Skip to content

feat(proactive-runtime): M1-M2 agent tokens + rotation hardening #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
khaliqgant merged 6 commits into from
May 12, 2026
Merged

feat(proactive-runtime): M1-M2 agent tokens + rotation hardening #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5b99533
chore: checkpoint workspace agent token changes
May 11, 2026
4dc93d5
chore: checkpoint relayauth workspace state
May 11, 2026
bb4e856
fix: checkpoint workspace token revocation handling
May 11, 2026
9314cfa
feat(relayauth): proactive runtime M1
May 12, 2026
9dd1cfa
feat(chain): M2 data triggers (gateway watch fan-in, expand, DLQ, per…
May 12, 2026
c3f6d8c
feat(chain): M2 data triggers (gateway watch fan-in, expand, DLQ, per…
May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 75 additions & 39 deletions .trajectories/active/traj_1774612574920_f3fdc1c5.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
"title": "Planning",
"agentName": "orchestrator",
"startedAt": "2026-03-27T11:56:14.920Z",
"endedAt": "2026-03-27T11:56:18.971Z",
"events": [
{
"ts": 1774612574921,
Expand All @@ -69,22 +70,22 @@
"type": "note",
"content": "Approach: 7-step dag workflow — Parsed 7 steps, 3 parallel tracks, 4 dependent steps, DAG validated, no cycles"
}
],
"endedAt": "2026-03-27T11:56:18.971Z"
]
},
{
"id": "ch_e1ab34b7",
"title": "Execution: security-review, developer-review, historian-review",
"agentName": "orchestrator",
"startedAt": "2026-03-27T11:56:18.971Z",
"events": [],
"endedAt": "2026-03-27T11:56:18.975Z"
"endedAt": "2026-03-27T11:56:18.975Z",
"events": []
},
{
"id": "ch_19e59662",
"title": "Execution: developer-review",
"agentName": "developer",
"startedAt": "2026-03-27T11:56:18.975Z",
"endedAt": "2026-03-27T11:56:18.975Z",
"events": [
{
"ts": 1774612578975,
Expand All @@ -94,14 +95,14 @@
"agent": "developer"
}
}
],
"endedAt": "2026-03-27T11:56:18.975Z"
]
},
{
"id": "ch_f857cd6f",
"title": "Execution: historian-review",
"agentName": "historian",
"startedAt": "2026-03-27T11:56:18.975Z",
"endedAt": "2026-03-27T11:56:18.975Z",
"events": [
{
"ts": 1774612578975,
Expand All @@ -111,14 +112,14 @@
"agent": "historian"
}
}
],
"endedAt": "2026-03-27T11:56:18.975Z"
]
},
{
"id": "ch_c812f4a3",
"title": "Execution: security-review",
"agentName": "security",
"startedAt": "2026-03-27T11:56:18.975Z",
"endedAt": "2026-03-27T12:00:55.962Z",
"events": [
{
"ts": 1774612578975,
Expand All @@ -132,7 +133,6 @@
"ts": 1774612816779,
"type": "completion-marker",
"content": "\"security-review\" marker-based completion — Legacy STEP_COMPLETE marker observed (2 signal(s), 6 file change(s); signals=security-review, >0q>4m<u▗ ▗ ▖ ▖ Claude Code v2.1.85; files=modified:.github/workflows/publish.yml, created:.turbo/cache/09b954894e65bada-manifest.json, created:.turbo/cache/09b954894e65bada-meta.json, created:.turbo/cache/09b954894e65bada.tar.zst, created:.turbo/cache/09c8d9a3c485952a-manifest.json, created:.turbo/cache/09c8d9a3c485952a-meta.json)",
"significance": "medium",
"raw": {
"stepName": "security-review",
"completionMode": "marker",
Expand All @@ -152,7 +152,8 @@
"created:.turbo/cache/09c8d9a3c485952a-meta.json"
]
}
}
},
"significance": "medium"
},
{
"ts": 1774612816780,
Expand All @@ -164,7 +165,6 @@
"ts": 1774612853461,
"type": "completion-marker",
"content": "\"developer-review\" marker-based completion — Legacy STEP_COMPLETE marker observed (4 signal(s), 1 relevant channel post(s), 6 file change(s); signals=developer-review, COMPLETE, >0q>4m<u╭─── Claude Code v2.1.85 ──────────────────────────────────────────────────────╮, COMPLETE; channel=**[developer-review] Output:**\n```\n smaller sub-checks for each claim group.\\n\\n👨‍💻\n DEV [LOW] [sc; files=modified:.github/workflows/publish.yml, created:.turbo/cache/09b954894e65bada-manifest.json, created:.turbo/cache/09b954894e65bada-meta.json, created:.turbo/cache/09b954894e65bada.tar.zst, created:.turbo/cache/09c8d9a3c485952a-manifest.json, created:.turbo/cache/09c8d9a3c485952a-meta.json)",
"significance": "medium",
"raw": {
"stepName": "developer-review",
"completionMode": "marker",
Expand All @@ -189,7 +189,8 @@
"created:.turbo/cache/09c8d9a3c485952a-meta.json"
]
}
}
},
"significance": "medium"
},
{
"ts": 1774612853462,
Expand All @@ -201,7 +202,6 @@
"ts": 1774612855956,
"type": "completion-marker",
"content": "\"historian-review\" marker-based completion — Legacy STEP_COMPLETE marker observed (3 signal(s), 6 file change(s); signals=historian-review, COMPLETE, >0q>4m<u▗ ▗ ▖ ▖ Claude Code v2.1.85; files=modified:.github/workflows/publish.yml, created:.turbo/cache/09b954894e65bada-manifest.json, created:.turbo/cache/09b954894e65bada-meta.json, created:.turbo/cache/09b954894e65bada.tar.zst, created:.turbo/cache/09c8d9a3c485952a-manifest.json, created:.turbo/cache/09c8d9a3c485952a-meta.json)",
"significance": "medium",
"raw": {
"stepName": "historian-review",
"completionMode": "marker",
Expand All @@ -222,53 +222,54 @@
"created:.turbo/cache/09c8d9a3c485952a-meta.json"
]
}
}
},
"significance": "medium"
},
{
"ts": 1774612855957,
"type": "finding",
"content": "\"historian-review\" completed → ✽",
"significance": "medium"
}
],
"endedAt": "2026-03-27T12:00:55.962Z"
]
},
{
"id": "ch_ab406706",
"title": "Convergence: security-review + developer-review + historian-review",
"agentName": "orchestrator",
"startedAt": "2026-03-27T12:00:55.962Z",
"endedAt": "2026-03-27T12:00:55.962Z",
"events": [
{
"ts": 1774612855962,
"type": "reflection",
"content": "security-review + developer-review + historian-review resolved. 3/3 steps completed. All steps completed on first attempt. Unblocking: security-cross-review, developer-cross-review, historian-cross-review.",
"significance": "high",
"raw": {
"confidence": 0.75,
"focalPoints": [
"security-review: completed",
"developer-review: completed",
"historian-review: completed"
]
}
},
"significance": "high"
}
],
"endedAt": "2026-03-27T12:00:55.962Z"
]
},
{
"id": "ch_7f3b4ccf",
"title": "Execution: security-cross-review, developer-cross-review, historian-cross-review",
"agentName": "orchestrator",
"startedAt": "2026-03-27T12:00:55.962Z",
"events": [],
"endedAt": "2026-03-27T12:00:55.963Z"
"endedAt": "2026-03-27T12:00:55.963Z",
"events": []
},
{
"id": "ch_22e5176f",
"title": "Execution: security-cross-review",
"agentName": "security-xr",
"startedAt": "2026-03-27T12:00:55.963Z",
"endedAt": "2026-03-27T12:00:55.963Z",
"events": [
{
"ts": 1774612855963,
Expand All @@ -278,14 +279,14 @@
"agent": "security-xr"
}
}
],
"endedAt": "2026-03-27T12:00:55.963Z"
]
},
{
"id": "ch_abb60298",
"title": "Execution: developer-cross-review",
"agentName": "developer-xr",
"startedAt": "2026-03-27T12:00:55.963Z",
"endedAt": "2026-03-27T12:00:55.963Z",
"events": [
{
"ts": 1774612855963,
Expand All @@ -295,14 +296,14 @@
"agent": "developer-xr"
}
}
],
"endedAt": "2026-03-27T12:00:55.963Z"
]
},
{
"id": "ch_dc4edad8",
"title": "Execution: historian-cross-review",
"agentName": "historian-xr",
"startedAt": "2026-03-27T12:00:55.963Z",
"endedAt": "2026-03-27T12:03:30.529Z",
"events": [
{
"ts": 1774612855963,
Expand All @@ -316,7 +317,6 @@
"ts": 1774612975429,
"type": "completion-marker",
"content": "\"historian-cross-review\" marker-based completion — Legacy STEP_COMPLETE marker observed (1 signal(s), 3 file change(s); signals=historian-cross-review; files=modified:.github/workflows/publish.yml, modified:.gitignore, deleted:packages/sdk/tsconfig.tsbuildinfo)",
"significance": "medium",
"raw": {
"stepName": "historian-cross-review",
"completionMode": "marker",
Expand All @@ -332,7 +332,8 @@
"deleted:packages/sdk/tsconfig.tsbuildinfo"
]
}
}
},
"significance": "medium"
},
{
"ts": 1774612975430,
Expand All @@ -344,7 +345,6 @@
"ts": 1774613003114,
"type": "completion-marker",
"content": "\"security-cross-review\" marker-based completion — Legacy STEP_COMPLETE marker observed (2 signal(s), 3 file change(s); signals=security-cross-review, COMPLETE; files=modified:.github/workflows/publish.yml, modified:.gitignore, deleted:packages/sdk/tsconfig.tsbuildinfo)",
"significance": "medium",
"raw": {
"stepName": "security-cross-review",
"completionMode": "marker",
Expand All @@ -361,7 +361,8 @@
"deleted:packages/sdk/tsconfig.tsbuildinfo"
]
}
}
},
"significance": "medium"
},
{
"ts": 1774613003114,
Expand All @@ -373,7 +374,6 @@
"ts": 1774613010526,
"type": "completion-marker",
"content": "\"developer-cross-review\" marker-based completion — Legacy STEP_COMPLETE marker observed (4 signal(s), 1 relevant channel post(s), 3 file change(s); signals=COMPLETE, ## Developer Cross-Review of Phase 1 Findings, developer-cross-review, >0q>4m<u▗ ▗ ▖ ▖ Claude Code v2.1.85; channel=## Developer Cross-Review of Phase 1 Findings\n\n### Confirmations\n\n✅ CONFIRM [scripts/relay/agentdeny-hook.sh:20] — Agree with all three reviewers. Security (HIG; files=modified:.github/workflows/publish.yml, modified:.gitignore, deleted:packages/sdk/tsconfig.tsbuildinfo)",
"significance": "medium",
"raw": {
"stepName": "developer-cross-review",
"completionMode": "marker",
Expand All @@ -395,39 +395,39 @@
"deleted:packages/sdk/tsconfig.tsbuildinfo"
]
}
}
},
"significance": "medium"
},
{
"ts": 1774613010526,
"type": "finding",
"content": "\"developer-cross-review\" completed → 2",
"significance": "medium"
}
],
"endedAt": "2026-03-27T12:03:30.529Z"
]
},
{
"id": "ch_1a2cfb74",
"title": "Convergence: security-cross-review + developer-cross-review + historian-cross-review",
"agentName": "orchestrator",
"startedAt": "2026-03-27T12:03:30.529Z",
"endedAt": "2026-03-27T12:03:30.530Z",
"events": [
{
"ts": 1774613010529,
"type": "reflection",
"content": "security-cross-review + developer-cross-review + historian-cross-review resolved. 3/3 steps completed. All steps completed on first attempt. Unblocking: merge-findings.",
"significance": "high",
"raw": {
"confidence": 0.75,
"focalPoints": [
"security-cross-review: completed",
"developer-cross-review: completed",
"historian-cross-review: completed"
]
}
},
"significance": "high"
}
],
"endedAt": "2026-03-27T12:03:30.530Z"
]
},
{
"id": "ch_8f8cc23a",
Expand All @@ -442,8 +442,44 @@
"raw": {
"agent": "synthesizer"
}
},
{
"ts": 1778524520195,
"type": "decision",
"content": "Use the existing workspace->agent->refresh server flow and add SDK-level rotating agent sessions instead of inventing a second agent-token endpoint: Use the existing workspace->agent->refresh server flow and add SDK-level rotating agent sessions instead of inventing a second agent-token endpoint",
"raw": {
"question": "Use the existing workspace->agent->refresh server flow and add SDK-level rotating agent sessions instead of inventing a second agent-token endpoint",
"chosen": "Use the existing workspace->agent->refresh server flow and add SDK-level rotating agent sessions instead of inventing a second agent-token endpoint",
"alternatives": [],
"reasoning": "The relayauth server already enforces 1h agent access TTLs, refresh rotation, and workspace-token lineage revocation; M1 mainly needs a stable public contract and transparent client-side renewal for the gateway."
},
"significance": "high"
},
{
"ts": 1778524787254,
"type": "reflection",
"content": "M1 agent-token server semantics were already present; this pass hardened the public contract with exported request types, a rotating SDK session helper, explicit path-token stub coverage, and synced package build artifacts.",
"raw": {
"focalPoints": [
"agent-tokens",
"sdk-contracts",
"path-stub"
],
"adjustments": "Kept the existing /workspace -> /agent -> /refresh lineage instead of adding a second rotation protocol.",
"confidence": 0.9
},
"significance": "high",
"tags": [
"focal:agent-tokens",
"focal:sdk-contracts",
"focal:path-stub",
"confidence:0.9"
]
}
]
}
]
],
"commits": [],
"filesChanged": [],
"tags": []
}
Loading
Loading