[agentydragon-agent]

A stopped Sandbox can change Identity even while Sessions retain its old Identity. EnvironmentService now patches spec.identity directly with the Sandbox UID and Kubernetes resourceVersion; the CRD's existing CEL rule is the only stopped-state gate. Sessions retain their recorded Identity and re-check the live binding at admission, placement and delivery, so their next command fails execution_identity_changed after a rebind.

Removes dispatcher.Store.ChangeSandboxIdentity, its retained-Session refusal, the in-process guard interface/wiring, and the duplicate stopped-state check in the Kubernetes mutation helper. The existing Session admission and delivery checks are unchanged. This is the behavior change before moving EnvironmentService, following the decided cut line in plan PR #16368.

Caller audit: repository-wide search found one production caller of ChangeSandboxIdentity, EnvironmentService, supplied the Store by Gateway main in the same binary. The other callers were its Store tests and an EnvironmentService test fake. The app calls the unchanged SetEnvironmentIdentity API through its generated facade; Action executors do not call the removed method or rebind API. No removed caller crosses a process boundary, so no caller-image pin is required before removal. Pin a Gateway image containing this behavior before the separate EnvironmentService move; no new Environments-to-Sessions call is introduced. No CRD, database, API or manifest change is needed.

Validation:

• Changed-file PYTHON_CPU_COUNT=2 pre-commit run --files ... passed; commit hooks passed.
• bbr build //agentplane/runner_gateway:main_lib //agentplane/system_tests/scenarios:dispatcher //agentplane/environments/v1:environment_service_pb2_grpc — passed (invocation).
• Initial remote bbr test //agentplane/runner_gateway/environments/internal/management:unit_test //agentplane/runner_gateway/environments:environments_test //agentplane/runner_gateway/dispatcher:store_integration_test //agentplane/system_tests/suites:test_dispatcher --test_output=errors. The three Go targets passed in d6685423. The system scenario passed its rebind/command assertions but failed teardown because the replacement Identity was deleted before its referencing Sandbox. Cleanup now groups Identity lifetimes so the Sandbox is deleted first. The corrected full bbr test //agentplane/system_tests/suites:test_dispatcher --test_output=errors passed (1/1 target, 290.6s; ae770da0).
• The existing Dispatcher system suite's queue scenario now places a real Session, verifies that the live CRD refuses an Identity change while running, stops the Sandbox, changes Identity through EnvironmentService, and submits input to the retained Session. It checks that the Session still records its original Identity and the command fails execution_identity_changed without Runtime admission. This scenario must pass before merge; the old Store refusal would reject its stopped rebind.
• A mutation test races a policy update against the Identity patch, requiring an optimistic-lock conflict and a retry that preserves both changes. Existing manager/UID authorization, creation receipts, live-Identity fencing, queue, wake and replica scenarios remain covered.

Rollout: deploy/pin this Gateway behavior before the EnvironmentService extraction. Rollback: revert the Gateway image pin; the old image conservatively refuses a rebind with conflicting retained Sessions again. Preserve Sandbox Identity choices, Session rows and History; failed commands remain failed, with no replay or data migration. After Flux applies the pin, check inventory/Session reads, normal command delivery, stopped-state admission, queue/wake and History. Required system test: full //agentplane/system_tests/suites:test_dispatcher.

Deliberately leaves out the undecided Runtime check comparing a Session's recorded Identity with its own credential, the EnvironmentService move, caller-authentication changes, Session Identity rebinding, and any new cross-component RPC. It does not grant environment-management authority to Identity callers.

Rebased onto 9a955bd3 after Gateway service SVID admission #16364, preserving its service-role fields and authentication behavior. Conflict resolution only adjusts the existing removal/budget change to that base. Post-rebase bbr test //agentplane/runner_gateway/environments/internal/management:unit_test //agentplane/runner_gateway/environments:environments_test //agentplane/runner_gateway/dispatcher:store_integration_test //agentplane/system_tests/suites:test_dispatcher --test_output=errors — all four executed and passed (ee7652bc); the full Dispatcher system suite passed in 222.0s. Pre-commit passed; full current-head CI pending.

Latest rebase: head a36b49798ff47c173a4789b805ad64c607a4161f is based on a68e0de510d6ea10184705ab453a69259cb85801, including service-SVID admission and the system-test root-key renewal correction #16377. The rebase was conflict-free; range-diff showed unchanged patches, and it was published with --force-with-lease. GitHub confirms this head. Current-head pre-commit, Nix and artifact/import checks passed; Bazel and visual review are running, with no reported failures as of 2026-11-14 08:29 UTC. The focused RBE results above remain prior-base validation. Fresh origin/devel is 6e591f383864ab47d7a9370abb4bd6637f0faee3; its two additional commits change image pins and a Dispatcher documentation note, and GitHub reports this PR mergeable.

Questions for Claude

None.

[github-actions]

Visual review for a36b4979

Request a manual rerun from the CI run page.

Warning

1 target used the latest devel baseline (bb7c716f) because the PR base published none. Diffs there may include devel drift, not just this PR's changes.

No visual changes among the 1 affected Bazel test target. Open visual review.