[pandemicsyn]

Summary

Add gated service-specific credentials for Auto-routing Benchmark. The token lifetime remains six hours, exactly as in the existing legacy flow. When the family flag is enabled, the internal token endpoint instead issues a token restricted to two audiences: the main backend API (kilo-api) and AI Gateway (kilo-gateway), retaining the configured user and optional organization. It cannot be exchanged for broader credentials. This changes the token’s scope, not its lifetime. The benchmark Worker already calls this endpoint; this changes its token format when the family flag is enabled.

Benchmark CLI processes disable automatic Session Ingest on both warmup and run paths. Results still come from CLI output. This container setting applies on deployment, including legacy-token runs.

Extracted from #5976, originating in #5857. This PR targets main independently of mobile and Gastown/Wasteland.

Verification

No manual deployed benchmark/container smoke test was run. Verification used automated tests and source comparison; the built CLI version and its handling of the Session Ingest setting still need a live check before activation.

Visual Changes

N/A

Reviewer Notes

Feature toggle	Default / current state	Where to configure
BENCHMARK_RESOURCE_TOKENS_ENABLED	Off: unset or false	Vercel — Web environment variables; redeploy Web after changes
SHARED_RESOURCE_TOKENS_ENABLED	Already enabled in Vercel; code default is off	Vercel — Web environment variables; preserve the existing setting

Both Web settings must be exactly true for modern benchmark issuance. No Cloudflare feature toggle is added. Leave the benchmark family off until the actual built CLI/container is verified. With it off, the endpoint retains its legacy six-hour token response; with it on, blocked users, missing peppers, and unsupported organization roles are rejected without legacy fallback. No pepper initialization or rotation is introduced.

The image installs @kilocode/cli@latest. Automated container tests check the spawned environment, not the installed CLI's behavior. The token covers API and gateway audiences; Session Ingest is intentionally disabled rather than granted an additional audience. User CLI installations and Cloud Agent Next are unchanged.

Automated validation: 290 benchmark tests and 14 Web token-route tests passed, plus benchmark/Web typechecks, scoped lint, formatting, and diff checks. The four extracted source/test files match their versions in #5976 exactly.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Reviewed the gated benchmark resource-token issuance change: the modern token built with buildModernKiloTokenPayload (audiences [kilo-api, kilo-gateway], delegated-workload, credentialExchange: false, 6h), the legacy fallback preserved when the family flag is off, the eligibility gate (non-empty pepper, not blocked), owner/member org-role restriction, and the KILO_DISABLE_SESSION_INGEST: '1' container opt-out. Verified token version (3), signing algorithm (HS256), secret source (NEXTAUTH_SECRET), audience handling in validateAuthorizationHeader, blocked_at/blocked_reason reset on unblock, and the KILO_DISABLE_SESSION_INGEST name/value precedent (KILO_DEBUG_SESSION_INGEST: '1' in cloud-agent-next). No defects found in the changed lines.

Files Reviewed (4 files)

• apps/web/src/app/api/internal/auto-routing-benchmark/token/route.ts
• apps/web/src/app/api/internal/auto-routing-benchmark/token/route.test.ts
• services/auto-routing-benchmark/container/server.mjs
• services/auto-routing-benchmark/src/container-auth.test.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 184.5K · Output: 30.3K · Cached: 1.7M}

_{Review guidance: REVIEW.md from base branch main}