Harden production workflows and agent admission

server/monlet_server/schemas.py

@@ -23,18 +23,22 @@ SENSITIVE_LABEL_WORDS = (
 
 Status = Literal["ok", "warning", "critical", "unknown"]
 AgentStatus = Literal["alive", "stale", "dead"]
+AgentAdmissionState = Literal["pending", "accepted"]
 IncidentState = Literal["open", "resolved"]
 Severity = Literal["warning", "critical", "unknown"]
 OutboxState = Literal["pending", "sending", "sent", "retry", "failed", "discarded"]
 OutboxEventType = Literal["firing", "resolved"]
 ErrorCode = Literal[
     "unauthorized",
+    "forbidden",
+    "conflict",
     "not_found",
     "validation",
     "payload_too_large",
     "rate_limited",
     "internal",
     "not_ready",
+    "agent_blocked",
 ]
 
 
@@ -140,6 +144,9 @@ class Agent(BaseModel):
     agent_id: str
     hostname: str
     status: AgentStatus
+    admission_state: AgentAdmissionState
+    rotation_pending: bool = False
+    key_fingerprint: str | None = None
     last_seen_at: datetime
     features: AgentFeatures
     labels: dict[str, str] = Field(default_factory=dict)
@@ -186,12 +193,30 @@ class NotificationOutboxItem(BaseModel):
 
 class PageEnvelope(BaseModel):
     next_cursor: str | None = None
+    prev_cursor: str | None = None
 
 
 class AgentsPage(PageEnvelope):
     items: list[Agent]
 
 
+class AgentBlacklistItem(BaseModel):
+    id: str
+    key_fingerprint: str
+    agent_id: str
+    hostname: str
+    created_at: datetime
+    last_seen_at: datetime
+
+
+class AgentBlacklistPage(PageEnvelope):
+    items: list[AgentBlacklistItem]
+
+
+class ActionCountResponse(BaseModel):
+    count: int = Field(ge=0)
+
+
 class ChecksPage(PageEnvelope):
     items: list[CheckState]
 
@@ -212,3 +237,14 @@ class UUIDStr(BaseModel):
     """Helper to validate generated UUIDs."""
 
     value: UUID
+
+
+class SystemSummaryResponse(BaseModel):
+    agents_online: int
+    agents_offline: int
+    checks_ok: int
+    checks_warning: int
+    checks_critical: int
+    checks_unknown: int
+    open_incidents: int
+    generated_at: datetime