Attribute agent workflow dispatch

scripts/cli-first-contract-smoke.js

@@ -106,6 +106,7 @@ for (const [name, pattern] of [
   ["CLI JSON parse coverage", /fn cli_first_json_mode_parses_for_primary_commands\(\)/],
   ["CLI human output coverage", /fn human_report_is_text_not_json\(\)/],
   ["CLI key lifecycle coverage", /fn key_lifecycle_reports_project_scoped_agent_credentials\(\)/],
+  ["CLI agent workflow actor coverage", /fn run_with_agent_public_key_sends_attributable_workflow_actor\(\)/],
   ["CLI node revoke coverage", /fn node_revoke_reports_scoped_credential_revocation\(\)/],
   ["CLI admin public API coverage", /fn admin_status_and_suspend_use_public_coordinator_api\(\)/],
   ["CLI debug attach coverage", /fn debug_attach_reports_public_authorization\(\)/],
@@ -141,6 +142,21 @@ expect(
   "coordinator agent key lifecycle coverage",
   /fn service_manages_project_scoped_agent_public_keys\(\)/
 );
+expect(
+  coordinator,
+  "coordinator agent workflow dispatch coverage",
+  /fn service_runs_agent_workflows_with_scoped_key_attribution\(\)/
+);
+expect(
+  coordinator,
+  "coordinator agent workflow authorization",
+  /authorize_agent_project_run\([\s\S]*project:run/
+);
+expect(
+  coordinator,
+  "coordinator agent workflow actor fields",
+  /pub struct WorkflowActor[\s\S]*agent: Option<AgentId>[\s\S]*public_key_fingerprint: Option<Digest>[\s\S]*authenticated_without_browser/
+);
 expect(
   coordinator,
   "coordinator node revoke coverage",
@@ -176,6 +192,11 @@ expect(
   "CLI surfaces debug audit and quota fields",
   /debug_reads_quota_limited[\s\S]*charged_debug_read_bytes[\s\S]*used_debug_read_bytes/
 );
+expect(
+  cli,
+  "CLI sends agent workflow actor fields",
+  /fn add_workflow_actor_fields[\s\S]*actor_agent[\s\S]*agent_public_key_fingerprint/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],