---
kind: task
slug: agent-install-lifecycle
title: Enforce reviewed agent installation and lifecycle mutations
plan_slug: workspace-communications
epic_slug: agent-participation
status: ready
priority: P1
tenant_id: global
owner: unassigned
cursor_todo_id: null
updated_at: "2026-10-22"
---

# Task summary

Add the canonical server-side review/confirm boundary for agent installation, shared publication, activation, update and disable/archive.

## Description

Build workspace-authorized tRPC procedures on the single registry and version contracts. This task owns lifecycle enforcement/audit, not marketplace or review UI, sandbox execution, agent jobs, or chat membership. Consuming UIs call these procedures rather than implementing separate mutations. Installation never grants channel/object access or executes an agent.

## Subtasks

- [ ] Return a review of immutable target version, provenance, permission changes and expected current revision for installation, draft publication/activation or update.
- [ ] Require explicit confirmation from an `admin`/`owner` for shared lifecycle and ordinary allowlisted grants; only `owner` may approve mutating sandbox policy or sensitive workspace-wide tools. Private drafts must first be submitted by their creator without enabling arbitrary admin browsing.
- [ ] Bind confirmation to workspace, actor authority, agent/template/version, revision and capability diff; revalidate in the transaction, record audit and enforce idempotency for retries/concurrent confirmation.
- [ ] Implement disable/archive without erasing conversation/run provenance; expose authoritative lifecycle checks so enqueue/execution/delivery deny disabled versions and removal/revocation cannot leave stale access.
- [ ] Test unauthorized role, stale review/version, scope escalation, duplicate install/confirmation, explicit update adoption and disable behavior.

## Owner or assignee

`unassigned`

## Status

`ready` for scheduling after registry schema and API; not currently running.

## Estimation

`M`

## Acceptance criteria

- [ ] A member cannot install, publish/activate or grant capabilities through direct API calls; a review screen is not the security boundary.
- [ ] Duplicate confirmations produce one installation/lifecycle transition and audit outcome; stale or changed capability requests require a fresh review.
- [ ] Version updates are explicit; existing pinned runs/conversations do not silently adopt them.
- [ ] Workspace role/tool approval never substitutes for context delegation, adds chat membership or grants private-project reads.
- [ ] Disable/archive preserve history but prevent new use; runtime consumers must recheck lifecycle rather than trusting old confirmation.
- [ ] `pnpm lint && pnpm type-check && pnpm test` pass.

## Links to related Epic / Plan

- Epic: [Agent participation](./Epic-agent-participation.md)
- Plan: [Workspace communications](../Plan-workspace-communications.md)
- Depends on: [Registry schema](./Task-agent-registry-marketplace.md), [Registry API](./Task-agent-registry-api.md)
- Consumers: [Library UI](./Task-agent-marketplace-library-ui.md), [Review/sandbox UI](./Task-agent-builder-review-sandbox.md)
- Separate access grant: [Agent channel membership](./Task-agent-channel-membership.md)