Repository navigation
Add service SVID allowlists to Policy and Egress Admin - #16355
Merged
agentydragon merged 3 commits intoNov 14, 2026
Merged
agentydragon merged 3 commits into
agentydragon merged 3 commits into
Conversation
Contributor
Visual review for
|
agentydragon-agent
force-pushed
the
agent/service-svid-policy-egress
branch
2 times, most recently
from
November 14, 2026 06:59
b14bb79 to
7102f71
Compare
agentydragon
enabled auto-merge (squash)
November 14, 2026 07:02
auto-merge was automatically disabled
November 14, 2026 07:17
Head branch was pushed to by a user without write access
agentydragon-agent
force-pushed
the
agent/service-svid-policy-egress
branch
from
November 14, 2026 07:17
7102f71 to
7418d3c
Compare
agentydragon
enabled auto-merge (squash)
November 14, 2026 07:27
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
#16341 removed the Dispatcher's readers for pre-Identity and unattributed rows after #16340 dropped them, so the transition-tolerance-removal track left the plan and the ledger re-pinned. Stage 1 now holds only the Gateway connection Lease. Since 1f3e26c, #16341, #16355, #16360, #16363, #16367 and #16369 edited 44 Go files; none were added, removed or moved and no .proto changed. The evidence's History correction no longer names the removed track. The identity-fence step names its open PR, #16373. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
…16368) This is the single open batch PR for the Agentplane organization plan. Later plan updates go here as commits until it merges. ## Commit 1: identity-fence decision The operator decided at 2026-11-14 07:20 UTC, answering the card "Choose how an Identity change is fenced against Session admission": "okay, sounds good to me, sessions can re-check". - **Cut line "Identity change against Session admission"** is now DECIDED. - There is no call between the binaries. EnvironmentService patches `spec.identity` under optimistic locking. - The Sandbox CRD already admits that change only while nothing runs. - Sessions re-check the live Identity at admission, placement and every delivery. - The retained-Session refusal goes. Session rows are never deleted, so the refusal blocked any rebind once a Session had existed. - Proposed addition, not decided: the Runtime refuses to run a retained Session whose recorded Identity differs from the Identity on its own credential. - **`environment-service-to-sandbox-controller`.** - Contract item (c) is decided. Dropping `dispatcher.Store.ChangeSandboxIdentity` and its refusal is its own behavior PR, ahead of the move. - The gate, the preserved invariants and the next-PR step change to match. - **Stale path fixed.** The automatic-wake card now says `environments/internal`. - **Evidence.** `evidence.json` records the operator's words and the checked facts: the CRD's stopped-only rule, and the Runtime's re-admission check. ## Commit 2: explicit-resume decision The operator decided at 2026-11-14 07:41 UTC, card "Choose how explicit resume is rate-bounded once EnvironmentService has no database": "No budget for explicit resume". - **Cut line "Rate bound for explicit resume"** is now DECIDED. Explicit resume reserves no wake budget; only the Sessions binary's automatic wake keeps one. - A resume acts only on a fully stopped Sandbox, and the generation token makes a stale resume return `STATE_CHANGED` (`lifecycle/SPEC.md`). So a Sandbox is resumed at most once per stop. - An Identity's `resume` grant scopes which Sandboxes it may wake. - Dropping the reservation from the explicit path is a behavior PR before EnvironmentService moves. - **`environment-service-to-sandbox-controller`.** Contract item (b) and the preserved invariants now name only automatic wake's rate limit. - **Keep-alive holds.** The proposal names Identities with a `resume` grant beside operators as explicit resumers. - **Operator questions.** The queue is empty, and the page says "None open." when it is. - **Transition tolerances.** History's empty Sandbox UID is listed as live again. A central Session may have no Sandbox, and #16356 and #16336 were closed unmerged. - **Evidence.** The operator's words are recorded. A verified fact that predated #16346 no longer says only operators may resume. ## Commit 3: burn down `transition-tolerance-removal` and re-pin at `7867f81780` - **Track landed whole.** #16341 removed the Dispatcher's readers for Sessions without an execution Identity or caller attribution, and for dispatch rows without stored attribution, after #16340 dropped those rows. The track, its next-PR entry and its ledger references are gone. Stage 1 now holds only the Gateway connection Lease. - **Ledger re-pinned.** Since `1f3e26cc58`, #16341, #16355, #16360, #16363, #16367 and #16369 edited 44 Go files. None were added, removed or moved, and no `.proto` changed. #16369 added History migration `00019_service_writer.sql`. - **Evidence.** The History correction no longer names the removed track. The identity-fence step names its open PR, #16373. - **Home page.** The reviewed-source line names the new pin. ## Checks - Structural check against the `7867f81780` inventory: PASS. All 1,275 Go files match, in 223 directories. - `prettier@3.9.10 --check`: clean. - Local Playwright: the report, the home page and the target-binaries section render at desktop and mobile, in light and dark, with no overflow and no console errors. All seven cut-line cards render, and the empty question list shows "None open.". - No source behaviour tests were run; this is a planning-only change. --- 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add exact service SPIFFE allowlists to PolicyService’s separate reader/writer capabilities and EgressAdmin’s read API. Both listeners can verify client certificates using the configured trust bundle while existing TokenReview callers keep working. The forward proxy’s workload Identity boundary remains separate.
This is optional stage-3 receiver support. It deliberately leaves out deployment settings, caller switches, TokenReview removal and RBAC cleanup; code and receiver image pins come first. The overview diagram records the optional certificate edges.
Validation: pre-commit and commit hooks passed. Isolated bbr verification passed for
//agentplane/egress/cmd:{listener_test,config_test},//agentplane/egress/internal/admin:admin_test,//agentplane/policy_controller/internal/rpc:rpc_test,//agentplane/policy_controller/cmd:config_test, and both Python:settingslibraries (invocation). Deployment suitebbr test //agentplane/system_tests/suites/mcp:test_servicespassed (invocation).Rollback: revert this receiver commit before enabling service callers; after a caller cutover, restore compatible caller images/settings first. Existing account admission remains available during this stage. Check Policy watches/grants and Egress Admin health/decisions after rollout. Flux, cert-manager and cluster policy objects have no system test and are not changed here.
The generated-manifest CI failure was traced to newly serialized empty service settings. Inactive defaults are now omitted.
bbr test //agentplane/policy_controller:settings //agentplane/egress:settings //cluster/cdk8s:test_generate_manifestspassed (https://app.buildbuddy.io/invocation/b83a5f4b-ba45-4b72-963a-33056bef72b5).Rollout gate: no new certificate-path or service-allowlist manifest setting until #16359 merges and the receiver images are pinned.
Python authoring models now enforce the same exact service-ID and client-trust requirements as Go.
bbr test //agentplane/policy_controller:settings //agentplane/egress:settings //cluster/cdk8s:test_generate_manifestspassed (https://app.buildbuddy.io/invocation/8f4a7182-ce3e-416a-a5f2-4a36529a8b3d).Questions for Claude
None.