feat(registry): the agent register — every agent that has acted

[ExposureGuard]

Independent of #73–#76; branched from main. This is the spine of the assurance model — the artifact an auditor, a customer or a regulator asks for: "show me your register of AI systems."

The state it fixes

agents has been written on every session creation since migration 001 — Gate.register_agent, reached from POST /v1/sessions (api.py:930) and the delegation path — and nothing has ever read it. No list method, no route, no dashboard page, no CLI, no export. The register already existed as state; this is the surface.

What's in it

haldir_registry.py — five grouped queries over one tenant, no N+1, no Flask. Derived from activity as well as registration: an agent that acted but was never explicitly registered is still listed. A register that silently omits agents reads as complete and isn't, which is worse than none.

Per agent: registered, default_scopes, max_spend, first_seen/last_seen, sessions (total/active/revoked), spend, activity (actions, cost, flagged), approvals, and delegation in both directions — delegates_to and spawned_by, because "which of my agents can spawn others" is what the tree exists to answer.

Two spend figures, deliberately. session_spend_usd is what the Gate metered against caps; audited_cost_usd is what the append-only log recorded per action. A payment moves both, a tool call that only logs cost moves the second. Reporting one as "spend" would quietly pick a side.

GET /v1/agents and GET /v1/agents/<id> — tenant-scoped, admin:read. A miss returns the same 404 whether the agent belongs to another tenant or to nobody, so the route can't be used as an existence oracle.

The dashboard gains an Agents page (summary stats + table). The contract test parses the real dashboard.js template against a real payload — same guarantee as #75's pages. Note: #75 introduces tests/test_dashboard_contract.py with the same helpers and three other pages; whichever lands second should keep both sets — they're additive.

haldir agents [--agent ID] [--json] — the register as a terminal table.

The evidence pack gains an "Agent register" section in both rendered forms. This is the form an auditor receives, so it is signed like everything else — with the recency fields (last_seen, last_action_at, sessions.active) excluded from the digest, exactly as access_control.last_used is. A session TTL expires with no write; without the exclusion, an auditor re-verifying an archived pack reads that drift as tampering, which is the failure the digest exists to prevent. The register's substance stays in the digest, and the test asserts both directions — recency changes leave it fixed, an action-count change moves it.

Verification

• 1106 tests pass, flake8 clean, mypy clean over 30 files (the new module is in scope)
• Wheel built and inspected — haldir_registry.py ships
• Checked both directions on the digest property (fails if the normalization is removed)
• openapi.json regenerated for the two routes; /docs lists them

What this unlocks

The register is what makes the rest of the assurance model sellable: POST /v1/compliance/schedules and the evidence pack already exist, and this gives them the section that answers the actual buyer question. The natural next two pieces are framework coverage (ISO 42001 and EU AI Act Art. 12/26 mappings alongside SOC 2) and an opt-in capability card for an agent, so a register entry can also be a discovery entry — owner-published, capability-only.

🤖 Generated with Claude Code