@app-vitals/agent-admin 0.4.0 → 0.6.0

package/prisma/client/internal/prismaNamespace.ts

@@ -2749,6 +2749,7 @@ export const AgentGitHubInstallationsSnapshotScalarFieldEnum = {
   agentId: 'agentId',
   reportedAt: 'reportedAt',
   installations: 'installations',
+  repoAccess: 'repoAccess',
   createdAt: 'createdAt'
 } as const
 
@@ -2808,6 +2809,14 @@ export const JsonNullValueInput = {
 export type JsonNullValueInput = (typeof JsonNullValueInput)[keyof typeof JsonNullValueInput]
 
 
+export const NullableJsonNullValueInput = {
+  DbNull: DbNull,
+  JsonNull: JsonNull
+} as const
+
+export type NullableJsonNullValueInput = (typeof NullableJsonNullValueInput)[keyof typeof NullableJsonNullValueInput]
+
+
 export const QueryMode = {
   default: 'default',
   insensitive: 'insensitive'

package/prisma/client/internal/prismaNamespaceBrowser.ts

@@ -439,6 +439,7 @@ export const AgentGitHubInstallationsSnapshotScalarFieldEnum = {
   agentId: 'agentId',
   reportedAt: 'reportedAt',
   installations: 'installations',
+  repoAccess: 'repoAccess',
   createdAt: 'createdAt'
 } as const
 
@@ -498,6 +499,14 @@ export const JsonNullValueInput = {
 export type JsonNullValueInput = (typeof JsonNullValueInput)[keyof typeof JsonNullValueInput]
 
 
+export const NullableJsonNullValueInput = {
+  DbNull: DbNull,
+  JsonNull: JsonNull
+} as const
+
+export type NullableJsonNullValueInput = (typeof NullableJsonNullValueInput)[keyof typeof NullableJsonNullValueInput]
+
+
 export const QueryMode = {
   default: 'default',
   insensitive: 'insensitive'

package/prisma/client/models/AgentGitHubInstallationsSnapshot.ts

@@ -43,6 +43,7 @@ export type AgentGitHubInstallationsSnapshotCountAggregateOutputType = {
   agentId: number
   reportedAt: number
   installations: number
+  repoAccess: number
   createdAt: number
   _all: number
 }
@@ -67,6 +68,7 @@ export type AgentGitHubInstallationsSnapshotCountAggregateInputType = {
   agentId?: true
   reportedAt?: true
   installations?: true
+  repoAccess?: true
   createdAt?: true
   _all?: true
 }
@@ -148,6 +150,7 @@ export type AgentGitHubInstallationsSnapshotGroupByOutputType = {
   agentId: string
   reportedAt: Date
   installations: runtime.JsonValue
+  repoAccess: runtime.JsonValue | null
   createdAt: Date
   _count: AgentGitHubInstallationsSnapshotCountAggregateOutputType | null
   _min: AgentGitHubInstallationsSnapshotMinAggregateOutputType | null
@@ -177,6 +180,7 @@ export type AgentGitHubInstallationsSnapshotWhereInput = {
   agentId?: Prisma.StringFilter<"AgentGitHubInstallationsSnapshot"> | string
   reportedAt?: Prisma.DateTimeFilter<"AgentGitHubInstallationsSnapshot"> | Date | string
   installations?: Prisma.JsonFilter<"AgentGitHubInstallationsSnapshot">
+  repoAccess?: Prisma.JsonNullableFilter<"AgentGitHubInstallationsSnapshot">
   createdAt?: Prisma.DateTimeFilter<"AgentGitHubInstallationsSnapshot"> | Date | string
   agent?: Prisma.XOR<Prisma.AgentScalarRelationFilter, Prisma.AgentWhereInput>
 }
@@ -186,6 +190,7 @@ export type AgentGitHubInstallationsSnapshotOrderByWithRelationInput = {
   agentId?: Prisma.SortOrder
   reportedAt?: Prisma.SortOrder
   installations?: Prisma.SortOrder
+  repoAccess?: Prisma.SortOrderInput | Prisma.SortOrder
   createdAt?: Prisma.SortOrder
   agent?: Prisma.AgentOrderByWithRelationInput
 }
@@ -198,6 +203,7 @@ export type AgentGitHubInstallationsSnapshotWhereUniqueInput = Prisma.AtLeast<{
   NOT?: Prisma.AgentGitHubInstallationsSnapshotWhereInput | Prisma.AgentGitHubInstallationsSnapshotWhereInput[]
   reportedAt?: Prisma.DateTimeFilter<"AgentGitHubInstallationsSnapshot"> | Date | string
   installations?: Prisma.JsonFilter<"AgentGitHubInstallationsSnapshot">
+  repoAccess?: Prisma.JsonNullableFilter<"AgentGitHubInstallationsSnapshot">
   createdAt?: Prisma.DateTimeFilter<"AgentGitHubInstallationsSnapshot"> | Date | string
   agent?: Prisma.XOR<Prisma.AgentScalarRelationFilter, Prisma.AgentWhereInput>
 }, "id" | "agentId">
@@ -207,6 +213,7 @@ export type AgentGitHubInstallationsSnapshotOrderByWithAggregationInput = {
   agentId?: Prisma.SortOrder
   reportedAt?: Prisma.SortOrder
   installations?: Prisma.SortOrder
+  repoAccess?: Prisma.SortOrderInput | Prisma.SortOrder
   createdAt?: Prisma.SortOrder
   _count?: Prisma.AgentGitHubInstallationsSnapshotCountOrderByAggregateInput
   _max?: Prisma.AgentGitHubInstallationsSnapshotMaxOrderByAggregateInput
@@ -221,6 +228,7 @@ export type AgentGitHubInstallationsSnapshotScalarWhereWithAggregatesInput = {
   agentId?: Prisma.StringWithAggregatesFilter<"AgentGitHubInstallationsSnapshot"> | string
   reportedAt?: Prisma.DateTimeWithAggregatesFilter<"AgentGitHubInstallationsSnapshot"> | Date | string
   installations?: Prisma.JsonWithAggregatesFilter<"AgentGitHubInstallationsSnapshot">
+  repoAccess?: Prisma.JsonNullableWithAggregatesFilter<"AgentGitHubInstallationsSnapshot">
   createdAt?: Prisma.DateTimeWithAggregatesFilter<"AgentGitHubInstallationsSnapshot"> | Date | string
 }
 
@@ -228,6 +236,7 @@ export type AgentGitHubInstallationsSnapshotCreateInput = {
   id?: string
   reportedAt: Date | string
   installations: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Date | string
   agent: Prisma.AgentCreateNestedOneWithoutGithubInstallationsSnapshotInput
 }
@@ -237,6 +246,7 @@ export type AgentGitHubInstallationsSnapshotUncheckedCreateInput = {
   agentId: string
   reportedAt: Date | string
   installations: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Date | string
 }
 
@@ -244,6 +254,7 @@ export type AgentGitHubInstallationsSnapshotUpdateInput = {
   id?: Prisma.StringFieldUpdateOperationsInput | string
   reportedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   installations?: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   agent?: Prisma.AgentUpdateOneRequiredWithoutGithubInstallationsSnapshotNestedInput
 }
@@ -253,6 +264,7 @@ export type AgentGitHubInstallationsSnapshotUncheckedUpdateInput = {
   agentId?: Prisma.StringFieldUpdateOperationsInput | string
   reportedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   installations?: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
 }
 
@@ -261,6 +273,7 @@ export type AgentGitHubInstallationsSnapshotCreateManyInput = {
   agentId: string
   reportedAt: Date | string
   installations: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Date | string
 }
 
@@ -268,6 +281,7 @@ export type AgentGitHubInstallationsSnapshotUpdateManyMutationInput = {
   id?: Prisma.StringFieldUpdateOperationsInput | string
   reportedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   installations?: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
 }
 
@@ -276,6 +290,7 @@ export type AgentGitHubInstallationsSnapshotUncheckedUpdateManyInput = {
   agentId?: Prisma.StringFieldUpdateOperationsInput | string
   reportedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   installations?: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
 }
 
@@ -289,6 +304,7 @@ export type AgentGitHubInstallationsSnapshotCountOrderByAggregateInput = {
   agentId?: Prisma.SortOrder
   reportedAt?: Prisma.SortOrder
   installations?: Prisma.SortOrder
+  repoAccess?: Prisma.SortOrder
   createdAt?: Prisma.SortOrder
 }
 
@@ -342,6 +358,7 @@ export type AgentGitHubInstallationsSnapshotCreateWithoutAgentInput = {
   id?: string
   reportedAt: Date | string
   installations: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Date | string
 }
 
@@ -349,6 +366,7 @@ export type AgentGitHubInstallationsSnapshotUncheckedCreateWithoutAgentInput = {
   id?: string
   reportedAt: Date | string
   installations: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Date | string
 }
 
@@ -372,6 +390,7 @@ export type AgentGitHubInstallationsSnapshotUpdateWithoutAgentInput = {
   id?: Prisma.StringFieldUpdateOperationsInput | string
   reportedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   installations?: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
 }
 
@@ -379,6 +398,7 @@ export type AgentGitHubInstallationsSnapshotUncheckedUpdateWithoutAgentInput = {
   id?: Prisma.StringFieldUpdateOperationsInput | string
   reportedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
   installations?: Prisma.JsonNullValueInput | runtime.InputJsonValue
+  repoAccess?: Prisma.NullableJsonNullValueInput | runtime.InputJsonValue
   createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string
 }
 
@@ -389,6 +409,7 @@ export type AgentGitHubInstallationsSnapshotSelect<ExtArgs extends runtime.Types
   agentId?: boolean
   reportedAt?: boolean
   installations?: boolean
+  repoAccess?: boolean
   createdAt?: boolean
   agent?: boolean | Prisma.AgentDefaultArgs<ExtArgs>
 }, ExtArgs["result"]["agentGitHubInstallationsSnapshot"]>
@@ -398,6 +419,7 @@ export type AgentGitHubInstallationsSnapshotSelectCreateManyAndReturn<ExtArgs ex
   agentId?: boolean
   reportedAt?: boolean
   installations?: boolean
+  repoAccess?: boolean
   createdAt?: boolean
   agent?: boolean | Prisma.AgentDefaultArgs<ExtArgs>
 }, ExtArgs["result"]["agentGitHubInstallationsSnapshot"]>
@@ -407,6 +429,7 @@ export type AgentGitHubInstallationsSnapshotSelectUpdateManyAndReturn<ExtArgs ex
   agentId?: boolean
   reportedAt?: boolean
   installations?: boolean
+  repoAccess?: boolean
   createdAt?: boolean
   agent?: boolean | Prisma.AgentDefaultArgs<ExtArgs>
 }, ExtArgs["result"]["agentGitHubInstallationsSnapshot"]>
@@ -416,10 +439,11 @@ export type AgentGitHubInstallationsSnapshotSelectScalar = {
   agentId?: boolean
   reportedAt?: boolean
   installations?: boolean
+  repoAccess?: boolean
   createdAt?: boolean
 }
 
-export type AgentGitHubInstallationsSnapshotOmit<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetOmit<"id" | "agentId" | "reportedAt" | "installations" | "createdAt", ExtArgs["result"]["agentGitHubInstallationsSnapshot"]>
+export type AgentGitHubInstallationsSnapshotOmit<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetOmit<"id" | "agentId" | "reportedAt" | "installations" | "repoAccess" | "createdAt", ExtArgs["result"]["agentGitHubInstallationsSnapshot"]>
 export type AgentGitHubInstallationsSnapshotInclude<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
   agent?: boolean | Prisma.AgentDefaultArgs<ExtArgs>
 }
@@ -440,6 +464,7 @@ export type $AgentGitHubInstallationsSnapshotPayload<ExtArgs extends runtime.Typ
     agentId: string
     reportedAt: Date
     installations: runtime.JsonValue
+    repoAccess: runtime.JsonValue | null
     createdAt: Date
   }, ExtArgs["result"]["agentGitHubInstallationsSnapshot"]>
   composites: {}
@@ -869,6 +894,7 @@ export interface AgentGitHubInstallationsSnapshotFieldRefs {
   readonly agentId: Prisma.FieldRef<"AgentGitHubInstallationsSnapshot", 'String'>
   readonly reportedAt: Prisma.FieldRef<"AgentGitHubInstallationsSnapshot", 'DateTime'>
   readonly installations: Prisma.FieldRef<"AgentGitHubInstallationsSnapshot", 'Json'>
+  readonly repoAccess: Prisma.FieldRef<"AgentGitHubInstallationsSnapshot", 'Json'>
   readonly createdAt: Prisma.FieldRef<"AgentGitHubInstallationsSnapshot", 'DateTime'>
 }
     

package/prisma/migrations/20261028000000_add_repo_access_to_github_installations_snapshot/migration.sql

@@ -0,0 +1,3 @@
+-- COS-44.1: per-repo GitHub access probe result reported by the runtime.
+-- Nullable and additive; no token or credential is ever stored here.
+ALTER TABLE "AgentGitHubInstallationsSnapshot" ADD COLUMN "repoAccess" JSONB;

package/prisma/schema/schema.prisma

@@ -496,6 +496,7 @@ model AgentGitHubInstallationsSnapshot {
   agent         Agent    @relation(fields: [agentId], references: [id], onDelete: Cascade)
   reportedAt    DateTime
   installations Json     // GitHubInstallation[]
+  repoAccess    Json?    // RepoAccessEntry[] — per-repo read/write probe (COS-44.1); null until a flagged runtime reports it
   createdAt     DateTime @default(now())
 }
 

package/src/admin-boot.ts

@@ -74,6 +74,7 @@ import { AgentAskService } from "./agent-ask.ts";
 import { parseAgentAskConfig } from "./agent-ask-config.ts";
 import { CronRunNowService } from "./cron-run-now.ts";
 import { parseCronRunNowConfig } from "./cron-run-now-config.ts";
+import { parsePodServiceAccountConfig } from "./pod-service-account-config.ts";
 import { AgentChatTokenService } from "./agent-chat-tokens.ts";
 import { AgentCronJobService } from "./agent-cron-jobs.ts";
 import { AgentCronRunStatsService } from "./agent-cron-run-stats.ts";
@@ -104,6 +105,7 @@ import { mountPlatformDoc } from "./platform-doc-route.ts";
 import { createAdminPrismaClient } from "./prisma-client.ts";
 import { isPushEnabled } from "./push-sender.ts";
 import { PushService } from "./push-service.ts";
+import { parseRepoAccessConfig } from "./repo-access-config.ts";
 import { parseSelfServeConfig } from "./self-serve-config.ts";
 import { HttpSlackProvisioningClient } from "./slack-provisioning-client.ts";
 import { SpecialtyRegistry } from "./specialty-manifest-loader.ts";
@@ -300,6 +302,9 @@ export async function startAdmin(
   // Cron-run transcript API (COS-43.1): flag off by default.
   const transcriptConfig = parseTranscriptConfig(process.env);
 
+  // Per-repo GitHub access check (COS-44.1): flag off by default.
+  const repoAccessConfig = parseRepoAccessConfig(process.env);
+
   // Web Push (CFB-4.2). Enabled ONLY when public + private + subject are all
   // set — a partial config must not half-enable the feature. When disabled,
   // pushService is undefined, the push routes 503, and the toggle renders "".
@@ -425,6 +430,7 @@ export async function startAdmin(
     agentTokenService,
     anthropicFederationEnabled,
     transcriptUploadEnabled: transcriptConfig.enabled,
+    repoAccessCheckEnabled: repoAccessConfig.enabled,
   });
 
   root.route("/agents", runtimeApp);
@@ -458,6 +464,7 @@ export async function startAdmin(
     pool: adminPool,
     selfServe,
     anthropicFederationEnabled,
+    podServiceAccountEnabled: parsePodServiceAccountConfig(process.env).enabled,
     chatCredentialsEnabled: parseChatCredentialConfig(process.env).enabled,
     ...(chatCredentialsClient
       ? { chatCredentials: chatCredentialsClient }

package/src/agent-account-assignment.ts

@@ -15,15 +15,44 @@ import type { AgentProvisioner } from "./agent-provisioner.ts";
  * already committed, so a reconcile failure is returned as a warning string
  * (the next full reconcile pass will converge it) instead of failing the call.
  */
-export async function reconcileAgentAfterAccountChange(
+type ReconcilableAgent = Partial<AgentAnthropicIdentity> & {
+  id: string;
+  name: string;
+  selfHosted: boolean;
+  accountId?: string | null;
+  podServiceAccountName?: string | null;
+};
+
+export function reconcileAgentAfterAccountChange(
+  provisioner: Pick<AgentProvisioner, "reconcile">,
+  agent: ReconcilableAgent,
+): Promise<string | undefined> {
+  return reconcileAgentWorkload(provisioner, agent, "account updated");
+}
+
+/**
+ * COS-49.1: reconciles the workload after podServiceAccountName changed.
+ * `previous` is the column value before the update; the provisioner uses it to
+ * clear the live ServiceAccount only when it is still the one it applied.
+ */
+export function reconcileAgentAfterPodServiceAccountChange(
+  provisioner: Pick<AgentProvisioner, "reconcile">,
+  agent: ReconcilableAgent,
+  previous: string | null,
+): Promise<string | undefined> {
+  return reconcileAgentWorkload(
+    provisioner,
+    agent,
+    "pod service account updated",
+    previous,
+  );
+}
+
+async function reconcileAgentWorkload(
   provisioner: Pick<AgentProvisioner, "reconcile">,
-  agent: Partial<AgentAnthropicIdentity> & {
-    id: string;
-    name: string;
-    selfHosted: boolean;
-    accountId?: string | null;
-    podServiceAccountName?: string | null;
-  },
+  agent: ReconcilableAgent,
+  what: string,
+  previousPodServiceAccountName?: string | null,
 ): Promise<string | undefined> {
   if (agent.selfHosted) return undefined;
   try {
@@ -38,14 +67,17 @@ export async function reconcileAgentAfterAccountChange(
         anthropicFederationRuleId: agent.anthropicFederationRuleId,
         k8sServiceAccountName: agent.k8sServiceAccountName,
         podServiceAccountName: agent.podServiceAccountName,
+        ...(previousPodServiceAccountName !== undefined
+          ? { previousPodServiceAccountName }
+          : {}),
       },
     ]);
     const failure = result.failed.find((f) => f.agentId === agent.id);
     return failure
-      ? `account updated, but reconciling the agent workload failed: ${failure.error}`
+      ? `${what}, but reconciling the agent workload failed: ${failure.error}`
       : undefined;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    return `account updated, but reconciling the agent workload failed: ${message}`;
+    return `${what}, but reconciling the agent workload failed: ${message}`;
   }
 }

package/src/agent-github-installations.integration.test.ts

@@ -66,6 +66,38 @@ describeOrSkip("AgentGitHubInstallationsService (integration)", () => {
     expect(read?.reportedAt).toEqual(reportedAt);
   });
 
+  it("round-trips repoAccess and keeps it when a later push omits it (COS-44.1)", async () => {
+    const agentId = await createAgent(prisma);
+    const repoAccess = [
+      {
+        repo: "agent",
+        owner: "app-vitals",
+        read: true,
+        write: true,
+        checkedAt: "2026-01-15T12:00:00.000Z",
+      },
+    ];
+    const first = await service.push(agentId, {
+      reportedAt: new Date("2026-01-15T12:00:00.000Z"),
+      installations: [],
+      repoAccess,
+    });
+    expect(first.repoAccess).toEqual(repoAccess);
+
+    await service.push(agentId, {
+      reportedAt: new Date("2026-01-16T12:00:00.000Z"),
+      installations: [],
+    });
+    expect((await service.get(agentId))?.repoAccess).toEqual(repoAccess);
+
+    await service.push(agentId, {
+      reportedAt: new Date("2026-01-17T12:00:00.000Z"),
+      installations: [],
+      repoAccess: [],
+    });
+    expect((await service.get(agentId))?.repoAccess).toEqual([]);
+  });
+
   it("get() returns null when nothing has been pushed", async () => {
     const agentId = await createAgent(prisma);
     expect(await service.get(agentId)).toBeNull();

package/src/agent-github-installations.ts

@@ -5,7 +5,9 @@
  *
  * One row per agent (AgentGitHubInstallationsSnapshot.agentId is @unique).
  * push() upserts the single row, replacing the installations list wholesale —
- * an installation absent from the latest push is gone.
+ * an installation absent from the latest push is gone. repoAccess (COS-44.1)
+ * is only written when the push carries it, so a push from a runtime with the
+ * check off never wipes a result stored earlier.
  */
 
 import type {
@@ -19,6 +21,8 @@ export type { AgentGitHubInstallationsSnapshot };
 interface PushGitHubInstallationsInput {
   reportedAt: Date;
   installations: Prisma.InputJsonValue;
+  /** Omitted leaves the stored per-repo access result unchanged; [] clears it. */
+  repoAccess?: Prisma.InputJsonValue;
 }
 
 export class AgentGitHubInstallationsService {
@@ -35,10 +39,16 @@ export class AgentGitHubInstallationsService {
         agentId,
         reportedAt: input.reportedAt,
         installations: input.installations,
+        ...(input.repoAccess === undefined
+          ? {}
+          : { repoAccess: input.repoAccess }),
       },
       update: {
         reportedAt: input.reportedAt,
         installations: input.installations,
+        ...(input.repoAccess === undefined
+          ? {}
+          : { repoAccess: input.repoAccess }),
       },
     });
   }

package/src/agent-provisioner.ts

@@ -151,6 +151,15 @@ export interface ReconcileTarget extends Partial<AgentAnthropicIdentity> {
   accountId?: string | null;
   /** The Agent row's pod ServiceAccount (COS-48.1); rendered only when the flag is on. */
   podServiceAccountName?: string | null;
+  /**
+   * The pod ServiceAccount this agent had before the change being reconciled
+   * (COS-49.1). Only used to clear: when `podServiceAccountName` is now unset,
+   * the live ServiceAccount is nulled only if it still equals this value, so a
+   * ServiceAccount set by another actor is left alone. The PATCH handler passes
+   * the pre-update column value; startup/full passes leave it absent (so they
+   * never clear anything).
+   */
+  previousPodServiceAccountName?: string | null;
 }
 
 export interface AgentProvisioner {
@@ -701,6 +710,44 @@ export function federationPatch(
   return Object.keys(patch).length > 0 ? patch : undefined;
 }
 
+/** The pod-identity patch: the ServiceAccount fields only. */
+interface PodIdentityPatch {
+  serviceAccountName: string | null;
+  serviceAccount?: null;
+}
+
+/**
+ * Strategic-merge fragment that brings the live pod ServiceAccount to the
+ * Agent row's podServiceAccountName (COS-49.1), for Deployments without
+ * federation wiring (federationPatch owns the ServiceAccount when the desired
+ * Deployment carries federation).
+ *
+ * - Desired ServiceAccount set: patched when the live one differs.
+ * - Desired unset: cleared (serviceAccountName and the deprecated
+ *   `serviceAccount` alias nulled) ONLY when the live value equals
+ *   `previous`, the value this admin previously applied. A ServiceAccount set
+ *   by another actor therefore survives, as does everything when `previous`
+ *   is unknown (startup passes).
+ */
+export function podIdentityPatch(
+  live: KubernetesDeployment,
+  desired: KubernetesDeployment,
+  previous?: string | null,
+): PodIdentityPatch | undefined {
+  const cur = federationParts(live);
+  const want = federationParts(desired);
+  if (want.volume || want.env.size > 0) return undefined;
+  if (want.serviceAccountName) {
+    return cur.serviceAccountName !== want.serviceAccountName
+      ? { serviceAccountName: want.serviceAccountName }
+      : undefined;
+  }
+  if (previous && cur.serviceAccountName === previous) {
+    return { serviceAccountName: null, serviceAccount: null };
+  }
+  return undefined;
+}
+
 function isConflict(err: unknown): boolean {
   return err instanceof ConflictError;
 }
@@ -1420,6 +1467,16 @@ export class KubernetesAgentProvisioner implements AgentProvisioner {
           const federation = manageFederation
             ? federationPatch(deployment, desiredDeployment)
             : undefined;
+          // Pod ServiceAccount (COS-49.1). Runs under policyOnly too, so an
+          // admin restart never regresses a Deployment to the wrong identity.
+          const podIdentity =
+            federation?.serviceAccountName === undefined
+              ? podIdentityPatch(
+                  deployment,
+                  desiredDeployment,
+                  agent.previousPodServiceAccountName,
+                )
+              : undefined;
           const containerDrift =
             !policyOnly &&
             current !== undefined &&
@@ -1427,7 +1484,11 @@ export class KubernetesAgentProvisioner implements AgentProvisioner {
             containerDrifted(current, desired);
           if (
             desired &&
-            (labelsDrifted || containerDrift || policy || federation)
+            (labelsDrifted ||
+              containerDrift ||
+              policy ||
+              federation ||
+              podIdentity)
           ) {
             // Under policyOnly the container entry carries only the policy and
             // federation mount/env changes (if any); image, the rest of env,
@@ -1466,11 +1527,15 @@ export class KubernetesAgentProvisioner implements AgentProvisioner {
               ...(policy?.volumes ?? []),
               ...(federation?.volumes ?? []),
             ];
-            const serviceAccount =
+            const saPatch =
               federation?.serviceAccountName !== undefined
+                ? federation
+                : podIdentity;
+            const serviceAccount =
+              saPatch?.serviceAccountName !== undefined
                 ? {
-                    serviceAccountName: federation.serviceAccountName,
-                    ...(federation.serviceAccount === null
+                    serviceAccountName: saPatch.serviceAccountName,
+                    ...(saPatch.serviceAccount === null
                       ? { serviceAccount: null }
                       : {}),
                   }