Pin NyxID assistant registry v8 and add dormant service.reauthorize action path - #3496
Open
eanz17 wants to merge 3 commits into
Open
Pin NyxID assistant registry v8 and add dormant service.reauthorize action path#3496eanz17 wants to merge 3 commits into
eanz17 wants to merge 3 commits into
Conversation
…ction path Pin registry revision nyxid-assistant-actions.v8 (service.connect, key.create, key.rotate, service.reauthorize) ahead of NyxID#1400 with the assumed exact descriptor in registry-v8.json, and add the typed service.reauthorize machinery: producer tool class, shared browser-action helpers, registry mapper with strict identity/scope validation, blocker sub-message, AG-UI branch, projection fields. The verb stays unadvertised (no tool mount, intent candidate, or prompt line) while NyxID production serves v7; a follow-up branch advertises it after v8 ships. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ertised Drop the ServiceReauthorize arms from the conversation GAgent route-to-intent mapping and from the executor built-in intent checks so a published profile whose member IntentId is literally service_reauthorize keeps its full committed catalog instead of narrowing to a built-in the materializer does not resolve yet. Add a GAgent test pinning the ordinary-profile-route behaviour. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
ChronoAIProject/NyxID#1400 §1 will publish a new assistant-actions registry revision that adds a
service.reauthorizedescriptor.NyxIdAssistantActionRegistry.Loadrejects any revision it has not pinned (NYXID_ACTION_REGISTRY_REVISION_UNSUPPORTED) and the startup path then installs the disabled registry, so all browser actions (service.connect,key.create,key.rotate) would fail closed on the next Aevatar restart after NyxID deploys the new revision. The tolerant consumer therefore has to ship first (same order as v5/v6/v7). Aevatar also lacked the producer/mapper forservice.reauthorize(#3312).Solution
Deploy-safe branch A — pin + dormant machinery, nothing advertised while NyxID production is still v7:
nyxid-assistant-actions.v8= v7 descriptors +service.reauthorize {userServiceId, requestedScopes[]}(riskgrant, tierv1,remember_eligible=false, byte-pinned indocs/contracts/nyxid-assistant-conformance/v1/registry-v8.json). v8 executable set = all four; v4–v7 unchanged. Revision name is a single constant (SupportedRegistryRevision).NyxIdRequestServiceReauthorizeTool(exactuserServiceId, 1..64 unique scopes, no secret material) — not mounted in any tool source on this branch; shared internals extracted toNyxIdBrowserActionRequestToolHelpers.ResolveServiceReauthorize, typed blocker sub-message (ai_messages.proto),NyxIdChatBrowserActionsbranch → existingVerifyServiceReauthorizeAsyncpostcondition, flat AG-UI wire params (old nested field reserved), Studio projection/read-model for the params.ParseServiceReauthorizemade as strict as the typed resolver; duplicated safe-identity/distinct-set blocks inResolve*extracted.docs/canon/nyxid-chat-api.md) + conformance README "When NyxID publishes v8" checklist. Any drift in the served v8 descriptor (params_schema/risk/remember_eligible) or a different revision name disables the whole registry at startup — documented as intended fail-closed.Follow-up (stacked, merge only after NyxID production serves v8): #3497 — tool mounts, intent candidate, system-prompt line.
Impact
agents/Aevatar.GAgents.NyxidChat(registry, browser actions, AG-UI builder, protos, executor/GAgent),src/Aevatar.AI.ToolProviders.NyxId(new tool + helpers),src/Aevatar.AI.Abstractions/ai_messages.proto,src/Aevatar.Studio.*(projection + query port),docs/canon,docs/contracts/nyxid-assistant-conformance/v1.Verification
dotnet build aevatar.slnx --nologo— 0 errorsdotnet test test/Aevatar.AI.Tests --nologo --filter FullyQualifiedName~NyxId— 2353 passed / 0 faileddotnet test test/Aevatar.Studio.Tests --nologo --filter FullyQualifiedName~NyxIdChat— 44/0dotnet test test/Aevatar.Capabilities.Tests --nologo --filter "FullyQualifiedName~MainnetHostCompositionTests|FullyQualifiedName~NyxId"— 111/0dotnet test test/Aevatar.GAgents.ChannelRuntime.Tests --nologo --filter FullyQualifiedName~ConversationReplyGeneratorTests— 86/0python3 -m unittest tools/ci/tests/test_nyxid_conformance_guard.py tools/ci/tests/test_nyxid_semantic_evaluation.py— OKbash tools/ci/nyxid_conformance_guard.sh/bash tools/ci/architecture_guards.sh/bash tools/ci/test_stability_guards.sh/bash tools/docs/lint.sh— all passnyxid_request_service_reauthorizeon this branch.🤖 Generated with Claude Code