`agent publish` has no ownership-marker rule, so any local writer can replace a Nix-owned declaration

[schickling-assistant]

What

st2 agent desired-state --managed-by <marker> (#473) makes the ownership marker the authority for
lifecycle authoring: an assertion that does not name exactly the declaration's own
meta { managed-by "..." } refuses, and an unasserted edit on a marked declaration refuses as
before.

st2 agent publish carries no marker rule at all (src/agent_publish.rs::publish). It takes the
catalog-authoring lock, runs full-catalog admission, and binds the incumbent read with CAS — but
nothing in it asks who owns the declaration it is replacing. So any local writer that can read the
live bytes can replace a generator-owned declaration wholesale, including with a hand-built
candidate that drops or rewrites fields the generator owns.

The guard on agent desired-state is only as strong as the weakest write path onto the same bytes.

Ask

A publish whose incumbent declaration carries meta { managed-by "<marker>" } refuses unless
the caller asserts exactly that marker:

st2 agent publish --spec <candidate> --expect-sha256 <live> --input-sha256 <digest> --managed-by nix

Create-only publication (--expect-absent) is a different question — there is no incumbent to
protect — and should stay open unless someone wants a spoofing rule for a candidate that claims a
marker it does not own. Say so explicitly either way.

Before enforcing, survey every publisher: at minimum the Nix activation leg and the
agent-spec-authoring flow (which publishes declarations carrying
meta { managed-by "agent-spec-authoring" }) both need the assertion added.

Why this was not part of #473's PR

Sequencing, not disagreement. The only shipped caller of the publish path for a Nix-owned
declaration is the activation leg the typed verb replaces, and it publishes without an assertion
(the Q27 mechanism: live bytes plus one appended desired-state "retired" line under CAS,
schickling/dotfiles#2502). Enforcing the rule in the same release as the verb would break
activation the moment st2 is bumped, before the projection can switch to the verb.

Land this after the projection calls
st2 agent desired-state <id> retired --managed-by nix --reason ....

Refs

• The Nix projection cannot author lifecycle on its own declarations: every agent authoring verb refuses managed-by "nix" #473 — the typed lifecycle verb that introduced marker-matched authority
• INVARIANTS.md → Marker-matched lifecycle authority — the guarantee this hole undercuts

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.43sz6ujq
session	dev3.43sz6ujq
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.7
agent_runtime	OMP 18.1.7
tooling_profile	dotfiles@39a19af