@app-vitals/agent-admin 0.5.0 → 0.6.0

package/openapi.json

@@ -204,6 +204,12 @@
           "typeName": {
             "type": "string"
           },
+          "podServiceAccountName": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "accountId": {
             "type": [
               "string",
@@ -303,6 +309,7 @@
           "patchAuthorAllowlist",
           "restrictSlackToMembers",
           "typeName",
+          "podServiceAccountName",
           "accountId",
           "createdAt",
           "updatedAt",
@@ -372,6 +379,15 @@
             "minLength": 1,
             "example": "acct_123"
           },
+          "podServiceAccountName": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 63,
+            "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
+            "example": "agent-pod-sa"
+          },
           "trialExpiresAt": {
             "type": [
               "string",
@@ -3546,7 +3562,7 @@
       },
       "patch": {
         "summary": "Update an agent",
-        "description": "Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, and/or `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.",
+        "description": "Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows), and/or `podServiceAccountName` (platform admin only — 403 otherwise; `null` clears it; 409 unless SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED is on; 422 for agents with a per-agent federated identity; reconciles the workload so the pod is recreated under the new ServiceAccount). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.",
         "parameters": [
           {
             "schema": {
@@ -3607,6 +3623,26 @@
                 }
               }
             }
+          },
+          "409": {
+            "description": "podServiceAccountName supplied while the pod ServiceAccount flag is off",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "podServiceAccountName supplied for an agent with a per-agent federated identity",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           }
         }
       },

package/openapi.platform.json

@@ -204,6 +204,12 @@
           "typeName": {
             "type": "string"
           },
+          "podServiceAccountName": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "accountId": {
             "type": [
               "string",
@@ -303,6 +309,7 @@
           "patchAuthorAllowlist",
           "restrictSlackToMembers",
           "typeName",
+          "podServiceAccountName",
           "accountId",
           "createdAt",
           "updatedAt",
@@ -372,6 +379,15 @@
             "minLength": 1,
             "example": "acct_123"
           },
+          "podServiceAccountName": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 63,
+            "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
+            "example": "agent-pod-sa"
+          },
           "trialExpiresAt": {
             "type": [
               "string",
@@ -3374,7 +3390,7 @@
       },
       "patch": {
         "summary": "Update an agent",
-        "description": "Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, and/or `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.",
+        "description": "Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows), and/or `podServiceAccountName` (platform admin only — 403 otherwise; `null` clears it; 409 unless SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED is on; 422 for agents with a per-agent federated identity; reconciles the workload so the pod is recreated under the new ServiceAccount). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.",
         "parameters": [
           {
             "schema": {
@@ -3435,6 +3451,26 @@
                 }
               }
             }
+          },
+          "409": {
+            "description": "podServiceAccountName supplied while the pod ServiceAccount flag is off",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "podServiceAccountName supplied for an agent with a per-agent federated identity",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           }
         }
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-vitals/agent-admin",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/app-vitals/agent.git",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "0.135.0",
-    "@app-vitals/agent-lib": "0.5.0",
+    "@app-vitals/agent-lib": "0.6.0",
     "@hono/zod-openapi": "^1.0.0",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",

package/src/admin-boot.ts

@@ -74,6 +74,7 @@ import { AgentAskService } from "./agent-ask.ts";
 import { parseAgentAskConfig } from "./agent-ask-config.ts";
 import { CronRunNowService } from "./cron-run-now.ts";
 import { parseCronRunNowConfig } from "./cron-run-now-config.ts";
+import { parsePodServiceAccountConfig } from "./pod-service-account-config.ts";
 import { AgentChatTokenService } from "./agent-chat-tokens.ts";
 import { AgentCronJobService } from "./agent-cron-jobs.ts";
 import { AgentCronRunStatsService } from "./agent-cron-run-stats.ts";
@@ -463,6 +464,7 @@ export async function startAdmin(
     pool: adminPool,
     selfServe,
     anthropicFederationEnabled,
+    podServiceAccountEnabled: parsePodServiceAccountConfig(process.env).enabled,
     chatCredentialsEnabled: parseChatCredentialConfig(process.env).enabled,
     ...(chatCredentialsClient
       ? { chatCredentials: chatCredentialsClient }

package/src/agent-account-assignment.ts

@@ -15,15 +15,44 @@ import type { AgentProvisioner } from "./agent-provisioner.ts";
  * already committed, so a reconcile failure is returned as a warning string
  * (the next full reconcile pass will converge it) instead of failing the call.
  */
-export async function reconcileAgentAfterAccountChange(
+type ReconcilableAgent = Partial<AgentAnthropicIdentity> & {
+  id: string;
+  name: string;
+  selfHosted: boolean;
+  accountId?: string | null;
+  podServiceAccountName?: string | null;
+};
+
+export function reconcileAgentAfterAccountChange(
+  provisioner: Pick<AgentProvisioner, "reconcile">,
+  agent: ReconcilableAgent,
+): Promise<string | undefined> {
+  return reconcileAgentWorkload(provisioner, agent, "account updated");
+}
+
+/**
+ * COS-49.1: reconciles the workload after podServiceAccountName changed.
+ * `previous` is the column value before the update; the provisioner uses it to
+ * clear the live ServiceAccount only when it is still the one it applied.
+ */
+export function reconcileAgentAfterPodServiceAccountChange(
+  provisioner: Pick<AgentProvisioner, "reconcile">,
+  agent: ReconcilableAgent,
+  previous: string | null,
+): Promise<string | undefined> {
+  return reconcileAgentWorkload(
+    provisioner,
+    agent,
+    "pod service account updated",
+    previous,
+  );
+}
+
+async function reconcileAgentWorkload(
   provisioner: Pick<AgentProvisioner, "reconcile">,
-  agent: Partial<AgentAnthropicIdentity> & {
-    id: string;
-    name: string;
-    selfHosted: boolean;
-    accountId?: string | null;
-    podServiceAccountName?: string | null;
-  },
+  agent: ReconcilableAgent,
+  what: string,
+  previousPodServiceAccountName?: string | null,
 ): Promise<string | undefined> {
   if (agent.selfHosted) return undefined;
   try {
@@ -38,14 +67,17 @@ export async function reconcileAgentAfterAccountChange(
         anthropicFederationRuleId: agent.anthropicFederationRuleId,
         k8sServiceAccountName: agent.k8sServiceAccountName,
         podServiceAccountName: agent.podServiceAccountName,
+        ...(previousPodServiceAccountName !== undefined
+          ? { previousPodServiceAccountName }
+          : {}),
       },
     ]);
     const failure = result.failed.find((f) => f.agentId === agent.id);
     return failure
-      ? `account updated, but reconciling the agent workload failed: ${failure.error}`
+      ? `${what}, but reconciling the agent workload failed: ${failure.error}`
       : undefined;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    return `account updated, but reconciling the agent workload failed: ${message}`;
+    return `${what}, but reconciling the agent workload failed: ${message}`;
   }
 }

package/src/agent-provisioner.ts

@@ -151,6 +151,15 @@ export interface ReconcileTarget extends Partial<AgentAnthropicIdentity> {
   accountId?: string | null;
   /** The Agent row's pod ServiceAccount (COS-48.1); rendered only when the flag is on. */
   podServiceAccountName?: string | null;
+  /**
+   * The pod ServiceAccount this agent had before the change being reconciled
+   * (COS-49.1). Only used to clear: when `podServiceAccountName` is now unset,
+   * the live ServiceAccount is nulled only if it still equals this value, so a
+   * ServiceAccount set by another actor is left alone. The PATCH handler passes
+   * the pre-update column value; startup/full passes leave it absent (so they
+   * never clear anything).
+   */
+  previousPodServiceAccountName?: string | null;
 }
 
 export interface AgentProvisioner {
@@ -701,6 +710,44 @@ export function federationPatch(
   return Object.keys(patch).length > 0 ? patch : undefined;
 }
 
+/** The pod-identity patch: the ServiceAccount fields only. */
+interface PodIdentityPatch {
+  serviceAccountName: string | null;
+  serviceAccount?: null;
+}
+
+/**
+ * Strategic-merge fragment that brings the live pod ServiceAccount to the
+ * Agent row's podServiceAccountName (COS-49.1), for Deployments without
+ * federation wiring (federationPatch owns the ServiceAccount when the desired
+ * Deployment carries federation).
+ *
+ * - Desired ServiceAccount set: patched when the live one differs.
+ * - Desired unset: cleared (serviceAccountName and the deprecated
+ *   `serviceAccount` alias nulled) ONLY when the live value equals
+ *   `previous`, the value this admin previously applied. A ServiceAccount set
+ *   by another actor therefore survives, as does everything when `previous`
+ *   is unknown (startup passes).
+ */
+export function podIdentityPatch(
+  live: KubernetesDeployment,
+  desired: KubernetesDeployment,
+  previous?: string | null,
+): PodIdentityPatch | undefined {
+  const cur = federationParts(live);
+  const want = federationParts(desired);
+  if (want.volume || want.env.size > 0) return undefined;
+  if (want.serviceAccountName) {
+    return cur.serviceAccountName !== want.serviceAccountName
+      ? { serviceAccountName: want.serviceAccountName }
+      : undefined;
+  }
+  if (previous && cur.serviceAccountName === previous) {
+    return { serviceAccountName: null, serviceAccount: null };
+  }
+  return undefined;
+}
+
 function isConflict(err: unknown): boolean {
   return err instanceof ConflictError;
 }
@@ -1420,6 +1467,16 @@ export class KubernetesAgentProvisioner implements AgentProvisioner {
           const federation = manageFederation
             ? federationPatch(deployment, desiredDeployment)
             : undefined;
+          // Pod ServiceAccount (COS-49.1). Runs under policyOnly too, so an
+          // admin restart never regresses a Deployment to the wrong identity.
+          const podIdentity =
+            federation?.serviceAccountName === undefined
+              ? podIdentityPatch(
+                  deployment,
+                  desiredDeployment,
+                  agent.previousPodServiceAccountName,
+                )
+              : undefined;
           const containerDrift =
             !policyOnly &&
             current !== undefined &&
@@ -1427,7 +1484,11 @@ export class KubernetesAgentProvisioner implements AgentProvisioner {
             containerDrifted(current, desired);
           if (
             desired &&
-            (labelsDrifted || containerDrift || policy || federation)
+            (labelsDrifted ||
+              containerDrift ||
+              policy ||
+              federation ||
+              podIdentity)
           ) {
             // Under policyOnly the container entry carries only the policy and
             // federation mount/env changes (if any); image, the rest of env,
@@ -1466,11 +1527,15 @@ export class KubernetesAgentProvisioner implements AgentProvisioner {
               ...(policy?.volumes ?? []),
               ...(federation?.volumes ?? []),
             ];
-            const serviceAccount =
+            const saPatch =
               federation?.serviceAccountName !== undefined
+                ? federation
+                : podIdentity;
+            const serviceAccount =
+              saPatch?.serviceAccountName !== undefined
                 ? {
-                    serviceAccountName: federation.serviceAccountName,
-                    ...(federation.serviceAccount === null
+                    serviceAccountName: saPatch.serviceAccountName,
+                    ...(saPatch.serviceAccount === null
                       ? { serviceAccount: null }
                       : {}),
                   }

package/src/agent-provisioner.unit.test.ts

@@ -21,6 +21,7 @@ import {
   type KubernetesAgentProvisionerConfig,
   NoopAgentProvisioner,
   perAgentFederation,
+  podIdentityPatch,
   policyDrifted,
 } from "./agent-provisioner.ts";
 import type { AgentTokenService } from "./agent-tokens.ts";
@@ -1138,6 +1139,7 @@ function manifestWith(
   overrides: {
     imageTag?: string;
     anthropicFederation?: AgentAnthropicFederation;
+    podServiceAccountName?: string;
   } = {},
 ) {
   return buildAgentDeploymentManifest({
@@ -1151,6 +1153,7 @@ function manifestWith(
     tokenSecretKey: "token",
     claudePolicy,
     anthropicFederation: overrides.anthropicFederation,
+    podServiceAccountName: overrides.podServiceAccountName,
   });
 }
 
@@ -1898,3 +1901,136 @@ describe("KubernetesAgentProvisioner — pod service account (COS-48.1)", () =>
     ).toBeUndefined();
   });
 });
+
+// ─── Pod ServiceAccount drift (COS-49.1) ────────────────────────────────────
+
+describe("podIdentityPatch()", () => {
+  const withSa = (name?: string) =>
+    manifestWith(undefined, { podServiceAccountName: name });
+
+  it("patches the desired ServiceAccount when the live one differs", () => {
+    expect(podIdentityPatch(withSa(), withSa("agent-sa"))).toEqual({
+      serviceAccountName: "agent-sa",
+    });
+    expect(podIdentityPatch(withSa("old-sa"), withSa("agent-sa"))).toEqual({
+      serviceAccountName: "agent-sa",
+    });
+  });
+
+  it("is undefined when already in sync", () => {
+    expect(
+      podIdentityPatch(withSa("agent-sa"), withSa("agent-sa")),
+    ).toBeUndefined();
+  });
+
+  it("clears serviceAccountName and serviceAccount when live equals the previous value", () => {
+    expect(podIdentityPatch(withSa("agent-sa"), withSa(), "agent-sa")).toEqual({
+      serviceAccountName: null,
+      serviceAccount: null,
+    });
+  });
+
+  it("leaves a foreign ServiceAccount alone when clearing", () => {
+    expect(
+      podIdentityPatch(withSa("hand-set"), withSa(), "agent-sa"),
+    ).toBeUndefined();
+  });
+
+  it("never clears when the previous value is unknown", () => {
+    expect(podIdentityPatch(withSa("agent-sa"), withSa())).toBeUndefined();
+    expect(
+      podIdentityPatch(withSa("agent-sa"), withSa(), null),
+    ).toBeUndefined();
+  });
+
+  it("defers to federationPatch when the desired Deployment has federation", () => {
+    expect(
+      podIdentityPatch(withSa("x"), fedManifest(FED_A), "x"),
+    ).toBeUndefined();
+  });
+});
+
+describe("KubernetesAgentProvisioner.reconcile() — pod ServiceAccount drift (COS-49.1)", () => {
+  const live = (sa?: string) =>
+    new RecordedKubernetesClient({
+      deployments: {
+        [`${NAMESPACE}/${POLICY_RESOURCE}`]: manifestWith(undefined, {
+          podServiceAccountName: sa,
+        }),
+      },
+      secrets: {},
+      pvcs: {},
+    });
+  const provisioner = (client: KubernetesClient, enabled = true) =>
+    new KubernetesAgentProvisioner(client, stubTokens() as AgentTokenService, {
+      ...BASE_CONFIG,
+      podServiceAccount: { enabled },
+    });
+  const sa = async (rec: RecordedKubernetesClient) =>
+    (await rec.getDeployment(NAMESPACE, POLICY_RESOURCE)).spec.template.spec
+      .serviceAccountName;
+
+  for (const policyOnly of [false, true]) {
+    it(`patches the desired ServiceAccount when live differs (policyOnly=${policyOnly})`, async () => {
+      const rec = live("old-sa");
+      const { client, patches } = patchSpy(rec);
+      const result = await provisioner(client).reconcile(
+        [{ id: POLICY_AGENT_ID, podServiceAccountName: "agent-sa" }],
+        { policyOnly },
+      );
+      expect(result.updated).toEqual([POLICY_AGENT_ID]);
+      expect(patches).toHaveLength(1);
+      expect(await sa(rec)).toBe("agent-sa");
+    });
+  }
+
+  it("clears a previously managed ServiceAccount", async () => {
+    const rec = live("agent-sa");
+    const result = await provisioner(rec).reconcile([
+      {
+        id: POLICY_AGENT_ID,
+        podServiceAccountName: null,
+        previousPodServiceAccountName: "agent-sa",
+      },
+    ]);
+    expect(result.updated).toEqual([POLICY_AGENT_ID]);
+    expect(await sa(rec)).toBeUndefined();
+  });
+
+  it("leaves a hand-set ServiceAccount on an unmanaged Deployment alone", async () => {
+    const rec = live("hand-set");
+    const { client, patches } = patchSpy(rec);
+    const result = await provisioner(client).reconcile(
+      [
+        {
+          id: POLICY_AGENT_ID,
+          podServiceAccountName: null,
+          previousPodServiceAccountName: "agent-sa",
+        },
+      ],
+      { policyOnly: true },
+    );
+    expect(result.updated).toEqual([]);
+    expect(patches).toHaveLength(0);
+    expect(await sa(rec)).toBe("hand-set");
+  });
+
+  it("does nothing for a clear without a previous value (startup pass)", async () => {
+    const rec = live("agent-sa");
+    const { client, patches } = patchSpy(rec);
+    await provisioner(client).reconcile(
+      [{ id: POLICY_AGENT_ID, podServiceAccountName: null }],
+      { policyOnly: true },
+    );
+    expect(patches).toHaveLength(0);
+  });
+
+  it("does not patch when the flag is off", async () => {
+    const rec = live("hand-set");
+    const { client, patches } = patchSpy(rec);
+    await provisioner(client, false).reconcile([
+      { id: POLICY_AGENT_ID, podServiceAccountName: "agent-sa" },
+    ]);
+    expect(patches).toHaveLength(0);
+  });
+});

package/src/agents-api.integration.test.ts

@@ -703,3 +703,150 @@ describeOrSkip("admin CRUD API (integration)", () => {
     expect((await fleet.json()).totals.input).toBe(510);
   });
 });
+
+// ─── COS-49.1: PATCH /agents/:id podServiceAccountName ──────────────────────────
+
+describeOrSkip("PATCH /agents/:id podServiceAccountName (integration)", () => {
+  let prisma: PrismaClient;
+  let agentId: string;
+  let cookie: string;
+  const reconciled: Array<Record<string, unknown>> = [];
+
+  const provisioner: AgentProvisioner = {
+    canProvision: true,
+    provision: async () => ({
+      resourceName: "r",
+      secretName: "s",
+      deploymentName: "d",
+    }),
+    deprovision: async () => {},
+    reconcile: async (targets: Array<{ id: string }>) => {
+      for (const t of targets) reconciled.push(t as Record<string, unknown>);
+      return {
+        recreated: [],
+        updated: [],
+        migrated: [],
+        noOwner: [],
+        orphans: [],
+        failed: [],
+        dryRun: false,
+      };
+    },
+  } as unknown as AgentProvisioner;
+
+  const patch = (
+    app: ReturnType<typeof createAdminApp>,
+    body: unknown,
+    headers: Record<string, string> = { Cookie: `admin_session=${cookie}` },
+  ) =>
+    app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify(body),
+      headers: { "Content-Type": "application/json", ...headers },
+    });
+
+  beforeEach(async () => {
+    prisma = makePrisma();
+    await prisma.agentWorkQueueSnapshot.deleteMany();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentPhaseMethodology.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agentMember.deleteMany();
+    await prisma.agent.deleteMany();
+    agentId = await createAgent(prisma);
+    cookie = await makeSessionCookie();
+    reconciled.length = 0;
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  const appWith = (enabled: boolean) =>
+    createAdminApp({
+      ...makeDeps(prisma, provisioner),
+      podServiceAccountEnabled: enabled,
+    });
+
+  it("409 when the flag is off; the column is untouched", async () => {
+    const res = await patch(appWith(false), {
+      podServiceAccountName: "sa",
+    });
+    expect(res.status).toBe(409);
+    const row = await prisma.agent.findUniqueOrThrow({
+      where: { id: agentId },
+    });
+    expect(row.podServiceAccountName).toBeNull();
+    expect(reconciled).toEqual([]);
+  });
+
+  it("403 for a non-admin session", async () => {
+    const memberCookie = await sign(
+      {
+        isAdmin: false,
+        userId: "user-m",
+        email: "member@example.com",
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      },
+      SESSION_SECRET,
+      "HS256",
+    );
+    await prisma.agentMember.create({
+      data: { agentId, email: "member@example.com" },
+    });
+    const res = await patch(
+      appWith(true),
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${memberCookie}` },
+    );
+    expect(res.status).toBe(403);
+    expect(reconciled).toEqual([]);
+  });
+
+  it("422 for an agent with a per-agent federated identity", async () => {
+    await prisma.agent.update({
+      where: { id: agentId },
+      data: {
+        ownerEmail: "jane.doe@example.com",
+        anthropicIdentityName: "id-49-1",
+        anthropicServiceAccountId: "svac_1",
+        anthropicFederationRuleId: "fdrl_1",
+        k8sServiceAccountName: "agent-sa",
+      },
+    });
+    const res = await patch(appWith(true), { podServiceAccountName: "sa" });
+    expect(res.status).toBe(422);
+    expect(reconciled).toEqual([]);
+  });
+
+  it("200 persists the value, serializes it and reconciles once; null clears", async () => {
+    const app = appWith(true);
+    const res = await patch(app, { podServiceAccountName: "agent-pod-sa" });
+    expect(res.status).toBe(200);
+    expect((await res.json()).podServiceAccountName).toBe("agent-pod-sa");
+    expect(reconciled).toHaveLength(1);
+    expect(reconciled[0]).toMatchObject({
+      id: agentId,
+      podServiceAccountName: "agent-pod-sa",
+      previousPodServiceAccountName: null,
+    });
+
+    const get = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect((await get.json()).podServiceAccountName).toBe("agent-pod-sa");
+
+    const clear = await patch(app, { podServiceAccountName: null });
+    expect(clear.status).toBe(200);
+    expect((await clear.json()).podServiceAccountName).toBeNull();
+    expect(reconciled).toHaveLength(2);
+    expect(reconciled[1]).toMatchObject({
+      podServiceAccountName: null,
+      previousPodServiceAccountName: "agent-pod-sa",
+    });
+  });
+});

package/src/agents-api.smoke.test.ts

@@ -6,7 +6,7 @@
  * Services are injected as in-memory mocks.
  */
 
-import { beforeAll, describe, expect, it } from "bun:test";
+import { beforeAll, describe, expect, it, spyOn } from "bun:test";
 import { sign } from "hono/jwt";
 import type { Prisma } from "../prisma/client/client.ts";
 import { getSelfServeSpecialty } from "./account-agent-create.ts";
@@ -5515,6 +5515,229 @@ describe("admin API — PATCH /agents/:id accountId (SSP-5.3)", () => {
   });
 });
 
+// ─── COS-49.1: PATCH /agents/:id podServiceAccountName ───────────────────────
+
+describe("admin API — PATCH /agents/:id podServiceAccountName (COS-49.1)", () => {
+  const patch = (
+    app: ReturnType<typeof createAdminApp>,
+    body: unknown,
+    headers: Record<string, string>,
+  ) =>
+    app.request(`/agents/${AGENT_ID}`, {
+      method: "PATCH",
+      body: JSON.stringify(body),
+      headers: { "Content-Type": "application/json", ...headers },
+    });
+
+  const FEDERATED = {
+    ownerEmail: "jane.doe@example.com",
+    anthropicIdentityName: "id",
+    anthropicServiceAccountId: "svac_1",
+    anthropicFederationRuleId: "fdrl_1",
+    k8sServiceAccountName: "agent-sa",
+  };
+
+  function depsFor(opts: {
+    provisioner: RecordingProvisioner;
+    enabled?: boolean;
+    existing?: Record<string, unknown>;
+    updated?: Array<Record<string, unknown>>;
+  }): AdminDeps {
+    const base = makeMockDeps();
+    return {
+      ...base,
+      provisioner: opts.provisioner,
+      podServiceAccountEnabled: opts.enabled ?? true,
+      agentService: {
+        ...base.agentService,
+        getDetail: async (id: string) => {
+          const d = await base.agentService.getDetail(id);
+          return d ? ({ ...d, ...opts.existing } as typeof d) : d;
+        },
+        updateSelfHosted: async (id, input) => {
+          opts.updated?.push(input as Record<string, unknown>);
+          return {
+            ...(await base.agentService.updateSelfHosted(id, input)),
+            podServiceAccountName:
+              (input as { podServiceAccountName?: string | null })
+                .podServiceAccountName ?? null,
+          };
+        },
+      },
+    };
+  }
+
+  it("admin sets the value: 200, serialized, and reconcile invoked once with the previous value", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(
+      depsFor({
+        provisioner,
+        existing: { podServiceAccountName: "old-sa" },
+      }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: "new-sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect(
+      ((await res.json()) as { podServiceAccountName: string })
+        .podServiceAccountName,
+    ).toBe("new-sa");
+    expect(provisioner.reconciled).toHaveLength(1);
+    expect(provisioner.reconciled[0]).toMatchObject({
+      id: AGENT_ID,
+      podServiceAccountName: "new-sa",
+      previousPodServiceAccountName: "old-sa",
+    });
+  });
+
+  it("null clears the value and passes the previous one", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(
+      depsFor({ provisioner, existing: { podServiceAccountName: "old-sa" } }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: null },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect(provisioner.reconciled[0]).toMatchObject({
+      podServiceAccountName: null,
+      previousPodServiceAccountName: "old-sa",
+    });
+  });
+
+  it("409 naming the flag when it is off; nothing written or reconciled", async () => {
+    const provisioner = new RecordingProvisioner();
+    const updated: Array<Record<string, unknown>> = [];
+    const app = createAdminApp(
+      depsFor({ provisioner, enabled: false, updated }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(409);
+    expect(JSON.stringify(await res.json())).toContain(
+      "SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED",
+    );
+    expect(updated).toEqual([]);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("422 for an agent with a per-agent federated identity", async () => {
+    const provisioner = new RecordingProvisioner();
+    const updated: Array<Record<string, unknown>> = [];
+    const app = createAdminApp(
+      depsFor({ provisioner, existing: FEDERATED, updated }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(422);
+    expect(updated).toEqual([]);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("403 for a non-admin session member", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp({
+      ...depsFor({ provisioner }),
+      callerScopeResolver: async () => ({
+        kind: "scoped",
+        accountId: "acct-a",
+        agentIds: [AGENT_ID],
+      }),
+    });
+    const cookie = await sign(
+      {
+        isAdmin: false,
+        userId: "user-acct",
+        email: "owner@acct-a.example.com",
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      },
+      SESSION_SECRET,
+      "HS256",
+    );
+    const res = await patch(
+      app,
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(403);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("rejects a value that is not an RFC 1123 label (400)", async () => {
+    const app = createAdminApp(
+      depsFor({ provisioner: new RecordingProvisioner() }),
+    );
+    const cookie = await makeSessionCookie();
+    for (const bad of ["Bad_Name", "-lead", "a".repeat(64), ""]) {
+      const res = await patch(
+        app,
+        { podServiceAccountName: bad },
+        { Cookie: `admin_session=${cookie}` },
+      );
+      expect(res.status).toBe(400);
+    }
+  });
+
+  it("logs an audit line with agent, old, new and caller name but never the key", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp({
+      ...depsFor({
+        provisioner,
+        existing: { podServiceAccountName: "old-sa" },
+      }),
+      adminApiKeys: parseAdminApiKeys(`ops-key-name:${ADMIN_API_KEY}:*`),
+    });
+    const spy = spyOn(console, "info").mockImplementation(() => {});
+    try {
+      const res = await patch(
+        app,
+        { podServiceAccountName: "new-sa" },
+        { Authorization: `Bearer ${ADMIN_API_KEY}` },
+      );
+      expect(res.status).toBe(200);
+      const lines = spy.mock.calls.map((c) => String(c[0]));
+      const line = lines.find((l) => l.includes("podServiceAccountName"));
+      expect(line).toBeDefined();
+      expect(line).toContain(AGENT_ID);
+      expect(line).toContain("old-sa");
+      expect(line).toContain("new-sa");
+      expect(line).toContain("ops-key-name");
+      expect(lines.join("\n")).not.toContain(ADMIN_API_KEY);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  it("does not touch the provisioner when the field is absent", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(depsFor({ provisioner, enabled: false }));
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { repos: ["org/repo"] },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+});
+
 // ─── WIF-2.1: Anthropic credential guards under federation ───────────────────
 
 describe("admin API — Anthropic credential guards (WIF-2.1)", () => {

package/src/agents-api.ts

@@ -39,7 +39,10 @@ import {
   getSelfServeSpecialty,
   isAccountCreateErrorCode,
 } from "./account-agent-create.ts";
-import { reconcileAgentAfterAccountChange } from "./agent-account-assignment.ts";
+import {
+  reconcileAgentAfterAccountChange,
+  reconcileAgentAfterPodServiceAccountChange,
+} from "./agent-account-assignment.ts";
 import {
   type AgentAskDeps,
   type AskChatClient,
@@ -62,7 +65,10 @@ import type { AgentEnvService } from "./agent-envs.ts";
 import type { AgentGitHubInstallationsService } from "./agent-github-installations.ts";
 import type { AgentMemberService } from "./agent-members.ts";
 import type { AgentPluginService } from "./agent-plugins.ts";
-import type { AgentProvisioner } from "./agent-provisioner.ts";
+import {
+  type AgentProvisioner,
+  hasPerAgentIdentity,
+} from "./agent-provisioner.ts";
 import type { AgentTokenService } from "./agent-tokens.ts";
 import type { AgentToolService } from "./agent-tools.ts";
 import type { AgentService } from "./agents.ts";
@@ -94,8 +100,10 @@ import {
 import {
   ApiError,
   BadRequestError,
+  ConflictError,
   ForbiddenError,
   NotFoundError,
+  UnprocessableEntityError,
 } from "./errors.ts";
 import {
   AddAgentReposBodySchema,
@@ -287,6 +295,12 @@ export interface AdminDeps {
   >;
   /** WIF-2.1: Anthropic federation is enabled; defaults to false. */
   anthropicFederationEnabled?: boolean;
+  /**
+   * COS-49.1: per-agent pod ServiceAccount flag
+   * (SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED). Off (default) -> PATCH
+   * /agents/:id with podServiceAccountName returns 409.
+   */
+  podServiceAccountEnabled?: boolean;
   /**
    * Agent-to-agent ask (COS-31.1): flag + allowlist config, the AgentAsk
    * audit store and an injectable clock. Absent or flag off → the ask routes
@@ -397,6 +411,8 @@ const GetAgentResultSchema = z
     patchAuthorAllowlist: z.array(z.string()),
     restrictSlackToMembers: z.boolean(),
     typeName: z.string(),
+    /** COS-49.1: the pod ServiceAccount; null when unset. */
+    podServiceAccountName: z.string().nullable(),
     /** Owning account; null for unassigned agents (task-store maps null to its 'default' account). */
     accountId: z.string().nullable(),
     createdAt: z.string().datetime(),
@@ -604,7 +620,7 @@ const patchAgentRoute = createRoute({
   path: "/agents/{id}",
   summary: "Update an agent",
   description:
-    "Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, and/or `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.",
+    "Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows), and/or `podServiceAccountName` (platform admin only — 403 otherwise; `null` clears it; 409 unless SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED is on; 422 for agents with a per-agent federated identity; reconciles the workload so the pod is recreated under the new ServiceAccount). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.",
   request: {
     params: AgentIdParamSchema,
     body: {
@@ -619,6 +635,16 @@ const patchAgentRoute = createRoute({
     400: { description: "Bad request", ...jsonError },
     403: { description: "Forbidden", ...jsonError },
     404: { description: "Agent not found", ...jsonError },
+    409: {
+      description:
+        "podServiceAccountName supplied while the pod ServiceAccount flag is off",
+      ...jsonError,
+    },
+    422: {
+      description:
+        "podServiceAccountName supplied for an agent with a per-agent federated identity",
+      ...jsonError,
+    },
   },
 });
 
@@ -1657,6 +1683,39 @@ export function createAdminApp(deps: AdminDeps): OpenAPIHono<AdminAuthEnv> {
         throw new ForbiddenError("Admin access required to change accountId");
       }
     }
+    // COS-49.1: pod ServiceAccount — platform-admin only, flag-gated, and not
+    // for agents whose federated identity owns the ServiceAccount.
+    let previousPodServiceAccountName: string | null = null;
+    if (body.podServiceAccountName !== undefined) {
+      if (c.get("isAdmin") !== true) {
+        throw new ForbiddenError(
+          "Admin access required to change podServiceAccountName",
+        );
+      }
+      if (deps.podServiceAccountEnabled !== true) {
+        throw new ConflictError(
+          "podServiceAccountName cannot be changed: SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED is not enabled",
+        );
+      }
+      const current = await agentService.getDetail(agentId);
+      if (!current) {
+        throw new NotFoundError(`agent ${agentId} not found`);
+      }
+      if (
+        hasPerAgentIdentity({
+          ownerEmail: current.ownerEmail ?? null,
+          anthropicIdentityName: current.anthropicIdentityName ?? null,
+          anthropicServiceAccountId: current.anthropicServiceAccountId ?? null,
+          anthropicFederationRuleId: current.anthropicFederationRuleId ?? null,
+          k8sServiceAccountName: current.k8sServiceAccountName ?? null,
+        })
+      ) {
+        throw new UnprocessableEntityError(
+          "podServiceAccountName cannot be set on an agent with a per-agent federated identity (federation owns its ServiceAccount)",
+        );
+      }
+      previousPodServiceAccountName = current.podServiceAccountName ?? null;
+    }
     const collision =
       body.repos !== undefined ? describeRepoNameCollision(body.repos) : null;
     if (collision) {
@@ -1665,6 +1724,9 @@ export function createAdminApp(deps: AdminDeps): OpenAPIHono<AdminAuthEnv> {
     const agent = await agentService
       .updateSelfHosted(agentId, {
         selfHosted: body.selfHosted,
+        ...(body.podServiceAccountName !== undefined
+          ? { podServiceAccountName: body.podServiceAccountName }
+          : {}),
         ...(body.accountId !== undefined ? { accountId: body.accountId } : {}),
         ...(body.repos !== undefined ? { repos: body.repos } : {}),
         ...(body.reviewAuthorAllowlist !== undefined
@@ -1719,8 +1781,24 @@ export function createAdminApp(deps: AdminDeps): OpenAPIHono<AdminAuthEnv> {
       body.accountId !== undefined
         ? await reconcileAgentAfterAccountChange(provisioner, agent)
         : undefined;
+    let podSaWarning: string | undefined;
+    if (body.podServiceAccountName !== undefined) {
+      // Audit: ids and names only — never the caller's key.
+      console.info(
+        `[agents-api] podServiceAccountName changed: agent=${agentId} old=${previousPodServiceAccountName ?? "null"} new=${body.podServiceAccountName ?? "null"} caller=${c.get("caller")?.name ?? "anonymous"}`,
+      );
+      if (body.podServiceAccountName !== previousPodServiceAccountName) {
+        podSaWarning = await reconcileAgentAfterPodServiceAccountChange(
+          provisioner,
+          agent,
+          previousPodServiceAccountName,
+        );
+      }
+    }
     const warning =
-      [slackWarning, reconcileWarning].filter(Boolean).join("; ") || undefined;
+      [slackWarning, reconcileWarning, podSaWarning]
+        .filter(Boolean)
+        .join("; ") || undefined;
     return c.json(serializeAgent(agent, warning), 200);
   });
 
@@ -2739,6 +2817,7 @@ function serializeAgent(
     restrictSlackToMembers?: boolean;
     typeName: string;
     accountId?: string | null;
+    podServiceAccountName?: string | null;
     createdAt: Date;
     updatedAt: Date;
     missingRequiredEnv?: string[];
@@ -2768,6 +2847,7 @@ function serializeAgent(
     restrictSlackToMembers: agent.restrictSlackToMembers ?? false,
     typeName: agent.typeName,
     accountId: agent.accountId ?? null,
+    podServiceAccountName: agent.podServiceAccountName ?? null,
     createdAt: agent.createdAt.toISOString(),
     updatedAt: agent.updatedAt.toISOString(),
     missingRequiredEnv: agent.missingRequiredEnv ?? [],

package/src/agents.ts

@@ -87,6 +87,8 @@ export interface AgentSummary extends Partial<AgentAnthropicIdentity> {
 }
 
 export interface AgentDetail extends Partial<AgentAnthropicIdentity> {
+  /** COS-49.1 pod ServiceAccount; null when unset. */
+  podServiceAccountName?: string | null;
   id: string;
   name: string;
   slackId: string | null;
@@ -137,6 +139,8 @@ export interface AgentDetail extends Partial<AgentAnthropicIdentity> {
 }
 
 interface UpdateSelfHostedInput {
+  /** COS-49.1: pod ServiceAccount; null clears it. */
+  podServiceAccountName?: string | null;
   /** SSP-5.3: owning account; null clears it (unassigned/platform agent). */
   accountId?: string | null;
   /**
@@ -472,6 +476,9 @@ export class AgentService {
         ...(input.accountId !== undefined
           ? { accountId: input.accountId }
           : {}),
+        ...(input.podServiceAccountName !== undefined
+          ? { podServiceAccountName: input.podServiceAccountName }
+          : {}),
         ...(input.repos !== undefined ? { repos: input.repos } : {}),
         ...(input.reviewAuthorAllowlist !== undefined
           ? { reviewAuthorAllowlist: input.reviewAuthorAllowlist }

package/src/kubernetes-client.unit.test.ts

@@ -510,6 +510,28 @@ describe("RecordedKubernetesClient.patchDeployment()", () => {
     );
   });
 
+  it("strategic-merges serviceAccountName: a string sets, null clears (with the alias)", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: { "shipwright/agent-abc": makeDeployment("img:v1") },
+      secrets: {},
+    });
+    const patchSa = (podSpec: object) =>
+      rec.patchDeployment("shipwright", "agent-abc", {
+        spec: { template: { spec: podSpec } },
+      });
+    const podSpec = async () =>
+      (await rec.getDeployment("shipwright", "agent-abc")).spec.template.spec;
+
+    await patchSa({ serviceAccountName: "agent-sa" });
+    expect((await podSpec()).serviceAccountName).toBe("agent-sa");
+    // Untouched containers survive a pod-level-only patch.
+    expect((await podSpec()).containers[0]?.image).toBe("img:v1");
+
+    await patchSa({ serviceAccountName: null, serviceAccount: null });
+    expect((await podSpec()).serviceAccountName).toBeUndefined();
+    expect((await podSpec()).serviceAccount).toBeUndefined();
+  });
+
   it("throws NotFoundError when the deployment does not exist", async () => {
     const rec = new RecordedKubernetesClient({ deployments: {}, secrets: {} });
 

package/src/openapi-schemas.ts

@@ -94,6 +94,22 @@ export const PatchAgentBodySchema = z
       .nullable()
       .optional()
       .openapi({ example: "acct_123" }),
+    /**
+     * COS-49.1: the Kubernetes ServiceAccount the agent's pod runs as
+     * (RFC 1123 label). Platform admin only; `null` clears it. Rejected 409
+     * unless SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED is on, and 422
+     * for agents with a per-agent federated identity.
+     */
+    podServiceAccountName: z
+      .string()
+      .max(63)
+      .regex(
+        /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,
+        "must be an RFC 1123 label (lowercase alphanumerics and '-', start and end alphanumeric)",
+      )
+      .nullable()
+      .optional()
+      .openapi({ example: "agent-pod-sa" }),
     /**
      * ATE-1.1: trial expiry timestamp. Nullable so it can also be explicitly
      * cleared. trialExpiryWarnedAt is intentionally NOT part of this schema —

package/src/openapi-schemas.unit.test.ts

@@ -17,6 +17,7 @@ import {
   type AgentTool,
   AgentToolSchema,
   ErrorSchema,
+  PatchAgentBodySchema,
 } from "./openapi-schemas.ts";
 
 // ─── Fixtures ─────────────────────────────────────────────────────────────────
@@ -350,3 +351,33 @@ describe("OpenAPI route metadata", () => {
     expect(issues).toEqual([]);
   });
 });
+
+describe("PatchAgentBodySchema.podServiceAccountName (COS-49.1)", () => {
+  const parse = (v: unknown) =>
+    PatchAgentBodySchema.safeParse({ podServiceAccountName: v });
+
+  test("accepts RFC 1123 labels", () => {
+    for (const ok of ["a", "agent-sa", "sa1", "a".repeat(63)]) {
+      expect(parse(ok).success).toBe(true);
+    }
+  });
+
+  test("accepts null (clear) and omission", () => {
+    expect(parse(null).success).toBe(true);
+    expect(PatchAgentBodySchema.safeParse({}).success).toBe(true);
+  });
+
+  test("rejects non-labels and values over 63 characters", () => {
+    for (const bad of [
+      "",
+      "Upper",
+      "under_score",
+      "-lead",
+      "trail-",
+      "dot.ted",
+      "a".repeat(64),
+    ]) {
+      expect(parse(bad).success).toBe(false);
+    }
+  });
+});