feat(scim): provision Entra agent identities and directory groups

[joshua-berri]

TLDR

Problem this solves:

• SCIM agent provisioning needs an integrated gateway workflow

How it solves it:

• Configures trusted provisioning sources in existing SCIM settings
• Provisions supported agent-user identities and human subjects
• Synchronizes groups into existing access-group controls
• Protects source ownership and applies deactivation immediately

Depends on #43229, which depends on #43149. Reconciles existing implementation and review fixes; no additional feature scope

Diff sizes are being refreshed after the reviewed repairs

User Flow

Before: the complete workflow below is unavailable at this PR's parent

1. Open SCIM settings and configure a trusted Entra provisioning source
2. Provision supported identities and mixed groups from Entra
3. Open Agents and inspect the provisioned agent identity
4. Map directory groups to access groups and exercise allowed/denied tools
5. Deactivate the identity in Entra and verify subsequent requests fail

After: this PR provides the workflow through the existing gateway surfaces

1. Open SCIM settings and configure a trusted Entra provisioning source
2. Provision supported identities and mixed groups from Entra
3. Open Agents and inspect the provisioned agent identity
4. Map directory groups to access groups and exercise allowed/denied tools
5. Deactivate the identity in Entra and verify subsequent requests fail

Relevant issues

Original complete implementation: #43149

Affected release

Linear ticket

Pre-Submission checklist

• Existing implementation and review fixes are preserved
• Meaningful tests remain with their owning behavior
• Devin verification at the reconciled head is complete
• Required CI and completed Codecov pass
• Greptile, Veria and Bugbot reviews have no actionable findings
• User has accepted the hosted UI workflow

Screenshots / Proof of Fix

Live SCIM checks used a source provisioning credential and a separate legacy /scim/* credential against a real source-owned team

Before, at 904e677, POST /scim/v2/Users with the directory team in groups returned 201 and added the new user to that roster. PUT and PATCH also returned 200 and changed source-owned membership

After the focused ownership guard, the same POST, PUT and PATCH requests return 403 before user creation or roster mutation. Ordinary-team creation and membership updates still return 201/200. The guard checks changed team IDs through the existing authoritative, bounded ownership lookup; unchanged memberships and trusted internal synchronization are preserved

Eight guard cases passed. Four endpoint regressions fail behaviorally on the parent by reaching the forbidden write. A final typing adjustment normalizes the existing structured team input to its ID before validation; its focused verification is pending

Previous-tip Codecov covered 900/900 reported changed executable lines. Current-tip CI, coverage and reviewer reassessment remain pending

Current scoped repair at 7a3b7c1: four membership-guard call sites use immutable empty defaults; 48 focused tests and the full canonical lint/type gates pass. Current-tip CI, coverage and bot reviews are pending; additional live checks are running in parallel.

Type

New Feature

• Current CI is blocked by unrelated Google Interactions OpenAPI drift; upstream fix: test(interactions): pin and refresh OpenAPI compliance contract #43532. No Interactions files changed in this PR.

Caveats

• Part of the four-PR identity, budgets, SCIM and delegated-team stack; do not release the complete feature without fix(agents): preserve delegated team authorization context #43459
• Current-tip verification and reviews remain pending; fresh Bugbot review is waived due to team quota
• Optional selector cleanup is excluded and saved as an unpublished follow-up
• SCIM provisions supported agent-user identities; application/service-principal onboarding remains explicit
• Accepted shared-directory limitation: trusted provisioning tokens can infer username/email existence from HTTP 409 conflicts. Cross-source reads, writes and adoption remain blocked; sources are not mutually private tenants. Collisions fail clearly: "This local user already exists; automatic directory adoption is not permitted"

Final Attestation

• Current-tip CI, coverage and review gates are complete

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[joshua-berri]

@greptileai Please review 82e6d85: the split preserves identity boundaries, isolates feature dependencies, and adds regression coverage for confirmed authorization gaps.

[joshua-berri]

bugbot run

Please review 82e6d85, including authorization boundaries, schema compatibility, failure handling, and regression tests for this split PR.

[joshua-berri]

@greptileai Please review 82e6d85: the split preserves identity boundaries, isolates feature dependencies, and adds regression coverage for confirmed authorization gaps.

[joshua-berri]

bugbot run

Please review 82e6d85, including authorization boundaries, schema compatibility, failure handling, and regression tests for this split PR.

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Adds SCIM provisioning for agent identities and directory groups.

No new merge-blocking issue was identified in the changes since the previous review

Summary

The PR adds trusted SCIM provisioning sources, directory-owned identities and groups, ownership protections, and directory-based agent admission. The changes since the previous review replace four empty list defaults at membership-guard call sites with empty tuples

_{Reviews (15) · Last reviewed commit: "fix(scim): use immutable empty membershi..."}

[cursor]

Stale Bugbot comment from a previous run.

[joshua-berri]

@greptileai Please review 5a701dd: atomic human ownership, legacy-token isolation, GUID normalization, and native Entra verification. Final independent verification is quota-blocked.

[joshua-berri]

bugbot run

Please review 5a701dd: source boundaries, atomic local-account reservation, immutable identity correspondence, and GUID normalization have fresh regression and live evidence.

[cursor]

Stale Bugbot comment from a previous run.

[joshua-berri]

Rejecting every scoped admin credential now has nine regression cases. @greptileai and @cursor review please recheck 472514e, including the withdrawn database-read finding

[joshua-berri]

@greptileai @veria-ai Please review da71c5a. This reconciles the approved three-PR stack and prior fixes. Verify this complete scope against its immediate parent.

[joshua-berri]

@greptileai @veria-ai Please review 9a917b5: legacy user routes now protect source-owned teams. Live attack blocked, ordinary controls pass; privacy limitation awaits adjudication.

[joshua-berri]

@greptileai @veria-ai Please review b265697: test-only PT012 repair, four cases pass; ownership enforcement unchanged. Conflict-response privacy limitation still awaits adjudication.

[joshua-berri]

@greptileai @veria-ai Please review 7a3b7c1: immutable membership defaults fix the lint overage. All canonical gates pass; accepted privacy limitation is documented.