Provisioning — Agent Lifecycle at Gateway Layer

Agents are first-class infra citizens — provisioned, quotad, and revoked from the CMS Studio console. The gateway enforces all limits; agents hold zero config.

Provisioning Flow

CMS Studio                          Gateway                         Fleet
──────────                          ────────                         ─────
Admin UI ──→ POST /admin/agents      ──→ verify                      ┌──────┐
     │                                 │      create Ed25519          │ Cipher │
     │  { "agent_id": "cipher",        │      store privkey           │  Vol   │
     │   "role": "code",               │      write pubkey to         └──────┘
     │   "daily_ops": 10000,           │      Firebase claims         ┌──────┐
     │   "burst_rps": 50,              │                                │  Axon  │
     │   "concurrent": 5 }             │                                │  Vol   │
     ▼                                 ▼                                └──────┘
Returns: {agent_id, public_key_jwk, handshake_url}

Agent receives:

Artifact	Location	Purpose
`ed25519_private.key`	`/secrets/agent/`	Signs handshake challenges (never transmitted)
`public_key.jwk`	`/secrets/agent/`	Gateway verifies signatures
`handshake_url`	`https://gateway/v1/auth/handshake`	Challenge endpoint

Rate Limit Tiers (Enforced at Gateway)

Tier	Daily Ops	Burst RPS	Concurrent	Typical Role
Agent (default)	10,000	50	5	cipher, prisma, theta, vector
Research Agent	50,000	200	20	almemsha, nova
Infra Architect	∞	∞	∞	titan, pulse

Configured in CMS Studio → Agent Provisioning → Quota & Rate Limits.

Quota Enforcement

# Gateway middleware (FastAPI)
@app.middleware("http")
async def enforce_quota(request, call_next):
    agent_id = extract_agent_id(request)  # from JWT `agent_id` claim
    quota = redis_get(f"quota:{agent_id}:daily")
    burst = redis_get(f"quota:{agent_id}:burst")
    
    if quota >= agent.tier.daily_ops:
        return JSONResponse({"error": "QUOTA_EXCEEDED", "retry_after": seconds_until_midnight()}, 429)
    if burst >= agent.tier.burst_rps:
        return JSONResponse({"error": "BURST_EXCEEDED", "retry_after": 1}, 429)
    
    redis_incr(f"quota:{agent_id}:daily")
    redis_incr(f"quota:{agent_id}:burst", ttl=1)
    return await call_next(request)

Reset: Daily at 00:00 UTC (configurable per-agent in CMS Studio).

Agent Revocation (Instant)

Action	Effect
Disable in Firebase	All `custom_token` requests for `agent_id` rejected at auth verifier
Delete custom claim	Existing API keys fail validation on next request
CMS Studio: "Revoke"	Both above + audit note to `fleet_notes` with `tags: ["auth", "revocation", agent_id]`

# Manual revocation
curl -X DELETE https://gateway.highlimitdesigns.com/v1/admin/agents/cipher \
  -H "Authorization: Bearer $ADMIN_TOKEN"
# {"revoked": true, "audit_id": "fleet_notes.STIDX001..."}

Provisioning API (Admin Only)

POST /v1/admin/agents
Authorization: Bearer <admin_token>
{
  "agent_id": "cipher",
  "display_name": "Cipher — General of Code",
  "role": "code",
  "tier": "agent",              # agent | research | infra
  "daily_ops": 10000,
  "burst_rps": 50,
  "concurrent_requests": 5,
  "skills": ["hermes-agent", "go-htmx", "hld-sovereign-backend", "fleet-notes"]
}

Response:

{
  "agent_id": "cipher",
  "handshake_url": "https://gateway.highlimitdesigns.com/v1/auth/handshake",
  "public_key_jwk": {"kty": "OKP", "crv": "Ed25519", "x": "..."},
  "daily_ops": 10000,
  "burst_rps": 50,
  "concurrent": 5,
  "expires_at": "2026-12-31T23:59:59Z"
}

Skills Assignment

Agents declare capabilities via skill registry (hot-reloadable YAML at runtime):

# /opt/hld-docs/agents/cipher/skills.yaml
skills:
  - hermes-agent
  - go-htmx
  - hld-sovereign-backend
  - fleet-notes
  - hld-agent-api-protocol
  - cybot-orchestration

CMS Studio writes this file to the agent's volume on provision. Agent runtime loads it at startup and signals capability to gateway:

POST /v1/dispatch
Authorization: Bearer <agent_token>
{ "capability": "go-htmx" }

Monitoring & Debug

Endpoint	Purpose
`GET /v1/admin/agents`	List all agents, tier, quota usage %
`GET /v1/admin/agents/{id}/usage`	Last 24h ops, burst hits, 429 count
`GET /v1/debug/agent/{id}`	Active sessions, recent ops, skill list

Admin Dashboard: studio.highlimitdesigns.com/agents — provision, quota tweak, revoke, view audit trail.

Agent Roster — 14 agents, roles, capabilities
Sovereign Runtimes — Docker volume, private keys, skill hot-reload
Authentication — Firebase handshake, Ed25519 challenge
Rate Limits — Gateway enforcement details
Webhooks — Completion events to HTTPS endpoints

Roster Sovereign Runtimes

Overview

Provisioning