[agentydragon]

This is the single open batch PR for the Agentplane organization plan. Further plan updates go here as commits until it merges, instead of one PR each.

Commit 1: re-pin to devel 1f3e26cc58 and place environmentaccess

Eight Agentplane commits landed after 02dc3c7a2e: #16345, #16346, #16340, #16350, #16352, #16342, #16347 and #16359. They added five Go files and removed or moved none. None of them finishes a plan track.

• New package runner_gateway/environmentaccess. It holds the environment rules from Admit explicit Identity environment resume grants #16346.
  • It moves with EnvironmentService to environments/access (package access).
  • It stays outside internal/ because the open slice Admit native Identity Sessions with explicit environment binding grants #16351 makes Session admission enforce bind_session with it, so both binaries import it.
  • It is a rule parser over the shared policy reader, like inboxaccess and egress policy.
• New files in existing packages. They take their package siblings' dispositions:
  • identity/auth/service{,_test}.go is retained.
  • environments/environment_grants_test.go moves with EnvironmentService.
• Landed steps recorded:
  • transition-tolerance-removal: [agentplane] discard pre-Identity Dispatcher rows #16340 dropped the pre-Identity Dispatcher rows, and [agentplane] remove pre-Identity Dispatcher reader fallbacks #16341 removes the branches. History's empty Sandbox UID is no longer listed as "not a leftover": [agentplane] refuse History writers without a Sandbox UID #16356 refuses writers without one, ahead of the History: delete Sessions without a Sandbox UID #16336 drop, which is on hold.
  • gateway-connection-lease-removal: Runtime: bind incarnation through Controller and accept independent Gateway watches #16345 has merged and Gateway: observe and call Runtimes independently on every replica #16361 is open.
• Cut line, explicit resume. Since Admit explicit Identity environment resume grants #16346 an Identity with a resume grant may resume, and every explicit resume reserves the Dispatcher-database wake budget. After the split, EnvironmentService has no database, so this crossing needs either its own bound or a call back to Sessions. It is queued as an operator question, after the identity fence.
• Counts and freshness. The ledger, counts, freshness evidence and listing counts are updated: 1,275 files in 223 packages.

Checks

• Structural check against the 1f3e26cc58 inventory: PASS (42 tracks, 1,275 files, 223 packages).
• prettier@3.9.10 --check: clean.
• Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors. The binaries section still shows all seven cut-line cards.
• No source behaviour tests run; this is a planning-only change.

---

Generated by Claude Code