Capture residual AgentRegistryGrant resolver CLI and validation wiring from PR #30

[mdheller]

Purpose

Capture the residual integration wiring from #30 after the safe core AgentRegistryGrant resolver payload was replayed and merged through #50.

#50 landed:

• src/agent_machine/agent_registry.py
• scripts/resolve-agent-registry-grant.py
• scripts/validate-agent-registry.py
• docs/architecture/agent-registry-grant-resolution.md

Merged replacement commit: a13674a38083584ed764bfb2d469d326ce4f09b3

Residual content from #30 still to capture

Makefile wiring

• Add validate-agent-registry to .PHONY.
• Add GRANT_DIR := examples.
• Wire validate-agent-registry into top-level validate.
• Add validate-agent-registry target that runs:
  • scripts/validate-agent-registry.py
  • scripts/resolve-agent-registry-grant.py smoke
  • Python CLI registry resolve smoke
  • activation evaluation using --grant-dir / --grant-id

Bootstrap CLI

• Add agent-machine registry resolve ... usage text.
• Delegate registry command to Python CLI.

Python CLI

• Add registry resolve command.
• Add local grant-store resolver args.
• Allow activation evaluation to resolve grants from --grant-dir / --grant-file / --grant-id.
• Preserve backward-compatible positional behavior.

Docs / package validation

• Add docs index pointer to AgentRegistryGrant resolution doc.
• Update package validator to import agent_machine.agent_registry and assert its default issued-at constant.

Why this was not landed in #50

The original branch was 15 commits behind current main. Carrying stale blobs for Makefile, bin/agent-machine, docs/index.md, scripts/validate-package.py, and src/agent_machine/cli.py would have overwritten newer mainline RuntimeInstallReceipt and WorkspaceOperationContract work. #50 therefore landed only the byte-identical new core files and left integration wiring to a small current-main patch.

Acceptance criteria

• CLI exposes registry resolve through Python CLI and bootstrap CLI.
• activate evaluate can resolve grant input from local grant files/directories.
• Makefile has and runs validate-agent-registry in top-level make validate.
• docs/index.md links the grant-resolution architecture doc.
• package validation imports and checks agent_machine.agent_registry.
• make validate passes.
• Original PR Add local AgentRegistryGrant resolver #30 can be closed after this issue is resolved or explicitly linked as complete capture.

[mdheller]

Progress update after #52.

Merged #52 / a60ee5d51d0dfa8c173193fdd456bf5d5cb544f9.

Now captured:

• Replay AgentRegistryGrant resolver core #50 / a13674a38083584ed764bfb2d469d326ce4f09b3: core local AgentRegistryGrant resolver, resolver scripts, validation script, and architecture doc.
• Wire AgentRegistryGrant validation target #52 / a60ee5d51d0dfa8c173193fdd456bf5d5cb544f9: Makefile validate-agent-registry target, top-level make validate wiring, and docs index pointer.

Still remaining from this issue:

• bootstrap CLI registry delegation.
• Python CLI registry resolve command.
• activation evaluation grant-store args.
• package validator import/check for agent_machine.agent_registry.

The remaining work needs a current-main patch, not stale blob replay from #30.

[mdheller]

Progress update after #53.

Merged #53 / b345c1bf7e17dbc6bb350ec04359faa53694f5d6.

Now captured:

• Replay AgentRegistryGrant resolver core #50 / a13674a38083584ed764bfb2d469d326ce4f09b3: core local AgentRegistryGrant resolver, resolver scripts, validation script, and architecture doc.
• Wire AgentRegistryGrant validation target #52 / a60ee5d51d0dfa8c173193fdd456bf5d5cb544f9: Makefile validate-agent-registry target, top-level make validate wiring, and docs index pointer.
• Delegate AgentRegistryGrant resolver from bootstrap CLI #53 / b345c1bf7e17dbc6bb350ec04359faa53694f5d6: bootstrap CLI agent-machine registry resolve delegation to the standalone resolver module.

Still remaining from this issue:

• Python CLI registry resolve command.
• activation evaluation grant-store args.
• package validator import/check for agent_machine.agent_registry.

The remaining work needs current-main edits to src/agent_machine/cli.py and scripts/validate-package.py, not stale blob replay from #30.

[mdheller]

Progress update after #54.

Merged #54 / 6fbac4ccd4aba68e43bfb1497e77fa1f81f0b11e.

Now captured:

• Replay AgentRegistryGrant resolver core #50 / a13674a38083584ed764bfb2d469d326ce4f09b3: core local AgentRegistryGrant resolver, resolver scripts, validation script, and architecture doc.
• Wire AgentRegistryGrant validation target #52 / a60ee5d51d0dfa8c173193fdd456bf5d5cb544f9: Makefile validate-agent-registry target, top-level make validate wiring, and docs index pointer.
• Delegate AgentRegistryGrant resolver from bootstrap CLI #53 / b345c1bf7e17dbc6bb350ec04359faa53694f5d6: bootstrap CLI agent-machine registry resolve delegation to the standalone resolver module.
• Validate AgentRegistryGrant resolver package surface #54 / 6fbac4ccd4aba68e43bfb1497e77fa1f81f0b11e: package validator import/check for the resolver module.

Still remaining from this issue:

• Python CLI registry resolve command.
• activation evaluation grant-store args.

The remaining work needs careful current-main edits to src/agent_machine/cli.py; stale blob replay from #30 must not be used.

[mdheller]

Boundary update.

The functional resolver path is now present through:

• Replay AgentRegistryGrant resolver core #50 / a13674a38083584ed764bfb2d469d326ce4f09b3: core agent_machine.agent_registry resolver module and scripts.
• Wire AgentRegistryGrant validation target #52 / a60ee5d51d0dfa8c173193fdd456bf5d5cb544f9: validate-agent-registry wired into top-level make validate.
• Delegate AgentRegistryGrant resolver from bootstrap CLI #53 / b345c1bf7e17dbc6bb350ec04359faa53694f5d6: bootstrap agent-machine registry resolve delegates to python3 -m agent_machine.agent_registry.
• Validate AgentRegistryGrant resolver package surface #54 / 6fbac4ccd4aba68e43bfb1497e77fa1f81f0b11e: package validator imports/checks the resolver module.

Remaining exact item: adding the alias inside src/agent_machine/cli.py as python3 -m agent_machine.cli registry resolve plus activation grant-store args.

Reason not forced here: src/agent_machine/cli.py has accumulated newer mainline steering, activation, receipt, and policy behavior. The old #30 cli.py blob is stale and must not be copied over current main. This should be handled as a dedicated current-main surgical PR, not stale branch replay.

Operationally, registry resolution is available through the bootstrap CLI and standalone Python module; the remaining task is a convenience/activation integration alias, not lost implementation.

[mdheller]

Final capture update.

Merged #56 / 9f506924f939a4a3b5c0733b9b37796fcabbf41f.

This completes the remaining current-main capture from this issue without replaying the stale #30 cli.py blob.

Now captured:

• Replay AgentRegistryGrant resolver core #50 / a13674a38083584ed764bfb2d469d326ce4f09b3: core local AgentRegistryGrant resolver, resolver scripts, validation script, and architecture doc.
• Wire AgentRegistryGrant validation target #52 / a60ee5d51d0dfa8c173193fdd456bf5d5cb544f9: Makefile validate-agent-registry target, top-level make validate wiring, and docs index pointer.
• Delegate AgentRegistryGrant resolver from bootstrap CLI #53 / b345c1bf7e17dbc6bb350ec04359faa53694f5d6: bootstrap CLI agent-machine registry resolve delegation.
• Validate AgentRegistryGrant resolver package surface #54 / 6fbac4ccd4aba68e43bfb1497e77fa1f81f0b11e: package validator import/check for agent_machine.agent_registry.
• Complete AgentRegistryGrant CLI and activation resolver capture #56 / 9f506924f939a4a3b5c0733b9b37796fcabbf41f: Python CLI registry resolve plus activation evaluation grant-store args.

Validation observed on #56 head dfad883b4617f2d5c0e68c44eaa416bfa07ef568:

• Trust Surface: success
• validate: success

Functional status: capture complete. Original PR #30 should now be considered superseded/captured by #50, #52, #53, #54, and #56.