[Benoît Cortier (CBenoit)]

The pending-enrollment poll stopped every identity runner and its agent channel streams whenever the stored-identity check returned any error, and logged nothing. An I/O error that only kept the check from running, rather than a stored identity failing it, therefore restarted all identity processing, for example in the middle of a renewal, which can reorder its confirm, new channel authentication and old stream close.

The check now reports an authority directory or identity.json as untrusted only when it fails the check itself or denies the agent access; any other I/O error stays an ordinary error. The poll stops every identity only for an untrusted stored identity and otherwise retries at the next poll, logging the error in both cases. The check still runs without the state lock, since it changes nothing and every state change repeats it under the lock.

When the tests job fails, CI now uploads the Agent Identity conformance directories the suite keeps, so that a failure seen once leaves its agent data directories and logs.

Issue: DGW-478

🤖 Generated with Claude Code

[Benoît Cortier (CBenoit)]

Lines changed

Area	Added	Removed
Production code (private_file.rs, identity/mod.rs outside tests)	66	15
Tests	123	16
Other (CI workflow)	29	0

Untested properties

• devolutions-agent/src/identity/mod.rs, pending poll: both outcomes of a failed check, a stop for an untrusted stored identity and a retry for any other error, are logged with the error. No test captures service logs.
• .github/workflows/ci.yml, tests job: the collect and upload steps run only after a failure, so no run has exercised them. They look for agent-identity-integration* under target, the temporary directory and ProgramData, so they keep working after the conformance work directory moves out of target (refactor(agent): keep private files with private-fs #2154). The collection script was dry-run locally on a fake layout of both shapes.

Decision: no state lock around the poll's check

crates/agent-identity/INTENT.md ("Local state") requires the lock for every state change. The check changes nothing, read_identity and list_identities already run it unlocked, and every state change repeats it under the lock (Store::lock). Writes are atomic renames, so an unlocked check sees the old or the new identity.json, or an I/O error, which the poll now retries. Taking the lock on every poll would make the poll wait behind renewals (up to 30 s on Windows), and on Linux and macOS state_lock::acquire also provisions the identity directories each time.

Verification

• New poll test fails on master on Windows and Linux (the poll returns Untrusted while identity/authorities is unlistable) and passes with the fix.
• cargo test -p agent-identity -p devolutions-agent passes on Windows and Linux (WSL). On Windows, two psu_agent process tests failed once under load in the full run and passed on rerun; this change does not touch them.
• cargo clippy -p agent-identity -p devolutions-agent --all-targets -- -D warnings is clean on Windows and Linux.

Note

LLM-assisted content (no human feedback).