feat(cloud-agent): pin GitHub installation identity

[RSO]

Summary

• add expectedIntegrationId as an authorization fence in the Git token service
• include installation identity in capabilities without breaking existing claims
• persist and validate githubIntegrationId through Cloud Agent session preparation, registration, resume, and credential refresh
• keep the new contract optional so this can deploy before clients expose secondary repositories

Stack

• Previous: feat(github): pilot multiple reviewer installations #5486
• This PR: 4 of 7
• Next: feat(cloud-agent): select GitHub installations on web #5488

Validation

• Git token service: 531 tests passed, typecheck and lint passed
• Cloud Agent Next: 2,723 tests passed with 3 skipped, typecheck and lint passed

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (27 files)

• services/cloud-agent-next/src/persistence/CloudAgentSession.ts
• services/cloud-agent-next/src/persistence/session-metadata.test.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.test.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.ts
• services/cloud-agent-next/src/router/handlers/session-start.ts
• services/cloud-agent-next/src/router/schemas.test.ts
• services/cloud-agent-next/src/router/schemas.ts
• services/cloud-agent-next/src/services/git-token-service-client.test.ts
• services/cloud-agent-next/src/services/git-token-service-client.ts
• services/cloud-agent-next/src/session-prepare.test.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/session/session-requests.ts
• services/cloud-agent-next/src/session/validate-repository-access.test.ts
• services/cloud-agent-next/src/session/validate-repository-access.ts
• services/cloud-agent-next/src/types.ts
• services/git-token-service/src/github-session-capability.test.ts
• services/git-token-service/src/github-session-capability.ts
• services/git-token-service/src/github-user-authorization-entrypoint.test.ts
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/installation-lookup-service.behavior.test.ts
• services/git-token-service/src/installation-lookup-service.test.ts
• services/git-token-service/src/installation-lookup-service.ts

Previous Review Summaries (2 snapshots, latest commit 6c43516)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 6c43516)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (27 files)

• services/cloud-agent-next/src/persistence/CloudAgentSession.ts
• services/cloud-agent-next/src/persistence/session-metadata.test.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.test.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.ts
• services/cloud-agent-next/src/router/handlers/session-start.ts
• services/cloud-agent-next/src/router/schemas.test.ts
• services/cloud-agent-next/src/router/schemas.ts
• services/cloud-agent-next/src/services/git-token-service-client.test.ts
• services/cloud-agent-next/src/services/git-token-service-client.ts
• services/cloud-agent-next/src/session-prepare.test.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/session/session-requests.ts
• services/cloud-agent-next/src/session/validate-repository-access.test.ts
• services/cloud-agent-next/src/session/validate-repository-access.ts
• services/cloud-agent-next/src/types.ts
• services/git-token-service/src/github-session-capability.test.ts
• services/git-token-service/src/github-session-capability.ts
• services/git-token-service/src/github-user-authorization-entrypoint.test.ts
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/installation-lookup-service.behavior.test.ts
• services/git-token-service/src/installation-lookup-service.test.ts
• services/git-token-service/src/installation-lookup-service.ts

Previous review (commit a1a5ebe)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/git-token-service/src/installation-lookup-service.ts	256	Fenced lookups classify a stale GitHub account login as integration_mismatch, so org-rename repair never runs

Files Reviewed (26 files)

• services/cloud-agent-next/src/persistence/CloudAgentSession.ts - 0 issues
• services/cloud-agent-next/src/persistence/session-metadata.test.ts - 0 issues
• services/cloud-agent-next/src/persistence/session-metadata.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-prepare.test.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-prepare.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-start.ts - 0 issues
• services/cloud-agent-next/src/router/schemas.test.ts - 0 issues
• services/cloud-agent-next/src/router/schemas.ts - 0 issues
• services/cloud-agent-next/src/services/git-token-service-client.test.ts - 0 issues
• services/cloud-agent-next/src/services/git-token-service-client.ts - 0 issues
• services/cloud-agent-next/src/session-prepare.test.ts - 0 issues
• services/cloud-agent-next/src/session-service.test.ts - 0 issues
• services/cloud-agent-next/src/session-service.ts - 0 issues
• services/cloud-agent-next/src/session/session-prepare.test.ts - 0 issues
• services/cloud-agent-next/src/session/session-registration.ts - 0 issues
• services/cloud-agent-next/src/session/session-requests.ts - 0 issues
• services/cloud-agent-next/src/session/validate-repository-access.test.ts - 0 issues
• services/cloud-agent-next/src/session/validate-repository-access.ts - 0 issues
• services/cloud-agent-next/src/types.ts - 0 issues
• services/git-token-service/src/github-session-capability.test.ts - 0 issues
• services/git-token-service/src/github-session-capability.ts - 0 issues
• services/git-token-service/src/index.test.ts - 0 issues
• services/git-token-service/src/index.ts - 0 issues
• services/git-token-service/src/installation-lookup-service.behavior.test.ts - 0 issues
• services/git-token-service/src/installation-lookup-service.test.ts - 0 issues
• services/git-token-service/src/installation-lookup-service.ts - 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by grok-4.6 · Input: 242.6K · Output: 14.6K · Cached: 514.4K}

_{Review guidance: REVIEW.md from base branch main}