feat(agent-harness): fence retirement and retry payload cleanup

[iscekic]

• Deleting an organization now also removes its saved conversations and messages.

---

Summary

Account and organization deletion call retireHarnessConversations within their transactions, so Worker availability does not decide deletion success.
softDeleteUser, anonymizeCloudUserData, and organizationAdminRouter.delete retain their caller contracts, subscription guards, response shapes, and error behavior.
Organization retirement follows the admission lock order before hierarchy checks; a hierarchy rejection rolls back both retirement and deletion.

Files

• apps/web/src/lib/user/index.ts — replaces inline harness cleanup with the shared retirement call; preserves explicit client and user-grant deletion (modified; +2/−37 lines).
• apps/web/src/routers/organizations/organization-admin-router.ts — adds retirement before hierarchy validation and the organization update inside the existing advisory-locked transaction (modified; +4/−0 lines).

The retirement store recovers orphaned conversations and retries purge delivery; permanent fences keep retired generations closed after payload cleanup.
Identity, Claim, Receipt, and BatchLimit require matching conversation generations, valid leases, strict durable acknowledgments, and batches of one to ten.
HarnessMaintenanceRequest restricts protocol version 1 to purge and importLegacy through signed POST /internal/maintenance calls, without creating primary authority.

Files

• apps/web/src/lib/agent-harness/retirement.ts — adds transaction-owned fences using account_deleted or context_retired; preserves generation zero for unregistered threads. Locks threads by identifier before registry updates and clears owner/context links. Deletes threads, with cascading removal of messages, grants, and invitation results. The sweep removes obsolete clients and catches missing threads, owner/context mismatches, deleted accounts, and missing or deleted organizations. Each sweep category skips locked rows and handles at most ten records. Purge claims use 60-second leases and one delivery attempt per lease; only matching durable: true receipts acknowledge a current lease. Acknowledgment removes discovery rows but retains the permanent fence; failures and lost acknowledgments retry after expiry. Transport binds HS256 tokens to issuer, audience, 60-second expiry, operation, identity, dispatch identifier, and the body digest, plus service authentication. It requires HTTPS except on loopback, rejects URL credentials and redirects, and enforces a two-second timeout and 4,096-byte JSON receipts (added; +282/−0 lines).

GET /api/cron/agent-harness-cleanup adds authenticated, one-minute maintenance with a 60-second execution limit and ten-item batches.
CRON_SECRET authorizes calls; AGENT_HARNESS_API_URL, NEXTAUTH_SECRET, and INTERNAL_API_SECRET configure delivery to the level-22 Worker receiver.
The response reports success, swept, purge, and ingress results; absent delivery configuration leaves remote work pending without blocking transactional deletion.

Files

• apps/web/src/app/api/cron/agent-harness-cleanup/route.ts — adds a GET handler that rejects missing or invalid cron credentials with 401. Runs the orphan sweep, purge delivery, and leased legacy ingress for registered conversations in that order. Returns purge acknowledgment/retry counts and ingress acknowledgment/retry/rejection counts (added; +46/−0 lines).
• apps/web/vercel.json — schedules the cleanup route every minute without changing the existing cron entries (modified; +4/−0 lines).

Tests: 2 files changed — apps/web/src/lib/agent-harness/retirement.test.ts added (+1,037/−0 lines); apps/web/src/lib/user/index.test.ts modified (+25/−2 lines).
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

No manual runtime verification ran for this level. Isolated PostgreSQL inputs remain unavailable, and the real Worker receiver belongs to level 22.

Reviewer Notes

Human steps

• before merge — Require the real PostgreSQL tests to pass in continuous integration (CI).
• before merge — Merge the stack from the lowest level upward after the section passes its completion gate.
• before merge — Confirm CRON_SECRET, NEXTAUTH_SECRET, and INTERNAL_API_SECRET exist in the target web deployment. If a value is missing, run pnpm web:env set <VARIABLE>.
• after merge — Before enabling maintenance delivery, deploy the level-22 receiver with matching signing and service credentials. If needed, run pnpm web:env set AGENT_HARNESS_API_URL to select that receiver.

Recorded checks

• The handoff reports that all five required scoped checks passed.
• These checks do not establish actual Worker durability, live cleanup, or complete runtime composition.

Scope

• Repository: Kilo-Org/cloud.
• Worktree: /Users/igor/Projects/.worktrees/shared-agent-harness-3bb0.
• Level 9 only: shared-agent-harness-3bb0-s8 to shared-agent-harness-3bb0-s9.
• This level adds no database migration.

Notes

No manual runtime verification ran for this level. Full backend, browser, iOS, and Android verification remains required on the completed stack tip.

Real PostgreSQL tests remain required in CI. Local pure tests do not prove database race behavior or actual Worker durability.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667 ← this PR
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• apps/web/src/app/api/cron/agent-harness-cleanup/route.ts
• apps/web/src/lib/agent-harness/retirement.test.ts
• apps/web/src/lib/agent-harness/retirement.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/index.ts
• apps/web/src/routers/organizations/organization-admin-router.ts
• apps/web/vercel.json

---

_{Reviewed by grok-4.6 · Input: 142.7K · Output: 20.2K · Cached: 484.9K}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s8}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.