Accounts keeper-view: fleet agent-identity setup (provider + GitHub)

Context

First keeper-view sub of the v13.1 harness-UI cockpit epic #13448 (graduated from Discussion #13436; "I own the UX convergence + design-language; keeper-view subs are filed + linked incrementally"). Lead (@neo-opus-grace) confirmed the decomposition + ordered Accounts first — it is the most-grounded keeper view and the M1 adoption gate: you cannot run a cross-family fleet until its agent identities are set up. The epic body defines Accounts as: "set up the cross-family fleet's agent identities (provider login + GitHub identity)."

This sub follows the lead-confirmed Refs-not-nest rule and the 3 scope guards for keeper-view leaf DoDs (A2A Re: [lead-role] #13448 decomposition, 2026-06-18): the leaf defines + renders the view consuming existing machinery — it does not rebuild it.

⚠️ Scope Correction (V-B-A 2026-06-19, pre-build — premise was partially false)

A pre-build source sweep found the Accounts keeper-view core already exists, conflated inside apps/agentos/view/FleetSettingsPanel.mjs (mounted in Viewport.mjs's cockpit dashboard; apps/agentos/view/ is ~36 operator-authored commits). FleetSettingsPanel already:

• renders the AgentDefinitions store (githubUsername/harnessType/credentialState/lifecycleState/statusText) in a grid — the "list identities (redacted)" AC;
• provides the identity-setup form (GitHub username + PAT → submitToFleetRegistryBridge, fails closed, clears the PAT, stores nothing in the App Worker) — the exact Brain-side credential boundary this ticket's DoD specifies;
• also carries the Fleet concern (gated Start/Stop/Restart lifecycle buttons).

So this is NOT greenfield. "The Problem" below ("no human-facing view to create/inspect agent definitions") is partially false — the view exists; it just conflates the Accounts + Fleet keeper-views that #13448 decomposes apart.

Corrected scope: extract/formalize the Accounts keeper-view out of the conflated FleetSettingsPanel (identity half), with a sibling Fleet keeper-view sub taking the run-control half — NOT a duplicate component.

Pending fork (needs convergence, NOT solo-build): split FleetSettingsPanel → Accounts + Fleet keeper-views, or keep it combined and adjust the #13448 decomposition. This touches operator-authored cockpit code → coordinate with @tobiu (the panel's primary author) + @neo-opus-grace (lead) before implementing. The sections below are retained as the original framing; the extract-not-greenfield correction supersedes the greenfield reading.

The Problem

The harness substrate is largely built (Project 13), but the harness UI is undefined (#13448). Without a defined Accounts view, fleet identity setup has no home — agent definitions exist as a model/store with no human-facing view to create/inspect them, and credential setup has no governed entry point. The risk this epic exists to kill is random, no-DoD harness tickets; this sub gives the Accounts surface a one-PR DoD with an explicit scope fence.

The Architectural Reality

The harness app is apps/agentos (the Agent OS cockpit — harness-IS-a-Neo-app, #13012). Verified substrate this view consumes:

• apps/agentos/model/AgentDefinition.mjs — the Body-side agent-identity model (Neo.data.Model). Fields: id, githubUsername, harnessType, credentialState, lifecycleState, statusText, updatedAt. ⭐ Security boundary (AgentDefinition.mjs:8-9): "This model deliberately contains no credential field: PAT bytes remain Brain-side in FleetRegistryService and may only surface here as redacted state." The view renders the redacted Body model; raw credentials never enter the App-Worker — the capability-security line (data-not-code across the trust boundary).
• apps/agentos/store/AgentDefinitions.mjs — the store the view binds to (the live fleet roster).
• apps/agentos/view/ — sibling views already exist (Viewport, ViewportController, FleetSettingsPanel, DockPreview). The Accounts view is a new sibling here.
• ai/ConfigProvider.mjs / ai/config.mjs — the AiConfig provider SSOT (ADR 0019). Provider-login config resolves through it; the view reads/writes leaves, never shadows them.
• Brain-side FleetRegistryService (named authority per AgentDefinition.mjs:8-9) — owns credential (PAT) bytes; the view's "set up provider login + GitHub identity" writes credentials through it.

The Fix

Define + render an Accounts keeper-view under apps/agentos/view/ (sibling to FleetSettingsPanel), bound to the AgentDefinitions store. It lists the fleet's agent identities (redacted) and provides the identity-setup flow (provider login + GitHub identity), writing credentials through the Brain-side FleetRegistryService so PAT bytes never enter the Body. The view's mount-point in the shell nav is owned by the cross-cutting structure/nav sub — this sub defines the view, not the shell.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR 0019 (AiConfig provider SSOT — read leaves, never shadow) and aligned-with ADR 0020 (harness concept — entry modes + co-habitation; no separate agent-console). Does not amend/supersede either.

Close-target reconciliation (PR #13516)

PR #13516 (the extraction) delivers the extraction scope — ACs 1, 2, 3, 7, 8: the Accounts view exists, its identity-setup form writes credentials through the Brain-side bridge (PAT never enters the App-Worker, fails closed), the shared AgentDefinitions roster (now a singleton) is the reactive seam, and the Fleet machinery is consumed, not rebuilt. The redacted roster listing (AC2) is rendered by the Fleet view (FleetSettingsPanel) reading the same singleton — the split reassigned listing→Fleet, setup→Accounts.

ACs 4 (AiConfig provider-login), 5 (basic NL-MCP entry), 6 (v14 IdentityState slot) are deferred to follow-up #13521 — Accounts enhancements beyond the extraction, tracked there rather than silently closed. With them split out, PR #13516 honestly Resolves this (extraction-scoped) Accounts keeper-view.

Acceptance Criteria

• A new AgentOS.view.Accounts keeper-view exists under apps/agentos/view/ (sibling to FleetSettingsPanel), bound to the AgentDefinitions store.
• The view lists the fleet's agent identities, rendering githubUsername, harnessType, credentialState (redacted), lifecycleState, statusText from the Body model — no raw-credential field is added to the Body model (AgentDefinition.mjs:8-9 boundary preserved).
• Identity setup (provider login + GitHub identity) writes credentials through the Brain-side FleetRegistryService; PAT bytes never enter the App-Worker.
• Provider-login config resolves via the AiConfig provider SSOT (ai/ConfigProvider.mjs, ADR 0019) — read/write leaves, no service-local shadow.
• The basic NL-MCP entry (v13.1 external-harness entry) is included; extended multi-agent NL coordination (#13056 / H3) is explicitly fenced — not pulled forward (scope guard #3).
• The v13.1 identity slot is a subset/prefix of the v14 IdentityState schema (#13444) — zero-migration forward-compat (no field contradicting the v14 shape).
• Does not rebuild the Fleet run-control machinery (#13015) or FleetRegistryService — consumes them (scope guard #1; leaf = one-PR, epic = multi-PR substrate).
• Contract Ledger row-surfaces re-verified at build time (ticket-intake) before assertion.

Out of Scope

• The stable-shell structure/nav (where the view mounts) — its own cross-cutting sub.
• The Fleet run-control keeper-view (start/stop/restart roster) — separate sub; FleetSettingsPanel / #13015 domain.
• Extended NL multi-agent coordination (#13056), H3 (your-own-repo), H4 (deploy plane).
• Standalone provider-OAuth (fenced in #13448).
• The full v14 IdentityState schema / COP (#13444).

Avoided Traps

• Raw credentials in the Body model — rejected; the Body AgentDefinition is redacted-only, PAT bytes stay Brain-side in FleetRegistryService (capability-security boundary, AgentDefinition.mjs:8-9).
• Rebuilding the fleet/identity machinery inside the view — rejected (scope guard #1); consume the existing model/store/service.
• Pulling #13056 extended-NL forward via the entry-mode fold — rejected (scope guard #3).
• A separate agent-console — rejected (ADR 0020 co-habitation: the agent operates the same live instances behind the human's views).

Related

• Parent: #13448 (harness-UI cockpit epic) — linked via SUB_ISSUE.
• Consumes (Refs, not nests): #13015 (Fleet Manager machinery), FleetRegistryService.
• Forward-compat: #13444 (v14 IdentityState superset).
• Fences: #13056 (extended NL, H3-deferred).
• Sibling keeper-view subs (to be filed): Fleet, Chat→live-pane, Live-pane (the keeper), Work-area; cross-cutting structure/nav (#13445-adjacent).
• Lead decomposition direction: A2A Re: [lead-role] #13448 decomposition — Refs-not-nest CONFIRMED + 3 scope guards (@neo-opus-grace, 2026-06-18).

Release classification: v13.1 harness cockpit (not v13-release-blocking) — boardless.

Origin Session ID: a200ff3b-5ea5-4fc0-b288-cd5fe2c917e0 Retrieval Hint: "Accounts keeper-view fleet agent-identity setup #13448"; AgentDefinition redacted-credential Body/Brain boundary; query_summaries "harness cockpit keeper-view decomposition".

Authored by Claude Opus 4.8 (Claude Code), @neo-opus-vega (Vega).