@opengeni/core 2.6.4 → 2.7.5-canary.0

package/src/domain/sessions.ts

@@ -2,10 +2,13 @@ import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
+  ORGANIZATION_GATEWAY_MODEL_ID_PREFIX,
+  ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX,
   resolveFirstPartyMcpToolPolicy,
   policyProviderIdForModel,
   resolveTurnExecutionPolicyV1,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
+  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
   XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
   type Settings,
 } from "@opengeni/config";
@@ -17,12 +20,15 @@ import {
   DraftTimelineAnnotations,
   FIRST_PARTY_MCP_TOOL_NAMES,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
+  SessionSkills,
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
   normalizeAutomaticSessionTitle,
   resolveWorkspaceSessionToolDefaults,
+  metadataWithTurnExecutionPolicyV1,
+  readTurnExecutionPolicyV1,
   stableJson,
   type AccessGrant,
   type ComposerDraft,
@@ -60,8 +66,10 @@ import {
   type XaiProviderAccountAuthoritySnapshotV1,
 } from "@opengeni/contracts";
 import {
+  assertExactNewSessionDraftInTransaction,
   createSession,
   createSessionWithIdempotencyKeyResult,
+  canonicalSessionCommandHash,
   encryptVariableSetValue,
   getAnySessionInGroup,
   getEnrollment,
@@ -70,12 +78,13 @@ import {
   getWorkspaceDefaultRigId,
   listDistinctVariableSetSelectionsInGroup,
   listDistinctRigVersionIdsInGroup,
+  listInstalledPortableSkills,
   getSandbox,
   getSession,
+  getInitializedSessionCreateReplay,
   getSessionAuthorityProjection,
   SessionIdConflictError,
   NewSessionDraftConflictError,
-  getSessionSpawnDenialByIdempotencyKey,
   getWorkspaceControlEvent,
   getSessionLineage,
   getSessionTurn,
@@ -88,6 +97,9 @@ import {
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
   requireSession,
+  setActiveSandbox,
+  setSubjectRlsContext,
+  replaySubmittedHumanPromptFromBoundaryReceipt,
   submitHumanPromptInTransaction,
   appendSessionEventsWithLockedSessionUpdate,
   updateSessionTitleWithEvent,
@@ -127,8 +139,19 @@ import {
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
 } from "../session-authorization";
-import { swapActiveSandbox, type FleetContext } from "../sandbox/fleet";
+import { assertHostMcpAuthoritySourceAdmissionEnabled } from "./host-mcp-authority-source-admission";
+import {
+  preflightCreateTimeSandboxTarget,
+  swapActiveSandbox,
+  type FleetContext,
+} from "../sandbox/fleet";
 import { managedSessionGroupBackend } from "../sandbox/runtime-settings";
+import {
+  isWorkspaceCustomModelId,
+  lockActiveCustomModelForAdmission,
+  resolveWorkspaceCatalogSettings,
+  workspaceCustomModelReference,
+} from "../model-catalog";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
 import { validateSubmittedTimelineAnnotations } from "./timeline-annotations";
 import { requireVariableSetEncryption, validateVariableSetAttachment } from "./environments";
@@ -158,6 +181,15 @@ const maxSessionMcpCredentialHeaderValueLength = 4096;
 // Keep the durable snapshot below the shared event-preview array boundary so
 // the generic lossy projection cannot silently rewrite this audit fact.
 const maxToolPolicyAuditRefs = 40;
+
+function isCatalogOverlayModel(modelId: string | null | undefined): boolean {
+  return (
+    modelId?.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) === true ||
+    modelId?.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) === true ||
+    modelId?.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX) === true ||
+    modelId?.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX) === true
+  );
+}
 // RFC 9110 field-name token characters.
 const sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
 
@@ -470,6 +502,7 @@ function validateSessionMcpServersForCreate(
   const dbServers: CreateSessionMcpServerInput[] = [];
   const metadata: SessionMcpServerMetadata[] = [];
   for (const server of servers) {
+    assertHostMcpAuthoritySourceAdmissionEnabled(settings, server.connectionRef);
     if (seenIds.has(server.id)) {
       throw new HTTPException(422, {
         message: `duplicate session MCP server id: ${server.id}`,
@@ -656,6 +689,16 @@ export async function createAndStartSessionWithOutcome(input: {
   /** Internal database-only composition seam. The exact session shell and this
    * linkage commit together before its first event/turn can be initialized. */
   beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
+  /** The custom workspace model was frozen by an earlier accepted boundary or
+   * inherited from an existing session, so retirement must not invalidate it. */
+  retainWorkspaceGatewayModel?: boolean;
+  /** Provider-neutral successor to retainWorkspaceGatewayModel. */
+  retainWorkspaceCustomModel?: boolean;
+  /** The selected workspace Gateway product is backed by a mutable custom row,
+   * rather than deployment-curated Gateway membership. */
+  workspaceGatewayCustomModel?: boolean;
+  /** Provider-neutral successor to workspaceGatewayCustomModel. */
+  workspaceCustomModel?: boolean;
   accountId: string;
   workspaceId: string;
   visibility?: "user_private" | "workspace_shared";
@@ -683,7 +726,11 @@ export async function createAndStartSessionWithOutcome(input: {
   createdByActor?: Extract<SessionCommandActor, { type: "agent_attempt" }> | null;
   // Ordered low-to-high precedence. Names/ids only; session.created never
   // carries variable values.
-  variableSets?: Array<{ id: string; name: string; scope: VariableSet["scope"] }>;
+  variableSets?: Array<{
+    id: string;
+    name: string;
+    scope: VariableSet["scope"];
+  }>;
   // The rig + frozen active rig version resolved at create (M3). Both null ⇒ a
   // rig-less session (byte-for-byte today's behavior). Frozen here so a later
   // rig promote never moves an existing session's version.
@@ -725,6 +772,9 @@ export async function createAndStartSessionWithOutcome(input: {
   // session. Every caller repairs or re-delivers the winner's one atomic start;
   // the durable initializer prevents duplicate events or turns.
   createIdempotencyKey?: string | null;
+  // Exact explicit installed-Skill selection. The database stores this only as
+  // keyed-create identity; runtime behavior comes from the frozen Skill content.
+  selectedInstalledSkillIds?: string[];
   // The shared-sandbox group this session's box joins (addendum 05 §D). Null/
   // omitted ⇒ a singleton group (the new row's own id, today's 1:1 behavior); a
   // shared/{groupId} spawn passes the resolved group so both run in ONE box.
@@ -735,11 +785,11 @@ export async function createAndStartSessionWithOutcome(input: {
   // OS-labeling surfaces honestly reflect the machine.
   sandboxOs?: Session["sandboxOs"];
   // Create-time machine targeting (A-2a, RACE-FREE): the enrolled machine (a
-  // sandbox id) to run this session on. When set, the active-sandbox pointer is
-  // resolved+validated+seeded (epoch-fenced) INSIDE finishStartSession, AFTER the
-  // session row exists but BEFORE the first turn is enqueued/the workflow woken,
-  // so the FIRST turn routes to the chosen machine. An invalid/unowned/offline
-  // target fails the create (422) — never a silent fall-back to the default box.
+  // sandbox id) to run this session on. When set, target liveness is preflighted
+  // before insertion, then the active-sandbox pointer is authority-checked and
+  // seeded (epoch-fenced) in the SAME transaction as the session row. The FIRST
+  // turn therefore routes to the chosen machine, while an invalid/unowned/offline
+  // target fails the create (422) without leaving a queued session shell.
   // `workingDir` (optional) is the path/cwd base the chosen machine runs under,
   // seeded alongside the pointer through the epoch-fenced CAS.
   seedTargetSandbox?: {
@@ -775,16 +825,117 @@ export async function createAndStartSessionWithOutcome(input: {
   allowNestedAgentDepthIncrease?: boolean;
   subjectId?: string | null;
 }): Promise<CreateSessionOutcome> {
-  const sessionMetadata = {
-    ...input.metadata,
-    model: input.model,
-    reasoningEffort: input.reasoningEffort,
-    ...(input.latencyMode !== undefined ? { latencyMode: input.latencyMode } : {}),
-  };
+  const sessionMetadata = metadataWithTurnExecutionPolicyV1(
+    {
+      ...input.metadata,
+      model: input.model,
+      reasoningEffort: input.reasoningEffort,
+      ...(input.latencyMode !== undefined ? { latencyMode: input.latencyMode } : {}),
+    },
+    input.turnExecutionPolicy,
+  );
   const frozenCreatedByContext = freezeAgentChildAutomaticTitleInCreatorContext(
     input.createdByContext,
     input.initialAutomaticTitle,
   );
+  const requiresActiveWorkspaceCustomModel =
+    (input.workspaceCustomModel === true || input.workspaceGatewayCustomModel === true) &&
+    input.retainWorkspaceCustomModel !== true &&
+    input.retainWorkspaceGatewayModel !== true;
+  const seedTargetForNewSession = input.seedTargetSandbox ?? null;
+  const preflightTarget = seedTargetForNewSession
+    ? await preflightCreateTimeSandboxTarget(
+        {
+          db: input.db,
+          settings: seedTargetForNewSession.settings,
+          bus: input.bus,
+        },
+        {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          ...(seedTargetForNewSession.resourceSubjectId
+            ? { subjectId: seedTargetForNewSession.resourceSubjectId }
+            : {}),
+        },
+        seedTargetForNewSession.sandboxId,
+        seedTargetForNewSession.workingDir ?? null,
+      )
+    : null;
+  const targetPreflightFailureMessage =
+    preflightTarget && !preflightTarget.ok
+      ? `cannot target sandbox ${seedTargetForNewSession!.sandboxId}: ${preflightTarget.reason}`
+      : null;
+  let targetSeededBeforeCreateCommit = false;
+  const beforeCreateCommit =
+    requiresActiveWorkspaceCustomModel ||
+    input.consumeNewSessionDraft ||
+    input.beforeCreateCommit ||
+    preflightTarget ||
+    targetPreflightFailureMessage
+      ? async (tx: Database, sessionId: string, context?: { created: boolean }): Promise<void> => {
+          // A committed keyed replay already crossed this fence when its shell
+          // was first accepted. Revalidate only the transaction inserting a new
+          // session, while still running caller linkage on every replay.
+          if (targetPreflightFailureMessage && context?.created !== false) {
+            throw new HTTPException(422, {
+              message: targetPreflightFailureMessage,
+            });
+          }
+          if (requiresActiveWorkspaceCustomModel && context?.created !== false) {
+            const reference = {
+              scope: input.turnExecutionPolicy.providerId.startsWith("organization-")
+                ? ("organization" as const)
+                : ("workspace" as const),
+              providerKind: input.turnExecutionPolicy.providerId.includes("openrouter")
+                ? ("openrouter" as const)
+                : ("vercel_gateway" as const),
+              upstreamModelId: input.turnExecutionPolicy.upstreamModelId,
+            };
+            const active = await lockActiveCustomModelForAdmission(tx, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              reference,
+            });
+            if (!active) {
+              throw new HTTPException(422, {
+                message: `model is not available: ${input.model}`,
+              });
+            }
+          }
+          // Reject an already-stale browser draft before the newly inserted
+          // shell can commit. The initializer repeats this exact check while
+          // consuming the draft after it installs the first runnable unit.
+          if (input.consumeNewSessionDraft && context?.created !== false) {
+            await setSubjectRlsContext(tx, input.consumeNewSessionDraft.subjectId);
+            await assertExactNewSessionDraftInTransaction(tx, {
+              workspaceId: input.workspaceId,
+              subjectId: input.consumeNewSessionDraft.subjectId,
+              expectedRevision: input.consumeNewSessionDraft.expectedRevision,
+              expectedSnapshot: input.consumeNewSessionDraft.expectedSnapshot,
+            });
+          }
+          if (preflightTarget?.ok && context?.created !== false) {
+            const seeded = await setActiveSandbox(tx, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              sessionId,
+              targetSandboxId: preflightTarget.targetSandboxId,
+              expectedEpoch: 0,
+              ...(seedTargetForNewSession?.resourceSubjectId
+                ? { subjectId: seedTargetForNewSession.resourceSubjectId }
+                : {}),
+              workingDir: preflightTarget.workingDir,
+            });
+            if (!seeded.swapped) {
+              throw new HTTPException(422, {
+                message: `cannot target sandbox ${seedTargetForNewSession!.sandboxId}: target authority changed during session creation`,
+              });
+            }
+            targetSeededBeforeCreateCommit = true;
+          }
+          await input.beforeCreateCommit?.(tx, sessionId);
+        }
+      : undefined;
   // Keyed creation is intentionally handled only by the database admission
   // transaction below. Its workspace/key lock replays either the successful
   // session or the committed denial atomically; an application-side lookup
@@ -820,6 +971,7 @@ export async function createAndStartSessionWithOutcome(input: {
       policyRole: input.policyRole ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
+      selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
       mcpServers: input.mcpServers ?? [],
@@ -834,15 +986,29 @@ export async function createAndStartSessionWithOutcome(input: {
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null,
-      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),
+      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
     });
     if (keyedResult.denied) {
       throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));
     }
     const { session: keyed, created } = keyedResult;
     if (!created) {
+      const persistedPolicy = readTurnExecutionPolicyV1(keyed.metadata);
       const finished = await finishStartSession(
-        keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,
+        keyed.temporalWorkflowId
+          ? {
+              ...input,
+              seedTargetSandbox: null,
+              ...(persistedPolicy.kind === "valid"
+                ? { turnExecutionPolicy: persistedPolicy.policy }
+                : {}),
+            }
+          : {
+              ...input,
+              ...(persistedPolicy.kind === "valid"
+                ? { turnExecutionPolicy: persistedPolicy.policy }
+                : {}),
+            },
         keyed,
       );
       return {
@@ -852,7 +1018,10 @@ export async function createAndStartSessionWithOutcome(input: {
         changed: finished.changed,
       };
     }
-    const finished = await finishStartSession(input, keyed);
+    const finished = await finishStartSession(
+      targetSeededBeforeCreateCommit ? { ...input, seedTargetSandbox: null } : input,
+      keyed,
+    );
     return {
       session: finished.session,
       outcome: "created",
@@ -905,7 +1074,7 @@ export async function createAndStartSessionWithOutcome(input: {
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null,
-      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),
+      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
     });
   } catch (error) {
     if (error instanceof SessionSpawnDeniedDbError) {
@@ -913,7 +1082,10 @@ export async function createAndStartSessionWithOutcome(input: {
     }
     throw error;
   }
-  const finished = await finishStartSession(input, session);
+  const finished = await finishStartSession(
+    targetSeededBeforeCreateCommit ? { ...input, seedTargetSandbox: null } : input,
+    session,
+  );
   return {
     session: finished.session,
     outcome: "created",
@@ -951,7 +1123,11 @@ async function finishStartSession(
     reasoningEffort: Settings["openaiReasoningEffort"];
     turnExecutionPolicy: TurnExecutionPolicyV1;
     sandboxBackend: Settings["sandboxBackend"];
-    variableSets?: Array<{ id: string; name: string; scope: VariableSet["scope"] }>;
+    variableSets?: Array<{
+      id: string;
+      name: string;
+      scope: VariableSet["scope"];
+    }>;
     goal?: GoalSpec | null;
     initialAutomaticTitle?: string | null;
     sessionMcpServers?: SessionMcpServerMetadata[];
@@ -984,15 +1160,12 @@ async function finishStartSession(
 ): Promise<{ session: CreateSessionResponse; changed: boolean }> {
   // Create-time machine targeting (A-2a): seed the active-sandbox pointer BEFORE
   // the atomic initial turn transaction, so the FIRST turn routes to the chosen
-  // machine. swapActiveSandbox does
+  // machine. Home backend and active route are independent: a backend:none
+  // session has no managed home but may still attach a valid Connected Machine.
+  // swapActiveSandbox does
   // the same ownership+liveness validation as the live swap; an invalid/unowned/
   // offline target FAILS the create (422) — never a silent fall-back to the box.
   if (input.seedTargetSandbox) {
-    if (session.sandboxBackend === "none") {
-      throw new HTTPException(422, {
-        message: "cannot target a machine for a session with no sandbox (backend: none)",
-      });
-    }
     const ctx: FleetContext = {
       accountId: session.accountId,
       workspaceId: session.workspaceId,
@@ -1137,9 +1310,6 @@ export function canonicalConfiguredModel(
   ) {
     return canonicalModel;
   }
-  if (canonicalModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
-    return canonicalModel;
-  }
   throw new HTTPException(422, { message: `model is not available: ${model}` });
 }
 
@@ -1245,7 +1415,17 @@ export async function requireQueuedTurnForApi(
  * `session_send_message` tool so the two surfaces cannot drift. Callers own
  * resource/tool validation and the per-message usage limit before calling.
  */
-export async function postUserMessageTurn(input: {
+type PostUserMessageTurnResult = {
+  accepted: SessionEvent;
+  turn: SessionTurn;
+  draft: ComposerDraft | null;
+  receipt: SessionCommandReceipt;
+  routing: SessionPromptRouting;
+  interruptionCount: number;
+  replay: boolean;
+};
+
+type PostUserMessageTurnInput = {
   db: Database;
   bus: EventBus;
   workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
@@ -1273,28 +1453,143 @@ export async function postUserMessageTurn(input: {
   commandActor?: SessionCommandActor;
   controlEtag?: string | null;
   expectedDraftRevision?: number | null;
+  boundaryRequestHash?: string;
   reasoningEffortFallback?: Settings["openaiReasoningEffort"];
   turnExecutionPolicy: TurnExecutionPolicyV1;
   recordAgentRunUsage?: boolean;
   schedulePostCommit?: (task: () => Promise<void>) => void;
-}): Promise<{
-  accepted: SessionEvent;
-  turn: SessionTurn;
-  draft: ComposerDraft | null;
-  receipt: SessionCommandReceipt;
-  routing: SessionPromptRouting;
-  interruptionCount: number;
-  replay: boolean;
-}> {
-  const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;
+};
+
+function finalizePostUserMessageTurn(
+  input: Pick<
+    PostUserMessageTurnInput,
+    | "db"
+    | "bus"
+    | "workflowClient"
+    | "accountId"
+    | "workspaceId"
+    | "sessionId"
+    | "delivery"
+    | "schedulePostCommit"
+  >,
+  result: Awaited<ReturnType<typeof submitHumanPromptInTransaction>>,
+): PostUserMessageTurnResult {
+  const { db, bus, workflowClient, accountId, workspaceId, sessionId } = input;
+  const postCommitTask = async () => {
+    await Promise.all([
+      (async () => {
+        try {
+          await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);
+          if (result.workspaceControlEventId) {
+            const controlEvent = await getWorkspaceControlEvent(
+              db,
+              workspaceId,
+              result.workspaceControlEventId,
+            );
+            if (!controlEvent) {
+              throw new Error(
+                `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,
+              );
+            }
+            await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);
+          }
+        } catch {
+          console.warn("[sessions] prompt event fanout failed; durable rows remain replayable", {
+            errorClass: "PromptEventFanoutOperationError",
+            errorCode: "session_prompt_event_fanout_failed",
+            origin: "core",
+          });
+        }
+      })(),
+      (async () => {
+        try {
+          await workflowClient.wakeSessionWorkflow({
+            accountId,
+            workspaceId,
+            sessionId,
+            workflowId: result.turn.temporalWorkflowId,
+            wakeRevision: result.wakeRevision,
+            ...((input.delivery ?? "send") === "steer" || result.interruptionCount > 0
+              ? { interruptionRequested: true }
+              : {}),
+          });
+        } catch {
+          console.warn("[sessions] workflow wake failed; durable outbox will retry", {
+            errorClass: "WorkflowWakeOperationError",
+            errorCode: "session_workflow_wake_failed",
+            origin: "core",
+          });
+        }
+      })(),
+    ]);
+  };
+  const schedulePostCommit =
+    input.schedulePostCommit ??
+    ((task: () => Promise<void>) => {
+      void task();
+    });
+  try {
+    schedulePostCommit(postCommitTask);
+  } catch {
+    console.warn("[sessions] prompt post-commit scheduling failed; durable recovery remains", {
+      errorClass: "PromptPostCommitScheduleError",
+      errorCode: "session_prompt_post_commit_schedule_failed",
+      origin: "core",
+    });
+  }
+  return {
+    accepted: result.accepted,
+    turn: result.turn,
+    receipt: {
+      id: result.receipt.id,
+      action: result.receipt.action,
+      operationKey: result.receipt.operationKey,
+      targetSessionId: result.receipt.targetSessionId,
+      targetTurnId: result.receipt.targetTurnId,
+      appliedControlRevision: result.receipt.appliedControlRevision,
+      appliedQueueVersion: result.receipt.appliedQueueVersion,
+      appliedTurnVersion: result.receipt.appliedTurnVersion,
+      appliedDraftRevision: result.receipt.appliedDraftRevision,
+      createdAt: result.receipt.createdAt.toISOString(),
+    },
+    routing: result.routing,
+    draft: result.draft
+      ? {
+          revision: result.draft.revision,
+          text: result.draft.text,
+          annotations: DraftTimelineAnnotations.parse(result.draft.annotations),
+          resources: result.draft.resources as ResourceRef[],
+          model: result.draft.model,
+          reasoningEffort: result.draft.reasoningEffort as ReasoningEffort,
+          latencyMode: result.draft.latencyMode as ComposerDraft["latencyMode"],
+          sourceTurnId: result.draft.sourceTurnId,
+          sourceTurnVersion: result.draft.sourceTurnVersion,
+          updatedAt: result.draft.updatedAt.toISOString(),
+        }
+      : null,
+    interruptionCount: result.interruptionCount,
+    replay: result.replay,
+  };
+}
+
+export async function postUserMessageTurn(
+  input: PostUserMessageTurnInput,
+): Promise<PostUserMessageTurnResult> {
+  const { db, settings, accountId, workspaceId, sessionId } = input;
   const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
   // Reject an explicit per-message model the host does not expose; an omitted
   // model inherits the session's model downstream (always a configured id).
   assertConfiguredModel(settings, requestedModel);
-  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
   const sessionForModelGate = await requireSession(db, workspaceId, sessionId);
   const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;
+  const freshWorkspaceCustomModel =
+    requestedModel !== null &&
+    isWorkspaceCustomModelId(settings, requestedModel) &&
+    requestedModel !== sessionForModelGate.model
+      ? requestedModel
+      : null;
+  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, effectiveModelForGate);
   try {
     assertSessionAllowsProductModel(sessionForModelGate, effectiveModelForGate);
   } catch (error) {
@@ -1329,6 +1624,9 @@ export async function postUserMessageTurn(input: {
                 subjectId: input.actor ?? accountId,
               },
               operationKey,
+              ...(input.boundaryRequestHash
+                ? { boundaryRequestHash: input.boundaryRequestHash }
+                : {}),
               delivery: input.delivery ?? "send",
               controlEtag: input.controlEtag ?? null,
               expectedDraftRevision: input.expectedDraftRevision ?? null,
@@ -1356,6 +1654,29 @@ export async function postUserMessageTurn(input: {
                   }
                 : {}),
               mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+              ...(freshWorkspaceCustomModel
+                ? {
+                    beforeFreshPromptCommit: async (tx: Database): Promise<void> => {
+                      const reference = workspaceCustomModelReference(
+                        settings,
+                        freshWorkspaceCustomModel,
+                      );
+                      if (!reference) {
+                        throw new Error("workspace custom model reference disappeared");
+                      }
+                      const active = await lockActiveCustomModelForAdmission(tx, {
+                        accountId,
+                        workspaceId,
+                        reference,
+                      });
+                      if (!active) {
+                        throw new HTTPException(422, {
+                          message: `model is not available: ${freshWorkspaceCustomModel}`,
+                        });
+                      }
+                    },
+                  }
+                : {}),
               controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
             }),
         ),
@@ -1386,125 +1707,31 @@ export async function postUserMessageTurn(input: {
     }
     throw error;
   }
-  const postCommitTask = async () => {
-    await Promise.all([
-      (async () => {
-        try {
-          await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);
-          if (result.workspaceControlEventId) {
-            const controlEvent = await getWorkspaceControlEvent(
-              db,
-              workspaceId,
-              result.workspaceControlEventId,
-            );
-            if (!controlEvent) {
-              throw new Error(
-                `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,
-              );
-            }
-            await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);
-          }
-        } catch {
-          console.warn("[sessions] prompt event fanout failed; durable rows remain replayable", {
-            errorClass: "PromptEventFanoutOperationError",
-            errorCode: "session_prompt_event_fanout_failed",
-            origin: "core",
-          });
-        }
-      })(),
-      (async () => {
-        try {
-          await workflowClient.wakeSessionWorkflow({
-            accountId,
-            workspaceId,
-            sessionId,
-            workflowId: result.turn.temporalWorkflowId,
-            wakeRevision: result.wakeRevision,
-            ...((input.delivery ?? "send") === "steer" || result.interruptionCount > 0
-              ? { interruptionRequested: true }
-              : {}),
-          });
-        } catch {
-          console.warn("[sessions] workflow wake failed; durable outbox will retry", {
-            errorClass: "WorkflowWakeOperationError",
-            errorCode: "session_workflow_wake_failed",
-            origin: "core",
-          });
-        }
-      })(),
-    ]);
-  };
-  const schedulePostCommit =
-    input.schedulePostCommit ??
-    ((task: () => Promise<void>) => {
-      void task();
-    });
-  try {
-    schedulePostCommit(postCommitTask);
-  } catch {
-    console.warn("[sessions] prompt post-commit scheduling failed; durable recovery remains", {
-      errorClass: "PromptPostCommitScheduleError",
-      errorCode: "session_prompt_post_commit_schedule_failed",
-      origin: "core",
-    });
-  }
-  return {
-    accepted: result.accepted,
-    turn: result.turn,
-    receipt: {
-      id: result.receipt.id,
-      action: result.receipt.action,
-      operationKey: result.receipt.operationKey,
-      targetSessionId: result.receipt.targetSessionId,
-      targetTurnId: result.receipt.targetTurnId,
-      appliedControlRevision: result.receipt.appliedControlRevision,
-      appliedQueueVersion: result.receipt.appliedQueueVersion,
-      appliedTurnVersion: result.receipt.appliedTurnVersion,
-      appliedDraftRevision: result.receipt.appliedDraftRevision,
-      createdAt: result.receipt.createdAt.toISOString(),
-    },
-    routing: result.routing,
-    draft: result.draft
-      ? {
-          revision: result.draft.revision,
-          text: result.draft.text,
-          annotations: DraftTimelineAnnotations.parse(result.draft.annotations),
-          resources: result.draft.resources as ResourceRef[],
-          model: result.draft.model,
-          reasoningEffort: result.draft.reasoningEffort as ReasoningEffort,
-          latencyMode: result.draft.latencyMode as ComposerDraft["latencyMode"],
-          sourceTurnId: result.draft.sourceTurnId,
-          sourceTurnVersion: result.draft.sourceTurnVersion,
-          updatedAt: result.draft.updatedAt.toISOString(),
-        }
-      : null,
-    interruptionCount: result.interruptionCount,
-    replay: result.replay,
-  };
-}
-
-/**
- * Full create-session flow shared by `POST /sessions` and the first-party MCP
- * `session_create` tool: payload validation, resource/tool/variableSet
- * checks, usage limits, session start, and usage recording. `rawPayload` is
- * the unparsed request body so absent-vs-empty execution-context fields keep
- * their meaning: a child inherits omitted resources/tools/mcpServers from its
- * trusted immediate parent, while explicit arrays (including []) win. A
- * top-level create with omitted tools applies workspace-default capability MCPs.
- */
-export function resolveChildGoalFromAcceptedSnapshot(
-  goal: GoalSpec,
-  parentGoalSnapshot: SessionGoalSnapshot,
-): GoalSpec {
-  const inheritedRootConstraints =
-    parentGoalSnapshot.state === "none" ? [] : parentGoalSnapshot.rootConstraints;
-  const requestedRootConstraints = goal.rootConstraints;
-  if (
-    requestedRootConstraints?.some((constraint) => !inheritedRootConstraints.includes(constraint))
-  ) {
-    throw new Error(
-      "child goal rootConstraints must be an exact subset of the calling turn's frozen root constraints",
-    );
+  return finalizePostUserMessageTurn(input, result);
+}
+
+/**
+ * Full create-session flow shared by `POST /sessions` and the first-party MCP
+ * `session_create` tool: payload validation, resource/tool/variableSet
+ * checks, usage limits, session start, and usage recording. `rawPayload` is
+ * the unparsed request body so absent-vs-empty execution-context fields keep
+ * their meaning: a child inherits omitted resources/tools/mcpServers from its
+ * trusted immediate parent, while explicit arrays (including []) win. A
+ * top-level create with omitted tools applies workspace-default capability MCPs.
+ */
+export function resolveChildGoalFromAcceptedSnapshot(
+  goal: GoalSpec,
+  parentGoalSnapshot: SessionGoalSnapshot,
+): GoalSpec {
+  const inheritedRootConstraints =
+    parentGoalSnapshot.state === "none" ? [] : parentGoalSnapshot.rootConstraints;
+  const requestedRootConstraints = goal.rootConstraints;
+  if (
+    requestedRootConstraints?.some((constraint) => !inheritedRootConstraints.includes(constraint))
+  ) {
+    throw new Error(
+      "child goal rootConstraints must be an exact subset of the calling turn's frozen root constraints",
+    );
   }
   return {
     ...goal,
@@ -1532,16 +1759,84 @@ export function resolveSessionCreateVisibility(input: {
   return input.requestedVisibility === "private" ? "user_private" : "workspace_shared";
 }
 
+async function resolveWorkspaceModelBoundarySettings(
+  deps: Pick<ApiRouteDeps, "db" | "settings" | "catalogSourceSettings">,
+  grant: AccessGrant,
+  workspaceId: string,
+  modelIds: readonly (string | null | undefined)[],
+  retainedProductModelId?: string | null,
+): Promise<Settings> {
+  const retainedCatalogModel = isCatalogOverlayModel(retainedProductModelId);
+  if (deps.catalogSourceSettings) {
+    // The adapter already resolved one exact workspace catalog snapshot for
+    // this request. Preserve it for fresh selections, but an existing session
+    // may name a retired custom model that the active-only adapter snapshot
+    // intentionally omitted. Re-open only the unoverlaid source for that
+    // retention lookup; never feed the synthetic workspace provider back
+    // through deployment validation.
+    if (!retainedCatalogModel) return deps.settings;
+  }
+  const needsWorkspaceResolution =
+    deps.settings.modelCatalogSource === "database" || modelIds.some(isCatalogOverlayModel);
+  if (!needsWorkspaceResolution) return deps.settings;
+  return (
+    await resolveWorkspaceCatalogSettings(deps.db, deps.catalogSourceSettings ?? deps.settings, {
+      accountId: grant.accountId,
+      workspaceId,
+      ...(retainedProductModelId !== undefined ? { retainedProductModelId } : {}),
+    })
+  ).settings;
+}
+
+async function withSessionCreateUsageRecording(input: {
+  deps: ApiRouteDeps;
+  grant: AccessGrant;
+  workspaceId: string;
+  startMode: "realtime" | undefined;
+  origin: "system" | "user";
+  createOutcome: CreateSessionOutcome;
+}): Promise<CreateSessionRequestOutcome> {
+  let usageRecording: CreateSessionRequestOutcome["usageRecording"] = "recorded";
+  if (input.startMode !== "realtime") {
+    try {
+      await recordWorkspaceUsage(input.deps, {
+        accountId: input.grant.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.grant.subjectId,
+        eventType: "agent_run.created",
+        quantity: 1,
+        unit: "run",
+        sourceResourceType: "session",
+        sourceResourceId: input.createOutcome.session.id,
+        sessionId: input.createOutcome.session.id,
+        initiator: input.createOutcome.session.createdBy,
+        initiatorContext: input.createOutcome.session.createdByContext,
+        origin: input.origin,
+        idempotencyKey: `agent_run.created:${input.workspaceId}:${input.createOutcome.session.id}`,
+      });
+    } catch (error) {
+      usageRecording = "failed";
+      reportSessionUsageRecordingFailure(error);
+    }
+  }
+  return { ...input.createOutcome, usageRecording };
+}
+
 export async function createSessionForRequestWithOutcome(
-  deps: ApiRouteDeps,
+  unresolvedDeps: ApiRouteDeps,
   grant: AccessGrant,
   workspaceId: string,
   rawPayload: unknown,
   authorization?: AccessGrantAuthorization,
   agentChildPresentation?: AgentChildSessionCreatePresentation,
 ): Promise<CreateSessionRequestOutcome> {
-  const { settings, db, bus, workflowClient, objectStorage } = deps;
   const payload = CreateSessionRequest.parse(rawPayload);
+  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
+    throw new HTTPException(422, {
+      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
+    });
+  }
+  const db = unresolvedDeps.db;
   const visibilityProvided = hasOwnProperty(rawPayload, "visibility");
   if (payload.visibility === "private" && !grant.metadata?.["sessionId"]) {
     if (!authorization) {
@@ -1549,39 +1844,13 @@ export async function createSessionForRequestWithOutcome(
         message: "managed human session required",
       });
     }
-    await requireManagedHumanPrivateSessionCreate(deps, authorization, workspaceId);
+    await requireManagedHumanPrivateSessionCreate(unresolvedDeps, authorization, workspaceId);
     if (payload.sandbox === "shared" || typeof payload.sandbox === "object") {
       throw new HTTPException(422, {
         message: "Only-me sessions require their own sandbox",
       });
     }
   }
-  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
-    throw new HTTPException(422, {
-      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
-    });
-  }
-  // A committed keyed denial is the idempotent outcome even if mutable
-  // resources, policy, authorization, or budget have changed since the first
-  // attempt. Replay it before any of those checks, just as a keyed successful
-  // session is returned rather than recreated later in createAndStartSession.
-  if (payload.idempotencyKey) {
-    const denial = await getSessionSpawnDenialByIdempotencyKey(
-      db,
-      workspaceId,
-      payload.idempotencyKey,
-    );
-    if (denial) {
-      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));
-    }
-  }
-  await requireAtomicPersonalResourceAttachment(
-    deps,
-    authorization,
-    workspaceId,
-    payload.personalResourceAttachment,
-    false,
-  );
   // Parent linkage and execution-context inheritance come ONLY from the
   // worker-signed sessionId claim. A caller cannot nominate a parent in the
   // payload, so inheriting an existing repository/tool/credential snapshot does
@@ -1592,7 +1861,7 @@ export async function createSessionForRequestWithOutcome(
       : null;
   if (parentSessionId) {
     try {
-      await requireSessionAuthorization(deps, grant, {
+      await requireSessionAuthorization(unresolvedDeps, grant, {
         sessionId: parentSessionId,
         operation: "session.child.create",
         surface: "core",
@@ -1650,6 +1919,118 @@ export async function createSessionForRequestWithOutcome(
       message: "caller attempt does not belong to the parent session",
     });
   }
+  const replayManagedHumanSubjectId = creationInitiator.actor
+    ? (parentCallingTurn?.initiatingHumanSubjectId ??
+      (parentCallingTurn?.initiator.kind === "subject"
+        ? parentCallingTurn.initiator.subjectId
+        : null))
+    : authorization?.canonicalManagedHumanSession || grant.principalKind === "human_session"
+      ? grant.subjectId
+      : null;
+  let retainedKeyedShellModel: string | null = null;
+  if (
+    payload.idempotencyKey &&
+    (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)
+  ) {
+    try {
+      const initializedReplay = await getInitializedSessionCreateReplay(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
+        ...(replayManagedHumanSubjectId
+          ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId }
+          : {}),
+        createIdempotencyKey: payload.idempotencyKey,
+        selectedInstalledSkillIds: payload.installedSkillIds ?? [],
+        ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),
+        visibility: effectiveVisibility,
+        variableSetIds: payload.variableSetIds ?? [],
+        initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+        deferInitialTurn: payload.startMode === "realtime",
+      });
+      if (initializedReplay) {
+        if (initializedReplay.outcome === "denied") {
+          throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
+        }
+        if (initializedReplay.outcome === "pending") {
+          retainedKeyedShellModel = initializedReplay.session.model;
+        } else {
+          if (initializedReplay.workflowWakeRevision !== null) {
+            await unresolvedDeps.workflowClient.wakeSessionWorkflow({
+              accountId: grant.accountId,
+              workspaceId,
+              sessionId: initializedReplay.session.id,
+              workflowId: initializedReplay.temporalWorkflowId,
+              wakeRevision: initializedReplay.workflowWakeRevision,
+            });
+          }
+          return await withSessionCreateUsageRecording({
+            deps: unresolvedDeps,
+            grant,
+            workspaceId,
+            startMode: payload.startMode,
+            origin: creationInitiator.actor ? "system" : "user",
+            createOutcome: {
+              session: initializedReplay.session,
+              outcome: initializedReplay.changed ? "repaired" : "replayed",
+              replay: !initializedReplay.changed,
+              changed: initializedReplay.changed,
+            },
+          });
+        }
+      }
+    } catch (error) {
+      if (error instanceof SessionIdConflictError) {
+        throw new HTTPException(409, {
+          message: "requested session id is already in use",
+        });
+      }
+      if (error instanceof SessionCreateIdempotencyConflictError) {
+        throw new HTTPException(409, { message: error.message, cause: error });
+      }
+      throw error;
+    }
+  }
+  let settings = await resolveWorkspaceModelBoundarySettings(
+    unresolvedDeps,
+    grant,
+    workspaceId,
+    [payload.model],
+    retainedKeyedShellModel,
+  );
+  let deps =
+    settings === unresolvedDeps.settings
+      ? unresolvedDeps
+      : {
+          ...unresolvedDeps,
+          catalogSourceSettings: unresolvedDeps.catalogSourceSettings ?? unresolvedDeps.settings,
+          settings,
+        };
+  const { bus, workflowClient, objectStorage } = deps;
+  await requireAtomicPersonalResourceAttachment(
+    deps,
+    authorization,
+    workspaceId,
+    payload.personalResourceAttachment,
+    false,
+  );
+  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
+  const effectiveModelId = payload.model ?? inheritedModel;
+  const effectiveCatalogSettings = await resolveWorkspaceModelBoundarySettings(
+    deps,
+    grant,
+    workspaceId,
+    [effectiveModelId],
+    parentSession ? inheritedModel : null,
+  );
+  if (effectiveCatalogSettings !== settings) {
+    deps = {
+      ...deps,
+      catalogSourceSettings: deps.catalogSourceSettings ?? settings,
+      settings: effectiveCatalogSettings,
+    };
+    settings = effectiveCatalogSettings;
+  }
   let effectiveGoal = payload.goal;
   if (parentSession && payload.goal) {
     try {
@@ -1723,9 +2104,43 @@ export async function createSessionForRequestWithOutcome(
       ? payload.resources
       : (parentSession?.resources ?? payload.resources),
   );
-  const skills = hasOwnProperty(rawPayload, "skills")
+  const inheritedOrSubmittedSkills = hasOwnProperty(rawPayload, "skills")
     ? payload.skills
     : (parentSession?.skills ?? payload.skills);
+  const selectedInstalledSkillIds = payload.installedSkillIds ?? [];
+  const selectedInstalledSkills: SessionSkill[] = [];
+  if (selectedInstalledSkillIds.length > 0) {
+    const installedSkills = await listInstalledPortableSkills(db, workspaceId, {
+      includeSessionSelected: true,
+    });
+    const installedById = new Map(installedSkills.map((skill) => [skill.capabilityId, skill]));
+    for (const capabilityId of selectedInstalledSkillIds) {
+      const installed = installedById.get(capabilityId);
+      if (!installed) {
+        throw new HTTPException(422, {
+          message: `Session-selected Skill is not installed in this workspace: ${capabilityId}`,
+        });
+      }
+      if (installed.activationMode !== "session_selected") {
+        throw new HTTPException(422, {
+          message: `Installed Skill does not require explicit session selection: ${capabilityId}`,
+        });
+      }
+      selectedInstalledSkills.push({
+        name: installed.name,
+        description: installed.description,
+        files: installed.files.map((file) => ({ path: file.path, content: file.content })),
+      });
+    }
+  }
+  let skills: SessionSkill[];
+  try {
+    skills = SessionSkills.parse([...inheritedOrSubmittedSkills, ...selectedInstalledSkills]);
+  } catch (error) {
+    throw new HTTPException(422, {
+      message: error instanceof Error ? error.message : "invalid session Skill selection",
+    });
+  }
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
   // Visibility became durable draft state after older clients had already
   // written rows without it. Compare it only when the create request supplied
@@ -1860,8 +2275,7 @@ export async function createSessionForRequestWithOutcome(
   // managers: falling back to the deployment model would silently move a child
   // onto the OpenGeni-credits billing path. Legacy session-bound grants without
   // exact attempt claims fall back to the parent session's persisted defaults.
-  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
-  const model = canonicalConfiguredModel(settings, payload.model ?? inheritedModel);
+  const model = canonicalConfiguredModel(settings, effectiveModelId);
   if (model === null || model === undefined) {
     throw new Error("effective session model unexpectedly resolved to null");
   }
@@ -2025,7 +2439,10 @@ export async function createSessionForRequestWithOutcome(
     payload.firstPartyMcpTools,
     parentSession ? parentSession.firstPartyMcpTools : undefined,
     workspaceFirstPartyDefaults && !parentSession
-      ? { ...deploymentFirstPartyMcpToolPolicy, default: workspaceFirstPartyDefaults }
+      ? {
+          ...deploymentFirstPartyMcpToolPolicy,
+          default: workspaceFirstPartyDefaults,
+        }
       : deploymentFirstPartyMcpToolPolicy,
   );
   const googleDrivePublicationEnabled =
@@ -2101,7 +2518,10 @@ export async function createSessionForRequestWithOutcome(
   let sandboxGroupId: string | null = null;
   let inheritedBackend: Session["sandboxBackend"] | undefined;
   let inheritedSandboxOs: Session["sandboxOs"] | undefined;
-  let inheritedActiveTarget: { sandboxId: string; workingDir: string | null } | null = null;
+  let inheritedActiveTarget: {
+    sandboxId: string;
+    workingDir: string | null;
+  } | null = null;
   // ENV-AWARE GROUPING: under the CURRENT mechanics the workspace VariableSet is
   // creation-time box state — the box's manifest env is fixed when it is cold-
   // created, and the SDK's provided-session guard rejects any manifest-env delta
@@ -2405,9 +2825,12 @@ export async function createSessionForRequestWithOutcome(
       sessionMcpServers: sessionMcpServers.metadata,
       personalConnectionDelegations,
       initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+      workspaceCustomModel: isWorkspaceCustomModelId(settings, model),
+      retainWorkspaceCustomModel: parentSession !== null && model === inheritedModel,
       ...(xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {}),
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
+      selectedInstalledSkillIds,
       maxNestedAgentDepthOverride: payload.maxNestedAgentDepth ?? null,
       allowNestedAgentDepthIncrease: hasPermission(grant.permissions, "workspace:admin"),
       subjectId: grant.subjectId,
@@ -2474,30 +2897,14 @@ export async function createSessionForRequestWithOutcome(
     }
     throw error;
   }
-  let usageRecording: CreateSessionRequestOutcome["usageRecording"] = "recorded";
-  if (payload.startMode !== "realtime") {
-    try {
-      await recordWorkspaceUsage(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        eventType: "agent_run.created",
-        quantity: 1,
-        unit: "run",
-        sourceResourceType: "session",
-        sourceResourceId: createOutcome.session.id,
-        sessionId: createOutcome.session.id,
-        initiator: createOutcome.session.createdBy,
-        initiatorContext: createOutcome.session.createdByContext,
-        origin: creationInitiator.actor ? "system" : "user",
-        idempotencyKey: `agent_run.created:${workspaceId}:${createOutcome.session.id}`,
-      });
-    } catch (error) {
-      usageRecording = "failed";
-      reportSessionUsageRecordingFailure(error);
-    }
-  }
-  return { ...createOutcome, usageRecording };
+  return await withSessionCreateUsageRecording({
+    deps,
+    grant,
+    workspaceId,
+    startMode: payload.startMode,
+    origin: creationInitiator.actor ? "system" : "user",
+    createOutcome,
+  });
 }
 
 /** @internal Fixed public projection; the committed session outcome remains authoritative. */
@@ -2525,6 +2932,53 @@ export async function createSessionForRequest(
   ).session;
 }
 
+function sessionPromptBoundaryRequestHash(input: {
+  delivery: "send" | "steer";
+  controlEtag: string | null;
+  expectedDraftRevision: number | null;
+  text: string;
+  annotations: SubmittedTimelineAnnotation[];
+  modelContext: string | null;
+  resources: ResourceRef[];
+  composerDraftResources?: ResourceRef[];
+  model: string | null;
+  reasoningEffort: ReasoningEffort | null;
+  latencyMode: "standard" | "priority" | "fast" | null;
+  source: "user" | "api";
+  mcpCredentialUpdates: SessionMcpCredentialUpdateInput[];
+  connectionAuthorities?: McpConnectionAuthoritySelection[];
+  personalResourceAttachment?: PersonalResourceAttachmentIntent;
+  commandActor: SessionCommandActor;
+}): string {
+  return `prompt-boundary-v1:${canonicalSessionCommandHash({
+    delivery: input.delivery,
+    controlEtag: input.controlEtag,
+    expectedDraftRevision: input.expectedDraftRevision,
+    text: input.text,
+    annotations: input.annotations,
+    modelContext: input.modelContext,
+    resources: input.resources,
+    composerDraftResourcesProvided: input.composerDraftResources !== undefined,
+    composerDraftResources: input.composerDraftResources ?? [],
+    model: input.model,
+    reasoningEffort: input.reasoningEffort,
+    latencyMode: input.latencyMode,
+    source: input.source,
+    mcpCredentialUpdates: input.mcpCredentialUpdates,
+    connectionAuthorities: input.connectionAuthorities ?? [],
+    personalResourceAttachment: input.personalResourceAttachment ?? null,
+    ...(input.commandActor.type === "service"
+      ? {
+          serviceInitiator: {
+            subjectId: input.commandActor.subjectId,
+            subjectLabel: input.commandActor.subjectLabel ?? null,
+            context: input.commandActor.context ?? {},
+          },
+        }
+      : {}),
+  })}`;
+}
+
 /**
  * Full accept-user-message flow shared by the `user.message` branch of
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
@@ -2566,192 +3020,316 @@ export async function acceptSessionUserMessageWithOutcome(
   interruptionCount: number;
   replay: boolean;
 }> {
-  const { settings, db, bus, workflowClient, objectStorage } = deps;
+  const { db, bus, workflowClient, objectStorage } = deps;
   const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
+  const delivery = input.delivery ?? "send";
+  const source = delegatedServiceInitiator || input.origin === "operator" ? "api" : "user";
+  const commandActor: SessionCommandActor = delegatedServiceInitiator
+    ? {
+        type: "service",
+        subjectId: delegatedServiceInitiator.initiator.subjectId,
+        ...(delegatedServiceInitiator.initiator.label
+          ? { subjectLabel: delegatedServiceInitiator.initiator.label }
+          : {}),
+        context: delegatedServiceInitiator.context,
+      }
+    : { type: "human", subjectId: grant.subjectId };
   await requireSessionAuthorization(deps, grant, {
     sessionId,
-    operation: input.delivery === "steer" ? "session.steer" : "session.append",
+    operation: delivery === "steer" ? "session.steer" : "session.append",
     surface: "core",
   });
-  await requireAtomicPersonalResourceAttachment(
-    deps,
-    input.authorization,
-    workspaceId,
-    input.personalResourceAttachment,
-    true,
-  );
-  // Hoisted above requireLimit so the codex-billed predicate can resolve the
-  // turn's effective model (a follow-up turn inherits the session's model). A
-  // pure read with no side effects.
-  const existingSession = await requireSession(db, workspaceId, sessionId);
-  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
-  const effectiveModel =
-    canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
-  if (effectiveModel === null) {
-    throw new Error("effective follow-up model unexpectedly resolved to null");
-  }
-  try {
-    assertSessionAllowsProductModel(existingSession, effectiveModel);
-  } catch (error) {
-    if (error instanceof CodexCompactionV2ProviderLockedError) {
-      throw new HTTPException(422, { message: error.message, cause: error });
-    }
-    throw error;
-  }
-  const sessionReasoningEffort = existingSession.reasoningEffort;
-  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
-  const sessionLatencyMode = existingSession.latencyMode;
-  const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
-  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
-    modelId: effectiveModel,
-    requestedModelId: input.model ?? null,
-    modelSource: input.model == null ? "session" : "explicit",
-    reasoningEffort: effectiveReasoningEffort,
-    reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
-    latencyMode: effectiveLatencyMode,
-    latencyModeSource: input.latencyMode == null ? "session" : "explicit",
-  });
   const requestedResources = normalizeResources(input.resources ?? []);
   const composerDraftResources = input.composerDraftResources
     ? normalizeResources(input.composerDraftResources)
     : undefined;
-  if (composerDraftResources) {
-    const acceptedResources = new Set(requestedResources.map((resource) => stableJson(resource)));
-    const unacceptedDraftResource = composerDraftResources.find(
-      (resource) => !acceptedResources.has(stableJson(resource)),
+  const boundaryRequestHash = input.clientEventId
+    ? sessionPromptBoundaryRequestHash({
+        delivery,
+        controlEtag: input.controlEtag ?? null,
+        expectedDraftRevision: input.expectedDraftRevision ?? null,
+        text: input.text,
+        annotations: input.annotations ?? [],
+        modelContext: input.modelContext ?? null,
+        resources: requestedResources,
+        ...(composerDraftResources ? { composerDraftResources } : {}),
+        model: input.model ?? null,
+        reasoningEffort: input.reasoningEffort ?? null,
+        latencyMode: input.latencyMode ?? null,
+        source,
+        mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+        ...(input.connectionAuthorities
+          ? { connectionAuthorities: input.connectionAuthorities }
+          : {}),
+        ...(input.personalResourceAttachment
+          ? { personalResourceAttachment: input.personalResourceAttachment }
+          : {}),
+        commandActor,
+      })
+    : null;
+  if (input.clientEventId && boundaryRequestHash) {
+    const replay = await withWorkspaceSubjectSessionActivityRls(
+      db,
+      workspaceId,
+      grant.subjectId,
+      async (scopedDb) =>
+        await replaySubmittedHumanPromptFromBoundaryReceipt(scopedDb, {
+          workspaceId,
+          sessionId,
+          subjectId: grant.subjectId,
+          actor: commandActor,
+          operationKey: input.clientEventId!,
+          delivery,
+          boundaryRequestHash,
+          expectedDraftRevision: input.expectedDraftRevision ?? null,
+        }),
     );
-    if (unacceptedDraftResource) {
-      throw new HTTPException(422, {
-        message: "composer draft resources must be included in the accepted resource set",
-      });
+    if (replay) {
+      return finalizePostUserMessageTurn(
+        {
+          db,
+          bus,
+          workflowClient,
+          accountId: grant.accountId,
+          workspaceId,
+          sessionId,
+          delivery,
+          ...(deps.schedulePromptPostCommit
+            ? { schedulePostCommit: deps.schedulePromptPostCommit }
+            : {}),
+        },
+        replay,
+      );
     }
   }
-  const annotations = await validateSubmittedTimelineAnnotations(
-    db,
-    workspaceId,
-    sessionId,
-    input.annotations ?? [],
-  );
-  await requireLimit(deps, {
-    accountId: grant.accountId,
-    workspaceId,
-    action: "agent_run:create",
-    quantity: 1,
-    model: effectiveModel,
-  });
-  if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException(503, {
-      message: "object storage is not configured",
+  try {
+    await requireAtomicPersonalResourceAttachment(
+      deps,
+      input.authorization,
+      workspaceId,
+      input.personalResourceAttachment,
+      true,
+    );
+    // Hoisted above requireLimit so the codex-billed predicate can resolve the
+    // turn's effective model (a follow-up turn inherits the session's model). A
+    // pure read with no side effects.
+    const existingSession = await requireSession(db, workspaceId, sessionId);
+    const settings = await resolveWorkspaceModelBoundarySettings(
+      deps,
+      grant,
+      workspaceId,
+      [input.model ?? existingSession.model],
+      existingSession.model,
+    );
+    if (settings !== deps.settings) {
+      deps = {
+        ...deps,
+        catalogSourceSettings: deps.catalogSourceSettings ?? deps.settings,
+        settings,
+      };
+    }
+    const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
+    const effectiveModel =
+      canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
+    if (effectiveModel === null) {
+      throw new Error("effective follow-up model unexpectedly resolved to null");
+    }
+    await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
+    try {
+      assertSessionAllowsProductModel(existingSession, effectiveModel);
+    } catch (error) {
+      if (error instanceof CodexCompactionV2ProviderLockedError) {
+        throw new HTTPException(422, { message: error.message, cause: error });
+      }
+      throw error;
+    }
+    const sessionReasoningEffort = existingSession.reasoningEffort;
+    const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
+    const sessionLatencyMode = existingSession.latencyMode;
+    const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
+    const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+      modelId: effectiveModel,
+      requestedModelId: input.model ?? null,
+      modelSource: input.model == null ? "session" : "explicit",
+      reasoningEffort: effectiveReasoningEffort,
+      reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
+      latencyMode: effectiveLatencyMode,
+      latencyModeSource: input.latencyMode == null ? "session" : "explicit",
     });
-  }
-  await validateFileResources(
-    db,
-    grant.accountId,
-    workspaceId,
-    grant.subjectId,
-    requestedResources,
-  );
-  await validateGitHubRepositorySelection(db, workspaceId, [
-    ...existingSession.resources,
-    ...requestedResources,
-  ]);
-  const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
-    settings,
-    grant,
-    session: existingSession,
-    updates: input.mcpCredentialUpdates ?? [],
-  });
-  const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
-  const inheritedPersonalConnectionDelegations =
-    connectionDelegationSource.kind === "turn"
-      ? await getSessionTurnPersonalConnectionDelegations(
-          db,
-          workspaceId,
-          connectionDelegationSource.sessionId,
-          connectionDelegationSource.turnId,
-        )
-      : null;
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
-    db,
-    workspaceId,
-    settings,
-    inheritedPersonalConnectionDelegations
-      ? {
-          personalConnectionDelegations: inheritedPersonalConnectionDelegations,
-        }
-      : { subjectId: grant.subjectId },
-  );
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
-    db,
-    workspaceId,
-    settings: runtimeSettings,
-    tools: existingSession.tools,
-    resources: [...existingSession.resources, ...requestedResources],
-    source: connectionDelegationSource,
-    targetSessionId: sessionId,
-    googleDrivePublicationEnabled:
-      existingSession.firstPartyMcpTools.includes("editable_artifact_export") &&
-      existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") &&
-      (!existingSession.firstPartyMcpPermissions?.length ||
-        (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
-          existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
-    atlassianEnabled:
-      existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
-      (!existingSession.firstPartyMcpPermissions?.length ||
-        existingSession.firstPartyMcpPermissions.includes("connections:read")),
-    ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
-  });
-  const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
-    await postUserMessageTurn({
+    if (composerDraftResources) {
+      const acceptedResources = new Set(requestedResources.map((resource) => stableJson(resource)));
+      const unacceptedDraftResource = composerDraftResources.find(
+        (resource) => !acceptedResources.has(stableJson(resource)),
+      );
+      if (unacceptedDraftResource) {
+        throw new HTTPException(422, {
+          message: "composer draft resources must be included in the accepted resource set",
+        });
+      }
+    }
+    const annotations = await validateSubmittedTimelineAnnotations(
       db,
-      bus,
-      workflowClient,
-      settings,
-      accountId: grant.accountId,
       workspaceId,
       sessionId,
-      text: input.text,
-      annotations,
-      modelContext: input.modelContext ?? null,
-      resources: requestedResources,
-      ...(composerDraftResources ? { composerDraftResources } : {}),
-      model: input.model ?? null,
-      reasoningEffort: input.reasoningEffort ?? null,
-      latencyMode: input.latencyMode ?? null,
-      reasoningEffortFallback: sessionReasoningEffort,
-      turnExecutionPolicy,
-      mcpCredentialUpdates,
-      personalConnectionDelegations,
-      ...(input.personalResourceAttachment
-        ? { personalResourceAttachment: input.personalResourceAttachment }
-        : {}),
-      delivery: input.delivery ?? "send",
-      origin: delegatedServiceInitiator ? "operator" : (input.origin ?? "human"),
-      actor: grant.subjectId,
-      ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
-      ...(delegatedServiceInitiator
+      input.annotations ?? [],
+    );
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "agent_run:create",
+      quantity: 1,
+      model: effectiveModel,
+    });
+    if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
+      throw new HTTPException(503, {
+        message: "object storage is not configured",
+      });
+    }
+    await validateFileResources(
+      db,
+      grant.accountId,
+      workspaceId,
+      grant.subjectId,
+      requestedResources,
+    );
+    await validateGitHubRepositorySelection(db, workspaceId, [
+      ...existingSession.resources,
+      ...requestedResources,
+    ]);
+    const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
+      settings,
+      grant,
+      session: existingSession,
+      updates: input.mcpCredentialUpdates ?? [],
+    });
+    const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
+    const inheritedPersonalConnectionDelegations =
+      connectionDelegationSource.kind === "turn"
+        ? await getSessionTurnPersonalConnectionDelegations(
+            db,
+            workspaceId,
+            connectionDelegationSource.sessionId,
+            connectionDelegationSource.turnId,
+          )
+        : null;
+    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      db,
+      workspaceId,
+      settings,
+      inheritedPersonalConnectionDelegations
         ? {
-            commandActor: {
-              type: "service" as const,
-              subjectId: delegatedServiceInitiator.initiator.subjectId,
-              ...(delegatedServiceInitiator.initiator.label
-                ? { subjectLabel: delegatedServiceInitiator.initiator.label }
-                : {}),
-              context: delegatedServiceInitiator.context,
-            },
+            personalConnectionDelegations: inheritedPersonalConnectionDelegations,
           }
-        : {}),
-      ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),
-      ...(input.expectedDraftRevision !== undefined
-        ? { expectedDraftRevision: input.expectedDraftRevision }
-        : {}),
-      ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
-      recordAgentRunUsage: true,
-      ...(deps.schedulePromptPostCommit
-        ? { schedulePostCommit: deps.schedulePromptPostCommit }
-        : {}),
+        : { subjectId: grant.subjectId },
+    );
+    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+      db,
+      workspaceId,
+      settings: runtimeSettings,
+      tools: existingSession.tools,
+      resources: [...existingSession.resources, ...requestedResources],
+      source: connectionDelegationSource,
+      targetSessionId: sessionId,
+      googleDrivePublicationEnabled:
+        existingSession.firstPartyMcpTools.includes("editable_artifact_export") &&
+        existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") &&
+        (!existingSession.firstPartyMcpPermissions?.length ||
+          (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
+            existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
+      atlassianEnabled:
+        existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
+        (!existingSession.firstPartyMcpPermissions?.length ||
+          existingSession.firstPartyMcpPermissions.includes("connections:read")),
+      ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
     });
-  return { accepted, turn, draft, receipt, routing, interruptionCount, replay };
+    const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
+      await postUserMessageTurn({
+        db,
+        bus,
+        workflowClient,
+        settings,
+        accountId: grant.accountId,
+        workspaceId,
+        sessionId,
+        text: input.text,
+        annotations,
+        modelContext: input.modelContext ?? null,
+        resources: requestedResources,
+        ...(composerDraftResources ? { composerDraftResources } : {}),
+        model: input.model ?? null,
+        reasoningEffort: input.reasoningEffort ?? null,
+        latencyMode: input.latencyMode ?? null,
+        reasoningEffortFallback: sessionReasoningEffort,
+        turnExecutionPolicy,
+        mcpCredentialUpdates,
+        personalConnectionDelegations,
+        ...(input.personalResourceAttachment
+          ? { personalResourceAttachment: input.personalResourceAttachment }
+          : {}),
+        delivery,
+        origin: source === "api" ? "operator" : "human",
+        actor: grant.subjectId,
+        ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
+        commandActor,
+        ...(boundaryRequestHash ? { boundaryRequestHash } : {}),
+        ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),
+        ...(input.expectedDraftRevision !== undefined
+          ? { expectedDraftRevision: input.expectedDraftRevision }
+          : {}),
+        ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
+        recordAgentRunUsage: true,
+        ...(deps.schedulePromptPostCommit
+          ? { schedulePostCommit: deps.schedulePromptPostCommit }
+          : {}),
+      });
+    return {
+      accepted,
+      turn,
+      draft,
+      receipt,
+      routing,
+      interruptionCount,
+      replay,
+    };
+  } catch (error) {
+    if (input.clientEventId && boundaryRequestHash) {
+      const replay = await withWorkspaceSubjectSessionActivityRls(
+        db,
+        workspaceId,
+        grant.subjectId,
+        async (scopedDb) =>
+          await replaySubmittedHumanPromptFromBoundaryReceipt(scopedDb, {
+            workspaceId,
+            sessionId,
+            subjectId: grant.subjectId,
+            actor: commandActor,
+            operationKey: input.clientEventId!,
+            delivery,
+            boundaryRequestHash,
+            expectedDraftRevision: input.expectedDraftRevision ?? null,
+            serializeOperation: true,
+          }),
+      );
+      if (replay) {
+        return finalizePostUserMessageTurn(
+          {
+            db,
+            bus,
+            workflowClient,
+            accountId: grant.accountId,
+            workspaceId,
+            sessionId,
+            delivery,
+            ...(deps.schedulePromptPostCommit
+              ? { schedulePostCommit: deps.schedulePromptPostCommit }
+              : {}),
+          },
+          replay,
+        );
+      }
+    }
+    throw error;
+  }
 }
 
 /** Backward-compatible entity-returning path used by existing REST callers. */