refactor(kiloclaw): removed managed Composio onboarding

[pandemicsyn]

Summary

• Remove the retired managed Composio onboarding surface from KiloClaw, including managed identity/Connect Link helpers, callback handling, tRPC procedures, and the obsolete onboarding tools state. Direct Google Calendar OAuth remains the supported onboarding path.
• Preserve user-owned Composio Settings configuration through the normal encrypted secret transport, and validate that provision-time manual Composio input contains the complete required credential pair.

Verification

• Queried production managed Composio inventory before retirement: found 12 managed identity rows, 9 with stored credentials, 4 managed instance markers, and 0 live managed instance markers; product inspection confirmed none of the retired-flow users has an existing live machine requiring managed-secret cleanup.
• No manual browser verification was performed; direct Google OAuth remains the intended visible onboarding flow, and no retired ?step=tools URLs require compatibility support.

Visual Changes

Before	After
No live managed Composio onboarding surface expected; add screenshot only if reproducing a retired internal URL	Direct Google Calendar onboarding remains the supported visible flow; add screenshot if manually verified

Reviewer Notes

• This PR intentionally does not remove the active provision advisory locks; those remain until Worker-side Registry reservation admission is implemented and deployed.
• Stored managed identity rows and the obsolete marker schema remain temporarily because production migrations deploy before this PR removes the endpoint that could create additional managed state; a separate generated migration can drop them after this deploys.
• New machines and Settings updates do not write retired managed-onboarding provenance. Manual Composio remains supported only as user-provided encrypted Settings configuration.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The two incremental commits add and then cleanly revert a short-lived manual Composio provenance tracking mechanism; the final PR state is consistent with the previous review's clean outcome, with all provenance tracking removed and no new issues introduced.

Previously Flagged Issue — Resolved

File	Status
apps/web/src/lib/kiloclaw/provision-secrets.ts — partial single-field null patch incorrectly triggering 'clear'	Resolved — provenance tracking was added in be07c6b8b then fully retired in c241a9b87; no tracking code remains

Other Observations (not in diff — carry-forward)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
apps/web/src/lib/config.server.ts	239–242	COMPOSIO_AGENTS_API_BASE_URL and COMPOSIO_API_BASE_URL are dead exports — their only consumer (composio-client.ts) was deleted in this PR. Safe to remove in a follow-up.

Files Reviewed (incremental — 2 commits)

• .specs/kiloclaw-composio.md — rule 18 (manual provenance) added then removed; final numbering consistent
• apps/web/src/lib/kiloclaw/instance-registry.ts — markComposioInstanceConfigManual/clearComposioInstanceConfigSource added then removed cleanly
• apps/web/src/lib/kiloclaw/provision-secrets.ts — exported hasComposioProvisionSecrets/getComposioSecretsPatchSource added then removed; private helper retained for validation
• apps/web/src/lib/kiloclaw/provision-secrets.test.ts — source tracking tests added then removed to match
• apps/web/src/routers/kiloclaw-router.ts — provenance calls added then removed; final state clean
• apps/web/src/routers/organizations/organization-kiloclaw-router.ts — same, symmetric

---

_{Reviewed by claude-4.6-sonnet-20260217 · 1,038,910 tokens}

_{Review guidance: REVIEW.md from base branch main}