@opengeni/core 1.0.1 → 2.2.0-canary.0

package/src/domain/sessions.ts

@@ -13,24 +13,28 @@ import {
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
+  DraftTimelineAnnotations,
   FIRST_PARTY_MCP_TOOL_NAMES,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
-  latencyModeForMetadata,
-  reasoningEffortForMetadata,
+  resolveWorkspaceSessionToolDefaults,
   stableJson,
   type AccessGrant,
+  type ComposerDraft,
   type CreateSessionResponse,
   type GoalSpec,
   type FirstPartyMcpToolName,
   type McpPersonalConnectionDelegation,
+  type McpConnectionAuthoritySelection,
   type Permission,
+  type PersonalResourceAttachmentIntent,
   type ReasoningEffort,
   type ResourceRef,
   type Session,
+  type SessionCommandReceipt,
   type SessionSkill,
   type SessionEvent,
   SessionMcpApprovalPolicy,
@@ -44,6 +48,8 @@ import {
   type SessionAuthorizationPort,
   type SessionToolPolicy,
   type SessionTurn,
+  type SessionPromptRouting,
+  type SessionGoalSnapshot,
   type ToolRef,
   type TurnInitiator,
   type TurnInitiatorContext,
@@ -63,13 +69,18 @@ import {
   listDistinctRigVersionIdsInGroup,
   getSandbox,
   getSession,
+  getSessionAuthorityProjection,
   SessionIdConflictError,
+  NewSessionDraftConflictError,
   getSessionSpawnDenialByIdempotencyKey,
   getWorkspaceControlEvent,
   getSessionLineage,
   getSessionTurn,
+  getSessionTurnForAttempt,
+  getSessionTurnPersonalConnectionDelegations,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getWorkspaceModelPolicy,
+  requireWorkspace,
   initializeSessionStartAtomically,
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
@@ -87,7 +98,13 @@ import {
   SessionSpawnDeniedDbError,
   SessionControlConflictError,
   SessionToolPolicyVersionConflictError,
+  SessionCreateIdempotencyConflictError,
+  PersonalResourceAttachmentAcceptanceError,
+  sessionTenancyProductActivated,
+  workspaceControlRequestLockTimeoutMs,
+  WorkspaceControlBusyError,
   type SessionCommandActor,
+  type NewSessionDraftSnapshot,
 } from "@opengeni/db";
 import {
   appendAndPublishEvents,
@@ -96,7 +113,7 @@ import {
   type EventBus,
 } from "@opengeni/events";
 import { HTTPException } from "hono/http-exception";
-import { hasPermission, requirePermission } from "../access";
+import { hasPermission, requirePermission, type AccessGrantAuthorization } from "../access";
 import { recordWorkspaceUsage, requireLimit } from "../billing/limits";
 import type {
   AcceptSessionUserMessageDependencies,
@@ -104,6 +121,7 @@ import type {
   SessionWorkflowClient,
 } from "../dependencies";
 import {
+  requireLiveAgentAttemptAuthorization,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
 } from "../session-authorization";
@@ -116,6 +134,10 @@ import {
   personalConnectionDelegationSourceForGrant,
 } from "./personal-connection-delegations";
 import { hasReservedOpenGeniSlackBotSessionMetadata } from "./slack-bot";
+import {
+  requireCanonicalManagedHuman,
+  requireManagedHumanPrivateSessionCreate,
+} from "../application/session-tenancy";
 import {
   assertToolRefsSubset,
   availableToolRefs,
@@ -124,7 +146,7 @@ import {
   validateFileResources,
   validateGitHubRepositorySelection,
   validateToolRefs,
-  withDefaultEnabledCapabilityMcpTools,
+  withWorkspaceDefaultMcpTools,
 } from "./resources";
 
 const reservedSessionMcpServerIds = new Set(["opengeni", "files", "docs", "codex_apps"]);
@@ -136,6 +158,39 @@ const maxToolPolicyAuditRefs = 40;
 // RFC 9110 field-name token characters.
 const sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 
+async function requireAtomicPersonalResourceAttachment(
+  deps: Pick<ApiRouteDeps, "db">,
+  authorization: AccessGrantAuthorization | undefined,
+  workspaceId: string,
+  intent: PersonalResourceAttachmentIntent | undefined,
+  existingSession: boolean,
+): Promise<void> {
+  if (!intent) return;
+  if (!authorization) {
+    throw new HTTPException(403, {
+      message: "Personal resources require the owning managed-human session.",
+    });
+  }
+  try {
+    requireCanonicalManagedHuman(authorization, workspaceId);
+  } catch (error) {
+    throw new HTTPException(403, {
+      message: "Personal resources require the owning managed-human session.",
+      cause: error,
+    });
+  }
+  if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
+    throw new HTTPException(409, {
+      message: "Session tenancy is not activated for this organization.",
+    });
+  }
+  if (existingSession && intent.expectedAuthorityEpoch === undefined) {
+    throw new HTTPException(422, {
+      message: "Personal-resource attachment requires expectedAuthorityEpoch.",
+    });
+  }
+}
+
 /** Transport-neutral typed denial raised only after its audit row committed. */
 export class SessionSpawnDeniedError extends Error {
   readonly denial: SessionSpawnDenial;
@@ -562,6 +617,7 @@ export async function createAndStartSessionWithOutcome(input: {
   beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
   accountId: string;
   workspaceId: string;
+  visibility?: "user_private" | "workspace_shared";
   initialMessage: string;
   /** Create the session shell without an initial user event/agent turn. */
   deferInitialTurn?: boolean;
@@ -613,6 +669,7 @@ export async function createAndStartSessionWithOutcome(input: {
   mcpServers?: CreateSessionMcpServerInput[];
   sessionMcpServers?: SessionMcpServerMetadata[];
   personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+  initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
   xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
   // The manager session spawning this worker (a worker-signed sessionId claim
   // on the creating grant); null for direct API creates and scheduled runs.
@@ -644,12 +701,27 @@ export async function createAndStartSessionWithOutcome(input: {
     sandboxId: string;
     settings: Settings;
     workingDir?: string | null;
+    resourceSubjectId?: string | null;
   } | null;
   // Exact actor-private pre-session draft represented by this create. The
   // initializer consumes it only after the first durable runnable unit commits.
   consumeNewSessionDraft?: {
     subjectId: string;
     expectedRevision: number;
+    expectedSnapshot: NewSessionDraftSnapshot;
+    acceptedSelection: {
+      channelId: string | null;
+      targetSandboxId: string | null;
+      workingDir: string | null;
+    };
+  } | null;
+  rememberNewSessionSelection?: {
+    subjectId: string;
+    acceptedSelection: {
+      channelId: string | null;
+      targetSandboxId: string | null;
+      workingDir: string | null;
+    };
   } | null;
   // A child may lower its inherited nested-agent depth limit freely; increases
   // are authorized by the caller's workspace:admin grant and checked again by
@@ -673,6 +745,7 @@ export async function createAndStartSessionWithOutcome(input: {
       ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
       accountId: input.accountId,
       workspaceId: input.workspaceId,
+      visibility: input.visibility ?? "workspace_shared",
       initialMessage: input.initialMessage,
       initialModelContext: input.modelContext ?? null,
       resources: input.resources,
@@ -684,6 +757,8 @@ export async function createAndStartSessionWithOutcome(input: {
       ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),
       createdByActor: input.createdByActor ?? null,
       model: input.model,
+      reasoningEffort: input.reasoningEffort,
+      latencyMode: input.latencyMode ?? "standard",
       sandboxBackend: input.sandboxBackend,
       variableSetId: input.variableSet?.id ?? null,
       rigId: input.rigId ?? null,
@@ -699,6 +774,8 @@ export async function createAndStartSessionWithOutcome(input: {
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
       mcpServers: input.mcpServers ?? [],
       personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+      initialPersonalResourceAttachmentIntent:
+        input.initialPersonalResourceAttachmentIntent ?? null,
       ...(input.xaiProviderAccountAuthoritySnapshot
         ? {
             initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,
@@ -739,6 +816,7 @@ export async function createAndStartSessionWithOutcome(input: {
       ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
       accountId: input.accountId,
       workspaceId: input.workspaceId,
+      visibility: input.visibility ?? "workspace_shared",
       initialMessage: input.initialMessage,
       initialModelContext: input.modelContext ?? null,
       resources: input.resources,
@@ -750,6 +828,8 @@ export async function createAndStartSessionWithOutcome(input: {
       ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),
       createdByActor: input.createdByActor ?? null,
       model: input.model,
+      reasoningEffort: input.reasoningEffort,
+      latencyMode: input.latencyMode ?? "standard",
       sandboxBackend: input.sandboxBackend,
       variableSetId: input.variableSet?.id ?? null,
       rigId: input.rigId ?? null,
@@ -764,6 +844,8 @@ export async function createAndStartSessionWithOutcome(input: {
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
       mcpServers: input.mcpServers ?? [],
       personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+      initialPersonalResourceAttachmentIntent:
+        input.initialPersonalResourceAttachmentIntent ?? null,
       ...(input.xaiProviderAccountAuthoritySnapshot
         ? {
             initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,
@@ -825,10 +907,25 @@ async function finishStartSession(
       sandboxId: string;
       settings: Settings;
       workingDir?: string | null;
+      resourceSubjectId?: string | null;
     } | null;
     consumeNewSessionDraft?: {
       subjectId: string;
       expectedRevision: number;
+      expectedSnapshot: NewSessionDraftSnapshot;
+      acceptedSelection: {
+        channelId: string | null;
+        targetSandboxId: string | null;
+        workingDir: string | null;
+      };
+    } | null;
+    rememberNewSessionSelection?: {
+      subjectId: string;
+      acceptedSelection: {
+        channelId: string | null;
+        targetSandboxId: string | null;
+        workingDir: string | null;
+      };
     } | null;
   },
   session: Session,
@@ -850,6 +947,9 @@ async function finishStartSession(
       sessionId: session.id,
       sessionBackend: session.sandboxBackend,
       sessionGroupId: session.sandboxGroupId,
+      ...(input.seedTargetSandbox.resourceSubjectId
+        ? { subjectId: input.seedTargetSandbox.resourceSubjectId }
+        : {}),
     };
     const seeded = await swapActiveSandbox(
       {
@@ -892,12 +992,19 @@ async function finishStartSession(
           ...(input.goal.successCriteria !== undefined
             ? { successCriteria: input.goal.successCriteria }
             : {}),
+          ...(input.goal.rootConstraints !== undefined
+            ? { rootConstraints: input.goal.rootConstraints }
+            : {}),
           ...(input.goal.maxAutoContinuations !== undefined
             ? { maxAutoContinuations: input.goal.maxAutoContinuations }
             : {}),
+          ...(input.goal.mutationPolicy !== undefined
+            ? { mutationPolicy: input.goal.mutationPolicy }
+            : {}),
         }
       : null,
     consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,
+    rememberNewSessionSelection: input.rememberNewSessionSelection ?? null,
     deferInitialTurn: input.deferInitialTurn === true,
   });
   await publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events);
@@ -1072,20 +1179,6 @@ export async function requireQueuedTurnForApi(
   return turn;
 }
 
-export function reasoningEffortForSession(
-  metadata: Record<string, unknown>,
-  fallback: Settings["openaiReasoningEffort"],
-): Settings["openaiReasoningEffort"] {
-  return reasoningEffortForMetadata(metadata, fallback);
-}
-
-export function latencyModeForSession(
-  metadata: Record<string, unknown>,
-  fallback: "standard" | "priority" | "fast" = "standard",
-): "standard" | "priority" | "fast" {
-  return latencyModeForMetadata(metadata, fallback);
-}
-
 /**
  * Appends a `user.message` to an existing session and enqueues the resulting
  * turn, merging requested resources/tools into the session and waking the
@@ -1111,6 +1204,7 @@ export async function postUserMessageTurn(input: {
   clientEventId?: string;
   mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
   personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+  personalResourceAttachment?: PersonalResourceAttachmentIntent;
   delivery?: "send" | "steer";
   origin?: "human" | "operator";
   actor?: string;
@@ -1125,6 +1219,9 @@ export async function postUserMessageTurn(input: {
 }): Promise<{
   accepted: SessionEvent;
   turn: SessionTurn;
+  draft: ComposerDraft | null;
+  receipt: SessionCommandReceipt;
+  routing: SessionPromptRouting;
   interruptionCount: number;
   replay: boolean;
 }> {
@@ -1189,11 +1286,28 @@ export async function postUserMessageTurn(input: {
                 ? { recordAgentRunUsage: input.recordAgentRunUsage }
                 : {}),
               personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+              ...(input.personalResourceAttachment
+                ? {
+                    personalResourceAttachment: input.personalResourceAttachment,
+                  }
+                : {}),
               mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+              controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
             }),
         ),
     );
   } catch (error) {
+    if (error instanceof WorkspaceControlBusyError) {
+      // Bounded control-prefix wait expired before any write; the request may
+      // be retried. The API layer renders the retryable 503 envelope.
+      throw error;
+    }
+    if (error instanceof PersonalResourceAttachmentAcceptanceError) {
+      throw new HTTPException(
+        error.kind === "invalid" ? 422 : error.kind === "forbidden" ? 403 : 409,
+        { message: error.message, cause: error },
+      );
+    }
     if (
       error instanceof QueueCommandConflictError ||
       error instanceof SessionControlConflictError
@@ -1209,46 +1323,52 @@ export async function postUserMessageTurn(input: {
     throw error;
   }
   const postCommitTask = async () => {
-    try {
-      await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);
-      if (result.workspaceControlEventId) {
-        const controlEvent = await getWorkspaceControlEvent(
-          db,
-          workspaceId,
-          result.workspaceControlEventId,
-        );
-        if (!controlEvent) {
-          throw new Error(
-            `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,
-          );
+    await Promise.all([
+      (async () => {
+        try {
+          await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);
+          if (result.workspaceControlEventId) {
+            const controlEvent = await getWorkspaceControlEvent(
+              db,
+              workspaceId,
+              result.workspaceControlEventId,
+            );
+            if (!controlEvent) {
+              throw new Error(
+                `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,
+              );
+            }
+            await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);
+          }
+        } catch {
+          console.warn("[sessions] prompt event fanout failed; durable rows remain replayable", {
+            errorClass: "PromptEventFanoutOperationError",
+            errorCode: "session_prompt_event_fanout_failed",
+            origin: "core",
+          });
         }
-        await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);
-      }
-    } catch {
-      console.warn("[sessions] prompt event fanout failed; durable rows remain replayable", {
-        errorClass: "PromptEventFanoutOperationError",
-        errorCode: "session_prompt_event_fanout_failed",
-        origin: "core",
-      });
-    }
-    try {
-      await workflowClient.wakeSessionWorkflow({
-        accountId,
-        workspaceId,
-        sessionId,
-        workflowId: result.turn.temporalWorkflowId,
-        wakeRevision: result.wakeRevision,
-        ...((input.delivery ?? "send") === "steer" || result.interruptionCount > 0
-          ? { interruptionRequested: true }
-          : {}),
-      });
-    } catch {
-      console.warn("[sessions] workflow wake failed; durable outbox will retry", {
-        errorClass: "WorkflowWakeOperationError",
-        errorCode: "session_workflow_wake_failed",
-        origin: "core",
-      });
-    }
+      })(),
+      (async () => {
+        try {
+          await workflowClient.wakeSessionWorkflow({
+            accountId,
+            workspaceId,
+            sessionId,
+            workflowId: result.turn.temporalWorkflowId,
+            wakeRevision: result.wakeRevision,
+            ...((input.delivery ?? "send") === "steer" || result.interruptionCount > 0
+              ? { interruptionRequested: true }
+              : {}),
+          });
+        } catch {
+          console.warn("[sessions] workflow wake failed; durable outbox will retry", {
+            errorClass: "WorkflowWakeOperationError",
+            errorCode: "session_workflow_wake_failed",
+            origin: "core",
+          });
+        }
+      })(),
+    ]);
   };
   const schedulePostCommit =
     input.schedulePostCommit ??
@@ -1267,6 +1387,33 @@ export async function postUserMessageTurn(input: {
   return {
     accepted: result.accepted,
     turn: result.turn,
+    receipt: {
+      id: result.receipt.id,
+      action: result.receipt.action,
+      operationKey: result.receipt.operationKey,
+      targetSessionId: result.receipt.targetSessionId,
+      targetTurnId: result.receipt.targetTurnId,
+      appliedControlRevision: result.receipt.appliedControlRevision,
+      appliedQueueVersion: result.receipt.appliedQueueVersion,
+      appliedTurnVersion: result.receipt.appliedTurnVersion,
+      appliedDraftRevision: result.receipt.appliedDraftRevision,
+      createdAt: result.receipt.createdAt.toISOString(),
+    },
+    routing: result.routing,
+    draft: result.draft
+      ? {
+          revision: result.draft.revision,
+          text: result.draft.text,
+          annotations: DraftTimelineAnnotations.parse(result.draft.annotations),
+          resources: result.draft.resources as ResourceRef[],
+          model: result.draft.model,
+          reasoningEffort: result.draft.reasoningEffort as ReasoningEffort,
+          latencyMode: result.draft.latencyMode as ComposerDraft["latencyMode"],
+          sourceTurnId: result.draft.sourceTurnId,
+          sourceTurnVersion: result.draft.sourceTurnVersion,
+          updatedAt: result.draft.updatedAt.toISOString(),
+        }
+      : null,
     interruptionCount: result.interruptionCount,
     replay: result.replay,
   };
@@ -1281,14 +1428,69 @@ export async function postUserMessageTurn(input: {
  * trusted immediate parent, while explicit arrays (including []) win. A
  * top-level create with omitted tools applies workspace-default capability MCPs.
  */
+export function resolveChildGoalFromAcceptedSnapshot(
+  goal: GoalSpec,
+  parentGoalSnapshot: SessionGoalSnapshot,
+): GoalSpec {
+  const inheritedRootConstraints =
+    parentGoalSnapshot.state === "none" ? [] : parentGoalSnapshot.rootConstraints;
+  const requestedRootConstraints = goal.rootConstraints;
+  if (
+    requestedRootConstraints?.some((constraint) => !inheritedRootConstraints.includes(constraint))
+  ) {
+    throw new Error(
+      "child goal rootConstraints must be an exact subset of the calling turn's frozen root constraints",
+    );
+  }
+  return {
+    ...goal,
+    rootConstraints: requestedRootConstraints ?? inheritedRootConstraints,
+  };
+}
+
+export function resolveSessionCreateVisibility(input: {
+  requestedVisibility: "private" | "workspace";
+  visibilityProvided: boolean;
+  parentVisibility: "user_private" | "workspace_shared" | null;
+}): "user_private" | "workspace_shared" {
+  if (input.parentVisibility === "user_private") {
+    if (input.visibilityProvided && input.requestedVisibility !== "private") {
+      throw new Error("A private parent cannot create a workspace-visible child");
+    }
+    return "user_private";
+  }
+  if (input.parentVisibility === "workspace_shared") {
+    if (input.visibilityProvided && input.requestedVisibility === "private") {
+      throw new Error("A workspace-visible parent cannot create a private child");
+    }
+    return "workspace_shared";
+  }
+  return input.requestedVisibility === "private" ? "user_private" : "workspace_shared";
+}
+
 export async function createSessionForRequestWithOutcome(
   deps: ApiRouteDeps,
   grant: AccessGrant,
   workspaceId: string,
   rawPayload: unknown,
+  authorization?: AccessGrantAuthorization,
 ): Promise<CreateSessionRequestOutcome> {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   const payload = CreateSessionRequest.parse(rawPayload);
+  const visibilityProvided = hasOwnProperty(rawPayload, "visibility");
+  if (payload.visibility === "private" && !grant.metadata?.["sessionId"]) {
+    if (!authorization) {
+      throw new HTTPException(403, {
+        message: "managed human session required",
+      });
+    }
+    await requireManagedHumanPrivateSessionCreate(deps, authorization, workspaceId);
+    if (payload.sandbox === "shared" || typeof payload.sandbox === "object") {
+      throw new HTTPException(422, {
+        message: "Only-me sessions require their own sandbox",
+      });
+    }
+  }
   if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
     throw new HTTPException(422, {
       message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
@@ -1308,6 +1510,13 @@ export async function createSessionForRequestWithOutcome(
       throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));
     }
   }
+  await requireAtomicPersonalResourceAttachment(
+    deps,
+    authorization,
+    workspaceId,
+    payload.personalResourceAttachment,
+    false,
+  );
   // Parent linkage and execution-context inheritance come ONLY from the
   // worker-signed sessionId claim. A caller cannot nominate a parent in the
   // payload, so inheriting an existing repository/tool/credential snapshot does
@@ -1336,10 +1545,37 @@ export async function createSessionForRequestWithOutcome(
       message: `parent session not found in workspace: ${parentSessionId}`,
     });
   }
+  const workspace = await requireWorkspace(db, workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  const parentAuthority = parentSession
+    ? await getSessionAuthorityProjection(db, workspaceId, parentSession.id)
+    : null;
+  if (parentSession && !parentAuthority) {
+    throw new HTTPException(403, {
+      message: "parent session authority is unavailable",
+    });
+  }
+  let effectiveVisibility: "user_private" | "workspace_shared";
+  try {
+    effectiveVisibility = resolveSessionCreateVisibility({
+      requestedVisibility: payload.visibility,
+      visibilityProvided,
+      parentVisibility: parentAuthority?.visibility ?? null,
+    });
+  } catch (error) {
+    throw new HTTPException(422, {
+      message: error instanceof Error ? error.message : "invalid child visibility",
+    });
+  }
   const creationInitiator = creationInitiatorForGrant(grant);
   const parentCallingTurn =
     parentSession && creationInitiator.actor
-      ? await getSessionTurn(db, workspaceId, creationInitiator.actor.turnId)
+      ? await getSessionTurnForAttempt(
+          db,
+          workspaceId,
+          parentSession.id,
+          creationInitiator.actor.attemptId,
+        )
       : null;
   if (
     creationInitiator.actor &&
@@ -1349,6 +1585,26 @@ export async function createSessionForRequestWithOutcome(
       message: "caller attempt does not belong to the parent session",
     });
   }
+  let effectiveGoal = payload.goal;
+  if (parentSession && payload.goal) {
+    try {
+      effectiveGoal = resolveChildGoalFromAcceptedSnapshot(
+        payload.goal,
+        parentCallingTurn?.goalSnapshot ?? {
+          state: "none",
+          capturedAt: "unavailable",
+        },
+      );
+    } catch (error) {
+      throw new HTTPException(422, {
+        message: error instanceof Error ? error.message : "invalid child goal root constraints",
+      });
+    }
+  }
+  const personalResourceSubjectId = creationInitiator.actor
+    ? (await requireLiveAgentAttemptAuthorization(db, grant, creationInitiator.actor.sessionId))
+        .initiatingHumanSubjectId
+    : grant.subjectId;
   const xaiProviderAccountAuthoritySnapshot =
     parentSession && creationInitiator.actor
       ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(
@@ -1358,13 +1614,25 @@ export async function createSessionForRequestWithOutcome(
           creationInitiator.actor.turnId,
         )
       : undefined;
+  const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
+  const inheritedPersonalConnectionDelegations =
+    connectionDelegationSource.kind === "turn"
+      ? await getSessionTurnPersonalConnectionDelegations(
+          db,
+          workspaceId,
+          connectionDelegationSource.sessionId,
+          connectionDelegationSource.turnId,
+        )
+      : null;
   const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
     db,
     workspaceId,
     settings,
-    {
-      subjectId: grant.subjectId,
-    },
+    inheritedPersonalConnectionDelegations
+      ? {
+          personalConnectionDelegations: inheritedPersonalConnectionDelegations,
+        }
+      : { subjectId: grant.subjectId },
   );
   const sessionMcpServers = hasOwnProperty(rawPayload, "mcpServers")
     ? validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers)
@@ -1386,6 +1654,10 @@ export async function createSessionForRequestWithOutcome(
     ? payload.skills
     : (parentSession?.skills ?? payload.skills);
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
+  // Visibility became durable draft state after older clients had already
+  // written rows without it. Compare it only when the create request supplied
+  // the field explicitly; the parsed schema default must not manufacture a
+  // mismatch for a legacy draft.
   const requestedTools = validateToolRefs(
     toolsProvided ? payload.tools : (parentSession?.tools ?? payload.tools),
     runtimeSettings,
@@ -1396,10 +1668,11 @@ export async function createSessionForRequestWithOutcome(
     const parentTracksWorkspaceDefaults = parentSession.toolPolicy?.mode === "workspace_default";
     const parentEffective = withFirstPartyTools(
       parentTracksWorkspaceDefaults
-        ? withDefaultEnabledCapabilityMcpTools(
+        ? withWorkspaceDefaultMcpTools(
             availableToolRefs(parentSession.tools, runtimeSettings),
             settings,
             runtimeSettings,
+            workspaceSessionToolDefaults,
           )
         : parentSession.tools,
       runtimeSettings,
@@ -1426,10 +1699,11 @@ export async function createSessionForRequestWithOutcome(
     selectedTools = requestedTools;
     toolPolicy = { mode: "explicit", inheritedFromSessionId: null };
   } else {
-    selectedTools = withDefaultEnabledCapabilityMcpTools(
+    selectedTools = withWorkspaceDefaultMcpTools(
       requestedTools,
       settings,
       capabilityRuntimeSettings,
+      workspaceSessionToolDefaults,
     );
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
@@ -1438,13 +1712,6 @@ export async function createSessionForRequestWithOutcome(
   // tool's permission/target authorization predicate, so attachment alone
   // exposes nothing.
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
-    db,
-    workspaceId,
-    settings: runtimeSettings,
-    tools,
-    source: personalConnectionDelegationSourceForGrant(grant),
-  });
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException(503, {
@@ -1479,7 +1746,7 @@ export async function createSessionForRequestWithOutcome(
   let frozenRigId: string | null = null;
   let frozenRigVersionId: string | null = null;
   if (requestedRigId) {
-    const rig = await getRig(db, workspaceId, requestedRigId);
+    const rig = await getRig(db, grant, requestedRigId);
     if (!rig || !rig.activeVersion) {
       if (payload.rigId) {
         throw new HTTPException(422, {
@@ -1490,6 +1757,14 @@ export async function createSessionForRequestWithOutcome(
       }
       // else: workspace-default fallback that no longer resolves → rig-less.
     } else {
+      for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
+        await validateVariableSetAttachment(
+          { settings, db },
+          grant,
+          workspaceId,
+          defaultVariableSetId,
+        );
+      }
       frozenRigId = rig.id;
       frozenRigVersionId = rig.activeVersion.id;
     }
@@ -1526,14 +1801,44 @@ export async function createSessionForRequestWithOutcome(
   await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
   const inheritedReasoningEffort =
     parentCallingTurn?.reasoningEffort ??
-    (parentSession
-      ? reasoningEffortForSession(parentSession.metadata, settings.openaiReasoningEffort)
-      : settings.openaiReasoningEffort);
+    parentSession?.reasoningEffort ??
+    settings.openaiReasoningEffort;
   const inheritedLatencyMode =
-    parentCallingTurn?.latencyMode ??
-    (parentSession ? latencyModeForSession(parentSession.metadata, "standard") : "standard");
+    parentCallingTurn?.latencyMode ?? parentSession?.latencyMode ?? "standard";
   const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;
   const latencyMode = payload.latencyMode ?? inheritedLatencyMode;
+  if (payload.expectedNewSessionDraftRevision !== undefined && payload.rigId === null) {
+    throw new HTTPException(409, {
+      message: "The submitted session options are not represented by the new-session draft",
+    });
+  }
+  const expectedNewSessionDraftSnapshot: NewSessionDraftSnapshot | null =
+    payload.expectedNewSessionDraftRevision !== undefined
+      ? {
+          text: payload.initialMessage ?? "",
+          resources,
+          tools: toolsProvided ? requestedTools : [],
+          toolsProvided,
+          model,
+          reasoningEffort,
+          latencyMode,
+          options: {
+            ...(visibilityProvided ? { visibility: payload.visibility } : {}),
+            ...(payload.sandboxBackend ? { sandboxBackend: payload.sandboxBackend } : {}),
+            ...(payload.targetSandboxId ? { targetSandboxId: payload.targetSandboxId } : {}),
+            ...(payload.workingDir ? { workingDir: payload.workingDir } : {}),
+            ...(payload.variableSetId ? { variableSetId: payload.variableSetId } : {}),
+            ...(payload.rigId ? { rigId: payload.rigId } : {}),
+            ...(payload.goal ? { goal: payload.goal } : {}),
+            ...(payload.firstPartyMcpPermissions
+              ? { firstPartyMcpPermissions: payload.firstPartyMcpPermissions }
+              : {}),
+            ...(payload.firstPartyMcpTools
+              ? { firstPartyMcpTools: payload.firstPartyMcpTools }
+              : {}),
+          },
+        }
+      : null;
   const inheritedFromParent = parentSession !== null;
   const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
     modelId: model,
@@ -1615,7 +1920,7 @@ export async function createSessionForRequestWithOutcome(
   // and never gains an unrequested permission. Top-level omission remains the
   // deployment's worker default, which includes the goal tools.
   if (
-    payload.goal &&
+    effectiveGoal &&
     firstPartyMcpPermissions &&
     !firstPartyMcpPermissions.includes("goals:manage")
   ) {
@@ -1626,7 +1931,8 @@ export async function createSessionForRequestWithOutcome(
   }
   // Tool visibility is independent from permission authority. A child that
   // omits the field inherits the parent's exact effective selection; a
-  // top-level omission selects the safe non-connector default catalog.
+  // top-level omission selects the workspace's exact default catalog (or the
+  // deployment default when the workspace has not configured one).
   const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(settings);
   const disallowedFirstPartyMcpTool = payload.firstPartyMcpTools?.find(
     (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
@@ -1636,12 +1942,37 @@ export async function createSessionForRequestWithOutcome(
       message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,
     });
   }
+  const workspaceFirstPartyDefaults = workspaceSessionToolDefaults?.firstPartyMcpTools.filter(
+    (tool) => deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
+  );
   const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
     payload.firstPartyMcpTools,
     parentSession ? parentSession.firstPartyMcpTools : undefined,
-    deploymentFirstPartyMcpToolPolicy,
+    workspaceFirstPartyDefaults && !parentSession
+      ? { ...deploymentFirstPartyMcpToolPolicy, default: workspaceFirstPartyDefaults }
+      : deploymentFirstPartyMcpToolPolicy,
   );
-  if (payload.goal) {
+  const googleDrivePublicationEnabled =
+    firstPartyMcpTools.includes("editable_artifact_export") &&
+    firstPartyMcpTools.includes("editable_artifact_export_status") &&
+    (!firstPartyMcpPermissions?.length ||
+      (firstPartyMcpPermissions.includes("artifacts:read") &&
+        firstPartyMcpPermissions.includes("artifacts:publish")));
+  const atlassianEnabled =
+    firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
+    (!firstPartyMcpPermissions?.length || firstPartyMcpPermissions.includes("connections:read"));
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db,
+    workspaceId,
+    settings: runtimeSettings,
+    tools,
+    resources,
+    source: connectionDelegationSource,
+    authoritySelections: payload.connectionAuthorities,
+    googleDrivePublicationEnabled,
+    atlassianEnabled,
+  });
+  if (effectiveGoal) {
     const missingGoalTools = ["goal_update", "goal_progress", "goal_complete", "goal_pause"].filter(
       (name) => !firstPartyMcpTools.includes(name as FirstPartyMcpToolName),
     );
@@ -1669,7 +2000,12 @@ export async function createSessionForRequestWithOutcome(
   // spawned FROM INSIDE a session (parentSessionId present ⇒ a worker-signed
   // sessionId claim) defaults to "shared" (join the creator's box); a top-level
   // create (no parent) defaults to "new" (a private singleton box). Explicit
-  // values always win.
+  // values always win — except a named `targetSandboxId` is a different compute
+  // home, not a share of the creator's box. Omission plus a machine target
+  // therefore defaults to "new" so the honest-label selfhosted home can fire
+  // (a backend:"none" parent has no box to share; inheriting "none" then 422s
+  // at seed). Explicit shared/{groupId} plus a machine target is contradictory
+  // and 422s rather than silently dropping the target.
   //
   // null sandboxGroupId ⇒ createSession seeds the new row's own id (singleton,
   // today's 1:1 behavior). A shared/{groupId} spawn inherits the box's backend
@@ -1678,7 +2014,14 @@ export async function createSessionForRequestWithOutcome(
   // getAnySessionInGroup are RLS-workspace-scoped, so a foreign parent/group
   // returns null → 404; the group uuid is NOT an access boundary, the workspace
   // filter is (stress (e)).
-  const sandboxChoice = payload.sandbox ?? (parentSessionId ? "shared" : "new");
+  if (payload.targetSandboxId && payload.sandbox !== undefined && payload.sandbox !== "new") {
+    throw new HTTPException(422, {
+      message:
+        "targetSandboxId requires an own sandbox (omit sandbox or pass 'new'); it cannot join a shared group",
+    });
+  }
+  const sandboxChoice =
+    payload.sandbox ?? (payload.targetSandboxId ? "new" : parentSessionId ? "shared" : "new");
   let sandboxGroupId: string | null = null;
   let inheritedBackend: Session["sandboxBackend"] | undefined;
   // ENV-AWARE GROUPING: under the CURRENT mechanics the workspace VariableSet is
@@ -1816,19 +2159,22 @@ export async function createSessionForRequestWithOutcome(
         "workingDir requires targetSandboxId (it is the targeted machine's working directory)",
     });
   }
-  // Honest-label (Stage-D closure): a top-level session TARGETED at a Connected
+  // Honest-label (Stage-D closure): a session TARGETED at a Connected
   // Machine (a selfhosted sandbox) runs machine-primary every turn, so its HOME
   // sandbox_backend must read "selfhosted" — not the deployment cloud default —
   // so the session row + first turn honestly reflect where the agent runs (the
   // Machines dashboard, the turn's warm-metering, and the file-download plane all
-  // key off this). GUARDS: (1) only at a TOP-LEVEL create (inheritedBackend
-  // undefined) — a shared/{groupId} spawn is literally the creator's box and must
-  // NOT be relabeled; (2) only when the target's kind is actually "selfhosted" —
-  // targetSandboxId also accepts a first-class MODAL sandbox id (resolveTarget),
-  // which must never be mislabeled. A not-found / non-selfhosted / modal target
-  // falls through to the default; the seed swap in createAndStartSession still
-  // validates ownership/liveness and 422s a bad target. (3) only when the feature
-  // flags that make the worker actually take the machine-primary path are ON
+  // key off this). GUARDS: (1) only when not inheriting a shared box
+  // (inheritedBackend undefined). Named targetSandboxId already 422s
+  // shared/{groupId} and defaults omission to own-box above, so this check is a
+  // backstop if those placement rules change; a shared spawn without a target
+  // is still literally the creator's box and must NOT be relabeled; (2) only
+  // when the target's kind is actually "selfhosted" — targetSandboxId also
+  // accepts a first-class MODAL sandbox id (resolveTarget), which must never be
+  // mislabeled. A not-found / non-selfhosted / modal target falls through to the
+  // default; the seed swap in createAndStartSession still validates
+  // ownership/liveness and 422s a bad target. (3) only when the feature flags
+  // that make the worker actually take the machine-primary path are ON
   // (sandboxOwnershipEnabled + sandboxSelfhostedEnabled/routing) — otherwise the
   // worker ignores the active pointer and a home="selfhosted" turn would fall to
   // the registry client with no bound agentId and throw; with the flags off we
@@ -1849,11 +2195,19 @@ export async function createSessionForRequestWithOutcome(
     settings.sandboxOwnershipEnabled &&
     settings.sandboxSelfhostedEnabled
   ) {
-    const targetSandbox = await getSandbox(db, workspaceId, payload.targetSandboxId);
+    const targetSandbox = await getSandbox(
+      db,
+      personalResourceSubjectId ? { ...grant, subjectId: personalResourceSubjectId } : grant,
+      payload.targetSandboxId,
+    );
     if (targetSandbox?.kind === "selfhosted") {
       machineHomeBackend = "selfhosted";
       if (targetSandbox.enrollmentId) {
-        const enrollment = await getEnrollment(db, workspaceId, targetSandbox.enrollmentId);
+        const enrollment = await getEnrollment(
+          db,
+          targetSandbox.workspaceId,
+          targetSandbox.enrollmentId,
+        );
         if (
           enrollment &&
           (enrollment.os === "macos" || enrollment.os === "windows" || enrollment.os === "linux")
@@ -1881,6 +2235,7 @@ export async function createSessionForRequestWithOutcome(
       workflowClient,
       accountId: grant.accountId,
       workspaceId,
+      visibility: effectiveVisibility,
       initialMessage: payload.initialMessage ?? "",
       deferInitialTurn: payload.startMode === "realtime",
       modelContext: payload.modelContext ?? null,
@@ -1895,14 +2250,13 @@ export async function createSessionForRequestWithOutcome(
       turnExecutionPolicy,
       // A shared spawn inherits the box's backend; a caller-supplied
       // sandboxBackend on a shared spawn is ignored (it is the same box). A
-      // machine-targeted top-level create labels the home "selfhosted"
-      // (machineHomeBackend), overriding the caller/deployment default so the row
-      // matches where the session actually runs.
+      // machine-targeted create (top-level or own-box child) labels the home
+      // "selfhosted" (machineHomeBackend), overriding the caller/deployment
+      // default so the row matches where the session actually runs.
       sandboxBackend:
         inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend,
-      // Mirror the backend relabel on the OS axis: only a machine-targeted
-      // top-level create carries a derived OS; everything else is omitted and the
-      // "linux" default holds (shared spawns keep the parent-box behavior).
+      // Mirror the backend relabel on the OS axis: a machine-targeted own-box
+      // create carries a derived OS; shared spawns keep the parent-box behavior.
       ...(machineHomeOs ? { sandboxOs: machineHomeOs } : {}),
       sandboxGroupId,
       metadata: payload.metadata,
@@ -1914,7 +2268,7 @@ export async function createSessionForRequestWithOutcome(
       rigId: frozenRigId,
       rigVersionId: frozenRigVersionId,
       channelId,
-      goal: payload.goal ?? null,
+      goal: effectiveGoal ?? null,
       // Per-session persona instructions (already trimmed/validated by the
       // contracts schema). Persisted on the row; composed system-level at turn
       // time. Not surfaced as an event.
@@ -1925,6 +2279,7 @@ export async function createSessionForRequestWithOutcome(
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
       personalConnectionDelegations,
+      initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
       ...(xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {}),
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
@@ -1940,17 +2295,41 @@ export async function createSessionForRequestWithOutcome(
             sandboxId: payload.targetSandboxId,
             settings,
             workingDir: payload.workingDir ?? null,
+            resourceSubjectId: personalResourceSubjectId,
           }
         : null,
       consumeNewSessionDraft:
-        payload.expectedNewSessionDraftRevision !== undefined
+        payload.expectedNewSessionDraftRevision !== undefined && payload.startMode !== "realtime"
           ? {
               subjectId: grant.subjectId,
               expectedRevision: payload.expectedNewSessionDraftRevision,
+              expectedSnapshot: expectedNewSessionDraftSnapshot!,
+              acceptedSelection: {
+                channelId,
+                targetSandboxId: payload.targetSandboxId ?? null,
+                workingDir: payload.targetSandboxId ? (payload.workingDir ?? null) : null,
+              },
+            }
+          : null,
+      rememberNewSessionSelection:
+        payload.expectedNewSessionDraftRevision !== undefined && payload.startMode === "realtime"
+          ? {
+              subjectId: grant.subjectId,
+              acceptedSelection: {
+                channelId,
+                targetSandboxId: payload.targetSandboxId ?? null,
+                workingDir: payload.targetSandboxId ? (payload.workingDir ?? null) : null,
+              },
             }
           : null,
     });
   } catch (error) {
+    if (error instanceof PersonalResourceAttachmentAcceptanceError) {
+      throw new HTTPException(
+        error.kind === "invalid" ? 422 : error.kind === "forbidden" ? 403 : 409,
+        { message: error.message, cause: error },
+      );
+    }
     if (error instanceof AgentCommandAuthorityError) {
       throw new HTTPException(403, { message: error.message });
     }
@@ -1959,6 +2338,15 @@ export async function createSessionForRequestWithOutcome(
         message: "requested session id is already in use",
       });
     }
+    if (error instanceof NewSessionDraftConflictError) {
+      throw new HTTPException(409, {
+        message: error.message,
+        cause: error,
+      });
+    }
+    if (error instanceof SessionCreateIdempotencyConflictError) {
+      throw new HTTPException(409, { message: error.message, cause: error });
+    }
     throw error;
   }
   let usageRecording: CreateSessionRequestOutcome["usageRecording"] = "recorded";
@@ -2005,8 +2393,11 @@ export async function createSessionForRequest(
   grant: AccessGrant,
   workspaceId: string,
   rawPayload: unknown,
+  authorization?: AccessGrantAuthorization,
 ): Promise<CreateSessionResponse> {
-  return (await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload)).session;
+  return (
+    await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload, authorization)
+  ).session;
 }
 
 /**
@@ -2031,14 +2422,20 @@ export async function acceptSessionUserMessageWithOutcome(
     latencyMode?: "standard" | "priority" | "fast" | null;
     clientEventId?: string;
     mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
+    connectionAuthorities?: McpConnectionAuthoritySelection[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
+    personalResourceAttachment?: PersonalResourceAttachmentIntent;
+    authorization?: AccessGrantAuthorization;
   },
 ): Promise<{
   accepted: SessionEvent;
   turn: SessionTurn;
+  draft: ComposerDraft | null;
+  receipt: SessionCommandReceipt;
+  routing: SessionPromptRouting;
   interruptionCount: number;
   replay: boolean;
 }> {
@@ -2049,6 +2446,13 @@ export async function acceptSessionUserMessageWithOutcome(
     operation: input.delivery === "steer" ? "session.steer" : "session.append",
     surface: "core",
   });
+  await requireAtomicPersonalResourceAttachment(
+    deps,
+    input.authorization,
+    workspaceId,
+    input.personalResourceAttachment,
+    true,
+  );
   // Hoisted above requireLimit so the codex-billed predicate can resolve the
   // turn's effective model (a follow-up turn inherits the session's model). A
   // pure read with no side effects.
@@ -2067,12 +2471,9 @@ export async function acceptSessionUserMessageWithOutcome(
     }
     throw error;
   }
-  const sessionReasoningEffort = reasoningEffortForSession(
-    existingSession.metadata,
-    settings.openaiReasoningEffort,
-  );
+  const sessionReasoningEffort = existingSession.reasoningEffort;
   const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
-  const sessionLatencyMode = latencyModeForSession(existingSession.metadata, "standard");
+  const sessionLatencyMode = existingSession.latencyMode;
   const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
   const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
     modelId: effectiveModel,
@@ -2119,60 +2520,96 @@ export async function acceptSessionUserMessageWithOutcome(
     session: existingSession,
     updates: input.mcpCredentialUpdates ?? [],
   });
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
-    subjectId: grant.subjectId,
-  });
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+  const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
+  const inheritedPersonalConnectionDelegations =
+    connectionDelegationSource.kind === "turn"
+      ? await getSessionTurnPersonalConnectionDelegations(
+          db,
+          workspaceId,
+          connectionDelegationSource.sessionId,
+          connectionDelegationSource.turnId,
+        )
+      : null;
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     db,
     workspaceId,
-    settings: runtimeSettings,
-    tools: existingSession.tools,
-    source: personalConnectionDelegationSourceForGrant(grant),
-  });
-  const { accepted, turn, interruptionCount, replay } = await postUserMessageTurn({
-    db,
-    bus,
-    workflowClient,
     settings,
-    accountId: grant.accountId,
-    workspaceId,
-    sessionId,
-    text: input.text,
-    annotations,
-    modelContext: input.modelContext ?? null,
-    resources: requestedResources,
-    model: input.model ?? null,
-    reasoningEffort: input.reasoningEffort ?? null,
-    latencyMode: input.latencyMode ?? null,
-    reasoningEffortFallback: sessionReasoningEffort,
-    turnExecutionPolicy,
-    mcpCredentialUpdates,
-    personalConnectionDelegations,
-    delivery: input.delivery ?? "send",
-    origin: delegatedServiceInitiator ? "operator" : (input.origin ?? "human"),
-    actor: grant.subjectId,
-    ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
-    ...(delegatedServiceInitiator
+    inheritedPersonalConnectionDelegations
       ? {
-          commandActor: {
-            type: "service" as const,
-            subjectId: delegatedServiceInitiator.initiator.subjectId,
-            ...(delegatedServiceInitiator.initiator.label
-              ? { subjectLabel: delegatedServiceInitiator.initiator.label }
-              : {}),
-            context: delegatedServiceInitiator.context,
-          },
+          personalConnectionDelegations: inheritedPersonalConnectionDelegations,
         }
-      : {}),
-    ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),
-    ...(input.expectedDraftRevision !== undefined
-      ? { expectedDraftRevision: input.expectedDraftRevision }
-      : {}),
-    ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
-    recordAgentRunUsage: true,
-    ...(deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}),
+      : { subjectId: grant.subjectId },
+  );
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db,
+    workspaceId,
+    settings: runtimeSettings,
+    tools: existingSession.tools,
+    resources: [...existingSession.resources, ...requestedResources],
+    source: connectionDelegationSource,
+    targetSessionId: sessionId,
+    googleDrivePublicationEnabled:
+      existingSession.firstPartyMcpTools.includes("editable_artifact_export") &&
+      existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") &&
+      (!existingSession.firstPartyMcpPermissions?.length ||
+        (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
+          existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
+    atlassianEnabled:
+      existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
+      (!existingSession.firstPartyMcpPermissions?.length ||
+        existingSession.firstPartyMcpPermissions.includes("connections:read")),
+    ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
   });
-  return { accepted, turn, interruptionCount, replay };
+  const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
+    await postUserMessageTurn({
+      db,
+      bus,
+      workflowClient,
+      settings,
+      accountId: grant.accountId,
+      workspaceId,
+      sessionId,
+      text: input.text,
+      annotations,
+      modelContext: input.modelContext ?? null,
+      resources: requestedResources,
+      model: input.model ?? null,
+      reasoningEffort: input.reasoningEffort ?? null,
+      latencyMode: input.latencyMode ?? null,
+      reasoningEffortFallback: sessionReasoningEffort,
+      turnExecutionPolicy,
+      mcpCredentialUpdates,
+      personalConnectionDelegations,
+      ...(input.personalResourceAttachment
+        ? { personalResourceAttachment: input.personalResourceAttachment }
+        : {}),
+      delivery: input.delivery ?? "send",
+      origin: delegatedServiceInitiator ? "operator" : (input.origin ?? "human"),
+      actor: grant.subjectId,
+      ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
+      ...(delegatedServiceInitiator
+        ? {
+            commandActor: {
+              type: "service" as const,
+              subjectId: delegatedServiceInitiator.initiator.subjectId,
+              ...(delegatedServiceInitiator.initiator.label
+                ? { subjectLabel: delegatedServiceInitiator.initiator.label }
+                : {}),
+              context: delegatedServiceInitiator.context,
+            },
+          }
+        : {}),
+      ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),
+      ...(input.expectedDraftRevision !== undefined
+        ? { expectedDraftRevision: input.expectedDraftRevision }
+        : {}),
+      ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
+      recordAgentRunUsage: true,
+      ...(deps.schedulePromptPostCommit
+        ? { schedulePostCommit: deps.schedulePromptPostCommit }
+        : {}),
+    });
+  return { accepted, turn, draft, receipt, routing, interruptionCount, replay };
 }
 
 /** Backward-compatible entity-returning path used by existing REST callers. */
@@ -2185,17 +2622,14 @@ export async function acceptSessionUserMessage(
 ): Promise<{
   accepted: SessionEvent;
   turn: SessionTurn;
+  receipt: SessionCommandReceipt;
+  routing: SessionPromptRouting;
   interruptionCount: number;
   replay: boolean;
 }> {
-  const { accepted, turn, interruptionCount, replay } = await acceptSessionUserMessageWithOutcome(
-    deps,
-    grant,
-    workspaceId,
-    sessionId,
-    input,
-  );
-  return { accepted, turn, interruptionCount, replay };
+  const { accepted, turn, receipt, routing, interruptionCount, replay } =
+    await acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, sessionId, input);
+  return { accepted, turn, receipt, routing, interruptionCount, replay };
 }
 
 /**
@@ -2342,6 +2776,7 @@ function toolPolicyAuditSnapshot(
       kind: tool.kind,
       id: tool.id,
       ...(tool.optional === undefined ? {} : { optional: tool.optional }),
+      ...(tool.eager === undefined ? {} : { eager: tool.eager }),
     }));
   const toolRefs = allToolRefs.slice(0, maxToolPolicyAuditRefs);
   return {
@@ -2384,6 +2819,8 @@ export async function updateSessionToolPolicy(
   requirePermission(grant, "sessions:control");
 
   const existingSession = await requireSession(deps.db, grant.workspaceId, sessionId);
+  const workspace = await requireWorkspace(deps.db, grant.workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
   const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     grant.workspaceId,
@@ -2424,10 +2861,19 @@ export async function updateSessionToolPolicy(
     });
   }
   const workspaceDefaultTools = withFirstPartyTools(
-    withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),
+    withWorkspaceDefaultMcpTools(
+      [],
+      deps.settings,
+      capabilityRuntimeSettings,
+      workspaceSessionToolDefaults,
+    ),
     runtimeSettings,
   );
-  const workspaceDefaultFirstPartyTools = [...deploymentFirstPartyMcpToolPolicy.default];
+  const workspaceDefaultFirstPartyTools = [
+    ...(workspaceSessionToolDefaults?.firstPartyMcpTools.filter((tool) =>
+      deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
+    ) ?? deploymentFirstPartyMcpToolPolicy.default),
+  ];
   const events = await appendSessionEventsWithLockedSessionUpdate(
     deps.db,
     grant.workspaceId,
@@ -2451,10 +2897,11 @@ export async function updateSessionToolPolicy(
         const parentTracksWorkspaceDefaults = parent.toolPolicy?.mode === "workspace_default";
         const parentEffective = withFirstPartyTools(
           parentTracksWorkspaceDefaults
-            ? withDefaultEnabledCapabilityMcpTools(
+            ? withWorkspaceDefaultMcpTools(
                 availableToolRefs(parent.tools, runtimeSettings),
                 deps.settings,
                 runtimeSettings,
+                workspaceSessionToolDefaults,
               )
             : parent.tools,
           runtimeSettings,