chore(vehicle): security consolidation train — #17113, #16444, #17088, #17095 in one CI run (#17048)

[mrveiss]

Thinking Path

This follows the owner's consolidation direction of 2026-09-19 ("fix all red, review and merge, check if any are consolidation candidates"). The approved security-class trains land together in one CI run, not one after another. The rest trains ride #17133. #17106 (session ownership, security) is appended to this train once #17133 has landed, because its resolution already contains #17133's content.

What Changed

The branch was cut from main after #17048 and carries these members:

PR	Carried head	Closes	Review
#17113	d69a1d1241	#16957, #16040, #16294, #16999	approve@d69a1d1241
#16444	8b7bd135c6	#16428	approve@8b7bd135c6
#17088	82233a4017	#17087	approve@82233a4017
#17095	172c5a7f45	— (Refs #13034, #16335, #16375, #16709)	carried here with #17088's fail-open fix, which supersedes its old #16899 code

Resolution commits, made locally on this branch (the coordinator's own):

• Merges: 64d9bd0a1a, 539ab7645d and a0e7b408dc bring in feat(secrets): bridge connector credential templates to ConnectorCredentialStore (#16428) #16444, security(models): pin 3 unpinned HF loads, widen bandit to npu-worker (#17087) #17088 and chore(train): batch vehicle 2 — 4 approved PRs (#17093, #17094, #16896, #16899), one CI run #17095.
  • Size mirrors: re-measured with wc -l. autobot-slm-backend/main.py is 798 and ai_hardware_accelerator.py is 1040.
  • .secrets.baseline: JSON union, de-duplicated by (type, hashed_secret); 1413 entries, and the should_exclude_file filter is kept.
  • autobot-slm-backend/main.py: auto-merged. It registers the shared 422 handler once, next to chore(vehicle): land A2A capability gating and originator authority (#16957, #16950) #17113's forwarded_allow_ips.
  • security(models): pin 3 unpinned HF loads, widen bandit to npu-worker (#17087) #17088's fail-open fix is intact in vision.py, voice.py and ai_hardware_accelerator.py. It loads and verifies first and only then assigns; this was checked across the chore(train): batch vehicle 2 — 4 approved PRs (#17093, #17094, #16896, #16899), one CI run #17095 merge.
• 3df1ea20e0: deletes autobot-backend/api/a2a.py's size entry (563 lines, under MAX_LINES). security(models): pin 3 unpinned HF loads, widen bandit to npu-worker (#17087) #17088 had added it, and python_file_size_ratchet_test.py requires compliant files to be removed.
• 7cd4c30bad: # pragma: allowlist secret on 9 non-secret literals that the whole-tree scan flags:
  • a public model revision SHA in pinned_model_registry.py;
  • 7 hashed_secret keys in repo_tests/secrets_baseline_reasons.py;
  • the X-API-Key header name in middleware/api_key_allow_list.py.

Closes #16957
Closes #16040
Closes #16294
Closes #16999
Closes #16428
Closes #17087
Refs #13034
Refs #16335
Refs #16375
Refs #16709

Verification

• detect-secrets-hook --baseline .secrets.baseline over all 124 files changed against main: exit 0.
• secrets_baseline_reasons_guard_test, secrets_baseline_legacy_keys_excluded_17130_test and python_file_size_ratchet_test: 40 passed. fastapi_validation_handler_guard_test and main_validation_handler_test: 8 passed.
• The pre-push hook passed on both pushes, run with the CI-parity interpreter.
• This PR's CI is the proof for the union. It is held behind chore(vehicle): rest consolidation train — #17107, #17119, #17122, #17117, #17129 in one CI run (#17128) #17133, which has CI priority per the owner.

Model Used

Claude Opus 5 (coordinator) and a Sonnet subagent for the conflict resolution

Closes #17052
Closes #17053
Closes #17057
Closes #17074
Closes #17078
Closes #17079

Carried in after #17133 landed

• Updated to main at 1b9f5143 — 0 behind. Four conflicts resolved: agent_communication.py
  (kept main's run_or_schedule import, which main still calls, and main's __main__ CLI block,
  which security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950 dropped incidentally; all of security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950's own changes survive), base_agent.py (both
  sides wanted — acting_for(origin) now wraps execute_with_tracking), and the two size
  baselines, pinned to sizes measured in the merged tree, not to either side's number.
• Carried fix(agents): agent-terminal sessions act only for their owner; agent commands report real output and exit codes (#17052, #17074) #17106 (issue-17052-command-approvals), whose closing links are added above.

[mrveiss]

Reviewed at 2afd939, --detach, challenging the judgement calls specifically (not just reading green CI). Verdict: APPROVE.

1. base_agent.py / agent_communication.py merge resolutions — correct, not just plausible.

• execute_with_tracking(agent_request) (replacing the bare process_request call under acting_for(origin)): read _tracked_process directly — it calls self.process_request(request) internally (base_agent.py:263), so this is a strict superset (adds analytics + scope/work-claim gating around the same call), never a loss. And it's the safer default now that #16986 makes peer delivery real: an incoming peer request now gets the same scope/work-claim protection every other caller gets, rather than bypassing it.
• run_or_schedule import + __main__ block restoration: confirmed exactly one import, one __main__ block, one call site — all inside if __name__ == "__main__":, which never executes on import. Nothing on the train could have "depended on" its absence; it's dead weight either way for every real code path.

2. security_api_test.py / security_integration_test.py — direction confirmed correct.
Traced is_interactive_human() directly (autobot_shared/auth/interactive_principal.py): _INTERACTIVE_AUTH_METHODS = {"jwt", "jwt_websocket", "session"} does NOT include "stub", and _TOKEN_AUTH_METHODS = {"jwt", "jwt_websocket"} excludes "session" from the login_token requirement, so {"username": "root", "role": "admin", "auth_method": "session"} genuinely passes the real gate. Widening the shared stub would have been a fail-open shortcut for every other backend test using it; the per-test override is the right call.

3. test_secrets_coordinator.py patch-target fix — verified directly. api/secrets.py has zero module-level get_coordinator (only a function-local from api.envelope_secrets import get_coordinator inside _create_system_vault_secret, at line 681). patch("api.secrets.get_coordinator", ...) would raise AttributeError; patching api.envelope_secrets.get_coordinator is exactly right for a deferred import resolved at call time.

4. migration-gate.yml's 3 new packages — traced both full import chains end to end, independently. defusedxml: direct (nextcloud.py:32). jsonschema: api/secrets.py → middleware.proxy_utils → triggers middleware/manager.py → autobot_shared.plugin_sdk.registry → triggers plugin_sdk/__init__.py (package init always runs first) → .loader → import jsonschema. prometheus_client: api/secrets.py → auth_middleware → security_layer → autobot_shared.monitoring.metrics.audit → import prometheus_client. Both chains are real; the comment's wording is a bit loose (skips the autobot_shared vs local plugin_sdk distinction) but the substance checks out.

5. Ratchet re-pins — spot-checked the 3 named entries exactly: manager.py=4067, tool_handler.py=3721, agent_communication.py=711, all matching wc -l and both baseline mirrors precisely. Lighter touch on the 3 relocated tests themselves (didn't re-derive their own assertions) given the volume here, but nothing about the relocation looked incomplete.

Bonus, unprompted: independently verified repo_tests/preflight_runs_synced_source_17137_test.py's property is the right generalization — checked all 3 playbook call sites reference the script via {{ git_repo_root }} (freshly-synced tree) while the venv interpreter path and --repo-root argument are correctly excluded from the "executable line" check. Matches the live incident exactly.

Nothing blocking.