58 lines
3.2 KiB
Markdown
58 lines
3.2 KiB
Markdown
---
|
|
kind: task
|
|
slug: agent-install-lifecycle
|
|
title: Enforce reviewed agent installation and lifecycle mutations
|
|
plan_slug: workspace-communications
|
|
epic_slug: agent-participation
|
|
status: ready
|
|
priority: P1
|
|
tenant_id: global
|
|
owner: unassigned
|
|
cursor_todo_id: null
|
|
updated_at: "2026-10-22"
|
|
---
|
|
|
|
# Task summary
|
|
|
|
Add the canonical server-side review/confirm boundary for agent installation, shared publication, activation, update and disable/archive.
|
|
|
|
## Description
|
|
|
|
Build workspace-authorized tRPC procedures on the single registry and version contracts. This task owns lifecycle enforcement/audit, not marketplace or review UI, sandbox execution, agent jobs, or chat membership. Consuming UIs call these procedures rather than implementing separate mutations. Installation never grants channel/object access or executes an agent.
|
|
|
|
## Subtasks
|
|
|
|
- [ ] Return a review of immutable target version, provenance, permission changes and expected current revision for installation, draft publication/activation or update.
|
|
- [ ] Require explicit confirmation from an `admin`/`owner` for shared lifecycle and ordinary allowlisted grants; only `owner` may approve mutating sandbox policy or sensitive workspace-wide tools. Private drafts must first be submitted by their creator without enabling arbitrary admin browsing.
|
|
- [ ] Bind confirmation to workspace, actor authority, agent/template/version, revision and capability diff; revalidate in the transaction, record audit and enforce idempotency for retries/concurrent confirmation.
|
|
- [ ] Implement disable/archive without erasing conversation/run provenance; expose authoritative lifecycle checks so enqueue/execution/delivery deny disabled versions and removal/revocation cannot leave stale access.
|
|
- [ ] Test unauthorized role, stale review/version, scope escalation, duplicate install/confirmation, explicit update adoption and disable behavior.
|
|
|
|
## Owner or assignee
|
|
|
|
`unassigned`
|
|
|
|
## Status
|
|
|
|
`ready` for scheduling after registry schema and API; not currently running.
|
|
|
|
## Estimation
|
|
|
|
`M`
|
|
|
|
## Acceptance criteria
|
|
|
|
- [ ] A member cannot install, publish/activate or grant capabilities through direct API calls; a review screen is not the security boundary.
|
|
- [ ] Duplicate confirmations produce one installation/lifecycle transition and audit outcome; stale or changed capability requests require a fresh review.
|
|
- [ ] Version updates are explicit; existing pinned runs/conversations do not silently adopt them.
|
|
- [ ] Workspace role/tool approval never substitutes for context delegation, adds chat membership or grants private-project reads.
|
|
- [ ] Disable/archive preserve history but prevent new use; runtime consumers must recheck lifecycle rather than trusting old confirmation.
|
|
- [ ] `pnpm lint && pnpm type-check && pnpm test` pass.
|
|
|
|
## Links to related Epic / Plan
|
|
|
|
- Epic: [Agent participation](./Epic-agent-participation.md)
|
|
- Plan: [Workspace communications](../Plan-workspace-communications.md)
|
|
- Depends on: [Registry schema](./Task-agent-registry-marketplace.md), [Registry API](./Task-agent-registry-api.md)
|
|
- Consumers: [Library UI](./Task-agent-marketplace-library-ui.md), [Review/sandbox UI](./Task-agent-builder-review-sandbox.md)
|
|
- Separate access grant: [Agent channel membership](./Task-agent-channel-membership.md)
|