perf(agentex): drop redundant owner-edge grant on task creation

[NiteshDhanpal]

Summary

_get_or_create_task created a task and then called grant_with_retry(task) — but create_task already registers the task as owner via register_resource(task, parent=agent). Both calls write the same owner grant, so every new task issued two identical authorization writes to egp-api-backend /private/v5/agentex/permissions.

This PR removes the duplicate (and the now-dead grant_with_retry method + its sole-use imports). No behavior change on either backend.

Why it's redundant (both backends verified)

Backend	register_resource (in create_task)	grant_with_retry	Equivalent?
SGP (legacy)	register_resource delegates to grant(permission="owner")	grant() also POSTs permission="owner"	✅ byte-identical upsert
Spark (SpiceDB)	confers the OWNER role + sets the parent edge	grant(create) → _RESOURCE_ROLE_MAP[create] = OWNER → grants OWNER (no parent)	✅ same role, fully subsumed

authorization_service.grant hardcodes operation=create, which maps to OWNER on Spark and to permission="owner" on SGP — exactly what register_resource already established. register_resource additionally sets the parent edge that grant_with_retry omitted, so the registration path is strictly the more complete of the two.

Impact

Observed on staging-infra: a load test drove ~433k POST /private/v5/agentex/permissions writes at ~595ms avg / ~2.1s p95, roughly 2× the new-task count because of this duplicate. Removing it:

• Halves new-task authorization write volume on the hot path.
• Removes a retrying round-trip (grant_with_retry retried up to 3× with backoff) from the message/send critical path, helping tail latency.

Changes

• Remove await self.grant_with_retry(task) from _get_or_create_task (create branch).
• Remove the now-dead grant_with_retry method (only call site was the line above; line 252 was its own recursive retry).
• Remove the 4 imports it solely used: asyncio, random, AuthenticationServiceUnavailableError, AgentexResource.

Net: 1 file, 33 deletions, 0 additions.

Testing

• ruff check — clean
• tests/unit/services/test_task_service.py + tests/unit/use_cases/test_agents_acp_use_case.py — 54 passed
• tests/integration/use_cases/test_task_authz_dual_write.py (directly exercises the authz registration path) — 5 passed

Forward-looking note

The SGP↔Spark equivalence relies on authorization_service.grant hardcoding operation=create (→ OWNER). If a future change makes grant_with_retry confer a narrower operation, re-evaluate. The _RESOURCE_ROLE_MAP comment ("Pending Port redesign that takes a role directly") flags this area as known-lossy, which is extra reason to remove the duplicate now.

🤖 Generated with Claude Code

Greptile Summary

Removes the grant_with_retry call (and the method itself) from _get_or_create_task in AgentsACPUseCase, because task_service.create_task already calls authorization_service.register_resource(task, parent=agent) — a strictly more complete write that subsumes the duplicate owner grant.

• Redundant write removed: register_resource in create_task establishes both the OWNER role and the parent edge; the removed grant_with_retry only posted the OWNER role with no parent, so the retained path is the more complete of the two.
• Dead code cleanup: the grant_with_retry method, its exponential-backoff retry loop, and 4 now-unused imports (asyncio, random, AuthenticationServiceUnavailableError, AgentexResource) are all deleted — net 33-line reduction with no logic change.

Confidence Score: 5/5

Safe to merge — the removed code was confirmed dead at both SGP and Spark backends, and the retained register_resource call in create_task is the more complete write.

The change is a pure deletion: create_task already performs register_resource(task, parent=agent) which grants OWNER and sets the parent edge. The removed grant_with_retry only re-posted OWNER without a parent — fully subsumed. No references to grant_with_retry remain anywhere in the codebase, the 4 removed imports are genuinely unused, and the PR description provides load-test evidence confirming the duplicate writes.

No files require special attention.

Important Files Changed

Filename	Overview
agentex/src/domain/use_cases/agents_acp_use_case.py	Removes the redundant grant_with_retry method and its sole call-site; task_service.create_task already performs the equivalent (and more complete) register_resource write, so no authorization behavior is altered.

Sequence Diagram

sequenceDiagram
    participant UC as AgentsACPUseCase
    participant TS as TaskService
    participant AS as AuthorizationService

    Note over UC,AS: Before this PR
    UC->>TS: create_task(agent, ...)
    TS->>AS: "register_resource(task, parent=agent) OWNER + parent edge"
    TS-->>UC: task
    UC->>AS: grant_with_retry → grant(task) duplicate OWNER (no parent)

    Note over UC,AS: After this PR
    UC->>TS: create_task(agent, ...)
    TS->>AS: "register_resource(task, parent=agent) OWNER + parent edge"
    TS-->>UC: task
    Note right of UC: grant_with_retry removed — no duplicate write

Loading

_{Reviews (1): Last reviewed commit: "perf(agentex): drop redundant owner-edge..." | Re-trigger Greptile}