@opengeni/core 2.5.3 → 2.6.4-canary.0

package/dist/index.js

@@ -125,8 +125,8 @@ import {
   markManagedAuthRequestActorTransitionApplied,
   releaseManagedAuthRequestActorLease,
   validateManagedAuthRequestActorLease
-} from "./chunk-ZVZJTMSV.js";
-import "./chunk-YGOMUGYS.js";
+} from "./chunk-OF65T3PM.js";
+import "./chunk-QO5GVFFO.js";
 
 // src/workflow-wake-contract.ts
 var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
@@ -208,6 +208,367 @@ function filenameForMimeType(mimeType) {
   }
 }
 
+// src/model-catalog.ts
+import {
+  applyModelCatalogDocument,
+  configuredGatewayWorkspaceProductModelIds,
+  configuredModels,
+  configuredModelNotes,
+  configuredOpenRouterWorkspaceProductModelIds,
+  configuredProviders,
+  validateModelCatalogSettings,
+  withCodexCatalogProvider,
+  withWorkspaceGatewayCatalogProvider,
+  withWorkspaceOpenRouterCatalogProvider,
+  withXaiSubscriptionCatalogProvider,
+  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
+  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
+  WORKSPACE_OPENROUTER_PROVIDER_ID
+} from "@opengeni/config";
+import {
+  evaluateWorkspaceModelPolicy
+} from "@opengeni/contracts";
+import {
+  getDeploymentModelCatalog,
+  getWorkspaceGatewayCustomModelForExecution,
+  getWorkspaceOpenRouterCustomModelForExecution,
+  listWorkspaceGatewayCustomModels,
+  listWorkspaceOpenRouterCustomModels
+} from "@opengeni/db";
+function isWorkspaceGatewayCustomModelId(settings, modelId) {
+  return modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) && !configuredGatewayWorkspaceProductModelIds(settings).includes(modelId);
+}
+function isWorkspaceOpenRouterCustomModelId(settings, modelId) {
+  return modelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) && !configuredOpenRouterWorkspaceProductModelIds(settings).includes(modelId);
+}
+function workspaceCustomModelReference(settings, modelId) {
+  if (isWorkspaceGatewayCustomModelId(settings, modelId)) {
+    return {
+      providerKind: "vercel_gateway",
+      upstreamModelId: modelId.slice(WORKSPACE_GATEWAY_MODEL_ID_PREFIX.length)
+    };
+  }
+  if (isWorkspaceOpenRouterCustomModelId(settings, modelId)) {
+    return {
+      providerKind: "openrouter",
+      upstreamModelId: modelId.slice(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX.length)
+    };
+  }
+  return null;
+}
+function isWorkspaceCustomModelId(settings, modelId) {
+  return workspaceCustomModelReference(settings, modelId) !== null;
+}
+async function resolveCatalogSettings(db, envSettings) {
+  if (envSettings.modelCatalogSource === "code") {
+    validateModelCatalogSettings(envSettings);
+    return {
+      settings: envSettings,
+      source: "code",
+      version: null,
+      modelNotes: configuredModelNotes(envSettings)
+    };
+  }
+  const row = await getDeploymentModelCatalog(db);
+  if (!row) {
+    throw new Error("database model catalog source is configured but the singleton row is missing");
+  }
+  const settings = applyModelCatalogDocument(envSettings, row.document);
+  validateModelCatalogSettings(settings);
+  return {
+    settings,
+    source: "database",
+    version: row.version,
+    modelNotes: configuredModelNotes(settings)
+  };
+}
+async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
+  const retainedProductModelIds = [
+    ...input.retainedProductModelIds ?? [],
+    input.retainedProductModelId
+  ];
+  const retainedGatewayUpstreamModelIds = retainedProductModelIds.flatMap(
+    (productModelId) => productModelId?.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ? [productModelId.slice(WORKSPACE_GATEWAY_MODEL_ID_PREFIX.length)] : []
+  );
+  const retainedOpenRouterUpstreamModelIds = retainedProductModelIds.flatMap(
+    (productModelId) => productModelId?.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) ? [productModelId.slice(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX.length)] : []
+  );
+  const [
+    resolved,
+    activeGatewayCustomModels,
+    activeOpenRouterCustomModels,
+    retainedGatewayCustomModels,
+    retainedOpenRouterCustomModels
+  ] = await Promise.all([
+    resolveCatalogSettings(db, envSettings),
+    listWorkspaceGatewayCustomModels(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId
+    }),
+    listWorkspaceOpenRouterCustomModels(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId
+    }),
+    Promise.all(
+      [...new Set(retainedGatewayUpstreamModelIds)].map(
+        async (upstreamModelId) => await getWorkspaceGatewayCustomModelForExecution(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          upstreamModelId
+        })
+      )
+    ),
+    Promise.all(
+      [...new Set(retainedOpenRouterUpstreamModelIds)].map(
+        async (upstreamModelId) => await getWorkspaceOpenRouterCustomModelForExecution(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          upstreamModelId
+        })
+      )
+    )
+  ]);
+  const includeRetainedModels = (activeModels, retainedModels) => {
+    const customModels = [...activeModels];
+    const includedUpstreamModelIds = new Set(activeModels.map((model) => model.upstreamModelId));
+    for (const retainedCustomModel of retainedModels) {
+      if (retainedCustomModel && !includedUpstreamModelIds.has(retainedCustomModel.upstreamModelId)) {
+        customModels.push(retainedCustomModel);
+        includedUpstreamModelIds.add(retainedCustomModel.upstreamModelId);
+      }
+    }
+    return customModels;
+  };
+  const gatewayCustomModels = includeRetainedModels(
+    activeGatewayCustomModels,
+    retainedGatewayCustomModels
+  );
+  const openRouterCustomModels = includeRetainedModels(
+    activeOpenRouterCustomModels,
+    retainedOpenRouterCustomModels
+  );
+  return {
+    ...resolved,
+    settings: withWorkspaceOpenRouterCatalogProvider(
+      withWorkspaceGatewayCatalogProvider(resolved.settings, gatewayCustomModels),
+      openRouterCustomModels
+    )
+  };
+}
+var MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS = 5 * 6e4;
+function modelDefinitionRunnable(model) {
+  return model.capabilities.inputModalities.includes("text") && model.capabilities.outputModalities.includes("text") && model.capabilities.transports.sse.runnable;
+}
+function observedCredentialReadiness(input) {
+  if (!input.observation) {
+    return {
+      status: "not_ready",
+      reason: "prerequisites_missing",
+      basis: input.basis,
+      checkedAt: null
+    };
+  }
+  const checkedAtMs = Date.parse(input.observation.checkedAt);
+  if (!Number.isFinite(checkedAtMs)) {
+    return {
+      status: "error",
+      reason: "resolver_error",
+      basis: input.basis,
+      checkedAt: null
+    };
+  }
+  const checkedAt = new Date(checkedAtMs).toISOString();
+  if (Math.abs(input.nowMs - checkedAtMs) > input.maxAgeMs) {
+    return {
+      status: "not_ready",
+      reason: "observation_stale",
+      basis: input.basis,
+      checkedAt
+    };
+  }
+  if (input.observation.status === "ready") {
+    return { status: "ready", reason: null, basis: input.basis, checkedAt };
+  }
+  if (input.observation.status === "not_ready") {
+    return {
+      status: "not_ready",
+      reason: input.observation.reason === "needs_reauth" ? "needs_reauth" : "prerequisites_missing",
+      basis: input.basis,
+      checkedAt
+    };
+  }
+  return {
+    status: "error",
+    reason: "resolver_error",
+    basis: input.basis,
+    checkedAt
+  };
+}
+function credentialReadinessFor(input) {
+  const source = input.model.credentialSource;
+  if (source.kind === "connected_subscription") {
+    const active = source.provider === "xai" ? input.xaiSubscriptionActive : input.codexSubscriptionActive;
+    return active ? { status: "ready", reason: null, basis: "connection", checkedAt: null } : {
+      status: "not_ready",
+      reason: "needs_reauth",
+      basis: "connection",
+      checkedAt: null
+    };
+  }
+  if (source.kind === "workspace_connection") {
+    const connectionActive = input.model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID ? input.workspaceOpenRouterConnectionActive : input.workspaceGatewayConnectionActive;
+    return connectionActive ? { status: "ready", reason: null, basis: "connection", checkedAt: null } : {
+      status: "not_ready",
+      reason: "needs_reauth",
+      basis: "connection",
+      checkedAt: null
+    };
+  }
+  if (source.kind === "deployment" && source.mechanism === "none") {
+    return { status: "ready", reason: null, basis: "configuration", checkedAt: null };
+  }
+  if (source.kind === "deployment" && source.mechanism === "api_key") {
+    return input.provider?.apiKey ? { status: "ready", reason: null, basis: "configuration", checkedAt: null } : {
+      status: "not_ready",
+      reason: "missing_credential",
+      basis: "configuration",
+      checkedAt: null
+    };
+  }
+  return observedCredentialReadiness({
+    observation: input.observation,
+    basis: "resolver",
+    nowMs: input.nowMs,
+    maxAgeMs: input.maxAgeMs
+  });
+}
+function isXaiGrokModel(model) {
+  return model.providerId === "xai" && model.id.startsWith("xai/grok-");
+}
+function observationTimestamp(observation) {
+  if (!observation || typeof observation.checkedAt !== "string") {
+    return { checkedAt: null, checkedAtMs: null };
+  }
+  const checkedAtMs = Date.parse(observation.checkedAt);
+  if (!Number.isFinite(checkedAtMs)) {
+    return { checkedAt: null, checkedAtMs: null };
+  }
+  return { checkedAt: new Date(checkedAtMs).toISOString(), checkedAtMs };
+}
+function xaiGrokAvailabilityFor(input) {
+  const { checkedAt, checkedAtMs } = observationTimestamp(input.observation);
+  const freshSuccessfulObservation = input.observation?.status === "available" && input.observation.reason === null && checkedAtMs !== null && checkedAtMs <= input.nowMs && input.nowMs - checkedAtMs <= input.maxAgeMs;
+  if (freshSuccessfulObservation) {
+    return {
+      status: "available",
+      selectable: true,
+      reason: null,
+      checkedAt
+    };
+  }
+  return {
+    status: "unavailable",
+    selectable: false,
+    reason: input.observation?.status === "unavailable" ? input.observation.reason ?? "provider_unhealthy" : "provider_unhealthy",
+    checkedAt
+  };
+}
+function availabilityFor(input) {
+  if (!modelDefinitionRunnable(input.model)) {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: "unsupported",
+      checkedAt: null
+    };
+  }
+  if (input.credentialReadiness.status !== "ready") {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: input.credentialReadiness.reason === "missing_credential" ? "missing_credential" : input.credentialReadiness.reason === "needs_reauth" ? "needs_reauth" : "credential_not_ready",
+      checkedAt: input.credentialReadiness.checkedAt
+    };
+  }
+  if (!input.policyAllowed) {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: "policy_blocked",
+      checkedAt: null
+    };
+  }
+  if (isXaiGrokModel(input.model)) {
+    return xaiGrokAvailabilityFor({
+      observation: input.observation,
+      nowMs: input.nowMs,
+      maxAgeMs: input.maxAgeMs
+    });
+  }
+  if (!input.observation) {
+    return { status: "unknown", selectable: true, reason: null, checkedAt: null };
+  }
+  if (input.observation.status === "unavailable") {
+    return {
+      status: "unavailable",
+      selectable: false,
+      reason: input.observation.reason ?? "provider_unhealthy",
+      checkedAt: input.observation.checkedAt
+    };
+  }
+  return {
+    status: input.observation.status,
+    selectable: true,
+    reason: null,
+    checkedAt: input.observation.checkedAt
+  };
+}
+function resolveWorkspaceModelSelection(input) {
+  const codexSettings = input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider(input.settings) : input.settings;
+  const xaiSettings = input.settings.supergrokSubscriptionEnabled ? withXaiSubscriptionCatalogProvider(codexSettings) : codexSettings;
+  const catalogSettings = withWorkspaceOpenRouterCatalogProvider(
+    withWorkspaceGatewayCatalogProvider(xaiSettings, input.workspaceGatewayCustomModels ?? []),
+    input.workspaceOpenRouterCustomModels ?? []
+  );
+  const providers = new Map(
+    configuredProviders(catalogSettings).map((provider) => [provider.id, provider])
+  );
+  const requestedNowMs = input.now?.getTime();
+  const nowMs = typeof requestedNowMs === "number" && Number.isFinite(requestedNowMs) ? requestedNowMs : Date.now();
+  const maxAgeMs = typeof input.credentialReadinessMaxAgeMs === "number" && Number.isFinite(input.credentialReadinessMaxAgeMs) && input.credentialReadinessMaxAgeMs >= 0 ? input.credentialReadinessMaxAgeMs : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
+  return configuredModels(catalogSettings).map((model) => {
+    const provider = providers.get(model.providerId);
+    const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
+      providerId: model.providerId,
+      modelId: model.id
+    }).allowed;
+    const credentialReadiness = credentialReadinessFor({
+      model,
+      provider,
+      codexSubscriptionActive: input.codexSubscriptionActive,
+      xaiSubscriptionActive: input.xaiSubscriptionActive === true,
+      workspaceGatewayConnectionActive: input.workspaceGatewayConnectionActive === true,
+      workspaceOpenRouterConnectionActive: input.workspaceOpenRouterConnectionActive === true,
+      observation: input.credentialReadinessObservations?.[model.definitionVersion],
+      nowMs,
+      maxAgeMs
+    });
+    return {
+      model,
+      credentialReadiness,
+      policyAllowed,
+      availability: availabilityFor({
+        model,
+        credentialReadiness,
+        policyAllowed,
+        observation: input.observations?.[model.definitionVersion],
+        nowMs,
+        maxAgeMs
+      })
+    };
+  });
+}
+
 // src/sandbox/fleet.ts
 import {
   authorizePersonalMachineForAttempt,
@@ -260,6 +621,16 @@ import {
 function directRetainedProcessMatchesBackend(durable, process, backend) {
   return durable.providerSessionId === process.providerSessionId && durable.providerBackend === backend.kind && durable.providerInstanceId === backend.providerInstanceId && durable.leaseEpoch === backend.leaseEpoch && durable.routeKind === "active" && durable.routeTargetId === backend.sandboxId && durable.routeEpoch === backend.activeEpoch;
 }
+function retainedProcessBackgroundSettlement(process, fallback) {
+  if (process.state === "active") {
+    throw new Error("Retained-process settlement returned an active durable process");
+  }
+  return {
+    outcome: process.state,
+    exitCode: process.exitCode,
+    reason: process.settlementReason ?? fallback.reason
+  };
+}
 function relayConfigFromSettings(settings) {
   const raw = settings.selfhostedRelayUrl?.trim();
   if (!raw) {
@@ -460,7 +831,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
         "API retained-process settlement lost its exact durable backend identity"
       );
     }
-    await settleRetainedProcess(db, {
+    const settlement = await settleRetainedProcess(db, {
       accountId: ids.accountId,
       workspaceId: ids.workspaceId,
       sessionId: ids.sessionId,
@@ -471,14 +842,13 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       reason: proof.reason,
       idleGraceMs: settings.sandboxIdleGraceMs
     });
+    const backgroundSettlement = retainedProcessBackgroundSettlement(settlement.process, proof);
     await settleSessionBackgroundCommandForRetainedProcess(db, {
       accountId: ids.accountId,
       workspaceId: ids.workspaceId,
       sessionId: ids.sessionId,
       retainedProcessId: process.id,
-      outcome: proof.outcome,
-      exitCode: proof.exitCode,
-      reason: proof.reason
+      ...backgroundSettlement
     });
   } : void 0;
   const resolver = makeActiveBackendResolver({
@@ -588,6 +958,235 @@ function wrapChannelABoxWithRouting(services, ids, established) {
   return { ...established, session: proxy };
 }
 
+// src/sandbox/runtime-settings.ts
+import {
+  CapabilityPack
+} from "@opengeni/contracts";
+import {
+  getRigVersion,
+  getWorkspacePack,
+  listPackInstallations
+} from "@opengeni/db";
+import { resolveModalCheckpointProviderBinding } from "@opengeni/runtime/sandbox";
+
+// src/rigs/provider-images.ts
+import { createHash } from "crypto";
+import {
+  RigProviderImage as RigProviderImageContract,
+  stableJson
+} from "@opengeni/contracts";
+function sha256(value) {
+  return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
+}
+function rigProviderImageProviderBindingKeyHash(bindingKey) {
+  return sha256(bindingKey);
+}
+function rigProviderImageSetupHash(definition) {
+  return sha256(definition.setupScript ?? "");
+}
+function rigProviderImageContentHash(input) {
+  return sha256(
+    stableJson({
+      version: 2,
+      backend: input.backend,
+      sourceImage: input.sourceImage,
+      setupScript: input.definition.setupScript,
+      checks: input.definition.checks,
+      credentialHooks: input.definition.credentialHooks,
+      defaultVariableSetIds: input.definition.defaultVariableSetIds
+    })
+  );
+}
+function rigProviderImageBuildRequestId(input) {
+  const bytes = createHash("sha256").update("opengeni-rig-provider-image-build-v2\0", "utf8").update(input.targetId, "utf8").update("\0", "utf8").update(input.backend, "utf8").update("\0", "utf8").update(input.contentHash, "utf8").digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function rigProviderImageMatchesDefinition(image, definition) {
+  return image.setupHash === rigProviderImageSetupHash(definition) && image.contentHash === rigProviderImageContentHash({
+    backend: image.backend,
+    sourceImage: image.sourceImage,
+    definition
+  });
+}
+function rigProviderImagesFromVerification(verification, definition) {
+  const parsed = RigProviderImageContract.safeParse(verification?.providerImage);
+  if (!parsed.success || parsed.data.status === "building") return {};
+  if (!rigProviderImageMatchesDefinition(parsed.data, definition)) return {};
+  return { [parsed.data.backend]: parsed.data };
+}
+
+// src/sandbox/runtime-settings.ts
+function managedSessionGroupBackend(deploymentBackend, sessionBackend) {
+  if (sessionBackend === "none") return null;
+  const backend = sessionBackend === "selfhosted" ? deploymentBackend : sessionBackend;
+  return backend === "none" || backend === "selfhosted" ? null : backend;
+}
+function managedSessionGroupOs(sessionBackend, sessionOs) {
+  return sessionBackend === "selfhosted" ? "linux" : sessionOs;
+}
+function packInstallationUsesLegacyRuntime(input) {
+  return input.manifestSnapshot === null && input.manifestDigest === null;
+}
+async function resolveWorkspaceLegacyRuntimePacks(db, workspaceId) {
+  const installations = await listPackInstallations(db, workspaceId);
+  const packs2 = [];
+  for (const installation of installations) {
+    if (installation.status !== "active" || !packInstallationUsesLegacyRuntime(installation)) {
+      continue;
+    }
+    const registration = await getWorkspacePack(db, workspaceId, installation.packId);
+    const parsed = CapabilityPack.safeParse(registration?.pack);
+    if (parsed.success) packs2.push(parsed.data);
+  }
+  return packs2;
+}
+function legacySandboxRuntimeFromPacks(packs2) {
+  const imagePacks = packs2.filter(
+    (pack) => typeof pack.sandboxImage === "string" && pack.sandboxImage.trim().length > 0
+  );
+  if (imagePacks.length > 1) {
+    const ids = imagePacks.map((pack) => pack.id).sort().join(", ");
+    throw new Error(
+      `Multiple enabled packs declare a sandbox image (${ids}). Only one enabled pack per workspace may declare sandboxImage; disable the others and retry.`
+    );
+  }
+  return {
+    sandboxImage: imagePacks[0]?.sandboxImage?.trim() ?? null,
+    sandboxProviderImages: imagePacks[0]?.sandboxProviderImages ?? null
+  };
+}
+function settingsWithPackSandboxImage(settings, sandboxImage, sandboxProviderImages = null) {
+  if (!sandboxImage) return settings;
+  return {
+    ...settings,
+    dockerImage: sandboxImage,
+    modalImageRef: sandboxImage,
+    modalImageId: sandboxProviderImages?.modal?.imageId
+  };
+}
+function settingsWithRigImage(settings, rigImage) {
+  void rigImage;
+  return settings;
+}
+function rigProviderImageSourceImage(settings, backend) {
+  if (backend === "modal") return settings.modalImageId ?? settings.modalImageRef ?? null;
+  if (backend === "docker") return settings.dockerImage ?? null;
+  return null;
+}
+function resolveRigProviderImageSelection(settings, version, backend, currentProviderBindingKeyHash) {
+  if (!version) return { settings, reason: "missing", contentHash: null, imageId: null };
+  if (backend !== "modal") {
+    return { settings, reason: "provider_unsupported", contentHash: null, imageId: null };
+  }
+  const image = version.providerImages[backend];
+  if (!image) return { settings, reason: "missing", contentHash: null, imageId: null };
+  if (image.status !== "ready" || !image.imageId) {
+    return {
+      settings,
+      reason: "not_ready",
+      contentHash: image.contentHash,
+      imageId: image.imageId
+    };
+  }
+  if (image.coldBootValidation?.version !== 1) {
+    return {
+      settings,
+      reason: "not_cold_boot_validated",
+      contentHash: image.contentHash,
+      imageId: null
+    };
+  }
+  const sourceImage = rigProviderImageSourceImage(settings, backend);
+  const expectedContentHash = rigProviderImageContentHash({
+    backend,
+    sourceImage,
+    definition: version
+  });
+  if (image.sourceImage !== sourceImage || image.contentHash !== expectedContentHash || !rigProviderImageMatchesDefinition(image, version)) {
+    return {
+      settings,
+      reason: "content_mismatch",
+      contentHash: expectedContentHash,
+      imageId: null
+    };
+  }
+  if (!image.providerBindingKeyHash || !currentProviderBindingKeyHash) {
+    return {
+      settings,
+      reason: "provider_binding_unavailable",
+      contentHash: expectedContentHash,
+      imageId: null
+    };
+  }
+  if (image.providerBindingKeyHash !== currentProviderBindingKeyHash) {
+    return {
+      settings,
+      reason: "provider_binding_mismatch",
+      contentHash: expectedContentHash,
+      imageId: null
+    };
+  }
+  return {
+    settings: { ...settings, modalImageId: image.imageId },
+    reason: "selected",
+    contentHash: expectedContentHash,
+    imageId: image.imageId
+  };
+}
+async function resolveRigProviderImageForRun(settings, version, backend, resolveBinding = resolveModalCheckpointProviderBinding) {
+  const image = backend === "modal" ? version?.providerImages.modal : null;
+  if (image?.status !== "ready" || !image.providerBindingKeyHash) {
+    return resolveRigProviderImageSelection(settings, version, backend, null);
+  }
+  const structural = resolveRigProviderImageSelection(
+    settings,
+    version,
+    backend,
+    image.providerBindingKeyHash
+  );
+  if (structural.reason !== "selected") return structural;
+  let currentProviderBindingKeyHash = null;
+  try {
+    const binding = await resolveBinding(settings);
+    currentProviderBindingKeyHash = rigProviderImageProviderBindingKeyHash(binding.key);
+  } catch {
+  }
+  return resolveRigProviderImageSelection(
+    settings,
+    version,
+    backend,
+    currentProviderBindingKeyHash
+  );
+}
+async function settingsWithRigProviderImage(settings, version, backend, resolveBinding = resolveModalCheckpointProviderBinding) {
+  return (await resolveRigProviderImageForRun(settings, version, backend, resolveBinding)).settings;
+}
+async function resolveSessionSandboxRuntime(db, settings, session) {
+  const [packs2, rigVersion] = await Promise.all([
+    resolveWorkspaceLegacyRuntimePacks(db, session.workspaceId),
+    session.rigId && session.rigVersionId ? getRigVersion(db, session.workspaceId, session.rigId, session.rigVersionId) : Promise.resolve(null)
+  ]);
+  if (session.rigVersionId && !rigVersion) {
+    throw new Error(`Frozen rig version ${session.rigVersionId} is unavailable`);
+  }
+  const legacy = legacySandboxRuntimeFromPacks(packs2);
+  const logicalSettings = rigVersion ? settings : settingsWithPackSandboxImage(settings, legacy.sandboxImage, legacy.sandboxProviderImages);
+  return {
+    settings: {
+      ...logicalSettings,
+      sandboxBackend: session.sandboxBackend
+    },
+    image: rigProviderImageSourceImage(logicalSettings, session.sandboxBackend),
+    rigVersion
+  };
+}
+async function providerSettingsForSessionSandboxRuntime(runtime, backend) {
+  return await settingsWithRigProviderImage(runtime.settings, runtime.rigVersion, backend);
+}
+
 // src/sandbox/fleet.ts
 async function buildFleetContextForSession(deps, ctx) {
   const session = await requireSession(deps.db, ctx.workspaceId, ctx.sessionId);
@@ -661,7 +1260,11 @@ async function listFleet(services, ctx) {
     activeEpoch: 0
   };
   const entries = [];
-  if (ctx.sessionBackend !== "none") {
+  const groupBackend = managedSessionGroupBackend(
+    services.settings.sandboxBackend,
+    ctx.sessionBackend
+  );
+  if (groupBackend) {
     const groupActive = pointer.activeSandboxId === null;
     const groupLease = await readLease(db, ctx.workspaceId, ctx.sessionGroupId);
     const groupOnline = Boolean(
@@ -673,10 +1276,10 @@ async function listFleet(services, ctx) {
     const groupRecoveryUnavailable = Boolean(
       groupLease && (groupLease.recovery.restore.status === "degraded" || groupLease.recovery.restore.status === "unrecoverable" || groupLease.recovery.workspace.status === "degraded" || groupLease.recovery.workspace.status === "unrecoverable")
     );
-    const groupOperationAvailability = groupOnline ? "ready" : groupRecoveryUnavailable ? "unavailable" : groupRecovering ? "recovering" : ctx.sessionBackend === "selfhosted" ? "unavailable" : "wakeable";
+    const groupOperationAvailability = groupOnline ? "ready" : groupRecoveryUnavailable ? "unavailable" : groupRecovering ? "recovering" : "wakeable";
     entries.push({
       id: ctx.sessionGroupId,
-      kind: ctx.sessionBackend === "selfhosted" ? "selfhosted" : ctx.sessionBackend === "opensandbox" ? "opensandbox" : "modal",
+      kind: groupBackend === "opensandbox" ? "opensandbox" : "modal",
       name: "session sandbox",
       liveness: groupOnline ? "online" : groupRecovering ? "reconnecting" : "offline",
       active: groupActive,
@@ -780,10 +1383,10 @@ async function listFleet(services, ctx) {
 }
 async function resolveTarget(services, ctx, target) {
   if (target === ctx.sessionGroupId || target === "session" || target === "default") {
-    if (ctx.sessionBackend === "none") {
+    if (!managedSessionGroupBackend(services.settings.sandboxBackend, ctx.sessionBackend)) {
       return {
         ok: false,
-        reason: "this session has no home sandbox; attach a Connected Machine",
+        reason: ctx.sessionBackend === "none" ? "this session has no home sandbox; attach a Connected Machine" : "this deployment has no managed session sandbox; select an enrolled machine",
         code: "unsupported_backend_context"
       };
     }
@@ -1227,228 +1830,7 @@ async function provisionSandbox(services, ctx, input) {
     kind: "modal",
     sandbox,
     note: "A named Modal sandbox record was created, but it is NOT yet attachable as a swap target: routing a session onto a second Modal box is not supported yet, so a sandbox_swap to this id is rejected. Use the session's own box (the default) or attach a Connected Machine instead."
-  };
-}
-
-// src/sandbox/runtime-settings.ts
-import {
-  CapabilityPack
-} from "@opengeni/contracts";
-import {
-  getRigVersion,
-  getWorkspacePack,
-  listPackInstallations
-} from "@opengeni/db";
-import { resolveModalCheckpointProviderBinding } from "@opengeni/runtime/sandbox";
-
-// src/rigs/provider-images.ts
-import { createHash } from "crypto";
-import {
-  RigProviderImage as RigProviderImageContract,
-  stableJson
-} from "@opengeni/contracts";
-function sha256(value) {
-  return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
-}
-function rigProviderImageProviderBindingKeyHash(bindingKey) {
-  return sha256(bindingKey);
-}
-function rigProviderImageSetupHash(definition) {
-  return sha256(definition.setupScript ?? "");
-}
-function rigProviderImageContentHash(input) {
-  return sha256(
-    stableJson({
-      version: 2,
-      backend: input.backend,
-      sourceImage: input.sourceImage,
-      setupScript: input.definition.setupScript,
-      checks: input.definition.checks,
-      credentialHooks: input.definition.credentialHooks,
-      defaultVariableSetIds: input.definition.defaultVariableSetIds
-    })
-  );
-}
-function rigProviderImageBuildRequestId(input) {
-  const bytes = createHash("sha256").update("opengeni-rig-provider-image-build-v2\0", "utf8").update(input.targetId, "utf8").update("\0", "utf8").update(input.backend, "utf8").update("\0", "utf8").update(input.contentHash, "utf8").digest().subarray(0, 16);
-  bytes[6] = bytes[6] & 15 | 80;
-  bytes[8] = bytes[8] & 63 | 128;
-  const hex = bytes.toString("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-function rigProviderImageMatchesDefinition(image, definition) {
-  return image.setupHash === rigProviderImageSetupHash(definition) && image.contentHash === rigProviderImageContentHash({
-    backend: image.backend,
-    sourceImage: image.sourceImage,
-    definition
-  });
-}
-function rigProviderImagesFromVerification(verification, definition) {
-  const parsed = RigProviderImageContract.safeParse(verification?.providerImage);
-  if (!parsed.success || parsed.data.status === "building") return {};
-  if (!rigProviderImageMatchesDefinition(parsed.data, definition)) return {};
-  return { [parsed.data.backend]: parsed.data };
-}
-
-// src/sandbox/runtime-settings.ts
-function packInstallationUsesLegacyRuntime(input) {
-  return input.manifestSnapshot === null && input.manifestDigest === null;
-}
-async function resolveWorkspaceLegacyRuntimePacks(db, workspaceId) {
-  const installations = await listPackInstallations(db, workspaceId);
-  const packs2 = [];
-  for (const installation of installations) {
-    if (installation.status !== "active" || !packInstallationUsesLegacyRuntime(installation)) {
-      continue;
-    }
-    const registration = await getWorkspacePack(db, workspaceId, installation.packId);
-    const parsed = CapabilityPack.safeParse(registration?.pack);
-    if (parsed.success) packs2.push(parsed.data);
-  }
-  return packs2;
-}
-function legacySandboxRuntimeFromPacks(packs2) {
-  const imagePacks = packs2.filter(
-    (pack) => typeof pack.sandboxImage === "string" && pack.sandboxImage.trim().length > 0
-  );
-  if (imagePacks.length > 1) {
-    const ids = imagePacks.map((pack) => pack.id).sort().join(", ");
-    throw new Error(
-      `Multiple enabled packs declare a sandbox image (${ids}). Only one enabled pack per workspace may declare sandboxImage; disable the others and retry.`
-    );
-  }
-  return {
-    sandboxImage: imagePacks[0]?.sandboxImage?.trim() ?? null,
-    sandboxProviderImages: imagePacks[0]?.sandboxProviderImages ?? null
-  };
-}
-function settingsWithPackSandboxImage(settings, sandboxImage, sandboxProviderImages = null) {
-  if (!sandboxImage) return settings;
-  return {
-    ...settings,
-    dockerImage: sandboxImage,
-    modalImageRef: sandboxImage,
-    modalImageId: sandboxProviderImages?.modal?.imageId
-  };
-}
-function settingsWithRigImage(settings, rigImage) {
-  void rigImage;
-  return settings;
-}
-function rigProviderImageSourceImage(settings, backend) {
-  if (backend === "modal") return settings.modalImageId ?? settings.modalImageRef ?? null;
-  if (backend === "docker") return settings.dockerImage ?? null;
-  return null;
-}
-function resolveRigProviderImageSelection(settings, version, backend, currentProviderBindingKeyHash) {
-  if (!version) return { settings, reason: "missing", contentHash: null, imageId: null };
-  if (backend !== "modal") {
-    return { settings, reason: "provider_unsupported", contentHash: null, imageId: null };
-  }
-  const image = version.providerImages[backend];
-  if (!image) return { settings, reason: "missing", contentHash: null, imageId: null };
-  if (image.status !== "ready" || !image.imageId) {
-    return {
-      settings,
-      reason: "not_ready",
-      contentHash: image.contentHash,
-      imageId: image.imageId
-    };
-  }
-  if (image.coldBootValidation?.version !== 1) {
-    return {
-      settings,
-      reason: "not_cold_boot_validated",
-      contentHash: image.contentHash,
-      imageId: null
-    };
-  }
-  const sourceImage = rigProviderImageSourceImage(settings, backend);
-  const expectedContentHash = rigProviderImageContentHash({
-    backend,
-    sourceImage,
-    definition: version
-  });
-  if (image.sourceImage !== sourceImage || image.contentHash !== expectedContentHash || !rigProviderImageMatchesDefinition(image, version)) {
-    return {
-      settings,
-      reason: "content_mismatch",
-      contentHash: expectedContentHash,
-      imageId: null
-    };
-  }
-  if (!image.providerBindingKeyHash || !currentProviderBindingKeyHash) {
-    return {
-      settings,
-      reason: "provider_binding_unavailable",
-      contentHash: expectedContentHash,
-      imageId: null
-    };
-  }
-  if (image.providerBindingKeyHash !== currentProviderBindingKeyHash) {
-    return {
-      settings,
-      reason: "provider_binding_mismatch",
-      contentHash: expectedContentHash,
-      imageId: null
-    };
-  }
-  return {
-    settings: { ...settings, modalImageId: image.imageId },
-    reason: "selected",
-    contentHash: expectedContentHash,
-    imageId: image.imageId
-  };
-}
-async function resolveRigProviderImageForRun(settings, version, backend, resolveBinding = resolveModalCheckpointProviderBinding) {
-  const image = backend === "modal" ? version?.providerImages.modal : null;
-  if (image?.status !== "ready" || !image.providerBindingKeyHash) {
-    return resolveRigProviderImageSelection(settings, version, backend, null);
-  }
-  const structural = resolveRigProviderImageSelection(
-    settings,
-    version,
-    backend,
-    image.providerBindingKeyHash
-  );
-  if (structural.reason !== "selected") return structural;
-  let currentProviderBindingKeyHash = null;
-  try {
-    const binding = await resolveBinding(settings);
-    currentProviderBindingKeyHash = rigProviderImageProviderBindingKeyHash(binding.key);
-  } catch {
-  }
-  return resolveRigProviderImageSelection(
-    settings,
-    version,
-    backend,
-    currentProviderBindingKeyHash
-  );
-}
-async function settingsWithRigProviderImage(settings, version, backend, resolveBinding = resolveModalCheckpointProviderBinding) {
-  return (await resolveRigProviderImageForRun(settings, version, backend, resolveBinding)).settings;
-}
-async function resolveSessionSandboxRuntime(db, settings, session) {
-  const [packs2, rigVersion] = await Promise.all([
-    resolveWorkspaceLegacyRuntimePacks(db, session.workspaceId),
-    session.rigId && session.rigVersionId ? getRigVersion(db, session.workspaceId, session.rigId, session.rigVersionId) : Promise.resolve(null)
-  ]);
-  if (session.rigVersionId && !rigVersion) {
-    throw new Error(`Frozen rig version ${session.rigVersionId} is unavailable`);
-  }
-  const legacy = legacySandboxRuntimeFromPacks(packs2);
-  const logicalSettings = rigVersion ? settings : settingsWithPackSandboxImage(settings, legacy.sandboxImage, legacy.sandboxProviderImages);
-  return {
-    settings: {
-      ...logicalSettings,
-      sandboxBackend: session.sandboxBackend
-    },
-    image: rigProviderImageSourceImage(logicalSettings, session.sandboxBackend),
-    rigVersion
-  };
-}
-async function providerSettingsForSessionSandboxRuntime(runtime, backend) {
-  return await settingsWithRigProviderImage(runtime.settings, runtime.rigVersion, backend);
+  };
 }
 
 // src/access/index.ts
@@ -1467,7 +1849,38 @@ import { HTTPException } from "hono/http-exception";
 var bearerPrefix = "Bearer ";
 var accessContextByRequest = /* @__PURE__ */ new WeakMap();
 var canonicalManagedCookieContexts = /* @__PURE__ */ new WeakSet();
+var canonicalLocalHumanContexts = /* @__PURE__ */ new WeakSet();
 var resolvedAccessGrantAuthorizations = /* @__PURE__ */ new WeakSet();
+var accountScopedApiKeyContexts = /* @__PURE__ */ new WeakMap();
+var accountScopedApiKeyAccountPermissions = /* @__PURE__ */ new Set([
+  "account:read",
+  "account:admin",
+  "workspace:create",
+  "billing:read",
+  "billing:manage",
+  "api_keys:manage"
+]);
+var accountScopedApiKeyWorkspaceExcludedPermissions = /* @__PURE__ */ new Set([
+  "account:read",
+  "account:admin",
+  "workspace:create",
+  "billing:read",
+  "billing:manage"
+]);
+function accountScopedApiKeyWorkspaceAuthority(context) {
+  const authority = accountScopedApiKeyContexts.get(context);
+  if (!authority) return null;
+  const matchingAccountGrants = context.accountGrants.filter(
+    (grant) => grant.accountId === authority.accountId && grant.subjectId === context.subjectId
+  );
+  if (!context.subjectId.startsWith("api_key:") || matchingAccountGrants.length !== 1 || context.defaultAccountId !== authority.accountId || context.defaultWorkspaceId !== null) {
+    return null;
+  }
+  return {
+    accountId: authority.accountId,
+    permissions: [...authority.permissions]
+  };
+}
 async function requireAccessContext(c, deps) {
   let pending = accessContextByRequest.get(c.req.raw);
   if (!pending) {
@@ -1505,7 +1918,8 @@ function accessGrantAuthorizationFromContext(context, grant) {
     accountGrant: contextIntegrity ? matchingAccountGrants[0] : null,
     authenticatedSubjectId: context.subjectId,
     contextIntegrity,
-    canonicalManagedHumanSession: isCanonicalManagedHumanSession(context, grant)
+    canonicalManagedHumanSession: isCanonicalManagedHumanSession(context, grant),
+    canonicalLocalHumanSession: isCanonicalLocalHumanSession(context, grant)
   };
   resolvedAccessGrantAuthorizations.add(authorization);
   return authorization;
@@ -1522,13 +1936,31 @@ function requireAccountAdminAuthorizationStamp(authorization) {
     permission: "account:admin"
   });
 }
+async function requireCanonicalLocalAccountAdministrator(c, deps, accountId) {
+  if (c.req.header("authorization")) {
+    throw new HTTPException(401, { message: "organization administrator session required" });
+  }
+  const context = await requireAccessContext(c, deps);
+  const grant = context.workspaceGrants.find((candidate) => candidate.accountId === accountId);
+  if (!grant) {
+    throw new HTTPException(403, {
+      message: "local organization administration is not authorized"
+    });
+  }
+  const authorization = accessGrantAuthorizationFromContext(context, grant);
+  if (!authorization.canonicalLocalHumanSession) {
+    throw new HTTPException(401, { message: "organization administrator session required" });
+  }
+  requireAccountAdminAuthorizationStamp(authorization);
+  return { subjectId: context.subjectId, authorization };
+}
 async function requireAccessGrantAuthorization(c, deps, workspaceId, permission) {
   const context = await requireAccessContext(c, deps);
   return await accessGrantAuthorization(context, deps, workspaceId, permission);
 }
 async function accessGrantAuthorization(context, deps, workspaceId, permission) {
   const principalKind = hostedHumanSessionPrincipalKind(context);
-  const grant = context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ?? await getWorkspaceGrant(
+  let grant = context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ?? await getWorkspaceGrant(
     deps.db,
     context.subjectId,
     workspaceId,
@@ -1539,7 +1971,20 @@ async function accessGrantAuthorization(context, deps, workspaceId, permission)
     if (!workspace) {
       throw new HTTPException(404, { message: "workspace not found" });
     }
-    throw new HTTPException(403, { message: "workspace access denied" });
+    const authority = accountScopedApiKeyWorkspaceAuthority(context);
+    const requiredWorkspacePermission = permission ?? "workspace:read";
+    if (authority && workspace.accountId === authority.accountId && workspace.kind === "shared" && hasPermission(authority.permissions, requiredWorkspacePermission)) {
+      grant = {
+        workspaceId: workspace.id,
+        accountId: workspace.accountId,
+        subjectId: context.subjectId,
+        ...context.subjectLabel ? { subjectLabel: context.subjectLabel } : {},
+        permissions: authority.permissions,
+        principalKind: "api_key"
+      };
+    } else {
+      throw new HTTPException(403, { message: "workspace access denied" });
+    }
   }
   if (permission) {
     requirePermission(grant, permission);
@@ -1549,6 +1994,9 @@ async function accessGrantAuthorization(context, deps, workspaceId, permission)
 function isCanonicalManagedHumanSession(context, grant) {
   return canonicalManagedCookieContexts.has(context) && grant.subjectId === context.subjectId && grant.subjectId.startsWith("user:");
 }
+function isCanonicalLocalHumanSession(context, grant) {
+  return canonicalLocalHumanContexts.has(context) && context.mode === "local" && context.subjectId === "dev" && grant.subjectId === context.subjectId && grant.principalKind === "human_session" && grant.metadata?.delegated !== true && !grant.serviceInitiator;
+}
 function hostedHumanSessionPrincipalKind(context) {
   if (context.mode !== "managed" || context.workspaceGrants.length === 0) {
     return void 0;
@@ -1598,7 +2046,7 @@ async function resolveAccessContext(c, deps) {
     if (delegated) {
       return delegated;
     }
-    return await bootstrapWorkspace(deps.db, {
+    const context = await bootstrapWorkspace(deps.db, {
       accountExternalSource: "opengeni:local",
       accountExternalId: "default",
       accountName: "Local",
@@ -1608,6 +2056,8 @@ async function resolveAccessContext(c, deps) {
       subjectId: "dev",
       subjectLabel: "Local dev"
     });
+    canonicalLocalHumanContexts.add(context);
+    return context;
   }
   if (deps.settings.productAccessMode === "configured") {
     const delegated = await delegatedAccessContext(c, deps, "configured");
@@ -1676,8 +2126,10 @@ async function apiKeyAccessContext(c, deps, mode) {
   const subjectId = `api_key:${apiKey.id}`;
   const accountPermissions = apiKey.workspaceId ? apiKey.permissions.filter(
     (permission) => permission === "billing:read" || permission === "billing:manage"
-  ) : apiKey.permissions;
-  return {
+  ) : apiKey.permissions.filter(
+    (permission) => accountScopedApiKeyAccountPermissions.has(permission)
+  );
+  const context = {
     mode,
     subjectId,
     subjectLabel: apiKey.name,
@@ -1702,6 +2154,20 @@ async function apiKeyAccessContext(c, deps, mode) {
     defaultAccountId: apiKey.accountId,
     defaultWorkspaceId: apiKey.workspaceId
   };
+  if (apiKey.workspaceId === null && apiKey.credentialKind === "organization") {
+    accountScopedApiKeyContexts.set(
+      context,
+      Object.freeze({
+        accountId: apiKey.accountId,
+        permissions: Object.freeze(
+          apiKey.permissions.filter(
+            (permission) => !accountScopedApiKeyWorkspaceExcludedPermissions.has(permission)
+          )
+        )
+      })
+    );
+  }
+  return context;
 }
 async function delegatedAccessContext(c, deps, mode, token = bearerToken(c)) {
   const delegationSecret = resolveFirstPartyDelegationSecret(deps.settings);
@@ -1969,9 +2435,13 @@ async function resolveSessionAuthorizationActor(db, grant) {
 }
 
 // src/billing/limits.ts
-import { configuredStaticUsageLimits, resolveModelProvider } from "@opengeni/config";
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn
+} from "@opengeni/config";
 import {
   countActiveApiKeysForWorkspace,
+  countActiveOrganizationApiKeysForAccount,
   countScheduledTasksForWorkspace,
   countWorkspacesForAccount,
   getBillingBalance,
@@ -1980,6 +2450,18 @@ import {
   sumUsageQuantity
 } from "@opengeni/db";
 import { HTTPException as HTTPException2 } from "hono/http-exception";
+function modelFundingForAdmission(settings, model, codexBilled) {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
+    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
+  };
+}
 async function requireLimit(deps, input) {
   const decision = await checkLimit(deps, input);
   if (decision.allowed) {
@@ -1996,19 +2478,22 @@ async function checkLimit(deps, input) {
     workspaceId: input.workspaceId,
     model: input.model
   }) : false;
-  const credentialFreeExternal = input.model ? (() => {
-    const resolved = resolveModelProvider(deps.settings, input.model);
-    return resolved?.model.billing.metering === "external" && resolved.model.credentialSource.kind === "deployment" && resolved.model.credentialSource.mechanism === "none";
-  })() : false;
-  const externallyBilled = codexBilled || credentialFreeExternal;
-  const creditDecision = await checkCreditBalance(deps, input, externallyBilled);
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
   if (!creditDecision.allowed) {
     return creditDecision;
   }
   if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
     return { allowed: true };
   }
-  return await checkStaticCaps(deps, input, externallyBilled);
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap
+  });
 }
 async function checkCreditBalance(deps, input, externallyBilled) {
   if (externallyBilled) {
@@ -2023,9 +2508,9 @@ async function checkCreditBalance(deps, input, externallyBilled) {
   }
   return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
 }
-async function checkStaticCaps(deps, input, externallyBilled) {
+async function checkStaticCaps(deps, input, funding) {
   const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !externallyBilled) {
+  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
     const used = await sumUsageQuantity(deps.db, {
       accountId: input.accountId,
       eventType: "model.cost",
@@ -2050,10 +2535,10 @@ async function checkStaticCaps(deps, input, externallyBilled) {
       );
     }
     case "api_key:create": {
-      if (!limits.maxApiKeysPerWorkspace || !input.workspaceId) {
+      if (!limits.maxApiKeysPerWorkspace) {
         return { allowed: true };
       }
-      const count = await countActiveApiKeysForWorkspace(deps.db, input.workspaceId);
+      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
       return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
         "max_api_keys_per_workspace",
         `API key limit reached (${limits.maxApiKeysPerWorkspace})`
@@ -2094,7 +2579,7 @@ async function checkStaticCaps(deps, input, externallyBilled) {
       );
     }
     case "tokens:consume": {
-      if (externallyBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
         return { allowed: true };
       }
       const used = await sumUsageQuantity(deps.db, {
@@ -4965,42 +5450,15 @@ function sha256Hex2(bytes) {
 
 // src/domain/environments.ts
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
+import {
+  variableSetVariableNameReservation
+} from "@opengeni/contracts";
 import { getVariableSet as getVariableSet2, recordAuditEvent } from "@opengeni/db";
 import { HTTPException as HTTPException6 } from "hono/http-exception";
 var MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
 var MAX_VARIABLES_PER_ENVIRONMENT = 100;
-var reservedExactNames = /* @__PURE__ */ new Set([
-  "HOME",
-  "PATH",
-  "SHELL",
-  "USER",
-  "LOGNAME",
-  "TMPDIR",
-  "IFS",
-  "ENV",
-  "BASH_ENV",
-  "NODE_OPTIONS",
-  "PYTHONPATH",
-  "PYTHONSTARTUP",
-  "PERL5OPT",
-  "PERL5LIB",
-  "GH_TOKEN",
-  "GITHUB_TOKEN",
-  "GITLAB_TOKEN",
-  "AZURE_DEVOPS_EXT_PAT",
-  "GIT_ASKPASS",
-  "GIT_TERMINAL_PROMPT"
-]);
-var reservedPrefixes = [
-  "OPENGENI_",
-  "GIT_CONFIG_",
-  "GIT_AUTHOR_",
-  "GIT_COMMITTER_",
-  "LD_",
-  "DYLD_"
-];
 function assertAllowedVariableSetVariableName(name) {
-  if (reservedExactNames.has(name) || reservedPrefixes.some((prefix) => name.startsWith(prefix))) {
+  if (variableSetVariableNameReservation(name)) {
     throw new HTTPException6(422, {
       message: `reserved variable set variable name / reserved environment variable name: ${name}`
     });
@@ -6250,15 +6708,40 @@ function personalConnectionDelegationsFromParent(input) {
   const projected = [
     ...mcp,
     ...input.parentDelegations.filter(
-      (item) => childEligible(item) && (item.connectionType === "social" || item.connectionType === "atlassian" || item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID)
+      (item) => childEligible(item) && (item.connectionType === "social" || item.connectionType === "atlassian" || item.connectionType === "github_personal" || item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID)
     ).map((item) => ({ ...item }))
   ];
-  if (input.rejectActivatedConnections && projected.some((delegation) => delegation.userDelegation)) {
+  const requestedGitHub = personalGitHubRepositoryResources(input.personalGitHubResources ?? []);
+  const inherited = projected.flatMap((delegation) => {
+    if (delegation.connectionType !== "github_personal") return [delegation];
+    if (requestedGitHub.length === 0) return [];
+    const snapshot = delegation.personalGitHubRepositorySelection;
+    if (!snapshot) return [];
+    const repositories = requestedGitHub.map((resource) => {
+      const parent = snapshot.repositories.find(
+        (candidate) => candidate.repositoryId === resource.repositoryId && candidate.canonicalUrl === resource.uri && candidate.ref === resource.ref
+      );
+      if (!parent || resource.credentialBindingId !== snapshot.credentialBindingId || resource.access === "write" && parent.access !== "write") {
+        throw new Error("agent-created personal GitHub repository exceeds parent authority");
+      }
+      return { ...parent, access: resource.access };
+    });
+    return [
+      {
+        ...delegation,
+        personalGitHubRepositorySelection: { ...snapshot, repositories }
+      }
+    ];
+  });
+  if (requestedGitHub.length > 0 && !inherited.some((delegation) => delegation.connectionType === "github_personal")) {
+    throw new Error("agent-created personal GitHub repository authority is unavailable");
+  }
+  if (input.rejectActivatedConnections && inherited.some((delegation) => delegation.userDelegation)) {
     throw new Error(
       "scheduled connection authority is not available until task occurrence authority is activated"
     );
   }
-  return projected;
+  return inherited;
 }
 function googleDrivePublicationDelegationFromVisibleConnections(input) {
   const selection = input.authoritySelection;
@@ -6471,11 +6954,6 @@ async function freezePersonalConnectionDelegations(input) {
         "agent-created work inherits connection authority from its exact parent turn"
       );
     }
-    if (personalGitHubResources.length > 0) {
-      throw new Error(
-        "agent-created personal GitHub repository authority is not activated in this delivery phase"
-      );
-    }
     const inherited = personalConnectionDelegationsFromParent({
       servers,
       parentDelegations: await getSessionTurnPersonalConnectionDelegations(
@@ -6484,6 +6962,7 @@ async function freezePersonalConnectionDelegations(input) {
         input.source.sessionId,
         input.source.turnId
       ),
+      personalGitHubResources,
       ...input.targetSessionId ? { targetSessionId: input.targetSessionId } : {},
       ...input.rejectUnselectedActivatedConnections !== void 0 ? { rejectActivatedConnections: input.rejectUnselectedActivatedConnections } : {}
     });
@@ -6935,6 +7414,8 @@ import {
   createScheduledTask,
   deleteScheduledTask,
   getConnectionMetadata as getConnectionMetadata4,
+  getEnrollment as getEnrollment3,
+  getLiveEnrollmentConnection as getLiveEnrollmentConnection3,
   getKnowledgeSourceForSyncAuthority,
   getNestedAgentDepthDeploymentPolicy,
   getRig as getRig5,
@@ -6942,8 +7423,11 @@ import {
   getScheduledTaskIncludingDeletedForUpdate,
   getScheduledTaskPersonalConnectionDelegations,
   getScheduledTaskXaiProviderAccountAuthoritySnapshot,
+  getSandbox as getSandbox4,
   getSessionTurnXaiProviderAccountAuthoritySnapshot as getSessionTurnXaiProviderAccountAuthoritySnapshot2,
   getSession as getSession3,
+  lockActiveWorkspaceGatewayCustomModelForAdmission as lockActiveWorkspaceGatewayCustomModelForAdmission2,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission as lockActiveWorkspaceOpenRouterCustomModelForAdmission2,
   nestedPostgresSqlState as nestedPostgresSqlState2,
   requireWorkspace as requireWorkspace4,
   scopedKnowledgeScopeKey,
@@ -6959,13 +7443,15 @@ import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
+  WORKSPACE_GATEWAY_MODEL_ID_PREFIX as WORKSPACE_GATEWAY_MODEL_ID_PREFIX2,
+  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX as WORKSPACE_OPENROUTER_MODEL_ID_PREFIX2,
   resolveFirstPartyMcpToolPolicy,
   policyProviderIdForModel,
   resolveTurnExecutionPolicyV1,
-  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   XAI_SUBSCRIPTION_MODEL_ID_PREFIX
 } from "@opengeni/config";
 import {
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
@@ -6975,14 +7461,18 @@ import {
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
-  evaluateWorkspaceModelPolicy,
+  evaluateWorkspaceModelPolicy as evaluateWorkspaceModelPolicy2,
+  normalizeAutomaticSessionTitle,
   resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults2,
+  metadataWithTurnExecutionPolicyV1,
+  readTurnExecutionPolicyV1,
   stableJson as stableJson4,
   SessionMcpApprovalPolicy
 } from "@opengeni/contracts";
 import {
   createSession,
   createSessionWithIdempotencyKeyResult,
+  canonicalSessionCommandHash,
   encryptVariableSetValue as encryptVariableSetValue2,
   getAnySessionInGroup,
   getEnrollment as getEnrollment2,
@@ -6993,10 +7483,10 @@ import {
   listDistinctRigVersionIdsInGroup,
   getSandbox as getSandbox3,
   getSession as getSession2,
+  getInitializedSessionCreateReplay,
   getSessionAuthorityProjection as getSessionAuthorityProjection2,
   SessionIdConflictError,
   NewSessionDraftConflictError,
-  getSessionSpawnDenialByIdempotencyKey,
   getWorkspaceControlEvent,
   getSessionLineage,
   getSessionTurn,
@@ -7008,7 +7498,10 @@ import {
   initializeSessionStartAtomically,
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   requireSession as requireSession2,
+  replaySubmittedHumanPromptFromBoundaryReceipt,
   submitHumanPromptInTransaction,
   appendSessionEventsWithLockedSessionUpdate,
   updateSessionTitleWithEvent,
@@ -7876,13 +8369,60 @@ function validateSessionMcpCredentialUpdates(input) {
   });
   return encryptedUpdates;
 }
+var AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY = "agentChildAutomaticTitle";
+function freezeAgentChildAutomaticTitleInCreatorContext(context, title) {
+  return title ? { ...context ?? {}, [AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY]: title } : context;
+}
+function initialAutomaticTitleForSessionStart(session, requestedTitle) {
+  const frozenTitle = session.createdByContext[AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY];
+  return typeof frozenTitle === "string" ? frozenTitle : requestedTitle ?? null;
+}
+function automaticTitleForAgentChildCreate(presentation, goal, initialMessage) {
+  for (const candidate of [presentation.automaticTitleCandidate, goal?.text, initialMessage]) {
+    if (typeof candidate !== "string") continue;
+    const normalized = normalizeAutomaticSessionTitle(candidate);
+    if (normalized && normalized !== AUTOMATIC_SESSION_TITLE_FALLBACK) return normalized;
+  }
+  return null;
+}
 async function createAndStartSessionWithOutcome(input) {
-  const sessionMetadata = {
-    ...input.metadata,
-    model: input.model,
-    reasoningEffort: input.reasoningEffort,
-    ...input.latencyMode !== void 0 ? { latencyMode: input.latencyMode } : {}
-  };
+  const sessionMetadata = metadataWithTurnExecutionPolicyV1(
+    {
+      ...input.metadata,
+      model: input.model,
+      reasoningEffort: input.reasoningEffort,
+      ...input.latencyMode !== void 0 ? { latencyMode: input.latencyMode } : {}
+    },
+    input.turnExecutionPolicy
+  );
+  const frozenCreatedByContext = freezeAgentChildAutomaticTitleInCreatorContext(
+    input.createdByContext,
+    input.initialAutomaticTitle
+  );
+  const requiresActiveWorkspaceCustomModel = (input.workspaceCustomModel === true || input.workspaceGatewayCustomModel === true) && input.retainWorkspaceCustomModel !== true && input.retainWorkspaceGatewayModel !== true;
+  const beforeCreateCommit = requiresActiveWorkspaceCustomModel || input.beforeCreateCommit ? async (tx, sessionId, context) => {
+    if (requiresActiveWorkspaceCustomModel && context?.created !== false) {
+      const openRouter = input.model.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX2);
+      const upstreamModelId = input.model.slice(
+        openRouter ? WORKSPACE_OPENROUTER_MODEL_ID_PREFIX2.length : WORKSPACE_GATEWAY_MODEL_ID_PREFIX2.length
+      );
+      const active = openRouter ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        upstreamModelId
+      }) : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        upstreamModelId
+      });
+      if (!active) {
+        throw new HTTPException11(422, {
+          message: `model is not available: ${input.model}`
+        });
+      }
+    }
+    await input.beforeCreateCommit?.(tx, sessionId);
+  } : void 0;
   if (input.createIdempotencyKey) {
     const keyedResult = await createSessionWithIdempotencyKeyResult(input.db, {
       ...input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {},
@@ -7897,7 +8437,7 @@ async function createAndStartSessionWithOutcome(input) {
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
-      ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
+      ...frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {},
       createdByActor: input.createdByActor ?? null,
       model: input.model,
       reasoningEffort: input.reasoningEffort,
@@ -7925,15 +8465,23 @@ async function createAndStartSessionWithOutcome(input) {
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null,
-      ...input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}
+      ...beforeCreateCommit ? { beforeCreateCommit } : {}
     });
     if (keyedResult.denied) {
       throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));
     }
     const { session: keyed, created } = keyedResult;
     if (!created) {
+      const persistedPolicy = readTurnExecutionPolicyV1(keyed.metadata);
       const finished3 = await finishStartSession(
-        keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,
+        keyed.temporalWorkflowId ? {
+          ...input,
+          seedTargetSandbox: null,
+          ...persistedPolicy.kind === "valid" ? { turnExecutionPolicy: persistedPolicy.policy } : {}
+        } : {
+          ...input,
+          ...persistedPolicy.kind === "valid" ? { turnExecutionPolicy: persistedPolicy.policy } : {}
+        },
         keyed
       );
       return {
@@ -7966,7 +8514,7 @@ async function createAndStartSessionWithOutcome(input) {
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...input.createdBy ? { createdBy: input.createdBy } : {},
-      ...input.createdByContext ? { createdByContext: input.createdByContext } : {},
+      ...frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {},
       createdByActor: input.createdByActor ?? null,
       model: input.model,
       reasoningEffort: input.reasoningEffort,
@@ -7993,7 +8541,7 @@ async function createAndStartSessionWithOutcome(input) {
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null,
-      ...input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}
+      ...beforeCreateCommit ? { beforeCreateCommit } : {}
     });
   } catch (error) {
     if (error instanceof SessionSpawnDeniedDbError) {
@@ -8070,6 +8618,10 @@ async function finishStartSession(input, session) {
       ...input.goal.maxAutoContinuations !== void 0 ? { maxAutoContinuations: input.goal.maxAutoContinuations } : {},
       ...input.goal.mutationPolicy !== void 0 ? { mutationPolicy: input.goal.mutationPolicy } : {}
     } : null,
+    initialAutomaticTitle: initialAutomaticTitleForSessionStart(
+      session,
+      input.initialAutomaticTitle
+    ),
     consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,
     rememberNewSessionSelection: input.rememberNewSessionSelection ?? null,
     deferInitialTurn: input.deferInitialTurn === true
@@ -8108,9 +8660,6 @@ function canonicalConfiguredModel(settings, model) {
   if (settings.supergrokSubscriptionEnabled && canonicalModel.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {
     return canonicalModel;
   }
-  if (canonicalModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
-    return canonicalModel;
-  }
   throw new HTTPException11(422, { message: `model is not available: ${model}` });
 }
 function assertConfiguredModel(settings, model) {
@@ -8147,7 +8696,7 @@ async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model
     return;
   }
   const providerId = policyProviderIdForModel(settings, canonicalModel);
-  const verdict = evaluateWorkspaceModelPolicy(policy, {
+  const verdict = evaluateWorkspaceModelPolicy2(policy, {
     providerId,
     modelId: canonicalModel
   });
@@ -8169,91 +8718,8 @@ async function requireQueuedTurnForApi(db, workspaceId, sessionId, turnId) {
   }
   return turn;
 }
-async function postUserMessageTurn(input) {
-  const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;
-  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
-  const requestedReasoningEffort = input.reasoningEffort ?? null;
-  assertConfiguredModel(settings, requestedModel);
-  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
-  const sessionForModelGate = await requireSession2(db, workspaceId, sessionId);
-  const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;
-  try {
-    assertSessionAllowsProductModel(sessionForModelGate, effectiveModelForGate);
-  } catch (error) {
-    if (error instanceof CodexCompactionV2ProviderLockedError) {
-      throw new HTTPException11(422, { message: error.message, cause: error });
-    }
-    throw error;
-  }
-  const operationKey = input.clientEventId ?? crypto.randomUUID();
-  let result;
-  try {
-    result = await runIdempotentPersistenceTransaction(
-      {
-        stage: "session.prompt.submit",
-        eventTypes: ["user.message", "turn.queued", "session.status.changed"],
-        maxAttempts: 3
-      },
-      async () => await withWorkspaceSubjectSessionActivityRls(
-        db,
-        workspaceId,
-        input.actor ?? accountId,
-        (scoped) => submitHumanPromptInTransaction(scoped, {
-          accountId,
-          workspaceId,
-          sessionId,
-          subjectId: input.actor ?? accountId,
-          ...input.actorLabel ? { subjectLabel: input.actorLabel } : {},
-          actor: input.commandActor ?? {
-            type: "human",
-            subjectId: input.actor ?? accountId
-          },
-          operationKey,
-          delivery: input.delivery ?? "send",
-          controlEtag: input.controlEtag ?? null,
-          expectedDraftRevision: input.expectedDraftRevision ?? null,
-          text: input.text,
-          annotations: input.annotations ?? [],
-          modelContext: input.modelContext ?? null,
-          resources: input.resources,
-          ...input.composerDraftResources ? { composerDraftResources: input.composerDraftResources } : {},
-          model: requestedModel,
-          reasoningEffort: requestedReasoningEffort,
-          latencyMode: input.latencyMode ?? null,
-          reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
-          turnExecutionPolicy: input.turnExecutionPolicy,
-          source: input.origin === "operator" ? "api" : "user",
-          ...input.recordAgentRunUsage !== void 0 ? { recordAgentRunUsage: input.recordAgentRunUsage } : {},
-          personalConnectionDelegations: input.personalConnectionDelegations ?? [],
-          ...input.personalResourceAttachment ? {
-            personalResourceAttachment: input.personalResourceAttachment
-          } : {},
-          mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
-          controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
-        })
-      )
-    );
-  } catch (error) {
-    if (error instanceof WorkspaceControlBusyError) {
-      throw error;
-    }
-    if (error instanceof PersonalResourceAttachmentAcceptanceError) {
-      throw new HTTPException11(
-        error.kind === "invalid" ? 422 : error.kind === "forbidden" ? 403 : 409,
-        { message: error.message, cause: error }
-      );
-    }
-    if (error instanceof QueueCommandConflictError || error instanceof SessionControlConflictError) {
-      throw new HTTPException11(409, { message: error.message });
-    }
-    if (error instanceof Error && error.message.includes("cancelled")) {
-      throw new HTTPException11(409, { message: error.message });
-    }
-    if (error instanceof Error && error.message.startsWith("Unknown session MCP server")) {
-      throw new HTTPException11(422, { message: error.message });
-    }
-    throw error;
-  }
+function finalizePostUserMessageTurn(input, result) {
+  const { db, bus, workflowClient, accountId, workspaceId, sessionId } = input;
   const postCommitTask = async () => {
     await Promise.all([
       (async () => {
@@ -8312,37 +8778,151 @@ async function postUserMessageTurn(input) {
       origin: "core"
     });
   }
-  return {
-    accepted: result.accepted,
-    turn: result.turn,
-    receipt: {
-      id: result.receipt.id,
-      action: result.receipt.action,
-      operationKey: result.receipt.operationKey,
-      targetSessionId: result.receipt.targetSessionId,
-      targetTurnId: result.receipt.targetTurnId,
-      appliedControlRevision: result.receipt.appliedControlRevision,
-      appliedQueueVersion: result.receipt.appliedQueueVersion,
-      appliedTurnVersion: result.receipt.appliedTurnVersion,
-      appliedDraftRevision: result.receipt.appliedDraftRevision,
-      createdAt: result.receipt.createdAt.toISOString()
-    },
-    routing: result.routing,
-    draft: result.draft ? {
-      revision: result.draft.revision,
-      text: result.draft.text,
-      annotations: DraftTimelineAnnotations2.parse(result.draft.annotations),
-      resources: result.draft.resources,
-      model: result.draft.model,
-      reasoningEffort: result.draft.reasoningEffort,
-      latencyMode: result.draft.latencyMode,
-      sourceTurnId: result.draft.sourceTurnId,
-      sourceTurnVersion: result.draft.sourceTurnVersion,
-      updatedAt: result.draft.updatedAt.toISOString()
-    } : null,
-    interruptionCount: result.interruptionCount,
-    replay: result.replay
-  };
+  return {
+    accepted: result.accepted,
+    turn: result.turn,
+    receipt: {
+      id: result.receipt.id,
+      action: result.receipt.action,
+      operationKey: result.receipt.operationKey,
+      targetSessionId: result.receipt.targetSessionId,
+      targetTurnId: result.receipt.targetTurnId,
+      appliedControlRevision: result.receipt.appliedControlRevision,
+      appliedQueueVersion: result.receipt.appliedQueueVersion,
+      appliedTurnVersion: result.receipt.appliedTurnVersion,
+      appliedDraftRevision: result.receipt.appliedDraftRevision,
+      createdAt: result.receipt.createdAt.toISOString()
+    },
+    routing: result.routing,
+    draft: result.draft ? {
+      revision: result.draft.revision,
+      text: result.draft.text,
+      annotations: DraftTimelineAnnotations2.parse(result.draft.annotations),
+      resources: result.draft.resources,
+      model: result.draft.model,
+      reasoningEffort: result.draft.reasoningEffort,
+      latencyMode: result.draft.latencyMode,
+      sourceTurnId: result.draft.sourceTurnId,
+      sourceTurnVersion: result.draft.sourceTurnVersion,
+      updatedAt: result.draft.updatedAt.toISOString()
+    } : null,
+    interruptionCount: result.interruptionCount,
+    replay: result.replay
+  };
+}
+async function postUserMessageTurn(input) {
+  const { db, settings, accountId, workspaceId, sessionId } = input;
+  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
+  const requestedReasoningEffort = input.reasoningEffort ?? null;
+  assertConfiguredModel(settings, requestedModel);
+  const sessionForModelGate = await requireSession2(db, workspaceId, sessionId);
+  const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;
+  const freshWorkspaceCustomModel = requestedModel !== null && isWorkspaceCustomModelId(settings, requestedModel) && requestedModel !== sessionForModelGate.model ? requestedModel : null;
+  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, effectiveModelForGate);
+  try {
+    assertSessionAllowsProductModel(sessionForModelGate, effectiveModelForGate);
+  } catch (error) {
+    if (error instanceof CodexCompactionV2ProviderLockedError) {
+      throw new HTTPException11(422, { message: error.message, cause: error });
+    }
+    throw error;
+  }
+  const operationKey = input.clientEventId ?? crypto.randomUUID();
+  let result;
+  try {
+    result = await runIdempotentPersistenceTransaction(
+      {
+        stage: "session.prompt.submit",
+        eventTypes: ["user.message", "turn.queued", "session.status.changed"],
+        maxAttempts: 3
+      },
+      async () => await withWorkspaceSubjectSessionActivityRls(
+        db,
+        workspaceId,
+        input.actor ?? accountId,
+        (scoped) => submitHumanPromptInTransaction(scoped, {
+          accountId,
+          workspaceId,
+          sessionId,
+          subjectId: input.actor ?? accountId,
+          ...input.actorLabel ? { subjectLabel: input.actorLabel } : {},
+          actor: input.commandActor ?? {
+            type: "human",
+            subjectId: input.actor ?? accountId
+          },
+          operationKey,
+          ...input.boundaryRequestHash ? { boundaryRequestHash: input.boundaryRequestHash } : {},
+          delivery: input.delivery ?? "send",
+          controlEtag: input.controlEtag ?? null,
+          expectedDraftRevision: input.expectedDraftRevision ?? null,
+          text: input.text,
+          annotations: input.annotations ?? [],
+          modelContext: input.modelContext ?? null,
+          resources: input.resources,
+          ...input.composerDraftResources ? { composerDraftResources: input.composerDraftResources } : {},
+          model: requestedModel,
+          reasoningEffort: requestedReasoningEffort,
+          latencyMode: input.latencyMode ?? null,
+          reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
+          turnExecutionPolicy: input.turnExecutionPolicy,
+          source: input.origin === "operator" ? "api" : "user",
+          ...input.recordAgentRunUsage !== void 0 ? { recordAgentRunUsage: input.recordAgentRunUsage } : {},
+          personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+          ...input.personalResourceAttachment ? {
+            personalResourceAttachment: input.personalResourceAttachment
+          } : {},
+          mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+          ...freshWorkspaceCustomModel ? {
+            beforeFreshPromptCommit: async (tx) => {
+              const reference = workspaceCustomModelReference(
+                settings,
+                freshWorkspaceCustomModel
+              );
+              if (!reference) {
+                throw new Error("workspace custom model reference disappeared");
+              }
+              const active = reference.providerKind === "openrouter" ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+                accountId,
+                workspaceId,
+                upstreamModelId: reference.upstreamModelId
+              }) : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+                accountId,
+                workspaceId,
+                upstreamModelId: reference.upstreamModelId
+              });
+              if (!active) {
+                throw new HTTPException11(422, {
+                  message: `model is not available: ${freshWorkspaceCustomModel}`
+                });
+              }
+            }
+          } : {},
+          controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
+        })
+      )
+    );
+  } catch (error) {
+    if (error instanceof WorkspaceControlBusyError) {
+      throw error;
+    }
+    if (error instanceof PersonalResourceAttachmentAcceptanceError) {
+      throw new HTTPException11(
+        error.kind === "invalid" ? 422 : error.kind === "forbidden" ? 403 : 409,
+        { message: error.message, cause: error }
+      );
+    }
+    if (error instanceof QueueCommandConflictError || error instanceof SessionControlConflictError) {
+      throw new HTTPException11(409, { message: error.message });
+    }
+    if (error instanceof Error && error.message.includes("cancelled")) {
+      throw new HTTPException11(409, { message: error.message });
+    }
+    if (error instanceof Error && error.message.startsWith("Unknown session MCP server")) {
+      throw new HTTPException11(422, { message: error.message });
+    }
+    throw error;
+  }
+  return finalizePostUserMessageTurn(input, result);
 }
 function resolveChildGoalFromAcceptedSnapshot(goal, parentGoalSnapshot) {
   const inheritedRootConstraints = parentGoalSnapshot.state === "none" ? [] : parentGoalSnapshot.rootConstraints;
@@ -8372,9 +8952,56 @@ function resolveSessionCreateVisibility(input) {
   }
   return input.requestedVisibility === "private" ? "user_private" : "workspace_shared";
 }
-async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload, authorization) {
-  const { settings, db, bus, workflowClient, objectStorage } = deps;
+async function resolveWorkspaceModelBoundarySettings(deps, grant, workspaceId, modelIds, retainedProductModelId) {
+  const retainedWorkspaceModel = retainedProductModelId?.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX2) === true || retainedProductModelId?.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX2) === true;
+  if (deps.catalogSourceSettings) {
+    if (!retainedWorkspaceModel) return deps.settings;
+  }
+  const workspaceModelIds = modelIds.filter(
+    (modelId) => typeof modelId === "string" && (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX2) || modelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX2))
+  );
+  const needsWorkspaceResolution = deps.settings.modelCatalogSource === "database" || workspaceModelIds.length > 0;
+  if (!needsWorkspaceResolution) return deps.settings;
+  return (await resolveWorkspaceCatalogSettings(deps.db, deps.catalogSourceSettings ?? deps.settings, {
+    accountId: grant.accountId,
+    workspaceId,
+    ...retainedProductModelId !== void 0 ? { retainedProductModelId } : {}
+  })).settings;
+}
+async function withSessionCreateUsageRecording(input) {
+  let usageRecording = "recorded";
+  if (input.startMode !== "realtime") {
+    try {
+      await recordWorkspaceUsage(input.deps, {
+        accountId: input.grant.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.grant.subjectId,
+        eventType: "agent_run.created",
+        quantity: 1,
+        unit: "run",
+        sourceResourceType: "session",
+        sourceResourceId: input.createOutcome.session.id,
+        sessionId: input.createOutcome.session.id,
+        initiator: input.createOutcome.session.createdBy,
+        initiatorContext: input.createOutcome.session.createdByContext,
+        origin: input.origin,
+        idempotencyKey: `agent_run.created:${input.workspaceId}:${input.createOutcome.session.id}`
+      });
+    } catch (error) {
+      usageRecording = "failed";
+      reportSessionUsageRecordingFailure(error);
+    }
+  }
+  return { ...input.createOutcome, usageRecording };
+}
+async function createSessionForRequestWithOutcome(unresolvedDeps, grant, workspaceId, rawPayload, authorization, agentChildPresentation) {
   const payload = CreateSessionRequest.parse(rawPayload);
+  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
+    throw new HTTPException11(422, {
+      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2} is reserved for scheduler routing`
+    });
+  }
+  const db = unresolvedDeps.db;
   const visibilityProvided = hasOwnProperty(rawPayload, "visibility");
   if (payload.visibility === "private" && !grant.metadata?.["sessionId"]) {
     if (!authorization) {
@@ -8382,39 +9009,17 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
         message: "managed human session required"
       });
     }
-    await requireManagedHumanPrivateSessionCreate(deps, authorization, workspaceId);
+    await requireManagedHumanPrivateSessionCreate(unresolvedDeps, authorization, workspaceId);
     if (payload.sandbox === "shared" || typeof payload.sandbox === "object") {
       throw new HTTPException11(422, {
         message: "Only-me sessions require their own sandbox"
       });
     }
   }
-  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
-    throw new HTTPException11(422, {
-      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2} is reserved for scheduler routing`
-    });
-  }
-  if (payload.idempotencyKey) {
-    const denial = await getSessionSpawnDenialByIdempotencyKey(
-      db,
-      workspaceId,
-      payload.idempotencyKey
-    );
-    if (denial) {
-      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));
-    }
-  }
-  await requireAtomicPersonalResourceAttachment(
-    deps,
-    authorization,
-    workspaceId,
-    payload.personalResourceAttachment,
-    false
-  );
   const parentSessionId = typeof grant.metadata?.["sessionId"] === "string" ? grant.metadata["sessionId"] : null;
   if (parentSessionId) {
     try {
-      await requireSessionAuthorization(deps, grant, {
+      await requireSessionAuthorization(unresolvedDeps, grant, {
         sessionId: parentSessionId,
         operation: "session.child.create",
         surface: "core"
@@ -8464,6 +9069,102 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       message: "caller attempt does not belong to the parent session"
     });
   }
+  const replayManagedHumanSubjectId = creationInitiator.actor ? parentCallingTurn?.initiatingHumanSubjectId ?? (parentCallingTurn?.initiator.kind === "subject" ? parentCallingTurn.initiator.subjectId : null) : authorization?.canonicalManagedHumanSession || grant.principalKind === "human_session" ? grant.subjectId : null;
+  let retainedKeyedShellModel = null;
+  if (payload.idempotencyKey && (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)) {
+    try {
+      const initializedReplay = await getInitializedSessionCreateReplay(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
+        ...replayManagedHumanSubjectId ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId } : {},
+        createIdempotencyKey: payload.idempotencyKey,
+        ...payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {},
+        visibility: effectiveVisibility,
+        variableSetIds: payload.variableSetIds ?? [],
+        initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+        deferInitialTurn: payload.startMode === "realtime"
+      });
+      if (initializedReplay) {
+        if (initializedReplay.outcome === "denied") {
+          throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
+        }
+        if (initializedReplay.outcome === "pending") {
+          retainedKeyedShellModel = initializedReplay.session.model;
+        } else {
+          if (initializedReplay.workflowWakeRevision !== null) {
+            await unresolvedDeps.workflowClient.wakeSessionWorkflow({
+              accountId: grant.accountId,
+              workspaceId,
+              sessionId: initializedReplay.session.id,
+              workflowId: initializedReplay.temporalWorkflowId,
+              wakeRevision: initializedReplay.workflowWakeRevision
+            });
+          }
+          return await withSessionCreateUsageRecording({
+            deps: unresolvedDeps,
+            grant,
+            workspaceId,
+            startMode: payload.startMode,
+            origin: creationInitiator.actor ? "system" : "user",
+            createOutcome: {
+              session: initializedReplay.session,
+              outcome: initializedReplay.changed ? "repaired" : "replayed",
+              replay: !initializedReplay.changed,
+              changed: initializedReplay.changed
+            }
+          });
+        }
+      }
+    } catch (error) {
+      if (error instanceof SessionIdConflictError) {
+        throw new HTTPException11(409, {
+          message: "requested session id is already in use"
+        });
+      }
+      if (error instanceof SessionCreateIdempotencyConflictError) {
+        throw new HTTPException11(409, { message: error.message, cause: error });
+      }
+      throw error;
+    }
+  }
+  let settings = await resolveWorkspaceModelBoundarySettings(
+    unresolvedDeps,
+    grant,
+    workspaceId,
+    [payload.model],
+    retainedKeyedShellModel
+  );
+  let deps = settings === unresolvedDeps.settings ? unresolvedDeps : {
+    ...unresolvedDeps,
+    catalogSourceSettings: unresolvedDeps.catalogSourceSettings ?? unresolvedDeps.settings,
+    settings
+  };
+  const { bus, workflowClient, objectStorage } = deps;
+  await requireAtomicPersonalResourceAttachment(
+    deps,
+    authorization,
+    workspaceId,
+    payload.personalResourceAttachment,
+    false
+  );
+  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
+  const effectiveModelId = payload.model ?? inheritedModel;
+  const effectiveCatalogSettings = await resolveWorkspaceModelBoundarySettings(
+    deps,
+    grant,
+    workspaceId,
+    [effectiveModelId],
+    parentSession ? inheritedModel : null
+  );
+  if (effectiveCatalogSettings !== settings) {
+    deps = {
+      ...deps,
+      catalogSourceSettings: deps.catalogSourceSettings ?? settings,
+      settings: effectiveCatalogSettings
+    };
+    settings = effectiveCatalogSettings;
+  }
   let effectiveGoal = payload.goal;
   if (parentSession && payload.goal) {
     try {
@@ -8480,6 +9181,11 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       });
     }
   }
+  const initialAutomaticTitle = parentSession && agentChildPresentation ? automaticTitleForAgentChildCreate(
+    agentChildPresentation,
+    effectiveGoal,
+    payload.initialMessage
+  ) : null;
   const personalResourceSubjectId = creationInitiator.actor ? (await requireLiveAgentAttemptAuthorization(db, grant, creationInitiator.actor.sessionId)).initiatingHumanSubjectId : grant.subjectId;
   const xaiProviderAccountAuthoritySnapshot = parentSession && creationInitiator.actor ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(
     db,
@@ -8609,8 +9315,7 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
     }
     channelId = channel.id;
   }
-  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
-  const model = canonicalConfiguredModel(settings, payload.model ?? inheritedModel);
+  const model = canonicalConfiguredModel(settings, effectiveModelId);
   if (model === null || model === void 0) {
     throw new Error("effective session model unexpectedly resolved to null");
   }
@@ -8733,6 +9438,8 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
   const sandboxChoice = payload.sandbox ?? (payload.targetSandboxId ? "new" : parentSessionId ? "shared" : "new");
   let sandboxGroupId = null;
   let inheritedBackend;
+  let inheritedSandboxOs;
+  let inheritedActiveTarget = null;
   const requestedVariableSetIds = variableSets.map((variableSet) => variableSet.id);
   const variableSetsMatchGroup = (memberVariableSetIds) => stableJson4(memberVariableSetIds) === stableJson4(requestedVariableSetIds);
   const rigVersionMatchesGroup = (memberRigVersionId) => memberRigVersionId === frozenRigVersionId;
@@ -8768,6 +9475,11 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
     } else {
       sandboxGroupId = parent.sandboxGroupId;
       inheritedBackend = parent.sandboxBackend;
+      inheritedSandboxOs = parent.sandboxOs;
+      inheritedActiveTarget = parent.activeSandboxId ? {
+        sandboxId: parent.activeSandboxId,
+        workingDir: parent.workingDir
+      } : null;
     }
   } else if (typeof sandboxChoice === "object") {
     const member = await getAnySessionInGroup(db, workspaceId, sandboxChoice.groupId);
@@ -8804,12 +9516,18 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
     }
     sandboxGroupId = sandboxChoice.groupId;
     inheritedBackend = member.sandboxBackend;
+    inheritedSandboxOs = member.sandboxOs;
   }
   if (payload.workingDir !== void 0 && !payload.targetSandboxId) {
     throw new HTTPException11(422, {
       message: "workingDir requires targetSandboxId (it is the targeted machine's working directory)"
     });
   }
+  if (inheritedBackend === void 0 && !payload.targetSandboxId && (payload.sandboxBackend ?? settings.sandboxBackend) === "selfhosted") {
+    throw new HTTPException11(422, {
+      message: "selfhosted sessions require targetSandboxId; select an online Connected Machine"
+    });
+  }
   let machineHomeBackend;
   let machineHomeOs;
   if (payload.targetSandboxId && inheritedBackend === void 0 && settings.sandboxOwnershipEnabled && settings.sandboxSelfhostedEnabled) {
@@ -8832,6 +9550,17 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       }
     }
   }
+  const effectiveSandboxBackend = inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend;
+  const effectiveSandboxOs = inheritedSandboxOs ?? machineHomeOs;
+  const effectiveSeedTarget = payload.targetSandboxId ? {
+    sandboxId: payload.targetSandboxId,
+    workingDir: payload.workingDir ?? null
+  } : inheritedActiveTarget;
+  if (effectiveSandboxBackend === "selfhosted" && effectiveSeedTarget === null && managedSessionGroupBackend(settings.sandboxBackend, effectiveSandboxBackend) === null) {
+    throw new HTTPException11(422, {
+      message: "self-hosted execution runs on a Connected Machine, but no machine was selected or inherited; connect the parent session to a machine or provide machineTarget"
+    });
+  }
   if (payload.startMode !== "realtime") {
     await requireLimit(deps, {
       accountId: grant.accountId,
@@ -8868,10 +9597,10 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       // machine-targeted create (top-level or own-box child) labels the home
       // "selfhosted" (machineHomeBackend), overriding the caller/deployment
       // default so the row matches where the session actually runs.
-      sandboxBackend: inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend,
+      sandboxBackend: effectiveSandboxBackend,
       // Mirror the backend relabel on the OS axis: a machine-targeted own-box
-      // create carries a derived OS; shared spawns keep the parent-box behavior.
-      ...machineHomeOs ? { sandboxOs: machineHomeOs } : {},
+      // create carries a derived OS; shared spawns inherit the exact parent box.
+      ...effectiveSandboxOs ? { sandboxOs: effectiveSandboxOs } : {},
       sandboxGroupId,
       metadata: payload.metadata,
       ...creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {},
@@ -8887,6 +9616,7 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       rigVersionId: frozenRigVersionId,
       channelId,
       goal: effectiveGoal ?? null,
+      initialAutomaticTitle,
       // Per-session persona instructions (already trimmed/validated by the
       // contracts schema). Persisted on the row; composed system-level at turn
       // time. Not surfaced as an event.
@@ -8898,6 +9628,8 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       sessionMcpServers: sessionMcpServers.metadata,
       personalConnectionDelegations,
       initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+      workspaceCustomModel: isWorkspaceCustomModelId(settings, model),
+      retainWorkspaceCustomModel: parentSession !== null && model === inheritedModel,
       ...xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {},
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
@@ -8908,10 +9640,10 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       // active-sandbox pointer is seeded race-free inside createAndStartSession
       // (after the row exists, before the first turn dispatches). Validation
       // (ownership/liveness) lives in swapActiveSandbox; an invalid target 422s.
-      seedTargetSandbox: payload.targetSandboxId ? {
-        sandboxId: payload.targetSandboxId,
+      seedTargetSandbox: effectiveSeedTarget ? {
+        sandboxId: effectiveSeedTarget.sandboxId,
         settings,
-        workingDir: payload.workingDir ?? null,
+        workingDir: effectiveSeedTarget.workingDir,
         resourceSubjectId: personalResourceSubjectId
       } : null,
       consumeNewSessionDraft: payload.expectedNewSessionDraftRevision !== void 0 && payload.startMode !== "realtime" ? {
@@ -8953,207 +9685,322 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
         message: error.message,
         cause: error
       });
-    }
-    if (error instanceof SessionCreateIdempotencyConflictError) {
-      throw new HTTPException11(409, { message: error.message, cause: error });
-    }
-    throw error;
-  }
-  let usageRecording = "recorded";
-  if (payload.startMode !== "realtime") {
-    try {
-      await recordWorkspaceUsage(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        eventType: "agent_run.created",
-        quantity: 1,
-        unit: "run",
-        sourceResourceType: "session",
-        sourceResourceId: createOutcome.session.id,
-        sessionId: createOutcome.session.id,
-        initiator: createOutcome.session.createdBy,
-        initiatorContext: createOutcome.session.createdByContext,
-        origin: creationInitiator.actor ? "system" : "user",
-        idempotencyKey: `agent_run.created:${workspaceId}:${createOutcome.session.id}`
-      });
-    } catch (error) {
-      usageRecording = "failed";
-      reportSessionUsageRecordingFailure(error);
-    }
-  }
-  return { ...createOutcome, usageRecording };
-}
-function reportSessionUsageRecordingFailure(_error) {
-  console.warn(
-    "[sessions] usage recording failed after committed session create; returning committed outcome",
-    {
-      errorClass: "UsageRecordingError",
-      errorCode: "session_create_usage_recording_failed",
-      origin: "core"
-    }
-  );
-}
-async function createSessionForRequest(deps, grant, workspaceId, rawPayload, authorization) {
-  return (await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload, authorization)).session;
-}
-async function acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, sessionId, input) {
-  const { settings, db, bus, workflowClient, objectStorage } = deps;
-  const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
-  await requireSessionAuthorization(deps, grant, {
-    sessionId,
-    operation: input.delivery === "steer" ? "session.steer" : "session.append",
-    surface: "core"
-  });
-  await requireAtomicPersonalResourceAttachment(
-    deps,
-    input.authorization,
-    workspaceId,
-    input.personalResourceAttachment,
-    true
-  );
-  const existingSession = await requireSession2(db, workspaceId, sessionId);
-  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
-  const effectiveModel = canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
-  if (effectiveModel === null) {
-    throw new Error("effective follow-up model unexpectedly resolved to null");
-  }
-  try {
-    assertSessionAllowsProductModel(existingSession, effectiveModel);
-  } catch (error) {
-    if (error instanceof CodexCompactionV2ProviderLockedError) {
-      throw new HTTPException11(422, { message: error.message, cause: error });
-    }
-    throw error;
-  }
-  const sessionReasoningEffort = existingSession.reasoningEffort;
-  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
-  const sessionLatencyMode = existingSession.latencyMode;
-  const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
-  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
-    modelId: effectiveModel,
-    requestedModelId: input.model ?? null,
-    modelSource: input.model == null ? "session" : "explicit",
-    reasoningEffort: effectiveReasoningEffort,
-    reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
-    latencyMode: effectiveLatencyMode,
-    latencyModeSource: input.latencyMode == null ? "session" : "explicit"
-  });
-  const requestedResources = normalizeResources(input.resources ?? []);
-  const composerDraftResources = input.composerDraftResources ? normalizeResources(input.composerDraftResources) : void 0;
-  if (composerDraftResources) {
-    const acceptedResources = new Set(requestedResources.map((resource) => stableJson4(resource)));
-    const unacceptedDraftResource = composerDraftResources.find(
-      (resource) => !acceptedResources.has(stableJson4(resource))
-    );
-    if (unacceptedDraftResource) {
-      throw new HTTPException11(422, {
-        message: "composer draft resources must be included in the accepted resource set"
-      });
-    }
-  }
-  const annotations = await validateSubmittedTimelineAnnotations(
-    db,
-    workspaceId,
-    sessionId,
-    input.annotations ?? []
-  );
-  await requireLimit(deps, {
-    accountId: grant.accountId,
-    workspaceId,
-    action: "agent_run:create",
-    quantity: 1,
-    model: effectiveModel
-  });
-  if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException11(503, {
-      message: "object storage is not configured"
-    });
-  }
-  await validateFileResources(
-    db,
-    grant.accountId,
-    workspaceId,
-    grant.subjectId,
-    requestedResources
-  );
-  await validateGitHubRepositorySelection(db, workspaceId, [
-    ...existingSession.resources,
-    ...requestedResources
-  ]);
-  const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
-    settings,
-    grant,
-    session: existingSession,
-    updates: input.mcpCredentialUpdates ?? []
-  });
-  const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
-  const inheritedPersonalConnectionDelegations = connectionDelegationSource.kind === "turn" ? await getSessionTurnPersonalConnectionDelegations2(
-    db,
-    workspaceId,
-    connectionDelegationSource.sessionId,
-    connectionDelegationSource.turnId
-  ) : null;
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
-    db,
-    workspaceId,
-    settings,
-    inheritedPersonalConnectionDelegations ? {
-      personalConnectionDelegations: inheritedPersonalConnectionDelegations
-    } : { subjectId: grant.subjectId }
-  );
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
-    db,
+    }
+    if (error instanceof SessionCreateIdempotencyConflictError) {
+      throw new HTTPException11(409, { message: error.message, cause: error });
+    }
+    throw error;
+  }
+  return await withSessionCreateUsageRecording({
+    deps,
+    grant,
     workspaceId,
-    settings: runtimeSettings,
-    tools: existingSession.tools,
-    resources: [...existingSession.resources, ...requestedResources],
-    source: connectionDelegationSource,
-    targetSessionId: sessionId,
-    googleDrivePublicationEnabled: existingSession.firstPartyMcpTools.includes("editable_artifact_export") && existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("artifacts:read") && existingSession.firstPartyMcpPermissions.includes("artifacts:publish")),
-    atlassianEnabled: existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("connections:read")),
-    ...input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}
+    startMode: payload.startMode,
+    origin: creationInitiator.actor ? "system" : "user",
+    createOutcome
   });
-  const { accepted, turn, draft, receipt: receipt2, routing, interruptionCount, replay } = await postUserMessageTurn({
-    db,
-    bus,
-    workflowClient,
-    settings,
-    accountId: grant.accountId,
-    workspaceId,
+}
+function reportSessionUsageRecordingFailure(_error) {
+  console.warn(
+    "[sessions] usage recording failed after committed session create; returning committed outcome",
+    {
+      errorClass: "UsageRecordingError",
+      errorCode: "session_create_usage_recording_failed",
+      origin: "core"
+    }
+  );
+}
+async function createSessionForRequest(deps, grant, workspaceId, rawPayload, authorization) {
+  return (await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload, authorization)).session;
+}
+function sessionPromptBoundaryRequestHash(input) {
+  return `prompt-boundary-v1:${canonicalSessionCommandHash({
+    delivery: input.delivery,
+    controlEtag: input.controlEtag,
+    expectedDraftRevision: input.expectedDraftRevision,
+    text: input.text,
+    annotations: input.annotations,
+    modelContext: input.modelContext,
+    resources: input.resources,
+    composerDraftResourcesProvided: input.composerDraftResources !== void 0,
+    composerDraftResources: input.composerDraftResources ?? [],
+    model: input.model,
+    reasoningEffort: input.reasoningEffort,
+    latencyMode: input.latencyMode,
+    source: input.source,
+    mcpCredentialUpdates: input.mcpCredentialUpdates,
+    connectionAuthorities: input.connectionAuthorities ?? [],
+    personalResourceAttachment: input.personalResourceAttachment ?? null,
+    ...input.commandActor.type === "service" ? {
+      serviceInitiator: {
+        subjectId: input.commandActor.subjectId,
+        subjectLabel: input.commandActor.subjectLabel ?? null,
+        context: input.commandActor.context ?? {}
+      }
+    } : {}
+  })}`;
+}
+async function acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, sessionId, input) {
+  const { db, bus, workflowClient, objectStorage } = deps;
+  const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
+  const delivery = input.delivery ?? "send";
+  const source = delegatedServiceInitiator || input.origin === "operator" ? "api" : "user";
+  const commandActor = delegatedServiceInitiator ? {
+    type: "service",
+    subjectId: delegatedServiceInitiator.initiator.subjectId,
+    ...delegatedServiceInitiator.initiator.label ? { subjectLabel: delegatedServiceInitiator.initiator.label } : {},
+    context: delegatedServiceInitiator.context
+  } : { type: "human", subjectId: grant.subjectId };
+  await requireSessionAuthorization(deps, grant, {
     sessionId,
+    operation: delivery === "steer" ? "session.steer" : "session.append",
+    surface: "core"
+  });
+  const requestedResources = normalizeResources(input.resources ?? []);
+  const composerDraftResources = input.composerDraftResources ? normalizeResources(input.composerDraftResources) : void 0;
+  const boundaryRequestHash = input.clientEventId ? sessionPromptBoundaryRequestHash({
+    delivery,
+    controlEtag: input.controlEtag ?? null,
+    expectedDraftRevision: input.expectedDraftRevision ?? null,
     text: input.text,
-    annotations,
+    annotations: input.annotations ?? [],
     modelContext: input.modelContext ?? null,
     resources: requestedResources,
     ...composerDraftResources ? { composerDraftResources } : {},
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
     latencyMode: input.latencyMode ?? null,
-    reasoningEffortFallback: sessionReasoningEffort,
-    turnExecutionPolicy,
-    mcpCredentialUpdates,
-    personalConnectionDelegations,
+    source,
+    mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+    ...input.connectionAuthorities ? { connectionAuthorities: input.connectionAuthorities } : {},
     ...input.personalResourceAttachment ? { personalResourceAttachment: input.personalResourceAttachment } : {},
-    delivery: input.delivery ?? "send",
-    origin: delegatedServiceInitiator ? "operator" : input.origin ?? "human",
-    actor: grant.subjectId,
-    ...grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {},
-    ...delegatedServiceInitiator ? {
-      commandActor: {
-        type: "service",
-        subjectId: delegatedServiceInitiator.initiator.subjectId,
-        ...delegatedServiceInitiator.initiator.label ? { subjectLabel: delegatedServiceInitiator.initiator.label } : {},
-        context: delegatedServiceInitiator.context
+    commandActor
+  }) : null;
+  if (input.clientEventId && boundaryRequestHash) {
+    const replay = await withWorkspaceSubjectSessionActivityRls(
+      db,
+      workspaceId,
+      grant.subjectId,
+      async (scopedDb) => await replaySubmittedHumanPromptFromBoundaryReceipt(scopedDb, {
+        workspaceId,
+        sessionId,
+        subjectId: grant.subjectId,
+        actor: commandActor,
+        operationKey: input.clientEventId,
+        delivery,
+        boundaryRequestHash,
+        expectedDraftRevision: input.expectedDraftRevision ?? null
+      })
+    );
+    if (replay) {
+      return finalizePostUserMessageTurn(
+        {
+          db,
+          bus,
+          workflowClient,
+          accountId: grant.accountId,
+          workspaceId,
+          sessionId,
+          delivery,
+          ...deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}
+        },
+        replay
+      );
+    }
+  }
+  try {
+    await requireAtomicPersonalResourceAttachment(
+      deps,
+      input.authorization,
+      workspaceId,
+      input.personalResourceAttachment,
+      true
+    );
+    const existingSession = await requireSession2(db, workspaceId, sessionId);
+    const settings = await resolveWorkspaceModelBoundarySettings(
+      deps,
+      grant,
+      workspaceId,
+      [input.model ?? existingSession.model],
+      existingSession.model
+    );
+    if (settings !== deps.settings) {
+      deps = {
+        ...deps,
+        catalogSourceSettings: deps.catalogSourceSettings ?? deps.settings,
+        settings
+      };
+    }
+    const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
+    const effectiveModel = canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
+    if (effectiveModel === null) {
+      throw new Error("effective follow-up model unexpectedly resolved to null");
+    }
+    await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
+    try {
+      assertSessionAllowsProductModel(existingSession, effectiveModel);
+    } catch (error) {
+      if (error instanceof CodexCompactionV2ProviderLockedError) {
+        throw new HTTPException11(422, { message: error.message, cause: error });
       }
-    } : {},
-    ...input.controlEtag !== void 0 ? { controlEtag: input.controlEtag } : {},
-    ...input.expectedDraftRevision !== void 0 ? { expectedDraftRevision: input.expectedDraftRevision } : {},
-    ...input.clientEventId ? { clientEventId: input.clientEventId } : {},
-    recordAgentRunUsage: true,
-    ...deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}
-  });
-  return { accepted, turn, draft, receipt: receipt2, routing, interruptionCount, replay };
+      throw error;
+    }
+    const sessionReasoningEffort = existingSession.reasoningEffort;
+    const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
+    const sessionLatencyMode = existingSession.latencyMode;
+    const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
+    const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+      modelId: effectiveModel,
+      requestedModelId: input.model ?? null,
+      modelSource: input.model == null ? "session" : "explicit",
+      reasoningEffort: effectiveReasoningEffort,
+      reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
+      latencyMode: effectiveLatencyMode,
+      latencyModeSource: input.latencyMode == null ? "session" : "explicit"
+    });
+    if (composerDraftResources) {
+      const acceptedResources = new Set(requestedResources.map((resource) => stableJson4(resource)));
+      const unacceptedDraftResource = composerDraftResources.find(
+        (resource) => !acceptedResources.has(stableJson4(resource))
+      );
+      if (unacceptedDraftResource) {
+        throw new HTTPException11(422, {
+          message: "composer draft resources must be included in the accepted resource set"
+        });
+      }
+    }
+    const annotations = await validateSubmittedTimelineAnnotations(
+      db,
+      workspaceId,
+      sessionId,
+      input.annotations ?? []
+    );
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "agent_run:create",
+      quantity: 1,
+      model: effectiveModel
+    });
+    if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
+      throw new HTTPException11(503, {
+        message: "object storage is not configured"
+      });
+    }
+    await validateFileResources(
+      db,
+      grant.accountId,
+      workspaceId,
+      grant.subjectId,
+      requestedResources
+    );
+    await validateGitHubRepositorySelection(db, workspaceId, [
+      ...existingSession.resources,
+      ...requestedResources
+    ]);
+    const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
+      settings,
+      grant,
+      session: existingSession,
+      updates: input.mcpCredentialUpdates ?? []
+    });
+    const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
+    const inheritedPersonalConnectionDelegations = connectionDelegationSource.kind === "turn" ? await getSessionTurnPersonalConnectionDelegations2(
+      db,
+      workspaceId,
+      connectionDelegationSource.sessionId,
+      connectionDelegationSource.turnId
+    ) : null;
+    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      db,
+      workspaceId,
+      settings,
+      inheritedPersonalConnectionDelegations ? {
+        personalConnectionDelegations: inheritedPersonalConnectionDelegations
+      } : { subjectId: grant.subjectId }
+    );
+    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+      db,
+      workspaceId,
+      settings: runtimeSettings,
+      tools: existingSession.tools,
+      resources: [...existingSession.resources, ...requestedResources],
+      source: connectionDelegationSource,
+      targetSessionId: sessionId,
+      googleDrivePublicationEnabled: existingSession.firstPartyMcpTools.includes("editable_artifact_export") && existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("artifacts:read") && existingSession.firstPartyMcpPermissions.includes("artifacts:publish")),
+      atlassianEnabled: existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("connections:read")),
+      ...input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}
+    });
+    const { accepted, turn, draft, receipt: receipt2, routing, interruptionCount, replay } = await postUserMessageTurn({
+      db,
+      bus,
+      workflowClient,
+      settings,
+      accountId: grant.accountId,
+      workspaceId,
+      sessionId,
+      text: input.text,
+      annotations,
+      modelContext: input.modelContext ?? null,
+      resources: requestedResources,
+      ...composerDraftResources ? { composerDraftResources } : {},
+      model: input.model ?? null,
+      reasoningEffort: input.reasoningEffort ?? null,
+      latencyMode: input.latencyMode ?? null,
+      reasoningEffortFallback: sessionReasoningEffort,
+      turnExecutionPolicy,
+      mcpCredentialUpdates,
+      personalConnectionDelegations,
+      ...input.personalResourceAttachment ? { personalResourceAttachment: input.personalResourceAttachment } : {},
+      delivery,
+      origin: source === "api" ? "operator" : "human",
+      actor: grant.subjectId,
+      ...grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {},
+      commandActor,
+      ...boundaryRequestHash ? { boundaryRequestHash } : {},
+      ...input.controlEtag !== void 0 ? { controlEtag: input.controlEtag } : {},
+      ...input.expectedDraftRevision !== void 0 ? { expectedDraftRevision: input.expectedDraftRevision } : {},
+      ...input.clientEventId ? { clientEventId: input.clientEventId } : {},
+      recordAgentRunUsage: true,
+      ...deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}
+    });
+    return { accepted, turn, draft, receipt: receipt2, routing, interruptionCount, replay };
+  } catch (error) {
+    if (input.clientEventId && boundaryRequestHash) {
+      const replay = await withWorkspaceSubjectSessionActivityRls(
+        db,
+        workspaceId,
+        grant.subjectId,
+        async (scopedDb) => await replaySubmittedHumanPromptFromBoundaryReceipt(scopedDb, {
+          workspaceId,
+          sessionId,
+          subjectId: grant.subjectId,
+          actor: commandActor,
+          operationKey: input.clientEventId,
+          delivery,
+          boundaryRequestHash,
+          expectedDraftRevision: input.expectedDraftRevision ?? null,
+          serializeOperation: true
+        })
+      );
+      if (replay) {
+        return finalizePostUserMessageTurn(
+          {
+            db,
+            bus,
+            workflowClient,
+            accountId: grant.accountId,
+            workspaceId,
+            sessionId,
+            delivery,
+            ...deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}
+          },
+          replay
+        );
+      }
+    }
+    throw error;
+  }
 }
 async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, input) {
   const { accepted, turn, receipt: receipt2, routing, interruptionCount, replay } = await acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, sessionId, input);
@@ -9478,6 +10325,26 @@ function scheduledTaskToolsProvided(rawPayload) {
     agentConfig && typeof agentConfig === "object" && Object.prototype.hasOwnProperty.call(agentConfig, "tools")
   );
 }
+function workspaceCustomModelCommitGuard(input) {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return void 0;
+  return async (tx) => {
+    const active = reference.providerKind === "openrouter" ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission2(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      upstreamModelId: reference.upstreamModelId
+    }) : await lockActiveWorkspaceGatewayCustomModelForAdmission2(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      upstreamModelId: reference.upstreamModelId
+    });
+    if (!active) {
+      throw new HTTPException12(422, {
+        message: `model is not available: ${input.modelId}`
+      });
+    }
+  };
+}
 function scheduledConnectionSurfaceEligibility(settings, target) {
   const tools = target?.firstPartyMcpTools ?? resolveFirstPartyMcpToolPolicy2(settings).default;
   const permissions = target?.firstPartyMcpPermissions?.length ? target.firstPartyMcpPermissions : DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2;
@@ -9513,6 +10380,15 @@ async function createValidatedScheduledTask(input) {
     rigId: input.payload.rigId,
     agentConfig
   });
+  if (!knowledgeAction) {
+    await validateScheduledTaskMachineTarget({
+      settings: input.settings,
+      db: input.db,
+      grant: input.grant,
+      runMode: input.payload.runMode,
+      agentConfig
+    });
+  }
   if (!knowledgeAction && input.payload.variableSetId) {
     await validateVariableSetAttachment(
       { settings: input.settings, db: input.db },
@@ -9560,6 +10436,12 @@ async function createValidatedScheduledTask(input) {
     workspaceId: input.grant.workspaceId,
     subjectId: input.grant.subjectId
   });
+  const beforeCreateCommit = !knowledgeAction && input.payload.runMode !== "existing_session" ? workspaceCustomModelCommitGuard({
+    settings: input.settings,
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    modelId: agentConfig.model ?? input.settings.openaiModel
+  }) : void 0;
   return await withScheduledTaskAuthorityWriteErrors(
     () => createScheduledTask(input.db, {
       id,
@@ -9581,7 +10463,8 @@ async function createValidatedScheduledTask(input) {
       targetSessionId: target?.id ?? null,
       variableSetId: input.payload.variableSetId ?? null,
       rigId: input.payload.rigId ?? null,
-      metadata: input.payload.metadata
+      metadata: input.payload.metadata,
+      ...beforeCreateCommit ? { beforeCreateCommit } : {}
     })
   );
 }
@@ -9695,6 +10578,59 @@ async function validateScheduledTaskTarget(input) {
   }
   return session;
 }
+async function validateScheduledTaskMachineTarget(input) {
+  const machineTarget = input.agentConfig.machineTarget;
+  if (!machineTarget) {
+    if (input.runMode !== "existing_session" && (input.agentConfig.sandboxBackend ?? input.settings.sandboxBackend) === "selfhosted") {
+      throw new HTTPException12(422, {
+        message: "self-hosted scheduled tasks require a Connected Machine; select a machine before saving"
+      });
+    }
+    return null;
+  }
+  if (input.runMode === "existing_session") {
+    throw new HTTPException12(422, {
+      message: "machineTarget cannot be used with an existing-session target"
+    });
+  }
+  if (!input.settings.sandboxOwnershipEnabled || !input.settings.sandboxSelfhostedEnabled) {
+    throw new HTTPException12(422, {
+      message: "Connected Machines are not enabled for scheduled tasks in this deployment"
+    });
+  }
+  const access = {
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    subjectId: input.grant.subjectId
+  };
+  const sandbox = await getSandbox4(input.db, access, machineTarget.targetSandboxId);
+  if (!sandbox || sandbox.kind !== "selfhosted" || !sandbox.enrollmentId) {
+    throw new HTTPException12(422, {
+      message: "the selected Connected Machine is unavailable"
+    });
+  }
+  if (sandbox.scope === "user") {
+    throw new HTTPException12(422, {
+      message: "personal Connected Machines cannot run unattended schedules; select a workspace or organization machine"
+    });
+  }
+  const enrollment = input.requireOnline ? await getLiveEnrollmentConnection3(input.db, access, sandbox.enrollmentId) : await getEnrollment3(input.db, access, sandbox.enrollmentId);
+  if (!enrollment || enrollment.status !== "active") {
+    throw new HTTPException12(422, {
+      message: input.requireOnline ? "the selected Connected Machine is offline" : "the selected Connected Machine is unavailable"
+    });
+  }
+  if (input.requireOnline && !enrollment.workspaceRoot) {
+    throw new HTTPException12(422, {
+      message: "the selected Connected Machine has not reported a workspace root; reconnect it with a current agent"
+    });
+  }
+  return {
+    sandboxId: sandbox.id,
+    enrollmentId: sandbox.enrollmentId,
+    sandboxOs: enrollment.os
+  };
+}
 function scheduledTaskForGrant(task, grant) {
   if (hasPermission(grant.permissions, "sessions:control") || task.targetSessionId === null) {
     return task;
@@ -9854,6 +10790,15 @@ async function validatedScheduledTaskUpdate(input) {
   const nextAgentConfig = update.agentConfig ?? input.existing.agentConfig;
   const authorityTargetChanged = nextRunMode !== input.existing.runMode || nextTargetSessionId !== input.existing.targetSessionId || input.payload.variableSetId !== void 0 && input.payload.variableSetId !== input.existing.variableSetId || input.payload.rigId !== void 0 && input.payload.rigId !== input.existing.rigId;
   const materialExecutionChange = authorityTargetChanged || input.payload.connectionAuthorities !== void 0 || !isDeepStrictEqual(nextAgentConfig, input.existing.agentConfig) || input.payload.action !== void 0 && !isDeepStrictEqual(input.payload.action, input.existing.action) || input.payload.schedule !== void 0 && !isDeepStrictEqual(input.payload.schedule, input.existing.schedule) || input.payload.overlapPolicy !== void 0 && input.payload.overlapPolicy !== input.existing.overlapPolicy || input.payload.metadata !== void 0 && !isDeepStrictEqual(input.payload.metadata, input.existing.metadata) || input.existing.status === "paused" && input.payload.status === "active";
+  if (materialExecutionChange && nextRunMode !== "existing_session") {
+    const beforeUpdateCommit = workspaceCustomModelCommitGuard({
+      settings: input.settings,
+      accountId: input.existing.accountId,
+      workspaceId: input.existing.workspaceId,
+      modelId: nextAgentConfig.model ?? input.settings.openaiModel
+    });
+    if (beforeUpdateCommit) update.beforeUpdateCommit = beforeUpdateCommit;
+  }
   const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
     input.db,
     input.existing.workspaceId,
@@ -9966,6 +10911,13 @@ async function validatedScheduledTaskUpdate(input) {
     rigId: input.payload.rigId !== void 0 ? input.payload.rigId : input.existing.rigId,
     agentConfig: update.agentConfig ?? input.existing.agentConfig
   });
+  await validateScheduledTaskMachineTarget({
+    settings: input.settings,
+    db: input.db,
+    grant: input.grant,
+    runMode: nextRunMode,
+    agentConfig: update.agentConfig ?? input.existing.agentConfig
+  });
   if (input.payload.targetSessionId !== void 0 || input.existing.runMode === "existing_session" || nextRunMode === "existing_session" || input.existing.runMode === "reusable_session" && nextRunMode !== "reusable_session") {
     update.targetSessionId = nextTargetSessionId;
   }
@@ -11008,6 +11960,7 @@ function denied(reason) {
 
 // src/domain/memory-slack-delivery.ts
 import {
+  correctWorkspaceMemory,
   enqueueMemorySlackPublication,
   getCurrentMemorySlackPublicationConfiguration,
   getWorkspaceMemorySlackPublicationSnapshot,
@@ -11021,6 +11974,25 @@ async function saveWorkspaceMemoryWithSlackPublication(db, input, publication, e
     return { ...result, slackPublication };
   });
 }
+async function correctWorkspaceMemoryWithSlackPublication(db, input, publication, embedder) {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const result = await correctWorkspaceMemory(scopedDb, input, embedder);
+    if (!publication || result.action !== "superseded" || !result.replacement) {
+      return { ...result, slackPublication: { decision: null, enqueue: null } };
+    }
+    const replacement = await requiredSnapshot(scopedDb, input.workspaceId, result.replacement.id);
+    const slackPublication = await evaluateAndEnqueue(scopedDb, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      snapshot: replacement,
+      changeKind: "corrected",
+      relatedMemoryId: result.memory.id,
+      occurredAt: result.replacement.updatedAt,
+      publication
+    });
+    return { ...result, slackPublication };
+  });
+}
 async function publishSavedMemoryMutation(db, input, result, publication) {
   if (result.updated || result.deduped && !result.superseded) {
     return { decision: null, enqueue: null };
@@ -11405,7 +12377,13 @@ import {
   writeCompanyBrainGovernedProposal
 } from "@opengeni/db";
 import { createHash as createHash7 } from "crypto";
-var DEFAULT_AUTOMATIC_LEARNING_DESTINATIONS = ["preference"];
+var DEFAULT_AUTOMATIC_LEARNING_DESTINATIONS = ["preference", "instruction_policy"];
+function dispatchBestEffortGovernedLearningNotification(notify) {
+  try {
+    void notify().catch(() => void 0);
+  } catch {
+  }
+}
 function createCompanyBrainGovernedWriteRouter(options) {
   const authority = options.authority ?? writeCompanyBrainGovernedProposal;
   return {
@@ -11566,15 +12544,14 @@ function createCompanyBrainLearningPolicyRouter(options) {
           learningFailure: classifyLearningFailure("activation", error)
         });
       }
-      try {
-        await notifyActivation({
+      dispatchBestEffortGovernedLearningNotification(
+        () => notifyActivation({
           db: options.db,
           receipt: activation,
           sessionId: attempt.sessionId,
           attemptId: attempt.attemptId
-        });
-      } catch {
-      }
+        })
+      );
       return CompanyBrainLearningPolicyRouteReceipt.parse({
         operationId: request.operationId,
         workspaceId: attempt.workspaceId,
@@ -12020,15 +12997,14 @@ function createRememberRouter(options) {
         }
       }
       if (!activation) throw asRememberFailure(lastFailure);
-      try {
-        await notifyActivation({
+      dispatchBestEffortGovernedLearningNotification(
+        () => notifyActivation({
           db: options.db,
           receipt: activation,
           sessionId: attempt.sessionId,
           attemptId: attempt.attemptId
-        });
-      } catch {
-      }
+        })
+      );
       return RememberConfirmReceipt.parse({
         status: "activated",
         operationId: request.operationId,
@@ -12848,7 +13824,9 @@ function resolveMemberSubjectId(userId) {
 function assertWorkspaceMemberRemovable(input) {
   const { members, subjectId, callerSubjectId } = input;
   if (subjectId === callerSubjectId) {
-    throw new HTTPException13(409, { message: "you cannot remove your own membership" });
+    throw new HTTPException13(409, {
+      message: "you cannot remove your own membership"
+    });
   }
   const target = members.find((member) => member.subjectId === subjectId);
   if (!target) {
@@ -12865,9 +13843,28 @@ function assertWorkspaceMemberRemovable(input) {
     }
   }
 }
+function assertWorkspaceMemberUpdateAllowed(input) {
+  const { members, subjectId, callerSubjectId, nextPermissions } = input;
+  if (subjectId === callerSubjectId) {
+    throw new HTTPException13(409, {
+      message: "you cannot change your own workspace access"
+    });
+  }
+  const target = members.find((member) => member.subjectId === subjectId);
+  if (!target) {
+    throw new HTTPException13(404, { message: "member not found" });
+  }
+  if (memberCanAdminister(target) && !memberCanAdminister({ permissions: nextPermissions }) && !members.some((member) => member.subjectId !== subjectId && memberCanAdminister(member))) {
+    throw new HTTPException13(409, {
+      message: "the workspace must keep at least one administrator"
+    });
+  }
+}
 function assertWorkspaceDeletable(input) {
   if (input.workspaceCountForAccount <= 1) {
-    throw new HTTPException13(409, { message: "cannot delete the account's only workspace" });
+    throw new HTTPException13(409, {
+      message: "cannot delete the account's only workspace"
+    });
   }
   if (input.activeSessionCount > 0) {
     throw new HTTPException13(409, {
@@ -13125,9 +14122,9 @@ import {
 } from "@opengeni/contracts";
 import {
   getNewSessionDraftInTransaction,
-  getEnrollment as getEnrollment3,
+  getEnrollment as getEnrollment4,
   getRig as getRig6,
-  getSandbox as getSandbox4,
+  getSandbox as getSandbox5,
   getVariableSet as getVariableSet4,
   NewSessionDraftAccessError,
   newSessionDraftToolsProvided,
@@ -13220,8 +14217,8 @@ async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
     if (!rig?.activeVersion) delete options.rigId;
   }
   if (options.targetSandboxId) {
-    const sandbox = await getSandbox4(deps.db, workspaceId, options.targetSandboxId);
-    const enrollment = sandbox?.enrollmentId ? await getEnrollment3(deps.db, workspaceId, sandbox.enrollmentId) : null;
+    const sandbox = await getSandbox5(deps.db, workspaceId, options.targetSandboxId);
+    const enrollment = sandbox?.enrollmentId ? await getEnrollment4(deps.db, workspaceId, sandbox.enrollmentId) : null;
     if (!sandbox || sandbox.kind !== "selfhosted" || !enrollment || enrollment.status !== "active") {
       delete options.targetSandboxId;
       delete options.workingDir;
@@ -14118,6 +15115,7 @@ async function saveHumanComposerDraft(deps, context, input) {
 // src/application/user-resource-grants.ts
 import {
   issueSelfUserResourceGrant,
+  issueSelfLocalConnectionUseGrant,
   listSelfUserResourceAuthorities,
   revokeSelfUserResourceGrant,
   sessionTenancyProductActivated as sessionTenancyProductActivated3,
@@ -14144,7 +15142,11 @@ async function requireOwnerProductGate(deps, authorization, workspaceId, permiss
   }
 }
 function requireOwnerAuthority(authorization, workspaceId, permissions) {
-  requireCanonicalManagedHuman(authorization, workspaceId);
+  if (!authorization.canonicalLocalHumanSession) {
+    requireCanonicalManagedHuman(authorization, workspaceId);
+  } else if (!authorization.contextIntegrity || authorization.authenticatedSubjectId !== authorization.grant.subjectId || authorization.grant.workspaceId !== workspaceId) {
+    throw new SessionTenancyManagedHumanRequiredError();
+  }
   for (const permission of permissions) requirePermission(authorization.grant, permission);
 }
 async function listManagedHumanUserResourceAuthorities(deps, authorization, workspaceId, input) {
@@ -14161,6 +15163,23 @@ async function listManagedHumanUserResourceAuthorities(deps, authorization, work
 }
 async function issueManagedHumanUserResourceGrant(deps, authorization, workspaceId, authorityId, request, authorizationSurface = "core") {
   const modePermissions = request.mode === "session" ? ["sessions:control"] : ["sessions:create"];
+  if (authorization.canonicalLocalHumanSession) {
+    requireOwnerAuthority(authorization, workspaceId, [
+      ...ISSUE_PERMISSIONS[request.resourceKind],
+      "sessions:create"
+    ]);
+    if (request.resourceKind !== "connection" || request.mode !== "always") {
+      throw new SessionTenancyManagedHumanRequiredError();
+    }
+    return await issueSelfLocalConnectionUseGrant(deps.db, {
+      accountId: authorization.grant.accountId,
+      workspaceId,
+      subjectId: authorization.grant.subjectId,
+      authorityId,
+      context: request.context,
+      workspaceSharedAcknowledged: request.workspaceSharedAcknowledged
+    });
+  }
   await requireOwnerProductGate(deps, authorization, workspaceId, [
     ...ISSUE_PERMISSIONS[request.resourceKind],
     ...modePermissions
@@ -14280,6 +15299,7 @@ export {
   MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES,
   MEMORY_SLACK_PROJECTION_VERSION,
   MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES,
+  MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS,
   ManagedAuthActorLeaseOutcomeUnknownError,
   MathEditableArtifactOutboxRandom,
   OPENGENI_PR_REVIEW_AGENT_INSTRUCTIONS,
@@ -14317,6 +15337,7 @@ export {
   acceptSessionUserMessage,
   acceptSessionUserMessageWithOutcome,
   accessGrantAuthorizationFromContext,
+  accountScopedApiKeyWorkspaceAuthority,
   activateRigVersionForApi,
   apiIntegrationsMatchingDelegations,
   appendRigSetupCommand,
@@ -14344,6 +15365,7 @@ export {
   assertVideoGenerationTransition,
   assertWorkspaceDeletable,
   assertWorkspaceMemberRemovable,
+  assertWorkspaceMemberUpdateAllowed,
   assertWorkspaceModelPolicyAllows,
   authorizedAtlassianConnectionsForGrant,
   authorizedSocialConnectionsForGrant,
@@ -14374,6 +15396,7 @@ export {
   controlHumanSessionWorkstreamWithOutcome,
   controlHumanWorkspace,
   conversationDeliveryNextAction,
+  correctWorkspaceMemoryWithSlackPublication,
   createAndStartSession,
   createAndStartSessionWithOutcome,
   createCatalogItem,
@@ -14405,6 +15428,7 @@ export {
   directRetainedProcessMatchesBackend,
   disableCapability,
   discoverMcpRegistryCapabilities,
+  dispatchBestEffortGovernedLearningNotification,
   editHumanQueuePrompt,
   editableArtifactActorKey,
   editableArtifactAuthorizationRevisionPortFromPostgres,
@@ -14442,6 +15466,7 @@ export {
   fikenConnectionMetadata,
   filenameForMimeType,
   forkManagedHumanSession,
+  freezeAgentChildAutomaticTitleInCreatorContext,
   freezePersonalConnectionDelegations,
   getActorNewSessionDraft,
   getAutomationAdapter,
@@ -14465,6 +15490,7 @@ export {
   hasReservedOpenGeniSlackBotSessionMetadata,
   hashEditableArtifactCreateRequest,
   hashEditableArtifactImportRequest,
+  initialAutomaticTitleForSessionStart,
   inlinePackSkillInstall,
   insightsSessionLabel,
   inspectEditableArtifactLiveWireEnvelope,
@@ -14476,6 +15502,9 @@ export {
   isTerminalVideoGenerationState,
   isTrustedScheduledSlackBotSession,
   isUserMember,
+  isWorkspaceCustomModelId,
+  isWorkspaceGatewayCustomModelId,
+  isWorkspaceOpenRouterCustomModelId,
   issueManagedHumanUserResourceGrant,
   legacySandboxRuntimeFromPacks,
   listCapabilityPacks,
@@ -14486,6 +15515,8 @@ export {
   listRigVersionsForApi,
   listWorkspaceCapabilityPacks,
   loadRigDefaultVariableSetEnvironment,
+  managedSessionGroupBackend,
+  managedSessionGroupOs,
   manualScheduledTaskTriggerUsageKey,
   manualScheduledTaskTriggerWorkflowId,
   markManagedAuthRequestActorTransitionApplied,
@@ -14494,6 +15525,7 @@ export {
   mergeResourceRefs,
   mergeRigDefaultVariableSetEnvironment,
   mergeToolRefs,
+  modelFundingForAdmission,
   moveHumanQueuePrompt,
   nativeConnectionCapabilityRecommendations,
   normalizeConversationActor,
@@ -14557,6 +15589,7 @@ export {
   requireAccessGrantAuthorization,
   requireAccountAdminAuthorizationStamp,
   requireAutomationAdapter,
+  requireCanonicalLocalAccountAdministrator,
   requireCanonicalManagedHuman,
   requireEnvironmentEncryption,
   requireFreshAccessGrant,
@@ -14575,6 +15608,7 @@ export {
   requireVariableSetEncryption,
   requireVariableSetForApi,
   resolveCapabilityPack,
+  resolveCatalogSettings,
   resolveChildGoalFromAcceptedSnapshot,
   resolveCodexAppsCredentialIdForRun,
   resolveFikenDefaultCompanySlug,
@@ -14587,8 +15621,11 @@ export {
   resolveSessionSandboxRuntime,
   resolveSessionToolPolicy,
   resolveSkillImport,
+  resolveWorkspaceCatalogSettings,
   resolveWorkspaceLegacyRuntimePacks,
+  resolveWorkspaceModelSelection,
   restoreScheduledTask,
+  retainedProcessBackgroundSettlement,
   revokeManagedHumanUserResourceGrant,
   rigActorForGrant,
   rigProviderImageBuildRequestId,
@@ -14653,6 +15690,7 @@ export {
   validateManagedAuthRequestActorLease,
   validateMcpCapabilityConnection,
   validateOpenGeniSlackBotConnectionSelection,
+  validateScheduledTaskMachineTarget,
   validateScheduledTaskTarget,
   validateToolRefs,
   validateToolRefsForSessionPolicy,
@@ -14672,6 +15710,7 @@ export {
   withScheduledTaskAuthorityWriteErrors,
   withWorkspaceDefaultMcpTools,
   workflowIdForSession,
+  workspaceCustomModelReference,
   workspaceSessionToolPolicyDefaultServerIds,
   workspaceSessionToolPolicyServerIds,
   wrapChannelABoxWithRouting