refactor: an autonomous run is a machine identity, not a mandate

Withdrawn: the offline_access mandate built an hour ago. An agent running on its
own account acts for itself. Nobody asked for the 06:00 run, so naming a person
as its principal was a fiction — and choosing which person was arbitrary, as the
first implementation showed by picking whichever test user was to hand.

It also cost more than it was worth. An offline token has no exp, dies only
after 30 days unused, is not rotated on use, and is revocable only by killing
that user's offline session: a permanent bearer credential standing in for a
consent nobody gave.

Now client_credentials, with the service account carrying read_only — the least
privilege the job needs. That is not a convention the workflow observes: the MCP
server maps the role to a consumer group at discovery, so tools/list under this
identity returns get-product and list-products and nothing else. create-product
is invisible rather than merely unused.

Nothing downstream changes. azp still names the agent, audiences are still
per-server, and policy still reads roles — a service account has roles like
anyone else.

The mandate client stays in the realm, unused, for the case where a person's own
authority genuinely is in play: Recouvrement's dunning, which is human-validated
already.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/agent-secrets.yaml

@@ -22,9 +22,3 @@ spec:
       remoteRef:
         key: keycloak/classic-models-realm
         property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT
-    # Redeems a mandate. Held by the workflow rather than by the adapter because
-    # it is the workflow that acts as the agent.
-    - secretKey: MANDATE_CLIENT_SECRET
-      remoteRef:
-        key: keycloak/classic-models-realm
-        property: KC_SECRET_MANDATE

deploy/flux-kustomization.yaml

@@ -37,7 +37,6 @@ spec:
       # The agents' Keycloak client secrets, so a workflow can exchange tokens
       # as the agent it represents. Created by agent-secrets.yaml beside this.
       EXTRA_ENV_SECRET: n8n-agent-secrets
-      EXTRA_ENV_SECRET_2: n8n-mandate-secrets
       EXTRA_CA_CONFIGMAP: sttlab-ca
       # "false" so a workflow can read $env.<AGENT>_CLIENT_SECRET. It means any
       # workflow on this instance can read any variable in the pod — acceptable

deploy/mandate-secrets.yaml

@@ -1,25 +0,0 @@
-# The standing authority the autonomous runs act under.
-#
-# A mandate is an `offline_access` refresh token, issued by the
-# classic-models-mandate client for the user who authorised the agent. It does
-# not expire, which is exactly why it is here and not in a workflow: it is
-# revoked by that user's session being revoked in Keycloak, and by nothing else.
-#
-# Two ExternalSecrets rather than one, because they answer to different owners:
-# the mandate is the agent estate's, the client secret that redeems it is the
-# realm's.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: n8n-mandate-secrets
-  namespace: n8n
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-n8n
-  target:
-    name: n8n-mandate-secrets
-  dataFrom:
-    - extract:
-        key: n8n/mandates