Skip to content

fix(cli): preserve matching fleet enrollment identity #1613

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kjgbot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(cli): preserve matching fleet enrollment identity #1613

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3bafddd
fix(cli): preserve matching fleet enrollment identity
miyaontherelay Aug 26, 2026
6b3fed1
docs(trail): record PR 1613 validation
miyaontherelay Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
248 changes: 248 additions & 0 deletions .agentworkforce/trajectories/completed/2026-08/traj_swo9tkg9voc8.trace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,248 @@
{
"version": "1.0.0",
"id": "71e42df2-d556-49b6-afe5-4789300d40c8",
"timestamp": "2026-08-26T00:34:27.910Z",
"trajectory": "traj_swo9tkg9voc8",
"files": [
{
"path": "CHANGELOG.md",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 5,
"end_line": 15,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/README.md",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 89,
"end_line": 102,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/src/cli/commands/cloud.test.ts",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 1789,
"end_line": 1865,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 1926,
"end_line": 1932,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/src/cli/commands/cloud.ts",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 460,
"end_line": 488,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 1019,
"end_line": 1025,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 1037,
"end_line": 1043,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/src/cli/commands/node.test.ts",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 197,
"end_line": 320,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 338,
"end_line": 355,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 359,
"end_line": 366,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/src/cli/commands/node.ts",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 90,
"end_line": 102,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 117,
"end_line": 123,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 137,
"end_line": 152,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 171,
"end_line": 180,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 198,
"end_line": 227,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 235,
"end_line": 247,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 255,
"end_line": 261,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 288,
"end_line": 341,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/src/cli/lib/enrollment-pin.test.ts",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 28,
"end_line": 87,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 98,
"end_line": 104,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "packages/cli/src/cli/lib/enrollment-pin.ts",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 11,
"end_line": 35,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
},
{
"start_line": 66,
"end_line": 92,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "tests/relayflows/cases/1613-matching-fleet-enrollment-identity/case.json",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 1,
"end_line": 20,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
},
{
"path": "tests/relayflows/cases/1613-matching-fleet-enrollment-identity/run.mjs",
"conversations": [
{
"contributor": {
"type": "ai"
},
"ranges": [
{
"start_line": 1,
"end_line": 170,
"revision": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16"
}
]
}
]
}
]
}
39 changes: 39 additions & 0 deletions .agentworkforce/trajectories/completed/2026-08/traj_swo9tkg9voc8/summary.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Trajectory: Finish PR 1613 enrollment workspace identity proof

> **Status:** ✅ Completed
> **Task:** PR-1613
> **Confidence:** 90%
> **Started:** August 26, 2026 at 02:33 AM
> **Completed:** August 26, 2026 at 02:34 AM

---

## Summary

Rebased PR 1613, addressed all three review findings, added deterministic exact-base/head RelayFlow coverage, and validated focused tests plus build and formatting.

**Approach:** Preserved the public node-up workflow, hardened matching-workspace enrollment selection and legacy-pin verification, and added an external exact-checkout harness.

---

## Key Decisions

### Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case
- **Chose:** Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case
- **Reasoning:** This deterministically exercises the public node-up identity selection on both exact checkouts while a harness-owned broker seam prevents external daemon or Cloud side effects.

---

## Chapters

### 1. Work
*Agent: default*

- Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case: Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case

---

## Artifacts

**Commits:** 3bafddd68
**Files changed:** 10
71 changes: 71 additions & 0 deletions .agentworkforce/trajectories/completed/2026-08/traj_swo9tkg9voc8/trajectory.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
{
"id": "traj_swo9tkg9voc8",
"version": 1,
"task": {
"title": "Finish PR 1613 enrollment workspace identity proof",
"source": {
"system": "plain",
"id": "PR-1613"
}
},
"status": "completed",
"startedAt": "2026-08-26T00:33:55.506Z",
"completedAt": "2026-08-26T00:34:27.540Z",
"agents": [
{
"name": "default",
"role": "lead",
"joinedAt": "2026-08-26T00:33:58.993Z"
}
],
"chapters": [
{
"id": "chap_rncyio9dzw7v",
"title": "Work",
"agentName": "default",
"startedAt": "2026-08-26T00:33:58.993Z",
"endedAt": "2026-08-26T00:34:27.540Z",
"events": [
{
"ts": 1787704438998,
"type": "decision",
"content": "Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case: Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case",
"raw": {
"question": "Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case",
"chosen": "Use the built production node command with real temporary enrollment and project-pin stores for the RelayFlow case",
"alternatives": [],
"reasoning": "This deterministically exercises the public node-up identity selection on both exact checkouts while a harness-owned broker seam prevents external daemon or Cloud side effects."
},
"significance": "high"
}
]
}
],
"retrospective": {
"summary": "Rebased PR 1613, addressed all three review findings, added deterministic exact-base/head RelayFlow coverage, and validated focused tests plus build and formatting.",
"approach": "Preserved the public node-up workflow, hardened matching-workspace enrollment selection and legacy-pin verification, and added an external exact-checkout harness.",
"confidence": 0.9
},
"commits": [
"3bafddd68"
],
"filesChanged": [
"CHANGELOG.md",
"packages/cli/README.md",
"packages/cli/src/cli/commands/cloud.test.ts",
"packages/cli/src/cli/commands/cloud.ts",
"packages/cli/src/cli/commands/node.test.ts",
"packages/cli/src/cli/commands/node.ts",
"packages/cli/src/cli/lib/enrollment-pin.test.ts",
"packages/cli/src/cli/lib/enrollment-pin.ts",
"tests/relayflows/cases/1613-matching-fleet-enrollment-identity/case.json",
"tests/relayflows/cases/1613-matching-fleet-enrollment-identity/run.mjs"
],
"projectId": "AgentWorkforce/relay",
"tags": [],
"_trace": {
"startRef": "10fc5ce1c4b6f0ac557b8cc0a2d3febc1cc6b2e6",
"endRef": "3bafddd686b219a31e4a9d99a5c291b8b61ddd16",
"traceId": "71e42df2-d556-49b6-afe5-4789300d40c8"
}
}
6 changes: 5 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,11 @@ All notable changes to Agent Relay will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]
## [Unreleased - Patch]

### Fixed

- `agent-relay node up` retains a stored Cloud fleet-node identity when the repository pin and enrollment name the same Relay workspace, including with a matching explicit workspace flag or environment key. A genuinely different explicit key still wins with a warning, and enrollment-time pin linking now preserves and checks the recorded workspace ID.
Comment thread
miyaontherelay marked this conversation as resolved.

## [11.8.4] - 2026-08-25

Expand Down
11 changes: 8 additions & 3 deletions packages/cli/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,14 @@ Workspace source: repository pin (.agentworkforce/relay/workspace-key.json)

A Cloud enrollment (`RELAY_NODE_TOKEN`, or a record in the Fleet enrollment
store) selects the node's _identity_, not its workspace, so it never appears on
the ladder. If a stored enrollment addresses a different workspace than the
repository pin, `node up` refuses to start and names both source files and
workspace IDs, never their keys.
the ladder. When the repository pin's recorded workspace ID matches the stored
enrollment, `node up` retains that enrolled node identity even if the pin has no
`enrolledNodeId`; the pin still supplies the workspace key. The same applies to
an explicit flag or environment key that is byte-identical to that pin. A
genuinely different explicit key still wins and warns that the enrollment is
being skipped. Without an explicit key, a stored enrollment that addresses a
different workspace than the repository pin stops startup and names both source
files and workspace IDs, never their keys.

`workspace create`, `join`, and `switch` select a named workspace globally and
pin it to the current project. A changed selection records the old name, so an
Expand Down
Loading
Loading