feat(agentos): enforce durable workload provider access

[akua-agentos]

LC1 + LC2: projected workload identity and durable provider-access custody

Stacked on: feat/agentos-p2-workload-gateway at 905f082674cf43eb40643bc7965f205bb271366b.

Do not merge this PR before its P2 base is merged or otherwise made its current base.

Exact reviewed candidate

• Head: e7504f6806df281480dcc4791953f902c9e5e8a8
• Tree: b3d5625ca6def74c1c3565169e377738ab532319
• Stack base: 905f082674cf43eb40643bc7965f205bb271366b
• Independent LC1 and LC2 exact-head approvals recorded. LC2 final review: deleg_db320f77 — APPROVE_EXACT_HEAD.

What this delivers

• Projected, audience-bound workload identity mounted only in the reviewed loopback proxy; hardened ServiceAccounts, RBAC and NetworkPolicies.
• Atomic request/token/spend/concurrency reservations before credential release and provider dispatch.
• Durable, idempotent original-window settlement, expiry recovery, provider/domain-bound attempts and lease renewal.
• Broker-authenticated closed /renew endpoint wired to actual AI-Gateway stream termination and exactly-once finalization.
• Explicit post-replacement PUBLIC EXECUTE revocation on every LC2 SECURITY DEFINER wrapper; narrow Egress grants and actual unprivileged SET ROLE denial tests.
• No reachable modern shared_token authentication path.

Evidence

• Candidate bundle SHA-256: 9cc6dc4bd874d6f78a4af261949ba2354932e2b3d5dfa4667fd76bd1604ac6af
• Candidate patch SHA-256: 735ec3d6b9149648c9070f9c68cc9a5bf3e4ad22ec8eff30e28776942f497c04
• Complete bundle custody, strict FSCK, exact tree/parent/ancestry, and patch replay verified.
• DB ACL/budget suite: 20/20 ×3; Service/Auth contracts: 68/68; independent final focused run: 69/69 plus build/typecheck.

Operational boundary

This PR does not deploy, run live migrations, call providers, or enable revenue automation. After merge, production rollout requires a separately approved immutable release, database/OpenFGA migration plan, identity/traffic rollout, no-provider-call canary and tested rollback.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	agentos-site	13f542d	Commit Preview URL Branch Preview URL	Aug 13 2026, 05:33 AM