Mutate the operator whitelist with an owner-signed payload.
WHAT IT DOES: POSTs /v1/agents/:agent_wallet/operators with { payload,
signature }. Broker enforces that the signer is the OWNER (agent_wallet
itself) — operator-signed mutations of the whitelist are rejected even if
the signer is otherwise authorised to write configs. Headless — the broker
NEVER signs.
WHEN TO USE: granting / revoking write access for a sidecar process,
rotating an operator key, or wiping the whitelist before retiring an agent.
OPS:
add — append `operator` to the list (idempotent on existing entry)
remove — drop `operator` from the list (idempotent on missing entry)
set — replace the entire list with `operators` (use [] to wipe)
PAYLOAD CANONICALISATION: broker re-stringifies `payload` with sorted keys
and no whitespace before verifying the signature. Sign that exact form.
RETURNS: OperatorsList after the mutation.
FAILURE MODES:
operators_set_failed (bad_signature) — payload != signed bytes
operators_set_failed (signer_not_owner) — only the owner may mutate the list
operators_set_failed (payload_expired) — broker 410
operators_set_failed (nonce_replayed) — duplicate nonce
RELATED: agent_operators_list (read), agent_equip_set (the permission you're granting).
Connector