fix(session-ingest): authorize contained subagent sessions

[pandemicsyn]

Summary

Fix contained Cloud Agent subagent history by authorizing child-session bootstrap and ingest as a server-managed Cloud Agent family, without introducing new CLI credentials or requiring a CLI rollout.

• Add an immutable cloud_agent_family_id to PostgreSQL session ownership and the Session Access Cache Durable Object, with self-healing for existing Cloud Agent roots.
• Extend Git Token Service classification and Cloud Agent outbound proxying so canonical child bootstrap and ingest use versioned internal Session Ingest routes.
• Require both the redeemed user JWT and internal proxy secret, atomically register children, cache authoritative family membership, and protect organization and parent metadata.
• Preserve exact-root public routing and serialize family bootstrap, reparenting, and deletion with root-before-child lock ordering.

Verification

• No manual end-to-end verification was performed because this path requires a coordinated contained Cloud Agent, Git Token Service, and Session Ingest deployment.
• Additional manual verification details:

Visual Changes

N/A

Reviewer Notes

• We intentionally accept a transient rollout tradeoff: a child session started while workers are on mixed versions may remain uncaptured for that session. Root Cloud Agent behavior continues, broadened requests never fall back to public Session Ingest, and a newly started session works once rollout completes.
• The PostgreSQL migration intentionally has no backfill. Existing root family markers heal on the first authoritative child bootstrap.
• Previously, kilo_meta.orgId from the sandbox could update cli_sessions_v2.organization_id after membership validation. This PR now rejects that update for Cloud Agent roots in services/session-ingest/src/ingest/metadata.ts.
• Primary review areas are the GTS route boundary, dual-auth internal routes, cached family authorization, and cross-operation lock ordering.

Performance impact: expected low, with family-local burst contention

• Steady-state transcript ingest is unchanged: family authorization is cached in SessionAccessCacheDO, and no PostgreSQL transaction runs when the ingest DO reports no metadata changes.
• The new root and child bootstrap transactions run once per session. Concurrent child bootstrap, hierarchy changes, and deletion within one Cloud Agent family serialize on that family root; this is required for correctness but can add latency when one root spawns many children simultaneously. Different families do not contend with each other.
• The primary regression risk is metadata projection: the transaction already existed, but this PR now locks the current session row for every non-empty metadata batch so it can enforce family invariants. The ingest DO emits metadata only when values change, which bounds frequency, but this path has not been production load-tested.
• No table-level lock or new family index is introduced. If production shows increased transaction latency or lock waits, the follow-up optimization is a non-locking UPDATE ... RETURNING fast path for simple title/platform/git metadata while retaining transactions for status, organization, and parent changes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The previously flagged non-concurrent CREATE INDEX was resolved by removing the index; the regenerated migration now only adds the cloud_agent_family_id column, and no new issues were found in the incremental changes.

Files Reviewed (5 files)

• packages/db/src/migrations/0199_past_the_executioner.sql
• packages/db/src/migrations/0199_skinny_marrow.sql (deleted)
• packages/db/src/migrations/meta/0199_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.ts

Previous Review Summaries (2 snapshots, latest commit c2f7f69)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit c2f7f69)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The previously flagged non-concurrent CREATE INDEX was resolved by removing the index; the regenerated migration now only adds the cloud_agent_family_id column, and no new issues were found in the incremental changes.

Files Reviewed (5 files)

• packages/db/src/migrations/0199_past_the_executioner.sql
• packages/db/src/migrations/0199_skinny_marrow.sql (deleted)
• packages/db/src/migrations/meta/0199_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.ts

Previous review (commit a3d696a)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The new CREATE INDEX on cli_sessions_v2 in 0199_skinny_marrow.sql is non-concurrent and can block writes on this actively-used session-ownership table during the index build.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/db/src/migrations/0199_skinny_marrow.sql	2	Non-concurrent CREATE INDEX on the live cli_sessions_v2 table; repo convention elsewhere uses CREATE INDEX CONCURRENTLY for populated tables

Files Reviewed (38 files)

• packages/db/src/migrations/0199_skinny_marrow.sql - 1 issue
• packages/db/src/migrations/meta/0199_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.ts
• packages/session-ingest-contracts/src/cloud-agent-family.ts
• packages/session-ingest-contracts/src/index.ts
• packages/worker-utils/src/cloud-agent-session-access.ts
• pnpm-lock.yaml
• services/cloud-agent-next/src/sandbox-outbound.test.ts
• services/cloud-agent-next/src/sandbox-outbound.ts
• services/cloud-agent-next/src/session-access.ts
• services/cloud-agent-next/src/types.ts
• services/git-token-service/package.json
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/kilo-capability-policy.test.ts
• services/git-token-service/src/kilo-capability-policy.ts
• services/session-ingest/drizzle/0005_sudden_fabian_cortez.sql
• services/session-ingest/drizzle/meta/0005_snapshot.json
• services/session-ingest/drizzle/meta/_journal.json
• services/session-ingest/drizzle/migrations.js
• services/session-ingest/src/app.ts
• services/session-ingest/src/cloud-agent-family-auth.test.ts
• services/session-ingest/src/db/sqlite-schema.ts
• services/session-ingest/src/dos/SessionAccessCacheDO.ts
• services/session-ingest/src/ingest/metadata.test.ts
• services/session-ingest/src/ingest/metadata.ts
• services/session-ingest/src/routes/api.test.ts
• services/session-ingest/src/routes/api.ts
• services/session-ingest/src/routes/cloud-agent-family.test.ts
• services/session-ingest/src/routes/cloud-agent-family.ts
• services/session-ingest/src/services/session-access.test.ts
• services/session-ingest/src/services/session-access.ts
• services/session-ingest/src/session-ingest-rpc.test.ts
• services/session-ingest/src/session-ingest-rpc.ts
• services/session-ingest/test/integration/session-access-cache-do.test.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5 · Input: 40 · Output: 11K · Cached: 1.1M}

_{Review guidance: REVIEW.md from base branch main}

[pandemicsyn]

Replaced by #4832 after the terminology and persisted identifier cleanup.