registry: copy the agents' names from srcfl/ftw-webapp

[frahlg]

What

Copies the agents' names from srcfl/ftw-webapp#90 into protocol/registry.yaml, byte for byte, and updates Contract.swift so ContractTests reads them back: six scopes (ftw.logs.read, ftw.config.read, ftw.diag.run, ftw.dispatch.hold, ftw.goals.request, ftw.update.request), the capability access.agents, and eight refusals with their retry flags.

The app does not use them yet. The Access list, the approval key in the Secure Enclave and the grant offer screen come later; docs/agents.md in srcfl/ftw (#1642) specifies them, and go/protocol/testdata/approval-vectors.json there holds the signature vectors the phone must replay.

Paired PRs

• registry: agents, their scopes, refusals and push kinds ftw-webapp#90 — the registry, edited there first.
• feat(contract): agents, their approval signature and roster entry ftw#1642 — the box's copy, docs/agents.md and the vectors.
• feat(agents): enforce agent and support access in Core ftw#1646 — Core enforcement.

Tests

ContractTests checks scopes, ops, capabilities and errors against the file. CI (FTWKit and the iPhone app) passes. Not run locally: other sessions held the Mac's Swift toolchain.

After the review (adversarial, at f557f6d)

Fixed before merge, the three blockers and everything that changes signed bytes or wire shapes:

• 1. The public door. Agent rows carry tun: false and no copy scopes; only FTW Cloud's keys part opens an agent's session, never /v1/app, /v1/app/once or the relay (docs/protocol-cloud.md). Offers are signed (SignedOffer {o, kid, sig}, protocol.OpenOffer) by a pinned offer key, live at most 10 minutes, carry clientHost and verified, leave home empty, and a support offer comes only from SupportClientID.
• 2. Holds. battery.hold and loadpoint.boost lose their agent scope. A new agent_args block allowlists each op's arguments, with labels (so voltage, max_amps_per_phase and the rest stay with owners). Holds carry their setter, an owner's hold wins (E_NEEDS_OWNER), an agent clears only its own, maxW is |W|, and revoke or expiry ends an agent's holds.
• 3. The box page. Every widening route needs the house password, loopback included; drivers never reach the box's own API.
• 5. Replay memory keyed by the signed bytes; agent.confirm signs [reqId, agent, op, sha256(args)]; request ids are 128 bits; an atMs from before the box started is refused.
• 6. The signed offer's fields as above; the owner types the code on the universal-link path; the app refuses an unknown home.
• 9. Request args checked on arrival against agent_args and the op's own checks.
• 11. by is staff:<id> or bot:<name>, refused from any session but support.
• 16. agent.widen signs the row's key.
• From cloud-mcp: the roster carries the box's Noise key (Roster.noise); typed reads live.get, loadpoints.get, cars.get, drivers.get in a registry reads table, cursors on logs and events, agent ids under the box's own key.
• Also in the wire now: approval.key.set takes prevSig, audit rows carry count, agent.decided, E_CLOCK_SKEW, push kinds agent.expiring, approval.key.set, owner.added, ftw.update.request marked reserved, E_NOT_FOUND worded for any id (the car contract can reuse it).

Vectors regenerated: approval (widen and confirm bytes changed), a signed offer, and the roster (with noise and an agent row).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T17:08:18.340008Z	09a8538	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 09a85385e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Assign update requests to an agent role

The registry states that each agent role's scope list is the maximum a grant of that kind may carry, but none of the three new agent roles includes the new ftw.update.request scope (and release is explicitly limited to health reads). Consequently, an agent can never be granted permission to request an update, so any update-request flow will be rejected regardless of owner approval; add the scope to the intended role or defer declaring it until such a role exists.

Useful? React with 👍 / 👎.