fix: persist and recover the Agent's real installation_id (heartbeat activation)

POST /v1/agents/enroll now returns installation_id; new installs persist it
to agent.env immediately. Runtime recovery precedence: existing SQLite
installation_identity -> configured INSTALLATION_ID -> authenticated
GET /v1/agents/me/identity. Recovery fails closed on missing/malformed/
mismatched identity rather than inventing a UUID (which the Hub would then
reject as a conflicting Installation on an already-enrolled Agent). An
explicit AGENT_JOBS_ENABLED gate stops the service from claiming a job right
after the first heartbeat.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
gti
2026-09-23 22:13:56 -03:00
co-authored by Claude Sonnet 5
parent a9aded1e49
commit ac7b503c2f
16 changed files with 754 additions and 15 deletions
+3 -2
View File
@@ -42,7 +42,7 @@ def test_agent_env_is_secret_free_and_write_safe(tmp_path, install_common, monke
monkeypatch.setenv("AGENT_VERSION", "1.1.1")
final = ROOT / "release" / "VERSION"
monkeypatch.setenv("AGENT_VERSION", final.read_text(encoding="utf-8").strip())
result = {"agent_id": 42, "agent_token": secret, "hub_url": "https://gtifiscal.gtigrupo.com.br", "agent_version": "1.1.1"}
result = {"agent_id": 42, "agent_token": secret, "hub_url": "https://gtifiscal.gtigrupo.com.br", "agent_version": "1.1.1", "installation_id": "00000000-0000-4000-8000-000000000222"}
install_common.write_agent_env(tmp_path, result)
env = (tmp_path / "agent.env").read_text(encoding="utf-8")
assert "AGENT_TOKEN" not in env
@@ -52,6 +52,7 @@ def test_agent_env_is_secret_free_and_write_safe(tmp_path, install_common, monke
assert "FISCAL_MODE=DRY_RUN" in env
assert "GTI_HUB_URL=https://gtifiscal.gtigrupo.com.br" in env
assert "AGENT_ID=42" in env
assert "INSTALLATION_ID=00000000-0000-4000-8000-000000000222" in env
assert "FIREBIRD_DATABASE_PATH=" in env
for k in ("AGENT_LOG_PATH", "AGENT_STATE_DB", "EXPECTED_SCHEMA_FINGERPRINT", "GTI_WRITE_EXECUTOR_PATH"):
assert k in env, k
@@ -118,4 +119,4 @@ def test_no_writes_ever_enabled_in_installer_sources():
assert "AUTO_APPLY" not in text
assert "FIREBIRD_WRITES=0" not in text # the flag lives only in install_common
assert "FISCAL_MODE=DRY_RUN" in install_common_text
assert "FIREBIRD_WRITES=0" in install_common_text
assert "FIREBIRD_WRITES=0" in install_common_text