feat(agent): add durable existing-agent credential transitions

backend/app/agent_auth/repository.py

@@ -32,12 +32,18 @@ class AgentAuthRepository:
             with connection.cursor(row_factory=dict_row) as cur:
                 cur.execute(
                     """
-                    SELECT agent_id,
-                           agent_secret_hash,
-                           credential_created_at,
-                           credential_revoked_at
-                    FROM minerops_site_agents
-                    WHERE agent_id = %s
+                    SELECT identity.agent_id,
+                           agent.agent_secret_hash,
+                           agent.credential_created_at,
+                           agent.credential_revoked_at,
+                           retirement.retired_at AS legacy_auth_disabled_at
+                    FROM (VALUES (%s::text)) AS identity(agent_id)
+                    LEFT JOIN minerops_site_agents AS agent
+                      ON agent.agent_id = identity.agent_id
+                    LEFT JOIN agent_legacy_auth_retirements AS retirement
+                      ON retirement.agent_id = identity.agent_id
+                    WHERE agent.agent_id IS NOT NULL
+                       OR retirement.agent_id IS NOT NULL
                     """,
                     (agent_id,),
                 )

backend/app/agent_auth/service.py

@@ -25,19 +25,50 @@ class AgentAuthService:
         identity = (agent_id or "").strip()
         secret = (provided_secret or "").strip()
 
-        if not identity:
-            raise AgentAuthenticationFailed("Missing Agent identity")
         if not secret:
             raise AgentAuthenticationFailed("Invalid or missing Agent secret")
 
+        # The production Alpha Agent predates the identity header. Missing-ID
+        # compatibility is therefore bound to exactly the configured legacy
+        # identity; no request value is allowed to select another Agent.
+        legacy_id = settings.minerops_agent_id.strip()
+        legacy_secret = settings.minerops_agent_shared_secret.strip()
+        missing_identity = not identity
+        if missing_identity:
+            if not legacy_id:
+                raise AgentAuthenticationUnavailable(
+                    "Legacy Agent authentication is not configured"
+                )
+            identity = legacy_id
+
         credential = self.repository.get_credential(identity)
 
+        # Revocation is authoritative regardless of which credential path
+        # would otherwise apply. Never allow malformed or historical
+        # credential state to fall through to the legacy shared secret.
+        if credential and credential.get("credential_revoked_at") is not None:
+            raise AgentCredentialRevoked("Agent credential has been revoked")
+
+        # This value comes from the identity-level retirement ledger, not the
+        # deletable current Agent row. It is therefore authoritative even when
+        # the Agent was deleted and has not yet been recreated.
+        legacy_auth_retired = bool(
+            credential
+            and credential.get("legacy_auth_disabled_at") is not None
+        )
+
         # Any Agent with a per-Agent credential is permanently on the new
         # authentication path. The legacy shared secret must never authenticate
         # that identity, even if the Agent later becomes revoked.
         if credential and credential.get("agent_secret_hash"):
-            if credential.get("credential_revoked_at") is not None:
-                raise AgentCredentialRevoked("Agent credential has been revoked")
+            # Once the configured legacy identity has ever received a
+            # per-Agent credential, secret-only fallback is permanently
+            # disabled. The legacy global secret cannot authenticate it and a
+            # per-Agent secret cannot be used without an explicit identity.
+            if missing_identity:
+                raise AgentAuthenticationFailed(
+                    "Explicit Agent identity is required for enrolled Agents"
+                )
 
             supplied_hash = hash_agent_secret(secret)
             if not hmac.compare_digest(
@@ -48,10 +79,15 @@ class AgentAuthService:
 
             return identity
 
-        # Temporary compatibility for the single pre-enrollment Agent.
-        legacy_id = settings.minerops_agent_id.strip()
-        legacy_secret = settings.minerops_agent_shared_secret.strip()
+        # The durable identity retirement survives Agent-row deletion,
+        # credential-field corruption, administrative mistakes, and future
+        # credential rotation workflows.
+        if legacy_auth_retired:
+            raise AgentAuthenticationFailed(
+                "Legacy Agent authentication has been permanently disabled"
+            )
 
+        # Temporary compatibility for the single pre-enrollment Agent.
         if not legacy_id or not legacy_secret:
             raise AgentAuthenticationUnavailable(
                 "Legacy Agent authentication is not configured"