feat(policy): add memory:CreateAgent action

[harshavardhana]

Summary

Adds memory:CreateAgent, so creating an agent record is grantable separately
from writing a memory beneath one.

Why

memory:PutAgent authorized both operations. In AIStor, creating an agent
record also mints the agent's IAM user and attaches its derived policy, so the
two operations are not comparable in privilege.

The resource ARN was meant to keep them apart, and cannot. Memory resource
matching is a plain glob where * crosses /:

pattern "c/agents/alpha/*"   resource "c/agents/alpha"       -> false   (holds)
pattern "c/agents/*"         resource "c/agents/alpha"       -> true    (collapses)
pattern "c/agents/*"         resource "c/agents/alpha/notes" -> true

So the separation survives only the per-agent spelling agents/<id>/*. On
agents/* — the natural spelling for "may write agent memories in this
cortex" — one action turns a grant to write data into a grant to mint
credentials.

This is the same argument that justified memory:UpdateAgent in #258, applied
to create, which is the more privileged of the two: an update re-derives a
policy, a create conjures an identity.

Changes

• MemoryCreateAgentAction (memory:CreateAgent), added to
  SupportedMemoryActions.
• MemoryPutAgentAction's doc now says what it covers: writing a memory
  beneath a record, not creating or modifying the record.
• Condition keys need no change: createMemoryActionConditionKeyMap derives
  from SupportedMemoryActions, and a point action correctly gets the common
  keys with no enumeration keys.

Testing

go build ./... and go test ./policy/... pass. The new action is added to
TestMemoryActionIsValid and to the pointActions list in
TestMemoryEnumerationConditionKeys, which asserts it carries no enumeration
condition keys.

Note for the consumer side

AIStor still authorizes a create under memory:PutAgent; moving it to
memory:CreateAgent is a follow-up there and needs this released first.

Summary by CodeRabbit

• New Features

  • Added a distinct memory:CreateAgent action for creating agent records and IAM identities.
  • Memory writes now explicitly target existing agents, while updates remain a separate operation.
  • Added support for the new action in memory policy validation and condition key handling.

• Chores

  • Updated supporting communication and API dependencies to newer versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9fa5f173-afa5-40af-92ae-4c9664c0368b

📥 Commits

Reviewing files that changed from the base of the PR and between 657d87e and 890802d.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• go.mod
• policy/memory-action.go
• policy/memory-action_test.go
• policy/memory-resource_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The policy separates agent creation from memory writes, registers and tests the new action, updates enumeration condition coverage, and bumps three indirect Google dependencies.

Changes

Memory action authorization

Layer / File(s)	Summary
Separate agent creation action policy/memory-action.go, policy/memory-action_test.go	Adds MemoryCreateAgentAction, changes MemoryPutAgentAction to write beneath existing agents, registers the new action, and validates it.
Validate action condition rules policy/memory-resource_test.go	Adds memory:CreateAgent to the point-action condition test. The test verifies that point actions reject memory:prefix and memory:maxkeys.

Indirect dependency updates

Layer / File(s)	Summary
Update indirect dependency versions go.mod	Updates the Google API, RPC, and gRPC indirect dependency versions.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: dilverse

Merge Risk: ⚪ Minimal · up to 89080

The authorization-action split and dependency updates have no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding the memory:CreateAgent action.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit splits the actions neat,
Create an agent, then store a treat.
The policy tests hop into line,
While newer modules gently shine.
“Memory paths are clear,” we cheer!}

_{Comment @coderabbitai help to get the list of available commands.}