fix(control-plane): credential session unblock + project namespace cleanup + CLI credential verbs (#1181)

## Summary

- **fix(control-plane):** Remove `ensureCredentialRoleBindings` from
`kube_reconciler.go` — this was creating K8s `RoleBinding` objects
referencing a non-existent `credential:token-reader` ClusterRole,
blocking session provisioning. The runner authenticates via `BOT_TOKEN`
(control-plane JWT injected as a secret), not K8s SA token, so the
binding was vestigial and served no purpose.
- **fix(control-plane):** `project_reconciler.go` `EventDeleted` now
calls `DeprovisionNamespace` instead of logging "namespace retained for
safety" (was a deliberate no-op that was never wired up).
- **feat(cli):** Wire `credentials` into generic `acpctl
get/delete/describe` verbs (was returning "unknown resource type").
- **feat(cli):** Add `kind: Credential` support to `acpctl apply`.
- **feat(cli):** Add `-o json` to `acpctl agent start`.
- **feat(cli):** Add `demo-github.sh` — end-to-end GitHub credential
demo script alongside `demo-kind.sh`.

## Test plan

- [ ] Start a session with a credential bound to an agent — should no
longer fail with `clusterroles.rbac.authorization.k8s.io
"credential:token-reader" not found`
- [ ] Delete a project — namespace should be deprovisioned (previously
retained indefinitely)
- [ ] `acpctl get credentials` / `acpctl describe credential <id>` /
`acpctl delete credential <id>` work as generic verbs
- [ ] `acpctl apply` with a `kind: Credential` YAML creates/patches the
credential
- [ ] `acpctl agent start <agent> -o json` returns JSON session object
- [ ] `./components/ambient-cli/demo-github.sh` runs end-to-end with a
GitHub PAT

🤖 Generated with [Claude Code](https://claude.ai/code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
  * Added JSON output format (`--output/-o`) for agent start command
* Added credential management: create, list, view, and delete
credentials via CLI
  * Included demo script for GitHub credential workflow

* **Improvements**
  * Projects now automatically clean up their namespaces upon deletion

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ambient Code Bot <bot@ambient-code.local>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

components/ambient-cli/cmd/acpctl/agent/cmd.go

@@ -349,8 +349,9 @@ var deleteCmd = &cobra.Command{
 }
 
 var agentStartArgs struct {
-	projectID string
-	prompt    string
+	projectID    string
+	prompt       string
+	outputFormat string
 }
 
 var agentStartCmd = &cobra.Command{
@@ -389,6 +390,13 @@ var agentStartCmd = &cobra.Command{
 			return fmt.Errorf("start agent: %w", err)
 		}
 
+		if agentStartArgs.outputFormat == "json" {
+			printer := output.NewPrinter(output.FormatJSON, cmd.OutOrStdout())
+			if resp.Session != nil {
+				return printer.PrintJSON(resp.Session)
+			}
+			return printer.PrintJSON(resp)
+		}
 		if resp.Session != nil {
 			fmt.Fprintf(cmd.OutOrStdout(), "session/%s started (phase: %s)\n", resp.Session.ID, resp.Session.Phase)
 		} else {
@@ -533,6 +541,7 @@ func init() {
 
 	agentStartCmd.Flags().StringVar(&agentStartArgs.projectID, "project-id", "", "Project ID (defaults to configured project)")
 	agentStartCmd.Flags().StringVar(&agentStartArgs.prompt, "prompt", "", "Task prompt for this run")
+	agentStartCmd.Flags().StringVarP(&agentStartArgs.outputFormat, "output", "o", "", "Output format: json")
 
 	ignitionCmd.Flags().StringVar(&ignitionArgs.projectID, "project-id", "", "Project ID (defaults to configured project)")
 

components/ambient-cli/cmd/acpctl/apply/cmd.go

@@ -22,13 +22,13 @@ import (
 
 var Cmd = &cobra.Command{
 	Use:   "apply",
-	Short: "Apply declarative Project and Agent manifests",
-	Long: `Apply Projects and Agents from YAML files or a Kustomize directory.
+	Short: "Apply declarative Project, Agent, and Credential manifests",
+	Long: `Apply Projects, Agents, and Credentials from YAML files or a Kustomize directory.
 
 Mirrors kubectl apply semantics: resources are created if they do not exist,
 or patched if they do. Output reports created / configured / unchanged per resource.
 
-Supported kinds: Project, Agent
+Supported kinds: Project, Agent, Credential
 
 File format (one or more documents separated by ---):
 
@@ -64,6 +64,16 @@ Examples:
   acpctl apply -k .ambient/teams/overlays/dev/
   acpctl apply -k .ambient/teams/overlays/prod/ --dry-run
   cat lead.yaml | acpctl apply -f -
+
+Credential example:
+
+  kind: Credential
+  name: my-gitlab-pat
+  provider: gitlab
+  token: $GITLAB_PAT
+  url: https://gitlab.myco.com
+  labels:
+    team: platform
 `,
 	RunE: run,
 }
@@ -93,6 +103,10 @@ type resource struct {
 	Labels      map[string]string `yaml:"labels"`
 	Annotations map[string]string `yaml:"annotations"`
 	Inbox       []inboxSeed       `yaml:"inbox"`
+	Provider    string            `yaml:"provider"`
+	Token       string            `yaml:"token"`
+	URL         string            `yaml:"url"`
+	Email       string            `yaml:"email"`
 }
 
 type inboxSeed struct {
@@ -161,6 +175,8 @@ func run(cmd *cobra.Command, _ []string) error {
 			result, err = applyProject(ctx, client, doc)
 		case "agent":
 			result, err = applyAgent(ctx, client, doc, projectName, factory)
+		case "credential":
+			result, err = applyCredential(ctx, client, doc)
 		default:
 			fmt.Fprintf(cmd.ErrOrStderr(), "warning: unknown kind %q — skipping\n", doc.Kind)
 			continue
@@ -226,6 +242,82 @@ func applyProject(ctx context.Context, client *sdkclient.Client, doc resource) (
 	return applyResult{Kind: "Project", Name: doc.Name, Status: "configured"}, nil
 }
 
+func applyCredential(ctx context.Context, client *sdkclient.Client, doc resource) (applyResult, error) {
+	existing, err := client.Credentials().Get(ctx, doc.Name)
+	if err != nil {
+		token := os.ExpandEnv(doc.Token)
+		builder := sdktypes.NewCredentialBuilder().
+			Name(doc.Name).
+			Provider(doc.Provider)
+		if token != "" {
+			builder = builder.Token(token)
+		}
+		if doc.Description != "" {
+			builder = builder.Description(doc.Description)
+		}
+		if doc.URL != "" {
+			builder = builder.Url(doc.URL)
+		}
+		if doc.Email != "" {
+			builder = builder.Email(doc.Email)
+		}
+		if len(doc.Labels) > 0 {
+			builder = builder.Labels(marshalStringMap(doc.Labels))
+		}
+		if len(doc.Annotations) > 0 {
+			builder = builder.Annotations(marshalStringMap(doc.Annotations))
+		}
+		cred, buildErr := builder.Build()
+		if buildErr != nil {
+			return applyResult{}, buildErr
+		}
+		if _, createErr := client.Credentials().Create(ctx, cred); createErr != nil {
+			return applyResult{}, createErr
+		}
+		return applyResult{Kind: "Credential", Name: doc.Name, Status: "created"}, nil
+	}
+
+	patch, changed := buildCredentialPatch(existing, doc)
+	if !changed {
+		return applyResult{Kind: "Credential", Name: doc.Name, Status: "unchanged"}, nil
+	}
+	if _, err = client.Credentials().Update(ctx, existing.ID, patch); err != nil {
+		return applyResult{}, err
+	}
+	return applyResult{Kind: "Credential", Name: doc.Name, Status: "configured"}, nil
+}
+
+func buildCredentialPatch(existing *sdktypes.Credential, doc resource) (map[string]any, bool) {
+	changed := false
+	patch := sdktypes.NewCredentialPatchBuilder()
+	if doc.Description != "" && doc.Description != existing.Description {
+		patch = patch.Description(doc.Description)
+		changed = true
+	}
+	if doc.URL != "" {
+		patch = patch.Url(doc.URL)
+		changed = true
+	}
+	if doc.Email != "" {
+		patch = patch.Email(doc.Email)
+		changed = true
+	}
+	token := os.ExpandEnv(doc.Token)
+	if token != "" {
+		patch = patch.Token(token)
+		changed = true
+	}
+	if len(doc.Labels) > 0 {
+		patch = patch.Labels(marshalStringMap(doc.Labels))
+		changed = true
+	}
+	if len(doc.Annotations) > 0 {
+		patch = patch.Annotations(marshalStringMap(doc.Annotations))
+		changed = true
+	}
+	return patch.Build(), changed
+}
+
 func marshalStringMap(m map[string]string) string {
 	if len(m) == 0 {
 		return ""

components/ambient-cli/cmd/acpctl/delete/cmd.go

@@ -26,7 +26,8 @@ Valid resource types:
   session           (aliases: sess)
   agent
   role
-  role-binding      (aliases: rolebinding, rb)`,
+  role-binding      (aliases: rolebinding, rb)
+  credential        (aliases: cred)`,
 	Args: cobra.ExactArgs(2),
 	RunE: run,
 }
@@ -107,7 +108,14 @@ func run(cmd *cobra.Command, cmdArgs []string) error {
 		fmt.Fprintf(cmd.OutOrStdout(), "role-binding/%s deleted\n", name)
 		return nil
 
+	case "credential", "credentials", "cred", "creds":
+		if err := client.Credentials().Delete(ctx, name); err != nil {
+			return fmt.Errorf("delete credential %q: %w", name, err)
+		}
+		fmt.Fprintf(cmd.OutOrStdout(), "credential/%s deleted\n", name)
+		return nil
+
 	default:
-		return fmt.Errorf("unknown or non-deletable resource type: %s\nDeletable types: project, project-settings, session, agent, role, role-binding", cmdArgs[0])
+		return fmt.Errorf("unknown or non-deletable resource type: %s\nDeletable types: project, project-settings, session, agent, role, role-binding, credential", cmdArgs[0])
 	}
 }

components/ambient-cli/cmd/acpctl/describe/cmd.go

@@ -24,7 +24,8 @@ Valid resource types:
   user              (aliases: usr)
   agent             (aliases: agents)
   role
-  role-binding      (aliases: rb)`,
+  role-binding      (aliases: rb)
+  credential        (aliases: cred)`,
 	Args: cobra.ExactArgs(2),
 	RunE: run,
 }
@@ -98,7 +99,14 @@ func run(cmd *cobra.Command, cmdArgs []string) error {
 		}
 		return printer.PrintJSON(rb)
 
+	case "credential", "credentials", "cred", "creds":
+		cred, err := client.Credentials().Get(ctx, name)
+		if err != nil {
+			return fmt.Errorf("describe credential %q: %w", name, err)
+		}
+		return printer.PrintJSON(cred)
+
 	default:
-		return fmt.Errorf("unknown resource type: %s\nValid types: session, project, project-settings, user, agent, role, role-binding", cmdArgs[0])
+		return fmt.Errorf("unknown resource type: %s\nValid types: session, project, project-settings, user, agent, role, role-binding, credential", cmdArgs[0])
 	}
 }

components/ambient-cli/cmd/acpctl/get/cmd.go

@@ -39,6 +39,7 @@ Valid resource types:
   agents              (aliases: agent)
   roles               (aliases: role)
   role-bindings       (aliases: role-binding, rb)
+  credentials         (aliases: credential, cred)
 `,
 	Args:    cobra.RangeArgs(1, 2),
 	RunE:    run,
@@ -135,8 +136,10 @@ func run(cmd *cobra.Command, cmdArgs []string) error {
 		return getRoles(ctx, client, printer, name)
 	case "role-bindings":
 		return getRoleBindings(ctx, client, printer, name)
+	case "credentials":
+		return getCredentials(ctx, client, printer, name)
 	default:
-		return fmt.Errorf("unknown resource type: %s\nValid types: sessions, projects, project-agents, project-settings, users, agents, roles, role-bindings", cmdArgs[0])
+		return fmt.Errorf("unknown resource type: %s\nValid types: sessions, projects, project-agents, project-settings, users, agents, roles, role-bindings, credentials", cmdArgs[0])
 	}
 }
 
@@ -158,6 +161,8 @@ func normalizeResource(r string) string {
 		return "roles"
 	case "role-binding", "role-bindings", "rolebinding", "rolebindings", "rb":
 		return "role-bindings"
+	case "credential", "credentials", "cred", "creds":
+		return "credentials"
 	default:
 		return r
 	}
@@ -510,6 +515,48 @@ func getRoleBindings(ctx context.Context, client *sdkclient.Client, printer *out
 	return printRoleBindingTable(printer, list.Items)
 }
 
+func getCredentials(ctx context.Context, client *sdkclient.Client, printer *output.Printer, name string) error {
+	if name != "" {
+		cred, err := client.Credentials().Get(ctx, name)
+		if err != nil {
+			return fmt.Errorf("get credential %q: %w", name, err)
+		}
+		if printer.Format() == output.FormatJSON {
+			return printer.PrintJSON(cred)
+		}
+		return printCredentialTable(printer, []sdktypes.Credential{*cred})
+	}
+	opts := sdktypes.NewListOptions().Size(args.limit).Build()
+	list, err := client.Credentials().List(ctx, opts)
+	if err != nil {
+		return fmt.Errorf("list credentials: %w", err)
+	}
+	if printer.Format() == output.FormatJSON {
+		return printer.PrintJSON(list)
+	}
+	return printCredentialTable(printer, list.Items)
+}
+
+func printCredentialTable(printer *output.Printer, credentials []sdktypes.Credential) error {
+	columns := []output.Column{
+		{Name: "ID", Width: 27},
+		{Name: "NAME", Width: 24},
+		{Name: "PROVIDER", Width: 12},
+		{Name: "DESCRIPTION", Width: 32},
+		{Name: "AGE", Width: 10},
+	}
+	table := output.NewTable(printer.Writer(), columns)
+	table.WriteHeaders()
+	for _, c := range credentials {
+		age := ""
+		if c.CreatedAt != nil {
+			age = output.FormatAge(time.Since(*c.CreatedAt))
+		}
+		table.WriteRow(c.ID, c.Name, c.Provider, c.Description, age)
+	}
+	return nil
+}
+
 func printRoleBindingTable(printer *output.Printer, rbs []sdktypes.RoleBinding) error {
 	columns := []output.Column{
 		{Name: "ID", Width: 27},