- Add restricted account and login-attempt records.

- Implement the device-code ceremony with one temporary process per attempt.

- Register each temporary process through the cluster registry so a LiveView

  reconnect on another fleet node can recover the same ceremony. Limit an

  unclustered web lane to one instance while the ceremony remains in memory.

- Add account read, model, rate-limit, health, drain, disconnect, and audit

  operations.

| Runtime identity | Purpose | May read |

| --- | --- | --- |

| `openagents-staging-web` | Phoenix release and forge Git endpoint | Web, provider, OAuth, vault, recording, forge verification, database, and cluster secrets listed below |

| `openagents-staging-fleet` | Three-node distributed application lane | The application secrets required by the same candidate plus the cluster cookie; no Compute mutation permission |

| `openagents-staging-web` | Phoenix release and forge Git endpoint | Web, provider, OAuth, vault, recording, forge verification, database, cluster, and preallocated Codex credential-slot secrets listed below |

| `openagents-staging-fleet` | Three-node distributed application lane | The application and preallocated Codex credential-slot secrets required by the same candidate plus the cluster cookie; no Compute mutation permission |

| `openagents-staging-deployer` | Minimal private rolling-replacement controller | Cluster cookie only; Compute mutation comes from its bounded workload identity |

| `openagents-staging-migrator` | Release migration and token rewrap job | Database URL, active GitHub vault key, prior GitHub vault keyring |

| `openagents-staging-builder` | Isolated BEAM build sidecar | Forge operator token only; use an askpass helper, never a URL or argv value |

| `VOICE_RECORDING_ENCRYPTION_KEY` | `openagents-staging-voice-recording-key` | web and fleet when recording is admitted | Scheduled recording-key procedure or suspected exposure |

| `OPENAGENTS_FORGE_OPERATOR_TOKEN` | `openagents-staging-forge-operator-token` | web, fleet, builder | Scheduled rotation, builder replacement, or suspected URL/argv/log exposure |

| `RELEASE_COOKIE` | `openagents-staging-release-cookie` | web, fleet, deployer | Fleet-wide coordinated rotation or suspected exposure |

| Connected Codex account slot 1 | `openagents-staging-scv-codex-operator-1` | web may add and read versions; a future isolated Codex SCV runtime may read one exact version | Operator disconnect, OpenAI reauthentication, or suspected exposure |

| Connected Codex account slot 2 | `openagents-staging-scv-codex-operator-2` | web may add and read versions; a future isolated Codex SCV runtime may read one exact version | Operator disconnect, OpenAI reauthentication, or suspected exposure |

| Connected Codex account slot 1 | `openagents-staging-scv-codex-operator-1` | web and fleet may add and read versions; an isolated Codex SCV runtime may read one exact version | Operator disconnect, OpenAI reauthentication, or suspected exposure |

| Connected Codex account slot 2 | `openagents-staging-scv-codex-operator-2` | web and fleet may add and read versions; an isolated Codex SCV runtime may read one exact version | Operator disconnect, OpenAI reauthentication, or suspected exposure |

`GITHUB_CLIENT_ID` and `GITHUB_TOKEN_ENCRYPTION_KEY_ID` are identifiers, not

secrets. `DB_PASSWORD` is not used by the admitted staging profile because it

  member    = google_service_account.web.member

}

resource "google_secret_manager_secret_iam_member" "fleet_scv_codex_credential_add" {

  for_each = local.scv_codex_credential_secrets

  secret_id = google_secret_manager_secret.runtime[each.value].id

  role      = "roles/secretmanager.secretVersionAdder"

  member    = google_service_account.fleet.member

}

resource "google_secret_manager_secret_iam_member" "fleet_scv_codex_credential_read" {

  for_each = local.scv_codex_credential_secrets

  secret_id = google_secret_manager_secret.runtime[each.value].id

  role      = "roles/secretmanager.secretAccessor"

  member    = google_service_account.fleet.member

}

resource "google_artifact_registry_repository" "openagents" {

  location      = var.region

  repository_id = "openagents-staging"

    error_message = "The staging web identity may read exact versions only from the preallocated SCV Codex credential slots."

  }

  assert {

    condition = alltrue([

      for binding in values(google_secret_manager_secret_iam_member.fleet_scv_codex_credential_add) :

      binding.role == "roles/secretmanager.secretVersionAdder"

    ])

    error_message = "The staging fleet identity may add versions only to the preallocated SCV Codex credential slots."

  }

  assert {

    condition = alltrue([

      for binding in values(google_secret_manager_secret_iam_member.fleet_scv_codex_credential_read) :

      binding.role == "roles/secretmanager.secretAccessor"

    ])

    error_message = "The staging fleet identity may read exact versions only from the preallocated SCV Codex credential slots."

  }

  assert {

    condition = toset(google_project_iam_custom_role.deployer.permissions) == toset([

      "compute.instances.get",

' "$run_root/secrets.json" >/dev/null

web_member="serviceAccount:openagents-staging-web@$staging_project.iam.gserviceaccount.com"

fleet_member="serviceAccount:openagents-staging-fleet@$staging_project.iam.gserviceaccount.com"

for slot in openagents-staging-scv-codex-operator-1 openagents-staging-scv-codex-operator-2; do

  jq -e --arg member "$web_member" '

    any(.bindings[]?; .role == "roles/secretmanager.secretVersionAdder" and (.members | index($member))) and

    any(.bindings[]?; .role == "roles/secretmanager.secretAccessor" and (.members | index($member)))

  jq -e --arg web "$web_member" --arg fleet "$fleet_member" '

    all([$web, $fleet][]; . as $member |

      any(.bindings[]?; .role == "roles/secretmanager.secretVersionAdder" and (.members | index($member))) and

      any(.bindings[]?; .role == "roles/secretmanager.secretAccessor" and (.members | index($member)))

    )

  ' "$run_root/$slot-iam.json" >/dev/null

done

    assert terraform =~ "roles/secretmanager.secretVersionAdder"

    assert terraform =~ "roles/secretmanager.secretAccessor"

    assert terraform =~ "fleet_scv_codex_credential_add"

    assert terraform =~ "fleet_scv_codex_credential_read"

    assert isolation_validator =~ "scv_codex_credential_slots"

    assert isolation_validator =~ "fleet_member"

  end

  test "production preflight preserves a pinned candidate across later commits" do