agentdid: add encrypted custody, purpose-bound signing and v1 identity documents

.github/workflows/agent-identity.yml

@@ -0,0 +1,85 @@
+name: Agent identity acceptance
+
+on:
+  pull_request:
+    branches: [app/v3]
+    paths:
+      - internal/agentdid/**
+      - internal/session/agent_identity*.go
+      - internal/session/place.go
+      - internal/session/session.go
+      - internal/session/approvalposture.go
+      - internal/session/effort.go
+      - cmd/codeaf/syncdrive_test.go
+      - cmd/codeaf/heldchat_drive_test.go
+      - cmd/codeaf/app_agent_identity_e2e_test.go
+      - .github/workflows/agent-identity.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agent-identity-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  binary-e2e:
+    name: Binary user-flow QA
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Build the actual app binary
+        run: make build
+      - name: Exercise the app as a desktop client
+        run: go test ./cmd/codeaf -run '^TestAppAgentIdentityBinaryE2E$' -count=1 -v -timeout 5m
+      - name: Check that custody preserves existing sync behavior
+        run: go test ./cmd/codeaf -run '^TestAQuitAtTheMoveQuestionLeavesTheOtherWindowsChatSendable$|^TestTheFreshChatBesideAHeldOneWorksOnItsOwnSeat$|^TestDriveSideDoorPublishesAndReleases$|^TestDriveSideStartsWhenAPairingMakesTheIdentity$|^TestAChatMovedBackGetsADriveSideOfItsOwn$|^TestAChatTakenAndTakenBackGetsADriveSideOfItsOwn$|^TestDriveSideStartsWhenTheSoloMarkerEnds$|^TestAppOrdinaryClientIDSurvivesABackendRestart$|^TestC6AppSendWithoutAViewerStaysLocal$|^TestC27NewChatByDefaultStaysQuiet$' -count=1 -v -timeout 5m
+
+      - name: Repeat sealed history portability
+        run: go test ./internal/session -run '^TestSealedTreeCarriesTaskHistory$' -count=20 -v -timeout 5m
+
+  race:
+    name: Custody race checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Race-check custody and lifecycle
+        run: go test -race ./internal/agentdid ./internal/session -run 'TestCredentials|TestCustody|TestOnlyTheRecipient|TestUnknownDocument|TestAgentIdentity|TestAgentDID|TestToolCommandsSeeTheAgentDID|TestTaskWorker.*DID' -count=1 -timeout 15m
+
+  repository:
+    name: Repository gates
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Build with the pinned engine
+        run: make build
+      - name: Run the repository PR gates against app/v3
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+        run: make pr-ready
+      - name: Run touched packages even if an existing light gate fails
+        if: ${{ !cancelled() }}
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+        run: make test-touched