Agent Lifecycle
The Agent Lifecycle dashboard (/agents/lifecycle) tracks agents through a persisted lifecycle state machine and exposes promotion gates, degraded agents, stale candidates, and retirement actions.
State machine
registering -> observing -> active -> degraded -> deprecated -> retired
Every manual or automated transition is stored with actor, reason, timestamp, telemetry context, and audit metadata.
Default gates
Agents must pass the default promotion gates before moving from observing to active:
| Gate | Default |
|---|---|
| Minimum sessions | 10 |
| Minimum quality score | 0.7 |
| Unresolved critical alerts | 0 |
| Assigned policy | Required |
| Assigned protection profile | Required |
| Valid attestation | Required |
| SBOM present | Required |
| Owner identified | Required |
Gate thresholds and checklist requirements are configurable per tenant.
Dashboard queues
| Queue | Meaning |
|---|---|
| State funnel | Count of agents in each lifecycle state. |
| Pending promotion | Observing agents that meet configured gates and await operator approval. |
| Degraded agents | Agents flagged for quality, alert, compliance, or operator concerns. |
| Stale candidates | Agents with no sessions for the configured staleness window, defaulting to 30 days. |
Retirement is never automatic from the dashboard queue. Stale agents become deprecated candidates first, and a destructive retirement requires explicit operator approval.
Legacy endpoint compatibility
The existing observe and retire dashboard API routes remain available. When tenant context is present, those routes now write durable lifecycle transitions instead of returning synthetic local records.