[DoodleBears]

Refs T4 #5 | Claim | Stacked on #23

Why the change

An Agent can hand a pending health check to another channel Agent while preserving the original Human's authority and preventing both forwarding and local execution from winning the same request.

Special things to note

• Merge risk: one-way authorization boundary after use — additive Channel schema 5 records execution choice and parent uniqueness, but older Workers ignore these fences; use a forward fix or quiesce Agents/work requests before downgrade. Medium blast radius: typed work authorization/results in TOB channels; review original membership, expiry, concurrent execution/forwarding and retry behavior. D1/Org stay 5/4.
• Local checks: 59 workerd tests, 41 Node tests, 2 wizard tests, typecheck and build passed. The first new rollback test expected 500; the existing storage contract returns 503; corrected and reran. UAT runtime864b16d (schemas5/4/5), deploy smoke and CI39089599338 passed. Separate CLI/Node processes verified original-Human A→B forwarding, same-channel results, local denial, replay count0 and both fences; test credentials revoked. Evidence. No new UI surface; DSH, model-driven forwarding, two Hosts, native mobile flow and WebSockets remain unqualified.
• Draft, UAT only, no merge/Prod. This is a preparatory public-protocol increment, not completion of T4. Agent task: codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.

Change outline

Human → canonical request targeting A
                 ├─ authorize execution → persist choice → no forwarding
                 └─ A forwards to B → one atomic child/message → no A execution
                                          ↓
                     original Human membership + B's local policy
                                          ↓
                         B's result → child ID → original request

+ POST /api/agent-channels/:channel/work-requests/:request/forward {targetActorId}
+ channel_work.parent_request_id UNIQUE NULLABLE
+ channel_work.execution_authorized DEFAULT false
+ WorkRequest.delegation {parentRequestId, actorId, hops: 1}
+ CLI: agent-channel forward --credential-file <private-file> --request <id> --target <id>
~ reference health runner checks Agent authorship and original-Human local permission

One parent has one child; identical retry returns it, conflicting targets fail. Capability and expiry cannot be changed. A child cannot forward again. Agent messages remain distinct from Human authorship; plain text never becomes an executable work request.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DoodleBears]

The read-only Agent identity endpoint is now deployed in UAT at 3eeed5b05782276b1a02cc2412dd04ab0ec60bca (Worker 02beb5ec-1804-468d-9318-89e06467377c). Two independent channel Agent credentials were verified through the formal CLI against canonical actor/owner/org/channel metadata; secret files remain private for the upcoming Host gate. Local coverage is 60 workerd + 41 Node tests, typecheck/build; source CI passed. The evidence-only follow-up does not change the deployed runtime.

The first fixture attempt omitted the CLI library runtime argument; the retry reused its saved operation IDs. No duplicate resources were intentionally created. Existing forwarding evidence remains bound to 864b16d; this new identity readback does not claim the two-Host/model execution path. Host integration continues in DeepSeekBot Draft #2157. UAT only; no Prod or merge.