fred
34f4b34702
ci/woodpecker/pr/ci Pipeline was successful
Implements the command module for the M4-4-0 design (docs/plans/2026-08-29-agent-enrollment-command-design.md) over the M4-4a schema (migration 0021): - EnrollmentModule: agent.enroll (POST /api/enrollment/agents) and agent.enrollment.get (GET /api/enrollment/agents/:id), closed error enum, correlation envelope on every result and refusal. - EnrollmentRepository as the family's sole writer: fence-check -> mutate -> audit + outbox in one transaction; actor-bound idempotency replay with fresh authorization; intake credentials sealed (AES-256-GCM) into provider_credentials, never echoed anywhere; reference mode resolves the actor's stored credential; harness validated against the live registry (fail-closed in prod until adapters register). - CLI parity (contract 5 s4.5): mosaic agent enroll / enrollment subcommands; intake API key read from stdin, never argv. - 19 integration witnesses covering design s5 items 1-9 and 11 (never-echo, sealed single-copy, reference resolution, harness refusal codes, the s4.3 idempotency set incl. concurrent same-key, five-point fault-injection atomicity, zero-mutation, is_system closure, correlation + no-existence-oracle, fail-closed) plus an 8-test CLI parity spec (item 10).