fix(session-ingest): authorize contained subagent sessions

[pandemicsyn]

Summary

Fix contained Cloud Agent subagent history by authorizing child-session bootstrap and ingest within the scope of the Cloud Agent session that spawned them, without introducing new CLI credentials or requiring a CLI rollout. The broadened child bootstrap/ingest path is exercised only for sessions whose organization has Kilo credential containment enabled; uncontained customers continue using the existing exact-root transport.

• Add an immutable cloud_agent_session_scope_id to PostgreSQL session ownership and the Session Access Cache Durable Object, with self-healing for existing Cloud Agent roots.
• Extend Git Token Service classification and Cloud Agent outbound proxying so canonical child bootstrap and ingest use versioned internal Session Ingest routes.
• Require both the redeemed user JWT and internal proxy secret, atomically register children, cache authoritative session-scope membership, and protect organization and parent metadata.
• Preserve exact-root public routing and serialize bootstrap, reparenting, and deletion with root-before-child lock ordering.

Verification

• Ran the real Cloud Agent Next local harness with Kilo containment enabled: a cold session completed through Worker, Durable Object, containment sandbox, wrapper, real Kilo CLI, and fake model.
• Ran a temporary fake-model task directive: a real general subagent session was created, completed, and streamed live child events to the root session.

Visual Changes

N/A

Reviewer Notes

• Blast-radius boundary: Kilo credential containment is enabled per organization through KILOCODE_TOKEN_CONTAINMENT_ORG_IDS (or * for all organizations) and is disabled for devcontainer sessions. Only those contained sessions can use the new broadened child proxy/internal-route flow. The schema/root session-scope marker and Cloud Agent metadata hardening apply to all Cloud Agent roots, so the containment boundary does not exclude those shared changes.
• We intentionally accept a transient rollout tradeoff: a child session started while workers are on mixed versions may remain uncaptured for that session. Root Cloud Agent behavior continues, broadened requests never fall back to public Session Ingest, and a newly started session works once rollout completes.
• The PostgreSQL migration intentionally has no backfill. Existing root session-scope markers heal on the first authoritative child bootstrap.
• Previously, kilo_meta.orgId from the sandbox could update cli_sessions_v2.organization_id after membership validation. This PR now rejects that update for Cloud Agent roots in services/session-ingest/src/ingest/metadata.ts.
• Primary review areas are the GTS route boundary, dual-auth internal routes, cached session-scope authorization, and cross-operation lock ordering.

Performance impact: expected low, with containment-specific behavior limited to enabled organizations and contention isolated to one Cloud Agent session

• Steady-state transcript ingest is unchanged: session-scope authorization is cached in SessionAccessCacheDO, and no PostgreSQL transaction runs when the ingest DO reports no metadata changes.
• The new child bootstrap path runs only for Kilo-contained sessions. Root registration writes the session-scope marker for every new Cloud Agent root. Concurrent child bootstrap, hierarchy changes, and deletion for one Cloud Agent session serialize on its root; this is required for correctness but can add latency when one contained root spawns many children simultaneously. Different Cloud Agent sessions do not contend on a shared lock.
• The primary regression risk is metadata projection: the transaction already existed, but this PR now locks the current session row for every non-empty metadata batch so it can enforce session-scope invariants. The ingest DO emits metadata only when values change, which bounds frequency, but this path has not been production load-tested.
• No table-level lock or new scope index is introduced. If production shows increased transaction latency or lock waits, the follow-up optimization is a non-locking UPDATE ... RETURNING fast path for simple title/platform/git metadata while retaining transactions for status, organization, and parent changes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the contained Cloud Agent subagent session-scope authorization changes across session-ingest, git-token-service, cloud-agent-next, worker-utils, and the PostgreSQL/SQLite schema/migrations, with focused attention on dual-auth enforcement, org/parent-metadata protection, root-before-child lock ordering, and migration safety; no high-confidence security, correctness, or breaking-change issues were found on changed lines.

Files Reviewed (34 files)

• packages/db/src/migrations/0199_smiling_madrox.sql
• packages/db/src/migrations/meta/0199_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.ts
• packages/session-ingest-contracts/src/cloud-agent-session-scope.ts
• packages/session-ingest-contracts/src/index.ts
• packages/worker-utils/src/cloud-agent-session-access.ts
• pnpm-lock.yaml
• services/cloud-agent-next/src/sandbox-outbound.test.ts
• services/cloud-agent-next/src/sandbox-outbound.ts
• services/cloud-agent-next/src/session-access.ts
• services/cloud-agent-next/src/types.ts
• services/git-token-service/package.json
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/kilo-capability-policy.test.ts
• services/git-token-service/src/kilo-capability-policy.ts
• services/session-ingest/drizzle/0005_dark_inhumans.sql
• services/session-ingest/drizzle/meta/0005_snapshot.json
• services/session-ingest/drizzle/meta/_journal.json
• services/session-ingest/drizzle/migrations.js
• services/session-ingest/src/app.ts
• services/session-ingest/src/cloud-agent-session-scope-auth.test.ts
• services/session-ingest/src/db/sqlite-schema.ts
• services/session-ingest/src/dos/SessionAccessCacheDO.ts
• services/session-ingest/src/ingest/metadata.test.ts
• services/session-ingest/src/ingest/metadata.ts
• services/session-ingest/src/queue-consumer.test.ts
• services/session-ingest/src/routes/api.test.ts
• services/session-ingest/src/routes/api.ts
• services/session-ingest/src/routes/cloud-agent-session-scope.test.ts
• services/session-ingest/src/routes/cloud-agent-session-scope.ts
• services/session-ingest/src/services/session-access.test.ts
• services/session-ingest/src/services/session-access.ts
• services/session-ingest/src/session-ingest-rpc.test.ts
• services/session-ingest/src/session-ingest-rpc.ts
• services/session-ingest/test/integration/session-access-cache-do.test.ts

---

_{Reviewed by claude-sonnet-5 · Input: 22 · Output: 11K · Cached: 437.2K}

_{Review guidance: REVIEW.md from base branch main}