feat(cloud-agent-next): add operational outcome reporting

[eshurakov]

Summary

Adds a separate table for cloud agent sessions to track outcomes and an admin dashboard with an overview.

Verification

• Local verification

Visual Changes

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Full incremental review of the entire PR (51 files changed) covering the new Cloud Agent operational outcome reporting pipeline — DB schema, queue consumer/producer, report store, session-registration telemetry hooks, admin dashboard, and all associated tests — found no bugs, security vulnerabilities, or logic errors.

Resolved Issues (from previous reviews)

File	Issue	Status
apps/web/src/routers/admin-cloud-agent-next-router.ts	Correlated subqueries for run counts	✅ Resolved — listSessions/aggregates removed; replaced with EXISTS/NOT EXISTS
services/cloud-agent-next/src/telemetry/report-store.ts	removeExpiredData held wide transaction	✅ Resolved — runs as independent mutations
services/cloud-agent-next/src/telemetry/report-store.ts	recordSessionFailure overwrote existing failure	✅ Resolved — isNull(failure_at) guard enforced
services/cloud-agent-next/src/router/auth.ts	String-comparison auth key check	✅ Resolved — replaced with timingSafeEqual

Files Reviewed (51 files)

• packages/db/src/schema.ts — new cloud_agent_sessions and cloud_agent_session_runs tables
• packages/db/src/migrations/0149_pink_tag.sql — generated migration; new tables only, no locking concerns
• packages/worker-utils/src/cloud-agent-queue-report.ts — queue report schema with strict Zod validation; no PII fields, diagnostics size-bounded
• packages/worker-utils/src/cloud-agent-queue-report.test.ts — comprehensive schema validation tests
• services/cloud-agent-next/src/telemetry/queue-reports.ts — emitRunStateReport never logs/reports user content (prompt, error, model); validates before enqueue
• services/cloud-agent-next/src/telemetry/queue-reports.test.ts — confirms PII exclusion and delivery fault tolerance
• services/cloud-agent-next/src/telemetry/report-consumer.ts — createCloudAgentReportStore(getPgDb(env)) called per-batch (no module-scope DB caching); correct ack/retry semantics
• services/cloud-agent-next/src/telemetry/report-consumer.test.ts — covers malformed, expired, missing-parent, and transient-failure paths
• services/cloud-agent-next/src/telemetry/report-store.ts — per-session advisory locking; idempotent recordSessionFailure with isNull guard; removeExpiredData uses independent mutations
• services/cloud-agent-next/src/telemetry/report-store.test.ts — unit coverage using manual DB fake
• services/cloud-agent-next/src/telemetry/session-reports.ts — thin orchestration; uses new Date().toISOString() as occurredAt
• services/cloud-agent-next/src/telemetry/session-reports.test.ts
• services/cloud-agent-next/src/session/session-message-state.ts — new failureStage, failureCode, dispatchAcceptanceKind, agentActivityObservedAt fields; markAgentActivityObserved idempotent
• services/cloud-agent-next/src/session/session-message-state.test.ts
• services/cloud-agent-next/src/session/session-registration.ts — reporting anchor created synchronously before CLI session row; each failure stage reports and re-throws; recordPostSetupFailure swallows to not block main flow
• services/cloud-agent-next/src/session/session-message-queue.ts — lastFlushFailureCode preserved through retries; classifyDeliveryFailure maps exhausted codes to typed report classifications
• services/cloud-agent-next/src/session/session-message-queue.test.ts
• services/cloud-agent-next/src/session/pending-messages.ts — lastFlushFailureCode field added; code preserved even when later attempt has no code
• services/cloud-agent-next/src/session/pending-messages.test.ts
• services/cloud-agent-next/src/session/wrapper-supervisor.ts — agentActivityObservedAt used to distinguish pre/post-activity failure stages; handleUnhealthyWrapper receives explicit failureCode
• services/cloud-agent-next/src/session/wrapper-supervisor.test.ts
• services/cloud-agent-next/src/session/message-settlement-outbox.ts — reportTerminalState callback; observeWrapperTerminalForIdleBatch guarded against replay replacing first gate result
• services/cloud-agent-next/src/session/message-settlement-outbox.test.ts
• services/cloud-agent-next/src/persistence/CloudAgentSession.ts — ctx.waitUntil used correctly for fire-and-forget reporting; observeCorrelatedAgentActivity wired to ingest and wrapper-supervisor
• services/cloud-agent-next/src/websocket/ingest.ts — observeCorrelatedAgentActivity called on every assistant message.updated (not just terminal), enabling activity observation
• services/cloud-agent-next/src/websocket/ingest.test.ts
• services/cloud-agent-next/src/router/auth.ts — timingSafeEqual for internal API key comparison
• services/cloud-agent-next/src/router/handlers/session-management.ts — deleteSessionResources extracted and shared between deleteSession and new cleanupSession
• services/cloud-agent-next/src/router.test.ts
• services/cloud-agent-next/src/execution/types.ts — failureBoundary discriminator on AdmissionFailure
• services/cloud-agent-next/src/session/legacy-prepared-admission.ts
• services/cloud-agent-next/src/types.ts — CLOUD_AGENT_REPORT_QUEUE binding
• services/cloud-agent-next/wrangler.jsonc — queue bindings, cron trigger, DLQ config
• services/cloud-agent-next/wrangler.test.jsonc
• services/cloud-agent-next/worker-configuration.d.ts
• services/cloud-agent-next/src/server.ts
• services/cloud-agent-next/test/integration/session/message-terminalization.test.ts
• services/cloud-agent-next/test/integration/session/idle-reconciliation.test.ts
• services/cloud-agent-next/test/test-worker.ts
• apps/web/src/routers/admin-cloud-agent-next-router.ts — emptyHealthSeries floors to UTC bucket boundaries; EXISTS/NOT EXISTS for platform filtering
• apps/web/src/routers/admin-cloud-agent-next-router.test.ts
• apps/web/src/routers/admin-router.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/CloudAgentNextOutcomesPage.tsx
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-interval.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-interval.test.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-period-preference.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-period-preference.test.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-summary.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-summary.test.ts
• apps/web/src/app/admin/api/cloud-agent-next/hooks.ts
• apps/web/src/app/admin/cloud-agent-next/page.tsx
• apps/web/src/app/admin/components/AppSidebar.tsx
• apps/web/src/components/admin/CopyButton.tsx
• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts
• apps/web/src/lib/security-agent/services/analysis-service.ts
• apps/web/src/lib/security-agent/services/analysis-service.test.ts
• apps/web/src/lib/user/index.test.ts

---

_{Reviewed by claude-sonnet-4.6 · 1,826,173 tokens}

_{Review guidance: REVIEW.md from base branch main}