feat(agent-harness): admit durable runs and revisioned commands

[iscekic]

No new behavior — this change does not make a new feature available to users.

---

Summary

admitCommand adds atomic AdmissionCommand handling for getOrCreateConversation, sendMessage, setPermissionMode, and cancelRun; each accepted send commits one message, queued run, and reply.
CommandAdapter, AuthoritySchema, and ModelAdmissionSchema validate current access and model bounds; RunLimitsSchema and SendResultSchema freeze each admitted context, prices, and limits.
Authorized retries return original results, while serialized revision checks, queue bounds, named cancellation, and durable alarms protect admission; production integration remains external.

Files

• services/agent-harness/src/commands.ts — Source, A (added), 339 lines (+339/−0). Validates command envelopes and returns explicit rejections for invalid input, unsupported protocols, and commands that require another handler. Requires current owner, client, and context authority, including reauthorization after awaited model validation. Resolves an existing conversation without scheduling work and preserves legacy Ask/revision-zero defaults. Uses the command identifier as the run identifier and freezes the model, variant, originating client, context, prices, and limits. Enforces message and queue bounds during admission; defaults allow 32 KiB messages and 32 pending runs, excluding the active run. Stores ceilings for calls, model steps, tokens, tool/network payloads, attempt/run duration, web requests/results, snippets, pages, and model cost. Positive overrides can only lower these ceilings; input tokens also respect model capacity. Fingerprints bind inputs to the actor and conversation; authorized replay skips model and limit validation. Changed inputs return command_conflict; durable stale_revision rejections require reviewed inputs under a new command identifier. Mode changes serialize revision increments and require an acknowledged direct user action to enable yolo. Enabling yolo resumes approval waits only; switching to Ask preserves existing calls, approvals, effects, and other wait gates. Named cancellation moves queued runs to cancelled and running or waiting runs to stopping; stopping and terminal runs remain unchanged. Cancellation preserves unrelated queued work and actual effects; missing-run rejections remain durable even if a later send creates that run. Requests durable recovery before mutation commits, except terminal cancellations, and retains the earliest wake through the existing store. Restarts, lost acknowledgments, and event compaction preserve committed work and original replies. Event-size failures roll back work and retain a permanent limit rejection; transient failures permit same-command retries without a stored result.

Tests: 1 test file added — services/agent-harness/src/commands.test.ts, A, 1,106 lines (+1,106/−0). Covers concurrent admission, durable replay, policy revisions, authority loss, frozen inputs, queue bounds, cancellation, preserved effects, rollback, and alarm recovery.
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

• No manual or live end-to-end (E2E) verification ran because this level adds backend command handling without activating a user-facing runtime.
• Production scheduling and authorization composition remain outside this level.

Reviewer Notes

Scope

• Level 11 only: atomic run admission and revisioned commands in the SQLite runtime.
• Repository: Kilo-Org/cloud.
• Worktree: /Users/igor/Projects/.worktrees/shared-agent-harness-3bb0, branch shared-agent-harness-3bb0-s11.
• Review refs: shared-agent-harness-3bb0-s10...shared-agent-harness-3bb0-s11.

Reported automated checks

The handoff reports that the implementer and reviewer passed all 42 scoped SQLite tests, lint, formatting, and whitespace checks.

• pnpm --filter @kilocode/agent-harness-worker exec vitest run src/commands.test.ts — 42 tests passed.
• pnpm exec oxlint --config .oxlintrc.json services/agent-harness/src/commands.ts services/agent-harness/src/commands.test.ts — passed.
• pnpm exec oxfmt --check services/agent-harness/src/commands.ts services/agent-harness/src/commands.test.ts — passed.
• git diff --check -- services/agent-harness/src/commands.ts services/agent-harness/src/commands.test.ts — passed.

These checks cover scoped SQLite behavior and storage recovery, not repository-wide checks or live runtime verification.

Human steps

This level requires no human steps before merge or after merge.
Later runtime activation needs scoped Worker and server configuration.

Notes

Live E2E verification remains pending at the completed stack tip. This level adds uncomposed backend command handling; it does not activate a user-facing runtime.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678 ← this PR
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/agent-harness/src/commands.ts
• services/agent-harness/src/commands.test.ts

---

_{Reviewed by grok-4.6 · Input: 137.7K · Output: 21.9K · Cached: 663.2K}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s10}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.