feat(cloud-agent): preserve provider identity through checkout

[iscekic]

• Cloud Agent sessions keep the selected GitHub, GitLab, or Bitbucket connection across retries and reject connection changes instead of silently switching.
• GitLab now checks repository access before creating a session; temporary failures during this check let you retry without changing your selection.
• Ordinary Bitbucket sessions can use a selected connection without starting a code review.

---

Summary

ResolvedRepositoryIdentity and ResolvedRepositoryIdentitySchema bind integrationId, integrationOwner, and instanceUrl; SessionRepositoryRequest and CurrentSessionMetadataSchema accept optional resolvedIdentity.
CloudAgentSession.updateResolvedRepositoryIdentity merges identity into current metadata in a storage-only transaction, preserving concurrent updates and rejecting deletion or identity changes.
Version 2 and legacy reads remain compatible, and later metadata writes cannot erase a resolved identity.

Files

• services/cloud-agent-next/src/session/session-requests.ts — source, modified (26 changed lines); adds the identity types, optional GitLab integration pin, and normalization to explicit legacy-unresolved for old requests and records.
• services/cloud-agent-next/src/persistence/session-metadata.ts — source, modified (79 changed lines); validates optional identity and GitLab pins. Guards the owner, provider, integration, repository location, instance, and Bitbucket identifiers while allowing branch and lifecycle updates. Retains legacy parsing and strips unknown identity fields.
• services/cloud-agent-next/src/persistence/CloudAgentSession.ts — source, modified (84 changed lines); shares the repository request contract and persists identity during registration. Checks GitLab pins and resolved identity during admission retries. Adds the transactional identity update, checks deletion markers, and returns current repository, workspace, and lifecycle state without overwriting unrelated metadata.
• services/cloud-agent-next/src/persistence/session-metadata.test.ts — test, modified (496 changed lines); updates metadata coverage, including concurrent updates, stale retries, and identity guards.

GitTokenService adds expectedIntegrationOwner for GitHub and expectedIntegrationId for GitLab; GitLab token and Bitbucket credential results require integrationId.
RepositoryIdentityResolution preserves authentication for unpinned GitHub responses lacking both identity fields as legacy-unresolved; all other successes require resolved.
service_compatibility_error rejects missing proof or partial identities, and integration_mismatch rejects conflicting identity; fallback requests retain both selectors.

Files

• services/cloud-agent-next/src/types.ts — source, modified (30 changed lines); re-exports the shared Owner type and extends token and capability contracts. Keeps GitHub response identity fields optional for older producers and adds the GitLab integration_mismatch failure.
• services/cloud-agent-next/src/services/git-token-service-client.ts — source, modified (143 changed lines); requires normalized identity in GitHub token, managed-auth, and capability results. Preserves both selectors through capability, managed-auth, and installation fallbacks. Carries GitLab and Bitbucket integration identifiers and classifies temporary GitLab failures. Documents fallback removal after old deployments, clients, and records disappear and the 30-day ledger window expires.
• services/cloud-agent-next/src/services/git-token-service-client.test.ts — test, modified (282 changed lines); updates credential compatibility coverage for legacy responses, selected integrations, and identity validation.

PrepareSessionInput and RepositoryInputSchema add optional gitlabIntegrationId and reject cross-provider integration fields; ordinary Bitbucket prepares accept bitbucketIntegrationId without review-only context.
Both prepareSession and start preserve the integration and branch, attach authorized resolvedIdentity, and pass createdOnPlatform into authorization.
Existing callers need no new required inputs; ledger-backed prepares defer authorization until operation admission, and code reviews still require complete review context.

Files

• services/cloud-agent-next/src/router/schemas.ts — source, modified (26 changed lines); validates GitLab integration pins in flat and grouped inputs. Separates ordinary Bitbucket integration selection from automation-only review fields and rejects integration pins for other providers.
• services/cloud-agent-next/src/router/handlers/session-prepare.ts — source, modified (18 changed lines); carries the GitLab pin through the flat adapter. Stores preflight identity for ordinary prepares and delegates ledger-backed authorization to admission.
• services/cloud-agent-next/src/router/handlers/session-start.ts — source, modified (13 changed lines); exports the grouped adapter, forwards GitLab pins, and attaches preflight identity before registration.
• services/cloud-agent-next/src/router/schemas.test.ts — test, modified (103 changed lines); updates repository input validation coverage.
• services/cloud-agent-next/src/router/handlers/session-prepare.test.ts — test, modified (62 changed lines); updates prepare adapter and handler coverage.
• services/cloud-agent-next/src/session-prepare.test.ts — test, modified (63 changed lines); updates preparation integration coverage for the identity contract.

assertRepositoryAccessBeforeSessionCreation returns ResolvedRepositoryIdentity for GitLab, Bitbucket, and pinned or resolved GitHub requests before session allocation.
GitLab authorization includes createdOnPlatform and the integration selector; temporary refresh, project-lookup, service, database, and transport failures return SERVICE_UNAVAILABLE.
Permanent failures return BAD_REQUEST; unpinned GitHub requests retain lazy authorization, and Bitbucket still requires an organization.

Files

• services/cloud-agent-next/src/session/validate-repository-access.ts — source, modified (88 changed lines); adds GitLab preflight and returns authorized identity instead of only checking access. Uses stored integration selectors, retains the GitHub owner selector, and returns no managed credentials to registration.
• services/cloud-agent-next/src/session/validate-repository-access.test.ts — test, modified (170 changed lines); updates provider authorization coverage, including temporary GitLab failures and permanent rejections.

createSessionWithLedger records createIntentFingerprint before authorization and stores repositoryIdentity separately in canonical_result, so creation and clone retries reuse authorization.
gitlabIntegrationId joins the existing provider pins and branch fingerprint; omitted additions preserve old fingerprint bytes, and changed same-key intent fails with session_creation_failed.
Legacy rows without fingerprints retain reconciliation; removing this fallback requires old clients and records to disappear and the 30-day window to expire.

Files

• services/cloud-agent-next/src/session/session-registration.ts — source, modified (71 changed lines); includes GitLab pins in immutable creation intent. Records the fingerprint before authorization can fail, persists the resolved identity separately, and reauthorizes that identity during creation or clone recovery. Rejects a different resolution without changing the established retry contract.
• services/cloud-agent-next/src/session/session-prepare.test.ts — test, modified (241 changed lines); updates admission and retry coverage, including unchanged selection after temporary GitLab failures.

SessionService reloads stored identity before credential lookup and persists successful resolutions before exposing tokens or capabilities to workspace preparation.
Raw-token and capability requests reuse expectedIntegrationId and GitHub expectedIntegrationOwner; unproved GitHub identity returns retryable WORKSPACE_SETUP_FAILED.
WrapperSessionReadyRequest keeps upstreamBranch, initial strictBranch, prepared-session resume, clone restoration, and the existing default branch behavior.

Files

• services/cloud-agent-next/src/session-service.ts — source, modified (130 changed lines); reads durable identity and calls the identity update before credential use. Applies the latest repository, workspace, and lifecycle state to the caller. Preserves GitLab instance subpaths, Bitbucket capability clone URLs, and the unpinned legacy GitHub fallback without weakening resolved requests.
• services/cloud-agent-next/src/session-service.test.ts — test, modified (385 changed lines); updates workspace credential and identity round-trip coverage.
• services/cloud-agent-next/wrapper/src/session-bootstrap.test.ts — test, modified (40 changed lines); extends strict branch regression coverage without changing the checkout engine.

Tests: 9 modified files (1,842 changed lines): persistence/session-metadata.test.ts, router/schemas.test.ts, router/handlers/session-prepare.test.ts, services/git-token-service-client.test.ts, session-prepare.test.ts, session-service.test.ts, session/session-prepare.test.ts, session/validate-repository-access.test.ts, and wrapper/src/session-bootstrap.test.ts.
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

• No manual tests ran for this level; runtime verification is pending for the cumulative stack.
• This level does not establish live checkout, provider write, or continuous integration (CI) results.

Reviewer Notes

• Scope: level 5 only, mobile-provider-parity-1d93-s4...mobile-provider-parity-1d93-s5.
• Repository: Kilo-Org/cloud; worktree: /Users/igor/Projects/.worktrees/mobile-provider-parity-1d93.
• The handoff reports passing focused checks; this level does not complete the full section.
• All product pull requests stay unassigned until every completion gate holds.

Human steps

• before merge: Deploy the preceding token-service level before the Cloud Agent consumer. GitLab and Bitbucket require integration identifiers; pinned GitHub requires identity proof.
• after merge: No additional human steps. The bot owns implementation and runtime verification.

Notes

Runtime verification is pending for the cumulative stack; this level adds no visual surface.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. mobile-provider-parity-1d93-s1 — feat(provider-review): add shared identity and stack checks #5663
2. mobile-provider-parity-1d93-s2 — feat(provider-review): define review contracts and vocabulary #5665
3. mobile-provider-parity-1d93-s3 — feat(provider-review): add safe provider SDK boundaries #5689
4. mobile-provider-parity-1d93-s4 — feat(git-token): authorize exact provider review resources #5692
5. mobile-provider-parity-1d93-s5 — feat(cloud-agent): preserve provider identity through checkout #5700 ← this PR
6. mobile-provider-parity-1d93-s6 — feat(provider-review): expose exact repositories and branches #5705
7. mobile-provider-parity-1d93-s7 — feat(mobile): preserve provider launch and recent identity #5711
8. mobile-provider-parity-1d93-s8 — feat(mobile): select exact provider repositories and branches #5729
9. mobile-provider-parity-1d93-s9 — feat(provider-review): add authorized GitLab review reads #5738
10. mobile-provider-parity-1d93-s10 — feat(provider-review): add authorized Bitbucket review reads #5745
11. mobile-provider-parity-1d93-s11 — feat(provider-review): add reconciled GitLab review actions #5748
12. mobile-provider-parity-1d93-s12 — feat(provider-review): add Bitbucket review actions and recovery #5756
13. mobile-provider-parity-1d93-s13 — feat(provider-review): expose the neutral review facade #5763 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (20 files)

• services/cloud-agent-next/src/persistence/CloudAgentSession.ts
• services/cloud-agent-next/src/persistence/session-metadata.test.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.test.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.ts
• services/cloud-agent-next/src/router/handlers/session-start.ts
• services/cloud-agent-next/src/router/schemas.test.ts
• services/cloud-agent-next/src/router/schemas.ts
• services/cloud-agent-next/src/services/git-token-service-client.test.ts
• services/cloud-agent-next/src/services/git-token-service-client.ts
• services/cloud-agent-next/src/session-prepare.test.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/session/session-requests.ts
• services/cloud-agent-next/src/session/validate-repository-access.test.ts
• services/cloud-agent-next/src/session/validate-repository-access.ts
• services/cloud-agent-next/src/types.ts
• services/cloud-agent-next/wrapper/src/session-bootstrap.test.ts

---

_{Reviewed by grok-4.6 · Input: 233.6K · Output: 14K · Cached: 628.9K}

_{Review guidance: REVIEW.md from base branch mobile-provider-parity-1d93-s4}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.