feat(security): autonomous agent token recovery via Vault self-issue

Add Strategy 3 to TokenProvider::refresh(): when Vault read and env
fallback both yield no new token, generate a 32-byte CSPRNG token,
write it to the agent's Vault KV path, and swap it in-memory. Since
Stacker validates by reading the same Vault KV path, the next signed
poll is accepted — no operator intervention or stacker-cli re-install
required.

Emit a token_self_issued audit event (target=audit, level=warn) so
SIEM/SOC pipelines can distinguish agent-initiated recovery from
Stacker-pushed rotations.

Tests cover both the happy path (read 404 → write 200 → token swapped)
and the unauthorized path (write 403 → token unchanged), with mock
expectations to verify Strategy 3 actually hit Vault.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: robotizeit

Cargo.lock

@@ -46,6 +46,10 @@ impl AuditLogger {
         info!(target: "audit", event = "token_rotated", agent_id, request_id = request_id.unwrap_or(""));
     }
 
+    pub fn token_self_issued(&self, deployment_hash: &str, reason: &str) {
+        warn!(target: "audit", event = "token_self_issued", deployment_hash, reason);
+    }
+
     pub fn internal_error(
         &self,
         agent_id: Option<&str>,

src/security/audit_log.rs

@@ -108,6 +108,28 @@ impl TokenProvider {
             return Ok(true);
         }
 
+        // Strategy 3: self-issue a new token and write it to Vault.
+        // Stacker validates by reading from the same Vault KV path, so a token
+        // the agent writes there is immediately accepted on the next poll.
+        if let Some(vault) = &self.vault_client {
+            let new_token = generate_secure_token();
+            match vault
+                .store_agent_token(&self.deployment_hash, &new_token, None)
+                .await
+            {
+                Ok(()) => {
+                    let mut token = self.token.write().await;
+                    *token = new_token;
+                    super::audit_log::AuditLogger::new()
+                        .token_self_issued(&self.deployment_hash, "primary_strategies_failed");
+                    return Ok(true);
+                }
+                Err(e) => {
+                    warn!(error = %e, "Vault self-issue failed; token unchanged");
+                }
+            }
+        }
+
         debug!("No new token available after refresh attempt");
         Ok(false)
     }
@@ -121,6 +143,14 @@ impl TokenProvider {
     }
 }
 
+fn generate_secure_token() -> String {
+    use ring::rand::{SecureRandom, SystemRandom};
+    let rng = SystemRandom::new();
+    let mut bytes = [0u8; 32];
+    rng.fill(&mut bytes).expect("CSPRNG failure");
+    bytes.iter().map(|b| format!("{:02x}", b)).collect()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -190,4 +220,93 @@ mod tests {
         tp2.swap("b".into()).await;
         assert_eq!(tp.get().await, "b");
     }
+
+    #[tokio::test]
+    async fn refresh_self_issues_token_when_vault_has_no_entry() {
+        use crate::security::vault_client::VaultClient;
+        use mockito::Server;
+
+        let _guard = env_lock().lock().unwrap();
+
+        let mut server = Server::new_async().await;
+
+        // Strategy 1: Vault read returns 404 (KV entry was deleted)
+        let read = server
+            .mock("GET", "/v1/status_panel/dep-abc/status_panel_token")
+            .with_status(404)
+            .with_body(r#"{"errors":[]}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        // Strategy 3: Vault write accepted (must be called exactly once)
+        let write = server
+            .mock("POST", "/v1/status_panel/dep-abc/status_panel_token")
+            .with_status(200)
+            .with_body("{}")
+            .expect(1)
+            .create_async()
+            .await;
+
+        let _addr = EnvGuard::set("VAULT_ADDRESS", &server.url());
+        let _tok = EnvGuard::set("VAULT_TOKEN", "vault-root");
+        let _prefix = EnvGuard::set("VAULT_AGENT_PATH_PREFIX", "status_panel");
+        // Strategy 2 is a no-op: env token matches current
+        let _agent = EnvGuard::set("AGENT_TOKEN", "stale-token");
+
+        let vault = VaultClient::from_env().unwrap().unwrap();
+        let tp = TokenProvider::new("stale-token".into(), Some(vault), "dep-abc".into());
+
+        let changed = tp.refresh().await.unwrap();
+        assert!(changed, "expected self-issued token to be applied");
+
+        let new_token = tp.get().await;
+        assert_ne!(new_token, "stale-token");
+        assert_eq!(new_token.len(), 64, "expected 32-byte hex token");
+        assert!(new_token.chars().all(|c| c.is_ascii_hexdigit()));
+
+        read.assert_async().await;
+        write.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn refresh_keeps_token_when_vault_write_forbidden() {
+        use crate::security::vault_client::VaultClient;
+        use mockito::Server;
+
+        let _guard = env_lock().lock().unwrap();
+
+        let mut server = Server::new_async().await;
+
+        // Strategy 1: Vault read returns 404
+        let _read = server
+            .mock("GET", "/v1/status_panel/dep-xyz/status_panel_token")
+            .with_status(404)
+            .with_body(r#"{"errors":[]}"#)
+            .create_async()
+            .await;
+
+        // Strategy 3: Vault write rejected (agent lacks write capability)
+        let write = server
+            .mock("POST", "/v1/status_panel/dep-xyz/status_panel_token")
+            .with_status(403)
+            .with_body(r#"{"errors":["permission denied"]}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let _addr = EnvGuard::set("VAULT_ADDRESS", &server.url());
+        let _tok = EnvGuard::set("VAULT_TOKEN", "vault-root");
+        let _prefix = EnvGuard::set("VAULT_AGENT_PATH_PREFIX", "status_panel");
+        let _agent = EnvGuard::set("AGENT_TOKEN", "stale-token");
+
+        let vault = VaultClient::from_env().unwrap().unwrap();
+        let tp = TokenProvider::new("stale-token".into(), Some(vault), "dep-xyz".into());
+
+        let changed = tp.refresh().await.unwrap();
+        assert!(!changed, "Strategy 3 must not claim success on write failure");
+        assert_eq!(tp.get().await, "stale-token", "token must not change on failure");
+
+        write.assert_async().await;
+    }
 }