[pinotelio]

The operator companion of per-agent integration access in Crewlet: crewlet/crewlet#478 (feat/agents-access). A Seat now says, per vendor, whether the agent is on there, what it may do in the vendor's own terms, and where; the engine holds the vendor to it.

Breaking change to v1alpha1. No tag has shipped this surface, so it is a plain reshape with no alias or conversion. Existing objects must be rewritten as below; a field the CRD no longer has is pruned on the next write.

What changes

Seat.spec.integrations gains gitlab, jira, confluence and datadog, and every block takes a required enabled (an absent block is off):

Block	Access	Scope
datadog	role: a Datadog role id	none
github	permissions: contents, issues, pullRequests, checks, actions, deployments, workflows, each Read or Write (replaces tier and workflows: true)	repos
gitlab	accessLevel: Guest, Planner, Reporter, Developer, Maintainer, Owner; or memberRoleID	projects
jira	projectRole: a project role id (none, with no projects, is product access only)	projects
confluence	spaceRole, or operations where the site has no space roles (neither, with no spaces, is product access only)	spaces
mattermost	roles: SystemUser, alone or with one of SystemPostAllPublic, SystemPostAll, SystemAdmin	channels (replaces channel)
slack	none	none

CEL holds each fixed vendor set (GitLab roles, Mattermost role sets, GitHub permission keys and levels, workflows as Write alone), accessLevel or memberRoleID, spaceRole or operations, and the access each block needs while the seat is on; live-listed ids (Datadog, Jira, Confluence roles, GitLab custom roles) are strings the engine checks against the vendor. A scope outside the company's reach, and a credential the engine manages written where it may not be, are refused by the engine's dry run and reported as Invalid on the Seat.

Moved off Integration:

• spec.gitlab.engineProvisioning.accessLevel and accessLevels become each Seat's spec.integrations.gitlab.accessLevel.
• spec.datadog.role becomes each Seat's spec.integrations.datadog.role.
• spec.gitlab.engineProvisioning.tokenScopes is removed: a seat's token scopes follow its role.

Credentials:

• A credential the engine mints (GitLab or Mattermost under provisioning Engine, Datadog, an Atlassian organization) is sealed by the engine under its own name, <VENDOR>_<FIELD>_<HANDLE>, and bound to the vendor's tool server by the engine. Seats no longer name it in spec.mcp; the engine's dry run refuses one there (reported Invalid on the Seat).
• spec.mcp values come from Secrets only (provisioned is gone there). Seat.spec.integrations.mattermost.botToken is now optional and a Secret only (unset under provisioning Engine).
• provisioned survives in spec.sandbox.env as {vendor, field} and renders the engine's own name, e.g. ${GITLAB_TOKEN_ANA} for git in the seat's box. secretsync.ProvisionedName now copies the engine's envref.SealedName (fingerprinted in the mirror table); ADR-0004 is rewritten in place for this.
• External credentials (Slack app, GitHub App, an External Mattermost bot or GitLab account, Jira/Confluence on Data Center) stay Secret-backed positions and must be the seat's alone; the engine refuses a variable shared with another seat or a company block.
• MCPServer.spec.seatCredentials declares which integration's seat credential a per-seat server reads and under which variable or header (kind, for Atlassian field, key, prefix), replacing the engine's defaults for servers it recognises; refused on a shared server. Crewlet's as is not offered, since it must equal the transport's.
• The engine's new integrations.slack.app_config_token (the engine creating each agent's Slack app) is listed as not offered: operator Slack seats are apps made outside the engine.

Render: the role blocks with enabled always written, GitHub permissions as GitHub's keys, GitLab access_level as GitLab's integer, Mattermost roles in Mattermost's order; provisioning.role, access_level and access_levels are no longer rendered. Every document names every integration kind in the top-level seat_access_migrated, the engine's gate for acting on a kind's seat blocks, since the operator renders that schema natively and under Enforce the engine's migration cannot write the list; engineConfig may not set the key.

Docs: integrations guide ("An agent's access" and each vendor), credentials concept page and guide, tool-servers guide, troubleshooting, company-document, ADR-0004/0005, samples, generated API reference.

Tests

• test/crd: every new CEL rule, accepted and refused, plus the moved fields and the reshaped provisioned source.
• Render: goldens updated (nimbus, github-enterprise, atlassian, secret-positions, optional-keys, slack), credential-position table and its doc page, NoProvisioner per vendor, provisioned names. The samples' per-seat example server is now Linear, since GitHub's and GitLab's servers get each seat's token from the engine.
• Mirror entries for the engine's fixed sets (GitHubPermissionKeys, GitLabRoles, MattermostRoleSets) and envref.SealedName.

Verified locally against the engine at feat/agents-access ba705774db (make crewlet CREWLET_VERSION=ba705774db), which carries every part of per-seat access merged, the seat credential binding and product-only access: the render and contract suites (crewlet validate on every golden, the samples and getting-started), the CRD and docs suites, secretsync and the controller suite, golangci-lint on both modules. The chart suite was not run locally (the helm target's checksum step needs GNU sha256sum); CI runs it.

To re-run once it lands on feat/agents-access: the narrowed SeatCredentialMode, under which operator-rendered Slack and GitHub seats are external.

CI runs against Crewlet's main, so it stays red until crewlet/crewlet#478 merges; land that one first.