feat(auth): mobile and remaining scoped-token consumers

[pandemicsyn]

Summary

Add gated scoped-token issuance for native/mobile, Chat/Events/Notifications, Wasteland, and benchmark.

Mobile retains legacy login, refresh, storage, and request authentication when native adoption is off, including when the shared Web master is on. Negotiated bundles select API/gateway credentials for model and voice requests. No pepper initialization or rotation is introduced. Benchmark processes disable automatic Session Ingest.

Verification

No physical-device or deployed provider/container smoke tests were run. Automated coverage and source comparison validate the extraction; device and deployed consumer checks remain necessary before activating the relevant family.

Visual Changes

N/A — credential handling changes do not add a visual interface.

Reviewer Notes

No new flag needs enabling when this merges. Preserve existing Cloud Agent settings.

Feature toggles	Default	Where to configure
NATIVE_RESOURCE_TOKENS_ENABLED, CHAT_RESOURCE_TOKENS_ENABLED, WASTELAND_RESOURCE_TOKENS_ENABLED	Off: unset or false	Vercel — Web environment variables; redeploy Web after changes
BENCHMARK_RESOURCE_TOKENS_ENABLED	Off: unset or false	Vercel — Web environment variables; redeploy Web after changes

Each family also requires Web SHARED_RESOURCE_TOKENS_ENABLED=true; the master alone does not enable them. Keep native adoption off until physical-device smoke coverage passes. Source-authority checks still apply with issuance off; benchmark ingest is disabled for legacy runs too. Retain compatible readers/runtime support during rollback.

Prior validation of the unchanged retained code: 811 mobile tests, 13 shared native contract tests, and 290 benchmark tests passed, with affected typechecks/lint and mobile unused-export checks. Remaining Web typecheck passed after extraction. This extraction changes no remaining application code; full repository or live smoke validation is not claimed.

Explicit resource delegation and its legacy compatibility fix are now #6155. Security Auto Analysis is #6147. Gastown is #6141; Webhook Ingest shipped in #6142. These changes originated in #5857. The remaining PR targets main independently. Cloud Agent Next transport changes are outside this PR.

Consumer audit · Rollout settings.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commit extracts Security Auto Analysis into a separate PR, reverting the services/security-auto-analysis tree to main behavior (verified byte-identical) and updating the rollout docs to drop its settings and coverage references; no defects were found in the changed code.

Files Reviewed (15 files)

• docs/token-consumer-audit.md
• docs/token-issuance-policy.md
• services/security-auto-analysis/src/callbacks.ts
• services/security-auto-analysis/src/callbacks.lifecycle.test.ts
• services/security-auto-analysis/src/db/queries.ts
• services/security-auto-analysis/src/launch.ts
• services/security-auto-analysis/src/launch.test.ts
• services/security-auto-analysis/src/manual-analysis.ts
• services/security-auto-analysis/src/remediation.ts
• services/security-auto-analysis/src/session-result.ts
• services/security-auto-analysis/src/token.ts
• services/security-auto-analysis/src/token.test.ts (deleted)
• services/security-auto-analysis/src/token-runtime-compat.test.ts (deleted)
• services/security-auto-analysis/worker-configuration.d.ts
• services/security-auto-analysis/wrangler.jsonc

Previous Review Summaries (5 snapshots, latest commit 0161d1c)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 0161d1c)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commit extracts Gastown and Webhook Agent Ingest issuance into separate PRs, reverting those branches to main behavior and updating the retained delegation test and rollout docs to match; the retained changes were verified against current code and no defects were found.

Files Reviewed (3 files)

• apps/web/src/lib/auth/resource-delegation.test.ts
• docs/token-consumer-audit.md
• docs/token-issuance-policy.md

Previous review (commit edde179)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The four follow-up commits since the previous review (mobile legacy-token behavior with native adoption off, remaining-family consumer contracts, Gastown pepper/runtime-renewal fencing, and rollout docs) were inspected in full; no new defects were found in the changed code.

Files Reviewed (39 files)

• apps/mobile/src/lib/auth/credentials.ts
• apps/mobile/src/lib/auth/native-credential-lifecycle.test.ts
• apps/mobile/src/lib/hooks/use-transcription-models.ts
• apps/mobile/src/lib/hooks/use-transcription-models.test.ts
• apps/mobile/src/lib/voice-input/gateway/native-gateway-voice-input.ts
• apps/mobile/src/lib/voice-input/gateway/native-gateway-voice-input.test.ts
• apps/web/src/app/api/auth/native/token/route.credentials.integration.test.ts
• apps/web/src/app/api/device-auth/token/route.flagoff.integration.test.ts
• apps/web/src/lib/auth/native-access-credentials.test.ts
• apps/web/src/app/api/auth/resource-token/route.ts
• apps/web/src/app/api/auth/resource-token/route.test.ts
• apps/web/src/app/api/gastown/token/route.ts
• apps/web/src/lib/auth/resource-delegation.ts
• apps/web/src/lib/auth/resource-delegation.test.ts
• apps/web/src/lib/kilo-chat/token.test.ts
• services/auto-routing-benchmark/container/server.mjs
• services/auto-routing-benchmark/src/container-auth.test.ts
• services/security-auto-analysis/src/token-runtime-compat.test.ts
• services/webhook-agent-ingest/src/queue-consumer.test.ts
• services/webhook-agent-ingest/src/services/token-minting-service.test.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/legacy-token-renewal.ts
• services/gastown/src/dos/town/legacy-token-renewal.test.ts
• services/gastown/src/dos/town/runtime-authorization.ts
• services/gastown/src/dos/town/runtime-authorization.test.ts
• services/gastown/src/dos/town/runtime-downstream-contract.test.ts
• services/gastown/src/dos/town/unattended-token-renewal.ts
• services/gastown/src/dos/town/unattended-token-renewal.test.ts
• services/gastown/src/gastown.worker.ts
• services/gastown/src/middleware/kilo-auth.middleware.ts
• services/gastown/src/middleware/kilo-auth.middleware.test.ts
• services/gastown/src/trpc/town-authorization.router.test.ts
• services/gastown/src/util/token-pepper.util.ts
• services/gastown/src/util/town-authorization.util.ts
• services/gastown/src/util/town-authorization.util.test.ts
• services/gastown/test/integration/town-private-identity.test.ts
• ENVIRONMENT.md
• docs/token-consumer-audit.md
• docs/token-issuance-policy.md

Previous review (commit 4ccf1ff)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (109 files)

• apps/mobile/src/lib/auth/auth-context.tsx
• apps/mobile/src/lib/auth/credentials.ts
• apps/mobile/src/lib/auth/native-auth-contract.ts
• apps/mobile/src/lib/auth/token-owner.ts
• apps/mobile/src/lib/auth/use-native-auth.ts
• apps/mobile/src/lib/auth/use-auth-bootstrap.ts
• apps/web/src/app/api/auth/native/token/route.ts
• apps/web/src/app/api/auth/native/exchange/route.ts
• apps/web/src/app/api/auth/native/refresh/route.ts
• apps/web/src/app/api/auth/resource-token/route.ts
• apps/web/src/app/api/device-auth/token/route.ts
• apps/web/src/app/api/gastown/token/route.ts
• apps/web/src/app/api/wasteland/token/route.ts
• apps/web/src/app/api/kilo-chat/token/route.ts
• apps/web/src/app/api/organizations/[id]/user-tokens/route.ts
• apps/web/src/app/api/internal/auto-routing-benchmark/token/route.ts
• apps/web/src/lib/auth/native-access-credentials.ts
• apps/web/src/lib/auth/device-sessions.ts
• apps/web/src/lib/kilo-chat/token.ts
• packages/app-shared/src/native-auth.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/runtime-authorization.ts
• services/gastown/src/dos/town/unattended-token-renewal.ts
• services/gastown/src/dos/town/legacy-token-renewal.ts
• services/gastown/src/middleware/town-auth.middleware.ts
• services/gastown/src/middleware/org-auth.middleware.ts
• services/gastown/src/handlers/town-runtime-authorization.handler.ts
• services/gastown/src/handlers/org-towns.handler.ts
• services/gastown/src/util/town-authorization.util.ts
• services/gastown/src/trpc/router.ts
• services/security-auto-analysis/src/token.ts
• services/webhook-agent-ingest/src/services/token-minting-service.ts
• docs/token-issuance-policy.md
• Remaining mobile/web/gastown/worker tests, wrangler defaults, and generated types

Previous review (commit 7a29996)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• apps/mobile/src/lib/auth/native-auth-contract.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/runtime-authorization.ts
• services/gastown/src/dos/town/runtime-authorization.test.ts
• services/gastown/src/dos/town/unattended-token-renewal.ts
• services/gastown/src/dos/town/unattended-token-renewal.test.ts
• services/gastown/src/middleware/town-auth.middleware.ts
• services/gastown/src/middleware/town-auth.middleware.test.ts
• services/gastown/test/integration/town-private-identity.test.ts
• services/security-auto-analysis/src/token.ts

Previous review (commit 287ed27)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/gastown/src/middleware/town-auth.middleware.ts	45	Admin bypass skipped for unmigrated towns
services/gastown/src/dos/town/runtime-authorization.ts	157	Split DO writes can brick a town as invalid
services/gastown/src/dos/town/runtime-authorization.ts	155	Org reauthorize requires original creator, not current owner

Files Reviewed (109 files)

• services/gastown/src/middleware/town-auth.middleware.ts - 1 issue
• services/gastown/src/dos/town/runtime-authorization.ts - 2 issues
• apps/mobile/src/lib/auth/* and related mobile auth call sites
• apps/web/src/app/api/auth/native/*, device-auth, resource-token, gastown/token, wasteland/token, kilo-chat/token, organizations/*/user-tokens, benchmark token routes
• packages/app-shared/src/native-auth.ts
• services/gastown remaining handlers, middleware, tRPC, renewal, and tests
• services/security-auto-analysis token minting and wrangler defaults
• services/webhook-agent-ingest token minting, callbacks, wrangler defaults
• docs/token-issuance-policy.md
• Generated worker-configuration.d.ts and pnpm-lock.yaml skipped for findings

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 46.3K · Output: 8.3K · Cached: 501.9K}

_{Review guidance: REVIEW.md from base branch main}