feat(agent-harness): authorize named Kilo operation dispatch

[iscekic]

No new behavior — the new support is not active in the product.

---

Summary

executeHarnessDispatch verifies current primary authority and the complete signed HarnessOperationSchema envelope before minting narrow capabilities for named backend Kilo operations.
Fresh Cloud Agent mutations require numeric dispatchStartedAt; reads need no timestamp, and reconciliation preserves original time or explicit legacy absence.
OrganizationRoleSchema rejects invalid invitations before effects; bounded, sanitized responses preserve pre-dispatch cancelled and non-retryable outcome_unknown for uncertain mutations or aborted reconciliation.

Files

• apps/web/src/lib/agent-harness/operation-dispatch.ts — Added source (+117/−0 lines). Routes organization, member, repository, and usage reads, invitations, and Cloud Agent session search, attachment, progress, start, continuation, and stop. Rejects other tools and unsupported reconciliation. Validates outputs with ToolOutcomeSchema and each tool’s schema, with 65,536-byte input/output limits. Uses separate reconciliation adapters, preserves outcome statuses, and replaces uncertain provider references with the operation identity. Leaves existing adapter signatures and stored formats unchanged; adds no endpoint.
• apps/web/src/lib/agent-harness/operation-dispatch.test.ts — Added test (+439/−0 lines). Covers authority loss, envelope tampering, rejected tools and roles, empty reads, result limits, safe recovery, and personal and organization mutation identity. Verifies legacy timestamp absence, lost responses, cancellation, and reconciliation without duplicate effects, including uncertain stop outcomes.

Tests: 1 test file added — operation-dispatch.test.ts (+439/−0 lines).
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

Manual verification: not run.
No endpoint activates at this level. Provider operations and endpoint composition remain in later levels.
Actual PostgreSQL execution and deployed runtime verification remain unverified.

Reviewer Notes

Human steps

No human steps are required before or after merge.

Recorded checks

• Saved evidence reports one passing suite with all 78 cases passing, plus scoped oxfmt, oxlint, and oxfmt --check passes.
• The tests use mocked business adapters and omit environment and database setup hooks; they do not prove actual database effects.
• This description round did not rerun product checks.
• Full type, build, and repository checks remain owned by continuous integration (CI).

Scope

• Repository: Kilo-Org/cloud; worktree: /Users/igor/Projects/.worktrees/shared-agent-harness-3bb0.
• Review range: shared-agent-harness-3bb0-s31...shared-agent-harness-3bb0-s32.

Notes

Runtime verification remains pending at the stack tip. This level adds named Kilo dispatch without activating an endpoint.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755 ← this PR
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Named Kilo dispatch authorizes the signed envelope, mints a narrower capability, and preserves cancel versus outcome-unknown semantics with no changed-code defects.

Files Reviewed (2 files)

• apps/web/src/lib/agent-harness/operation-dispatch.ts
• apps/web/src/lib/agent-harness/operation-dispatch.test.ts

---

_{Reviewed by grok-4.6 · Input: 302.1K · Output: 23K · Cached: 484.5K}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s31}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.