feat(gastown): add gated token issuance and runtime authorization

[pandemicsyn]

Summary

Add gated Gastown control/runtime credentials and current account, pepper, ownership, and organization checks. Matching explicit null peppers remain valid without initialization. Legacy renewal preserves the town owner and checks concurrent authorization changes before publishing a replacement token.

Extracted from #5976, which originated in the token-issuance implementation in #5857.

Verification

No manual application or live CLI/container smoke tests were run. This extraction was verified with automated suites and source comparison; deployed runtime verification remains required before activation.

Visual Changes

N/A

Reviewer Notes

Feature toggle	Default	Where to configure
GASTOWN_RESOURCE_TOKENS_ENABLED	Off: unset or false	Web application environment variables in Vercel; redeploy Web after changes
SHARED_RESOURCE_TOKENS_ENABLED	Off in code; may already be enabled for another family	Web application environment variables in Vercel; redeploy Web after changes

Gastown modern issuance requires both Web variables to be exactly true. Leave GASTOWN_RESOURCE_TOKENS_ENABLED off: Gastown is EOL, no activation is required, and the blockers below remain. Preserve the existing master setting for other families. This PR requires no Gastown Cloudflare Worker toggle.

• Current-account and membership checks apply to legacy requests on deployment. No legacy expiration cutoff is added. Existing modern authority cannot downgrade to legacy during rollback.
• Modern activation remains blocked by missing Session Ingest coverage, organization-bound control minting, and safe credential renewal in running CLI processes.
• Automated validation: 549 full-suite unit tests, a subsequent 47-test runtime-authorization run, 20 real Durable Object identity/renewal tests, and 23 focused Web tests passed; service/Web typechecks and scoped lint passed. The CI sales-demo timeout did not reproduce locally (1.17s with its original 5s timeout). The broader integration suite previously reproduced the same 52 failures and 12 errors on main and is not claimed green.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commits resolve the prior authorization findings for the gated Gastown token-issuance paths and introduce no new issues in the changed code.

Files Reviewed (10 files)

• apps/web/src/lib/auth/resource-delegation.test.ts
• apps/web/src/lib/auth/resource-delegation.ts
• services/gastown/src/dos/town/runtime-authorization.test.ts
• services/gastown/src/dos/town/runtime-authorization.ts
• services/gastown/src/handlers/town-runtime-authorization.handler.test.ts
• services/gastown/src/handlers/towns.handler.test.ts
• services/gastown/src/handlers/towns.handler.ts
• services/gastown/src/util/town-authorization.util.test.ts
• services/gastown/src/util/town-authorization.util.ts
• services/gastown/test/integration/town-private-identity.test.ts

Previous Review Summary (commit 72f248b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 72f248b)

Status: 5 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	3
SUGGESTION	1

Issue Details (click to expand)

CRITICAL

File	Line	Issue
services/gastown/src/handlers/towns.handler.ts	62	New :userId ownership guards have no admin bypass, so admin town/rig inspection (/api/users/:userId/towns, /towns/:townId/rigs) now returns 403

WARNING

File	Line	Issue
services/gastown/src/util/town-authorization.util.ts	139	authorizeTown returns admin before the ownership check, so a platform admin who owns a personal modern town is treated as a non-owner and blocked from delete/config/rigs/refresh
services/gastown/src/handlers/town-runtime-authorization.handler.ts	32	Org owner who is also a platform admin resolves to admin and is rejected by the type !== 'org' check, so they cannot reauthorize the runtime
apps/web/src/app/api/gastown/token/route.ts	40	Switching to createControlTokenForRequest sources legacy orgMemberships from membershipsFor, which omits the organizations.deleted_at IS NULL filter; members of soft-deleted orgs gain legacy org-town access

SUGGESTION

File	Line	Issue
services/gastown/src/dos/town/runtime-authorization.ts	172	hasActiveWork() is only enforced when expectedAuthorization is set, so the exported admission path can replace a live runtime authorization while work is active

Files Reviewed (34 files)

• ENVIRONMENT.md
• apps/web/src/app/api/gastown/token/route.ts - 1 issue
• apps/web/src/lib/auth/resource-delegation.test.ts
• apps/web/src/lib/auth/resource-delegation.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/config.ts
• services/gastown/src/dos/town/legacy-token-renewal.test.ts
• services/gastown/src/dos/town/legacy-token-renewal.ts
• services/gastown/src/dos/town/runtime-authorization.test.ts
• services/gastown/src/dos/town/runtime-authorization.ts - 1 issue
• services/gastown/src/dos/town/runtime-downstream-contract.test.ts
• services/gastown/src/dos/town/unattended-token-renewal.test.ts
• services/gastown/src/dos/town/unattended-token-renewal.ts
• services/gastown/src/gastown.worker.ts
• services/gastown/src/handlers/org-towns.handler.test.ts
• services/gastown/src/handlers/org-towns.handler.ts
• services/gastown/src/handlers/town-runtime-authorization.handler.ts - 1 issue
• services/gastown/src/handlers/towns.handler.ts - 1 issue
• services/gastown/src/middleware/kilo-auth.middleware.test.ts
• services/gastown/src/middleware/kilo-auth.middleware.ts
• services/gastown/src/middleware/org-auth.middleware.test.ts
• services/gastown/src/middleware/org-auth.middleware.ts
• services/gastown/src/middleware/town-auth.middleware.test.ts
• services/gastown/src/middleware/town-auth.middleware.ts
• services/gastown/src/trpc/init.ts
• services/gastown/src/trpc/router.ts
• services/gastown/src/trpc/town-authorization.router.test.ts
• services/gastown/src/types.runtime-authorization.test.ts
• services/gastown/src/types.ts
• services/gastown/src/util/token-pepper.util.ts
• services/gastown/src/util/town-authorization.util.test.ts
• services/gastown/src/util/town-authorization.util.ts - 1 issue
• services/gastown/test/integration/town-private-identity.test.ts
• services/gastown/vitest.workers.config.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 63.9K · Output: 17.1K · Cached: 802K}

_{Review guidance: REVIEW.md from base branch main}