chore(devops): #4665 identity-binding slice (deferred)

[aegis-gh-agent]

Context

This is the deferred slice of #4665 (ADR-0030 Phase 2 — Per-agent App identities). It depends on §A: Ema registering 3 new GitHub Apps on github.com and installing them on OneStepAt4time/aegis. §A is currently blocked — last activity on §A was 2026-06-11 08:25 CEST (Ema's PM heartbeat noting the gate still open).

Scope (deferred until §A clears)

§A — GitHub App registration (human-only, blocks all)

• Ema registers 3 new GitHub Apps: aegis-hermes, aegis-argus, aegis-hephaestus
• Each App installed on OneStepAt4time/aegis repo
• Ema sends Hermes (via 1Password share only — NOT channel-paste per Themis's secure-transfer rule) the 3 PEMs + 3 App IDs + 3 Installation IDs

§B — PEM storage + permissions (Hermes does this when PEMs land)

• Drop PEMs at ~/.openclaw/workspace/infra/github-apps/aegis-{hermes,argus,hephaestus}.pem mode 600
• Verify parent dir is mode 700
• Confirm scripts reference the correct PEM via PEM_FILE var (already staged in get-installation-token-{hermes,argus,hephaestus}.sh)

§D — Attribution confirm (Hermes, after §B)

• For each of 3 Apps: smoke-test TOKEN=$(./get-installation-token-{hermes,argus,hephaestus}.sh) && GH_TOKEN=$TOKEN gh api user — verify the response shows the correct App identity
• Confirm no cross-attribution (e.g., hermes script returns hermes identity, not argus)

§E — Rotation + cron (Hermes, after §B+§D)

• 90d PEM rotation cron (PEMs are 75d old for legacy aegis-gh-agent.pem; new PEMs need their own cadence)
• Token TTL behavior validation (verify 1h TTL, never persisted, stdout-only)
• Update manage-aegis-apps.sh if needed for the new identities

Themis's deferred items (PEM-dependent, queued for next Themis window)

• ⏸️ Token TTL behavior validation end-to-end
• ⏸️ Concurrent mint safety under rate limit

Acceptance criteria

• Ema registered 3 GitHub Apps and installed on OneStepAt4time/aegis
• Ema transferred 3 PEMs + 3 App IDs + 3 Installation IDs to Hermes via 1P share (NOT channel-paste)
• 3 PEMs on disk at expected paths, mode 600, parent dir mode 700
• 3 scripts (get-installation-token-{hermes,argus,hephaestus}.sh) have APP_ID + INSTALLATION_ID filled in
• Per-agent identity confirmed via gh api user smoke test
• 90d rotation cron set up
• Themis's deferred items (TTL behavior, concurrent mint) signed off
• Branch protection on develop updated if reviewer App pattern from ci(devops): fix bot-can't-self-approve friction in PR approval flow #4725 path (a) is the chosen approach

Sprint placement

Post-#4683. DEFERRED — blocks on Ema's §A. Sister-issue to the ship-now slice (#4731).

References

• Parent: [P1][spec] Per-agent App identities (ADR-0030 Phase 2) — Friday shipping target #4665 (ADR-0030 Phase 2 — Per-agent App identities)
• Sister-issue: chore(devops): #4665 ship-now slice — per-agent scripts + docs (no PEMs required) #4731 (chore(devops): #4665 ship-now slice)
• Trigger msg: Discord #aegis-devs 1516019096691540069 (Athena flagged timing)
• 24h window: Boss's directive at msg 1515992273509155049, expires 12:12 Rome
• Themis's split: msg 1515974350552170638 (script-only review LGTM)