Close I-004 (agent hard-delete cascades targets) coverage-gap finding

Operator decision answered as full soft-delete with optional forced
cascade — hard-delete is not reachable from any public surface. Prior
to this commit, DELETE /agents/{id} ran a plain `DELETE FROM agents`
whose schema-level `ON DELETE CASCADE` on deployment_targets.agent_id
silently wiped every target, orphaning certs and aborting in-flight
jobs. The finding closure reshapes the agent-removal contract around
soft retirement with explicit preflight counts, an opt-in cascade
gated by a mandatory reason, and unconditional protection for the
four reserved sentinel agents used by discovery sources.

Schema — migration 000015:
  migrations/000015_agent_retire.up.sql flips
  deployment_targets_agent_id_fkey from ON DELETE CASCADE to ON DELETE
  RESTRICT, so a stray `DELETE FROM agents` now errors at the DB
  boundary instead of quietly destroying targets. Both `agents` and
  `deployment_targets` grow a retired_at TIMESTAMPTZ + retired_reason
  TEXT pair (TEXT not VARCHAR so operator comments are never
  truncated), indexed via partial indexes WHERE retired_at IS NOT
  NULL. The migration is self-healing (ADD COLUMN IF NOT EXISTS, DROP
  CONSTRAINT IF EXISTS then ADD CONSTRAINT, CREATE INDEX IF NOT
  EXISTS) so repeated runs against partially-migrated databases
  converge. migrations/000015_agent_retire.down.sql restores CASCADE
  and drops the new columns for clean rollback. A dedicated
  repository-layer testcontainers test
  (internal/repository/postgres/migration_000015_test.go) asserts the
  before/after FK action, column presence, index presence, and
  round-trip idempotency under up→down→up.

Domain — sentinel guard + dependency counts:
  internal/domain/connector.go gains IsRetired() on Agent, the
  exported SentinelAgentIDs slice listing server-scanner,
  cloud-aws-sm, cloud-azure-kv, cloud-gcp-sm verbatim (matching the
  four reserved IDs documented in CLAUDE.md and created at startup in
  cmd/server/main.go), IsSentinelAgent(id string) predicate,
  AgentDependencyCounts{ActiveTargets, ActiveCertificates,
  PendingJobs} with a HasDependencies() method, and ActorTypeAgent /
  ActorTypeSystem enum values used by audit emission downstream.
  Coverage locked down by internal/domain/connector_test.go.

Service — 8-step ordered contract:
  internal/service/agent_retire.go:RetireAgent(ctx, id, actor,
  opts{Force, Reason}) enforces a fixed execution order:
  (1) sentinel guard — IsSentinelAgent(id) returns ErrAgentIsSentinel
      unconditionally; force=true does NOT bypass it.
  (2) fetch — ErrAgentNotFound on miss.
  (3) idempotency — if IsRetired() already, return
      AgentRetirementResult{AlreadyRetired: true} with no new audit
      event and no state change (safe to replay from flaky clients).
  (4) preflight counts — collectAgentDependencyCounts runs
      ActiveTargets, ActiveCertificates, PendingJobs sequentially
      (not in parallel; keeps the per-query timeout predictable and
      matches the repo's existing call-chain shape).
  (5) force-reason guard — opts.Force=true with empty Reason returns
      ErrForceReasonRequired (wired into the 400 status surface).
  (6) dependency guard — HasDependencies() with opts.Force=false
      returns BlockedByDependenciesError{Counts} (wired into the 409
      body with per-bucket counts).
  (7) mutation — single pinned retiredAt := time.Now(); agent
      retirement first, then cascade target retirement if opts.Force,
      all under the repo's single transaction so the two retired_at
      stamps match to the second.
  (8) best-effort audit — agent_retired always; agent_retirement_
      cascaded additionally on the force path. Actor is whatever the
      handler resolves from the request; actor type is mapped by
      resolveActorType (system/agent-prefix→Agent/else→User). Audit
      emission failures are logged via slog.Error but do not abort
      the retirement (matches the house convention used by every
      other scheduler-emitted event).

  BlockedByDependenciesError implements Error() as
  "active_targets=%d, active_certificates=%d, pending_jobs=%d" and
  Unwrap() → ErrBlockedByDependencies. The single struct satisfies
  errors.Is via Unwrap (used by scheduler-level tests) and errors.As
  via the concrete type (used by the handler to fish out Counts for
  the 409 body). ListRetiredAgents(page, perPage) adds a separate
  paginated accessor with page<1→1 and perPage<1→50 normalization so
  retired rows are queryable without polluting the default agent
  listing.

  Sentinel guard coverage is asymmetric by design: all four reserved
  IDs are protected, and force=true cannot override. Regression tests
  in internal/service/agent_retire_test.go assert each of the eight
  steps in order, plus sentinel bypass attempts and idempotency
  replay.

Handler + router — status-code surface:
  internal/api/handler/agents.go:RetireAgent exposes seven status
  codes on DELETE /agents/{id}:
    200 on a fresh retirement (body echoes AgentRetirementResult).
    204 on idempotent replay (AlreadyRetired=true; no new audit).
    400 on ErrForceReasonRequired.
    403 on ErrAgentIsSentinel.
    404 on ErrAgentNotFound.
    409 on BlockedByDependenciesError, with a custom body shape
        {error, counts{active_targets, active_certificates,
        pending_jobs}} that bypasses the default ErrorWithRequestID
        envelope so callers get the per-bucket numbers directly.
    500 on any other error.
  Heartbeat HandleHeartbeat returns 410 Gone when the agent is
  retired (ErrAgentRetired), signalling the agent to shut down.
  Query params `force=true` and `reason=<text>` drive the cascade
  path; both are forwarded as url.Values through the new MCP
  transport.

  internal/api/router/router.go registers GET /api/v1/agents/retired
  literal-path BEFORE /api/v1/agents/{id} — Go 1.22 ServeMux's
  literal-beats-pattern-var precedence routes "retired" to the
  paginated retired-agents listing instead of fetching a hypothetical
  agent named "retired".

Agent binary — clean shutdown on 410:
  cmd/agent/main.go gains the ErrAgentRetired sentinel, a
  retiredOnce sync.Once, and a retiredSignal chan struct{}. A
  markRetired(source, statusCode, body) helper closes the channel
  exactly once; the Run() select loop observes the close and returns
  ErrAgentRetired; main() matches via errors.Is(err, ErrAgentRetired)
  and exits cleanly instead of spinning in the heartbeat retry loop.
  The 410 Gone surface is therefore terminal for the agent process.

MCP transport:
  internal/mcp/client.go adds Client.DeleteWithQuery(path, query),
  a new additive transport method. Client.Delete is path-only; without
  this method the retire tool would silently drop `force` and `reason`,
  turning every cascade retire into a default soft-retire. The new
  method shares do()'s 204 normalization and 4xx/5xx error
  propagation so tool authors get one contract.
  internal/mcp/tools.go + internal/mcp/types.go expose the
  retire_agent tool with Force+Reason inputs wired through
  DeleteWithQuery.

CLI:
  cmd/cli/main.go + internal/cli/client.go add two CLI surfaces:
  `agents list --retired` (client-side strip of --retired then
  delegation to ListRetiredAgents, sharing --page/--per-page parsing
  with the default listing) and `agents retire <id> [--force --reason
  "…"]` (mirrors ErrForceReasonRequired — force without reason is
  rejected client-side before the request is sent). JSON + table
  output modes both honor the new columns.

Frontend:
  web/src/pages/AgentsPage.tsx surfaces retired/retire affordances.
  web/src/api/client.ts + web/src/api/types.ts expose the retire
  endpoint and the retired-listing. 4 new Vitest regression cases.

OpenAPI:
  api/openapi.yaml documents DELETE /agents/{id} with all seven
  status codes, 410 on heartbeat, and the 409 per-bucket body shape.

Regression coverage (six new test files, all green):
  internal/service/agent_retire_test.go           — 8-step contract + sentinel guards
  internal/api/handler/agent_retire_handler_test.go — 7-status-code surface + 410 heartbeat
  internal/mcp/retire_agent_test.go               — DeleteWithQuery wire-through
  internal/cli/agent_retire_test.go               — --retired listing + --force/--reason pairing
  internal/repository/postgres/migration_000015_test.go — FK flip + columns + indexes + up↔down
  internal/domain/connector_test.go               — IsRetired, IsSentinelAgent, SentinelAgentIDs, HasDependencies

Files:
  api/openapi.yaml                                — DELETE + 410 + 409 body shape
  cmd/agent/main.go                               — ErrAgentRetired, markRetired, retiredSignal
  cmd/cli/main.go                                 — handleAgents list/get/retire dispatch
  docs/architecture.md, docs/concepts.md,
    docs/testing-guide.md                         — retirement contract narrative
  internal/api/handler/agents.go                  — RetireAgent, status surface, 410 on heartbeat
  internal/api/handler/agent_handler_test.go      — extended coverage
  internal/api/handler/agent_retire_handler_test.go — new
  internal/api/router/router.go                   — /agents/retired before /agents/{id}
  internal/cli/agent_retire_test.go               — new
  internal/cli/client.go                          — ListRetiredAgents + RetireAgent
  internal/domain/connector.go                    — IsRetired, SentinelAgentIDs,
                                                    IsSentinelAgent, AgentDependencyCounts,
                                                    ActorTypeAgent/System
  internal/domain/connector_test.go               — new
  internal/integration/lifecycle_test.go          — retirement fixture
  internal/mcp/client.go                          — DeleteWithQuery additive transport
  internal/mcp/retire_agent_test.go               — new
  internal/mcp/tools.go, internal/mcp/types.go    — retire_agent tool + Force/Reason inputs
  internal/repository/interfaces.go               — AgentRepository retirement methods
  internal/repository/postgres/agent.go           — retire + cascade target retire + counts
  internal/repository/postgres/migration_000015_test.go — new
  internal/service/agent.go                       — wire into AgentService surface
  internal/service/agent_retire.go                — new 8-step contract
  internal/service/agent_retire_test.go           — new
  internal/service/deployment.go                  — skip retired agents
  internal/service/target.go                      — skip retired agents
  internal/service/testutil_test.go               — shared mocks extended
  migrations/000015_agent_retire.up.sql           — new
  migrations/000015_agent_retire.down.sql         — new
  web/src/api/client.ts, types.ts + tests         — retire endpoint wiring
  web/src/pages/AgentsPage.tsx                    — retire UI

web/src/api/client.test.ts

@@ -19,6 +19,8 @@ import {
   getAgents,
   getAgent,
   registerAgent,
+  retireAgent,
+  listRetiredAgents,
   getJobs,
   cancelJob,
   approveRenewal,
@@ -399,6 +401,113 @@ describe('API Client', () => {
     });
   });
 
+  // ─── Agent Retirement (I-004) ───────────────────────
+  //
+  // These tests pin the GUI's retirement contract against what the backend
+  // will add in Phase 2b: soft-retire via DELETE, force-cascade via
+  // ?force=true&reason=..., idempotent 204 on already-retired, 409 blocked
+  // payload with counts, and a GET /agents/retired listing surface.
+  //
+  // All compile-fail until client.ts exports retireAgent + listRetiredAgents
+  // — the shape of those exports is pinned here rather than assumed.
+  describe('Agent Retirement (I-004)', () => {
+    it('retireAgent sends DELETE without query when no force/reason', async () => {
+      mockFetch.mockReturnValueOnce(
+        mockJsonResponse({
+          retired_at: '2026-04-18T12:00:00Z',
+          already_retired: false,
+          cascade: false,
+        }),
+      );
+      await retireAgent('ag-1');
+      const [url, init] = mockFetch.mock.calls[0];
+      // Default soft-retire: bare path, no stray ? suffix.
+      expect(url).toBe('/api/v1/agents/ag-1');
+      expect(init.method).toBe('DELETE');
+    });
+
+    it('retireAgent propagates force+reason as URL query parameters', async () => {
+      mockFetch.mockReturnValueOnce(
+        mockJsonResponse({
+          retired_at: '2026-04-18T12:00:00Z',
+          already_retired: false,
+          cascade: true,
+          counts: { active_targets: 3, active_certificates: 7, pending_jobs: 2 },
+        }),
+      );
+      await retireAgent('ag-1', { force: true, reason: 'decommissioning rack 7' });
+      const [url, init] = mockFetch.mock.calls[0];
+      // URLSearchParams encodes space as "+"; "decommissioning rack 7" → "decommissioning+rack+7"
+      expect(url).toBe(
+        '/api/v1/agents/ag-1?force=true&reason=decommissioning+rack+7',
+      );
+      expect(init.method).toBe('DELETE');
+    });
+
+    it('retireAgent omits force=false even when reason is supplied', async () => {
+      // Client-side guard: the server's 400 ErrForceReasonRequired is the
+      // fallback; the GUI should never silently promote reason-without-force
+      // into a force call. Pins that reason-only still hits the soft path.
+      mockFetch.mockReturnValueOnce(
+        mockJsonResponse({
+          retired_at: '2026-04-18T12:00:00Z',
+          already_retired: false,
+          cascade: false,
+        }),
+      );
+      await retireAgent('ag-1', { reason: 'routine decommission' });
+      const [url] = mockFetch.mock.calls[0];
+      // force defaults to false → query carries reason only.
+      expect(url).toBe('/api/v1/agents/ag-1?reason=routine+decommission');
+    });
+
+    it('retireAgent surfaces the 409 dependency error message to the caller', async () => {
+      mockFetch.mockReturnValueOnce(
+        mockErrorResponse(409, {
+          message: 'agent has 3 active targets, 7 active certificates, 2 pending jobs',
+        }),
+      );
+      await expect(retireAgent('ag-1')).rejects.toThrow(
+        /active targets|active certificates|pending jobs/,
+      );
+    });
+
+    it('retireAgent treats 204 (already-retired) as success with empty body', async () => {
+      mockFetch.mockReturnValueOnce(
+        Promise.resolve({
+          ok: true,
+          status: 204,
+          json: () => Promise.reject(new Error('204 has no body')),
+          statusText: 'No Content',
+        } as Response),
+      );
+      // fetchJSON normalises 204 to {} — caller must not crash.
+      const result = await retireAgent('ag-1');
+      expect(result).toBeDefined();
+    });
+
+    it('listRetiredAgents sends GET /agents/retired with default pagination', async () => {
+      mockFetch.mockReturnValueOnce(
+        mockJsonResponse({ data: [], total: 0, page: 1, per_page: 50 }),
+      );
+      await listRetiredAgents();
+      const [url, init] = mockFetch.mock.calls[0];
+      expect(url).toBe('/api/v1/agents/retired?page=1&per_page=50');
+      // Default is GET — no explicit method means fetchJSON falls through.
+      expect(init.method ?? 'GET').toBe('GET');
+    });
+
+    it('listRetiredAgents forwards page/per_page overrides', async () => {
+      mockFetch.mockReturnValueOnce(
+        mockJsonResponse({ data: [], total: 0, page: 2, per_page: 100 }),
+      );
+      await listRetiredAgents({ page: '2', per_page: '100' });
+      const [url] = mockFetch.mock.calls[0];
+      expect(url).toContain('page=2');
+      expect(url).toContain('per_page=100');
+    });
+  });
+
   // ─── Jobs ───────────────────────────────────────────
 
   describe('Jobs', () => {