[mashkovd]

All nine required work items of unified-identity are closed as completed. The publication captured at 2026-10-18T09:49:09Z (run 39116819850) reports the epic as follows:

• healthy;
• completion: complete, required 9/9;
• blocking: [];
• drift 0, error 0.

Required items:

• feat(unified-identity): define canonical human, agent and service principals plus linked external identities mctl-api#373, #374, #434, #435
• feat(unified-identity): run self-hosted ZITADEL as the MCTL human identity provider mctl-gitops#1499, #1503
• feat(unified-identity): authorize tenants by canonical principal instead of GitHub login mctl-api#377: principal authorization, live since 2026-10-17 through mctl-gitops#1873.
• feat(unified-identity): finish canonical agent actor / on-behalf-of identity mctl-api#376: delegated agent identity.
  • mctl-agents#636 shipped in 1.76.0.
  • DevLoop 655 proved wi_ → we_ → aar_ → art_ → approve. The grant was consumed once, and decided_by_principal_id holds the canonical prn_.
  • The legacy relay has been off since mctl-gitops#1913.
  • Closed 2026-10-18; the evidence is on the issue.
• feat(unified-identity): add CIMD while keeping MCP client identity separate from ZITADEL user identity mctl-api#375: CIMD.
  • mctl-api#624 merged as abc14bbd (Claude APPROVED, agy PASS on the final head) and was released in 4.100.0. mctl-gitops 3a949776e bumped prod to it.
  • It ships dark (OAUTH_CIMD_ENABLED unset). The live check after rollout found:
    • discovery does not advertise CIMD;
    • an https:// URL client_id gets 400;
    • a DCR authorize still reaches the sign-in page;
    • an existing token still validates.

The manifest change is one line, lifecycle: active → completed, as in #154–#156, #160, #163 and #167. Locally, validate.py passes for all epics and the roadmap test suite passes (318 tests).

The publication carries one info diagnostic: HierarchyUnexpectedChild for mctl-api#629, which is a sub-issue of #91 but not in the manifest. It is a non-blocking follow-up and does not affect completion.

Follow-ups that do not block completion:

• feat(unified-identity): resolve surface binding and human-input respondents by principal mctl-api#629: surface binding and human-input by principal;
• fix(oauth): CIMD hardening follow-ups from #624 review (P3) mctl-api#684: CIMD hardening P3s, and the rule for turning it on;
• feat(unified-identity): offer tenant applications sign-in through a per-tenant ZITADEL organization mctl-gitops#1501 and #1504: optional tenant SSO and domain separation.

Refs #91

🤖 Generated with Claude Code

https://claude.ai/code/session_01VX8XFPopHp5vhk26xnhaUy

[claude]

Claude finished @mashkovd's task in 14s —— View job

---

Review of PR #198

• Read the diff
• Submit verdict

The diff is a one-line change in roadmap/epics/unified-identity.yaml, lifecycle: active → completed. It has no logic change and matches the earlier epic completions. I approved commit e40f1ca. I found no P1, P2 or P3 issues. This was a static review, so I ran no checks. CI runs them.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.8-flash-high · commit e40f1ca.

No significant issues found.

[claude]

One-line manifest lifecycle change active -> completed, matching prior epic completions; no logic change.