre_identity_rows.sql. After #16364’s00019_service_attribution.sql, this PR adds00020_session_creator_delegation.sql. The upgrade test now creates the pre-cutover schema at version 17 and applies the pending migrations, preserving #16340's retained-evidence checks without introducing a gap below an already-applied migration.Rollout and pin gates: no
environmentPolicySet may be authored on staging until the enforcing Gateway image from merged #16346 is pinned, as required byagentplane/docs/environment_policy_rollout.md. Before authoringbind_session, deploy this slice's expanded CRD and pin a staging Gateway image containing this PR's Dispatcher admission code. Confirm its independent policy watches are healthy and a fixture binding reportsEnvironmentReady. No standing PolicySet uses either new operation here. The reader compatibility audit remains in that rollout document.Rollback: remove
bind_sessionfrom rules (preserving resume/other mixed rules) and remove dedicated bindings before reverting the Gateway pin and narrowing the operation enum. Retain the nullable attribution columns and all Session rows; no down migration or uncertain creation replay. After Flux reconciles, check exact create receipts, execution-Identity fencing, inventory self-read, direct operator requested-stop resume, automatic wake and retained History. An older image refuses new Identity creation and may lack cross-Identity creator receipt recovery. Required system coverage: full//agentplane/system_tests/suites:test_pod(workload CLI denial/grant/target principal/exact receipt) and//agentplane/system_tests/suites:test_dispatcher(queue, receipts and wake). System results must pass before merge.Deliberately leaves out AttachEnvironment, a
sessionrule type, read/suspend/delete grants, environment-free or Identity central-sampler creation, cross-Identity Session execution binding, parent-over-child authority, launch-written grants (ORCHESTRATION_V1_BACKEND_GRANTS), retirement of orchestration_v1, and Action Service launcher admission or caller-authentication changes.Latest rebase: head
2879facb15540be0e93692941e5e28fe67fa8a9ais based ona68e0de510d6ea10184705ab453a69259cb85801, including service-SVID admission and the system-test root-key renewal correction #16377. The rebase was conflict-free; range-diff showed unchanged patches, and it was published with--force-with-lease. GitHub confirms this head. Current-head pre-commit, Nix and artifact/import checks passed; Bazel and visual review are running, with no reported failures as of 2026-11-14 08:29 UTC. The focused RBE results above remain prior-base validation. Freshorigin/develis6e591f383864ab47d7a9370abb4bd6637f0faee3; its two additional commits change image pins and a Dispatcher documentation note, and GitHub reports this PR mergeable.