fix(security-agent): isolate dismiss and bound owner sync

[iscekic]

Summary

Manual Security Agent sync and dismiss timeouts are not tRPC admission overload. Scheduled owner sync occupies security-sync-jobs until Cloudflare’s 15-minute queue-consumer limit. Dismiss shares that queue and is marked COMMAND_STALLED before first delivery.

This PR applies the two implementation items from the verified handoff:

• Move dismiss to security-dismiss-jobs so cheap dismissals do not wait on owner sync.
• Bound owner sync at 8 minutes, persist runtime_state.sync_run, and enqueue a continuation. Owner freshness and pruning run only after every selected repository finishes.

Analysis stays unchanged. The callback triggeredByUserId failures need a separate workstream.

Deploy

Create these queues before the first production deploy:

pnpm --filter cloudflare-security-sync exec wrangler queues create security-dismiss-jobs
pnpm --filter cloudflare-security-sync exec wrangler queues create security-dismiss-jobs-dlq
pnpm --filter cloudflare-security-sync exec wrangler queues create security-dismiss-jobs-dev
pnpm --filter cloudflare-security-sync exec wrangler queues create security-dismiss-jobs-dlq-dev

The sync consumer still accepts leftover dismiss messages during drain.

Verification

• Report counts for 2026-08-13T00:00:00Z–2026-08-20T00:00:00Z matched Axiom (ok 20,757, unknown 3,977, stalled dismiss 30, stalled manual sync 98).
• pnpm --filter cloudflare-security-sync test
• pnpm --filter cloudflare-security-sync typecheck
• pnpm --filter cloudflare-security-sync lint

Test plan

• Create the dismiss queues, then deploy cloudflare-security-sync.
• Confirm a dismiss command lands on security-dismiss-jobs and reaches a non-stalled terminal result under scheduled-sync load.
• Confirm a large scheduled owner run emits continuation messages and stops producing ~900s Outcome=unknown kills.
• Confirm runtime_state.last_synced_at advances only after every selected repository in the run is complete.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/security-sync/src/sync.test.ts
• services/security-sync/src/sync.ts

Previous Review Summaries (2 snapshots, latest commit 69cbc8b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 69cbc8b)

Status: 1 Issue Found | Recommendation: Address before merge

Fix these issues in Kilo Cloud

Executive Summary

Persisted errors from incomplete repository retries blocks last_synced_at after a successful continuation.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/security-sync/src/sync.ts	1826	Persisted errors from incomplete retries blocks freshness

Files Reviewed (2 files)

• services/security-sync/src/sync.test.ts - 0 issues
• services/security-sync/src/sync.ts - 1 issue

Previous review (commit 1efad47)

Status: 2 Issues Found | Recommendation: Address before merge

Fix these issues in Kilo Cloud

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/security-sync/src/sync.ts	267	Full runtime_state replace can drop last_synced_at
services/security-sync/src/sync.ts	1825	Fresh-run GitHub failures never trip the 8-minute budget

Files Reviewed (8 files)

• services/security-sync/README.md - 0 issues
• services/security-sync/src/dismiss.ts - 0 issues
• services/security-sync/src/index.test.ts - 0 issues
• services/security-sync/src/index.ts - 0 issues
• services/security-sync/src/sync.test.ts - 0 issues
• services/security-sync/src/sync.ts - 2 issues
• services/security-sync/worker-configuration.d.ts - 0 issues
• services/security-sync/wrangler.jsonc - 0 issues

---

_{Reviewed by grok-4.6 · Input: 46.2K · Output: 7.1K · Cached: 324.2K}

_{Review guidance: REVIEW.md from base branch main}