feat: extend MCP sessions for agent subjects

[danielkov]

Summary

Extends existing MCP user-session issuance and refresh flows to support agent subjects. Agent sessions retain immutable authorizer and delegated policy provenance while every access and refresh admission resolves the live parent and applies the credential admission boundary.

Motivation

Agent principals need delegated MCP sessions without introducing a parallel OAuth transport or dedicated token persistence model.

Technical details

Credential profile and admission

Agent subjects use the existing session, challenge, token, refresh, and revocation machinery. The stored profile carries the immutable authorizer plus delegated restriction, while admission enforces the effective R ∩ A ∩ O policy against current lifecycle and ownership state.

Refresh and revocation

Refresh rotation preserves the credential profile and re-admits the parent. Replay responses are denied when the authoritative successor session has been directly revoked.

Dependency and retargeting

This PR depends on #6068 (AIM-193 credential admission) and #6066 (AIM-196 prerequisite model work). It temporarily targets integration/aim-197-prerequisites, built from the recorded prerequisite heads. After both dependencies land on main, this branch should be rebased or otherwise reconciled and the PR retargeted to main.

Design context: First-class agent principals and delegated credentials RFC.

---

Summary by cubic

Mints and refreshes MCP sessions for agent subjects from the authorized agent handoff instead of rejecting it, re-admitting the live parent and delegated policy on every access and refresh.

• Agent is a first-class session subject (agent:<uuid>) and identity kind; sessions persist an immutable authorizer and endpoint-scoped delegated grants on the existing user_sessions row.
• Every access and refresh re-admits the live parent; refresh shares the rotation transaction snapshot, preserves the credential profile, denies replay when the successor session was directly revoked, and releases losing claims before replay fallback.
• Credential admission fails closed when the required principal context is missing; the MCP tool-execution killswitch classifies agent provenance separately and rejects it until agent principals are supported.
• Issuance and access sit behind a rollout flag; when disabled, token, refresh, and replay return 404 and access returns 401.
• Session creation now derives organization from the owning project for legacy project-tier issuers.
• No agent-specific OAuth endpoints or token stores are introduced; existing human sessions and MCP behavior are unchanged.
• Depends on feat: enforce live agent credential admission #6068 and feat: add agent selection to MCP authorization challenge #6066; temporarily targets integration/aim-197-prerequisites and should be retargeted to main after they land.

^{Written for commit e944ceb. Summary will update on new commits.}

[linear-code]

AIM-197

[changeset-bot]

🦋 Changeset detected

Latest commit: e944ceb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This change introduces a new agent session type with a delegated credential profile, touching session issuance, refresh, validation, and DB schema—core auth paths where a subtle bug could cause unauthorized access or break existing sessions.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 10m 31s

Review completed against the latest diff

Linked issue analysis

Linked issue: AIM-197: feat: extend existing MCP sessions for agent subjects

Status	Acceptance criteria	Notes
✅	Create an existing user session for the agent subject with immutable authorizer, endpoint-scoped delegated policy, and supported policy version	The token flow mints an agent: subject, stores the authorizer and delegated grants on user_sessions, and tests verify the persisted profile and policy binding.
✅	Preserve the agent subject, authorizer, delegated policy, and policy version across refresh	Refresh passes the existing credential fields into mintSession, and tests compare the old and rotated session profiles.
⚠️	Re-admit the live parent agent on access and refresh, denying suspended or otherwise invalid credentials	Access and refresh call admitAgentSession, and suspension denial is tested. The diff does not directly demonstrate every required lifecycle case such as deletion, owner loss, cross-tenant mismatch, or live-policy denial.
✅	Honor direct session revocation and deny refresh replay when the successor session is revoked	Agent access uses an authoritative non-deleted session lookup, while replay reloads and validates the successor session; a directly revoked successor is covered by a test.
⚠️	Continue using the existing MCP OAuth issuer, client, redirect, PKCE, resource, endpoint, and session contracts without agent-specific OAuth or token persistence surfaces	The implementation extends the existing token and session paths and validates endpoint binding, with no dedicated agent endpoint or token store added. The diff does not independently test every exact issuer, redirect, PKCE, and resource contract listed in the issue.
⚠️	Leave existing human sessions and MCP behavior unchanged when agent delegation fields are absent	Non-agent minting rejects unexpected delegation fields and the existing session path remains in use, but no focused regression test for unchanged human behavior is included in this diff.

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 11 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 13 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>