Repository navigation
Inventory service authentication paths and stage the SVID cutover - #16352
Merged
agentydragon merged 2 commits intoNov 14, 2026
Merged
agentydragon merged 2 commits into
agentydragon merged 2 commits into
Conversation
agentydragon-agent
force-pushed
the
agent/service-svid-inventory
branch
from
November 14, 2026 06:51
0393b08 to
bfee647
Compare
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
This is the single open batch PR for the Agentplane organization plan. Further plan updates go here as commits until it merges, instead of one PR each. ## Commit 1: re-pin to devel `1f3e26cc58` and place `environmentaccess` Eight Agentplane commits landed after `02dc3c7a2e`: #16345, #16346, #16340, #16350, #16352, #16342, #16347 and #16359. They added five Go files and removed or moved none. None of them finishes a plan track. - **New package `runner_gateway/environmentaccess`.** It holds the environment rules from #16346. - It moves with EnvironmentService to `environments/access` (package `access`). - It stays outside `internal/` because the open slice #16351 makes Session admission enforce `bind_session` with it, so both binaries import it. - It is a rule parser over the shared policy reader, like `inboxaccess` and egress `policy`. - **New files in existing packages.** They take their package siblings' dispositions: - `identity/auth/service{,_test}.go` is retained. - `environments/environment_grants_test.go` moves with EnvironmentService. - **Landed steps recorded:** - `transition-tolerance-removal`: #16340 dropped the pre-Identity Dispatcher rows, and #16341 removes the branches. History's empty Sandbox UID is no longer listed as "not a leftover": #16356 refuses writers without one, ahead of the #16336 drop, which is on hold. - `gateway-connection-lease-removal`: #16345 has merged and #16361 is open. - **Cut line, explicit resume.** Since #16346 an Identity with a `resume` grant may resume, and every explicit resume reserves the Dispatcher-database wake budget. After the split, EnvironmentService has no database, so this crossing needs either its own bound or a call back to Sessions. It is queued as an operator question, after the identity fence. - **Counts and freshness.** The ledger, counts, freshness evidence and listing counts are updated: 1,275 files in 223 packages. ## Checks - Structural check against the `1f3e26cc58` inventory: PASS (42 tracks, 1,275 files, 223 packages). - `prettier@3.9.10 --check`: clean. - Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors. The binaries section still shows all seven cut-line cards. - No source behaviour tests run; this is a planning-only change. --- _Generated by [Claude Code](https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Record the current first-party credential, audience, admission, transport and delegation paths, and reconcile the gRPC/workload authentication guidance with the operator’s 2026-11-14 service-SVID decision (#16342). The inventory separates the future Sessions → Runtime proxy hop from proxy → Runtime, and keeps each caller role independent of today’s combined Gateway binary. It records outside-Agentplane Haku routes and the remaining TLS gaps.
This is stage 1. It deliberately leaves out issuance, receiver wiring, caller settings and bearer removal; those are separately rolled PRs. #16333/#16334 own the in-flight Policy/sampler TLS changes. The service principal APIs are specified here and implemented separately in #16350.
Validation: pre-commit and commit hooks passed. This documentation-only change has no deployment or system-test behavior to exercise; shared auth baseline tests passed in the decision PR.
Rollback: revert this documentation PR; no manifests, data or traffic change.
Questions for Claude
Before the later sampler→LLM caller cutover, verify staging Sessions retain execution Identity name and UID for typed delegation. The inventory records that gate; it does not enable the cutover.