feat: VC-based authorization, sidecar management APIs, and multi-version reasoners

.gitignore

@@ -14,6 +14,14 @@ dist/
 coverage.out
 *.test
 tmp/
+examples/go_agent_nodes/permission_agent_*
+examples/go_agent_nodes/go_agent_nodes
+
+# Compiled binaries
+control-plane/agentfield-server
+control-plane/af
+examples/**/go_agent_node*
+!examples/**/*.go
 
 # Python
 __pycache__/

control-plane/.env.example

@@ -48,6 +48,13 @@ AGENTFIELD_STORAGE_MODE=local
 # AGENTFIELD_STORAGE_CLOUD_CONNECTION_POOL=true
 # AGENTFIELD_STORAGE_CLOUD_REPLICATION_MODE=async
 
+# VC Authorization
+# Admin token for admin API endpoints (tag approval, policy management)
+# AGENTFIELD_AUTHORIZATION_ADMIN_TOKEN=admin-secret
+# Internal token sent to agents during request forwarding.
+# Agents with RequireOriginAuth=true validate this to ensure only the control plane can invoke them.
+# AGENTFIELD_AUTHORIZATION_INTERNAL_TOKEN=internal-secret-token
+
 # Development/Debug
 # GIN_MODE=debug
 # LOG_LEVEL=info

control-plane/dev.sh

@@ -2,8 +2,11 @@
 # Start control plane with hot-reload using Air
 #
 # Usage:
-#   ./dev.sh           # Start with hot-reload (SQLite mode)
-#   ./dev.sh postgres  # Start with PostgreSQL (set AGENTFIELD_DATABASE_URL first)
+#   ./dev.sh              # SQLite mode with hot-reload
+#   ./dev.sh postgres     # PostgreSQL mode (starts postgres via docker-compose)
+#   ./dev.sh pg-stop      # Stop the dev postgres container
+#   ./dev.sh pg-reset     # Stop postgres and wipe its data volume
+#   ./dev.sh pg-test      # Run Go postgres tests against dev database
 #
 # Prerequisites:
 #   go install github.com/air-verse/air@v1.61.7
@@ -17,12 +20,37 @@ if ! command -v air &> /dev/null; then
     go install github.com/air-verse/air@v1.61.7
 fi
 
+pg_up() {
+    echo "Starting dev postgres..."
+    docker compose -f docker-compose.dev.yml up -d --wait
+    echo "Postgres ready at localhost:5432 (agentfield_dev)"
+}
+
+pg_down() {
+    docker compose -f docker-compose.dev.yml down "$@"
+}
+
 case "${1:-}" in
   postgres|pg)
+    pg_up
     echo "Starting control plane with PostgreSQL (hot-reload)..."
-    export AGENTFIELD_STORAGE_MODE=postgresql
+    export AGENTFIELD_STORAGE_MODE=postgres
     air -c .air.toml
     ;;
+  pg-stop)
+    echo "Stopping dev postgres..."
+    pg_down
+    ;;
+  pg-reset)
+    echo "Stopping dev postgres and wiping data..."
+    pg_down -v
+    ;;
+  pg-test)
+    pg_up
+    echo "Running postgres storage tests..."
+    POSTGRES_TEST_URL="postgres://agentfield:agentfield@localhost:5433/agentfield_dev?sslmode=disable" \
+      go test ./internal/storage/ -run TestPostgres -v -count=1
+    ;;
   *)
     echo "Starting control plane with SQLite (hot-reload)..."
     export AGENTFIELD_STORAGE_MODE=local

control-plane/go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.10.0
+	golang.org/x/crypto v0.37.0
 	golang.org/x/term v0.32.0
 	google.golang.org/grpc v1.67.3
 	google.golang.org/protobuf v1.36.6
@@ -94,7 +95,6 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	golang.org/x/arch v0.15.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
 	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/sync v0.13.0 // indirect
 	golang.org/x/sys v0.36.0 // indirect

control-plane/internal/application/container.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/Agent-Field/agentfield/control-plane/internal/cli/framework"
 	"github.com/Agent-Field/agentfield/control-plane/internal/config"
+	"github.com/Agent-Field/agentfield/control-plane/internal/encryption"
 	"github.com/Agent-Field/agentfield/control-plane/internal/core/services"
 	"github.com/Agent-Field/agentfield/control-plane/internal/infrastructure/process"
 	"github.com/Agent-Field/agentfield/control-plane/internal/infrastructure/storage"
@@ -55,6 +56,9 @@ func CreateServiceContainer(cfg *config.Config, agentfieldHome string) *framewor
 		// Create DID registry with database storage (required)
 		if storageProvider != nil {
 			didRegistry = didServices.NewDIDRegistryWithStorage(storageProvider)
+			if passphrase := cfg.Features.DID.Keystore.EncryptionPassphrase; passphrase != "" {
+				didRegistry.SetEncryptionService(encryption.NewEncryptionService(passphrase))
+			}
 		} else {
 			// DID registry requires database storage, skip if not available
 			didRegistry = nil