51733d8b36
Some checks failed
build-images / signing-service image (push) Failing after 14s
validate / JSON Schema (ajv) (push) Successful in 19s
validate / Rego (opa fmt + opa test) (push) Successful in 14s
validate / DB (migrate up/down dry-run) (push) Failing after 18s
validate / Go (vet + test) (push) Successful in 34s
- 0002_agents / 0003_agent_keys migrations per architecture v1.1 §4.4 (incl. (k8s_namespace, k8s_service_account) uniqueness for the signing service's dual identity check and an agent_id, valid_from index for the verification lookup path) - idempotent seed db/trust/seeds/0001_phase1_agents.sql with the three Phase-1 identities: agent-approval-service, agent-testagent-transform, agent-dummy-sink (namespace agent-trust) - new db CI job in validate.yml: runs postgres:16-alpine, migrate up -> down 2 -> up, applies the seed twice, verifies three agents Co-Authored-By: Paperclip <noreply@paperclip.ing>
27 lines
1.8 KiB
SQL
27 lines
1.8 KiB
SQL
-- Seed: Phase-1-Agent-Identitäten (DEV-607).
|
|
--
|
|
-- Diese drei Agents sind der minimale Satz für den Phase-1-End-to-End-Smoke:
|
|
-- agent-approval-service — signiert Approval-Attestations.
|
|
-- agent-testagent-transform — signiert Transform-Attestations.
|
|
-- agent-dummy-sink — Mock-Senke (`sink:dummy-sink`), signiert
|
|
-- handover-Attestations.
|
|
--
|
|
-- Namespace `agent-trust` ist mit deploy/signing-service/ und deploy/trillian/
|
|
-- konsistent. pocket_id_client ist der stabile OIDC-client_id, den Pocket ID
|
|
-- für diesen Agent ausstellt — in Phase 1 identisch zum agent_id-Slug,
|
|
-- Subtask 7 (Agent-Registry-HTTP-API / Pocket-ID-Provisionierung) kann
|
|
-- diesen Wert später per UPDATE angleichen, wenn Pocket ID eine andere
|
|
-- client_id erzwingt.
|
|
--
|
|
-- Dieser Seed berührt agent_keys NICHT. Die Signatur-Schlüssel landen über
|
|
-- die Rotations-Pipeline (`services/signing-service` Admin-Pfad, Phase 2).
|
|
-- Idempotent: ON CONFLICT (agent_id) DO NOTHING, damit mehrfaches Einspielen
|
|
-- und ein `migrate down 2 && migrate up` den Seed nicht duplizieren.
|
|
|
|
INSERT INTO agents
|
|
(agent_id, pocket_id_client, k8s_namespace, k8s_service_account, display_name, allowed_actions)
|
|
VALUES
|
|
('agent-approval-service', 'agent-approval-service', 'agent-trust', 'approval-service', 'Approval Service', ARRAY['expense.submit']),
|
|
('agent-testagent-transform', 'agent-testagent-transform', 'agent-trust', 'testagent-transform', 'Test Agent (Transform)', ARRAY['expense.normalize', 'expense.map_to_sink']),
|
|
('agent-dummy-sink', 'agent-dummy-sink', 'agent-trust', 'dummy-sink', 'Dummy Sink (sink:dummy-sink)', ARRAY['expense.post'])
|
|
ON CONFLICT (agent_id) DO NOTHING;
|