Module m0017_ambient_login_grandfather 

Grandfather the layer-3 use_ambient_login opt-in for pre-existing agents (spec §2.4 of SPEC_ACCOUNT_DELETE_DEAUTH_LAYERS_2_4_2026_07_14.md).

The spawn gate (identity/resolver/inject.rs) FAILS a spawn when an oauth-class provider the agent is supposed to have credentials for has no resolvable account. When this migration was written, an explicit use_ambient_login = 1 exempted the agent; that opt-out has since been retired (PLAN_LOGIN_SINGLE_PATH_CONSOLIDATION_2026_07_20.md §7), so the flag set here is now only logged, never gates. At the time, existing agents that relied on the (previously silent) ambient fallback must not all break on upgrade:

• agents with NO oauth-class db_agent_identity_links rows at migration time were de-facto ambient users for their CLI login → use_ambient_login = 1. Api-key-class links (e.g. a github PAT) do NOT count: they are never spawn-gated, so an agent whose only link is a PAT was still relying on the ambient CLI login and must be grandfathered, not broken (spec §2.4’s rationale — “grandfather de-facto ambient users” — keyed on the spawn-relevant provider class);
• agents WITH an oauth-class link opted into managed CLI accounts → 0 (honest failure is the correct new behavior for them).

Channel-scoped: each pre-existing channel’s db_agent_definitions / db_agents rows get the pass exactly once (fresh channels have no agent rows, so re-running on a new channel is a no-op — it can never flip an agent created after the upgrade). The live links table is the SHARED store’s; the channel store’s legacy copy is not consulted. Cross-channel registry records are handled by the Global-scoped m0018_ambient_login_registry.

Structs

M0017AmbientLoginGrandfather

Functions

oauth_linked_agent_ids 🔒

Agent ids whose links include at least one oauth-class provider — the only class the layer-3 spawn gate blocks on. Shared by m0017 (channel rows) and m0018 (registry records) so the two passes can never disagree on the rule.