feat(session-ingest): persist owned browser jobs

[iscekic]

No new behavior — This level prepares browser tasks without enabling them.

---

Summary

createBrowserJobStore provides the dormant BrowserJobStore with proof-bound ownership, deduplication, bounded queues and retention, immutable settlement, and fences that survive cleanup.
BrowserStoreSocket binds identity; BrowserStoreChange<T> returns committed BrowserStoreEffects, while BrowserJobStoreError reports safe failures and explicit retryability.
Callers must deliver effects and manage deadlines, expiration, and cleanup; dormant relay integration leaves existing callers and command records unchanged.

Files

• services/session-ingest/src/dos/browser-job-store.ts — A (added); Source; 1,120 lines added, none removed. Proof hashes and payload fingerprints bind invocations to the user, parent, provider, conversation, and goal; identical retries only rebind delivery. Owned status, cancel, and recover requests return retained jobs; a missing recovery returns null without creating work. Each conversation permits one outstanding job, and each provider dispatches in queue order with one fence. The limits are 1,000 retained jobs and 32 providers per user, plus 100 queued jobs per provider. Invocations expire seven days after their embedded timestamp; timestamps more than five minutes ahead fail validation. Invoke and recovery reject expired invocations before lookup. Queue and execution deadlines last ten minutes, approval lasts two minutes, and provider leases last 15 seconds. Job deadlines respect invocation expiry. Socket nonces survive hibernation; generations and approved-tab checks reject stale or unrelated provider updates. Provider loss, running cancellation, uncertain results, and dispatched timeouts interrupt work without replay; new registrations never adopt older queued jobs. Settlement preserves the first result and removes the goal, while fingerprints retain deduplication. Cleanup removes expired terminal records and unused indexes; unresolved fences block dispatch and retain proof bindings until matching quiescence or recovery. Cancellation records survive cleanup, and deadline queries support external scheduling. Callers must deliver expiration effects before cleanup. Byte limits cover escaped text, routing, tab details, and full results; provider listings and current-generation heartbeat snapshots support pagination.

Tests: 1 test file added — services/session-ingest/src/dos/browser-job-store.test.ts (A; Test; 1,952 lines added, none removed), covering the owned-job ledger.
Generated: 0 files changed.

---

Verification

• The handoff reports no manual verification for this level.
• The ledger is dormant and does not enable browser delegation; runtime verification waits for the stack tips.
• No end-to-end (E2E) report is attached.

Visual Changes

Visual Changes: N/A

Reviewer Notes

Human steps

• before merge: Merge each repository's levels from bottom to top after all section PRs receive human-ready.
• after merge: This level requires no new environment values, secrets, migrations, flag changes, or activation steps.

Automated evidence

• Supplied local evidence reports six scoped checks passed: Oxfmt write, Oxfmt format check, Oxlint, strict TypeScript, Vitest, and whitespace validation.
• The handoff reports 111 focused tests passed.
• These results do not establish runtime integration, continuous integration (CI), or live verification.

Repository scope

• Kilo-Org/cloud: /Users/igor/Projects/.worktrees/browser-task-0787; branch browser-task-0787-s2, base browser-task-0787. This level adds two files: 3,072 added lines, no deletions.
• Kilo-Org/kilocode: /Users/igor/Projects/.worktrees/browser-task-0787-kilocode; branch and comparison base browser-task-0787. Its matching contracts have no additional changes in this comparison.
• Base pull request (PR): Kilo-Org/cloud#5638.
• Matching command-line interface (CLI) contracts: Kilo-Org/kilocode#13535.

Notes

Runtime verification remains pending on the stack tips. This level adds a dormant job ledger and does not enable browser delegation.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. browser-task-0787 — feat(browser-task): define negotiated job contracts #5638
2. browser-task-0787-s2 — feat(session-ingest): persist owned browser jobs #5644 ← this PR
3. browser-task-0787-s3 — feat(session-ingest): route fenced browser providers #5648
4. browser-task-0787-s4 — feat(cloud-agent-sdk): support browser provider jobs #5653 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/session-ingest/src/dos/browser-job-store.ts
• services/session-ingest/src/dos/browser-job-store.test.ts

Previous Review Summary (commit f9acb72)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit f9acb72)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/session-ingest/src/dos/browser-job-store.ts
• services/session-ingest/src/dos/browser-job-store.test.ts

---

_{Reviewed by grok-4.6 · Input: 127.3K · Output: 17.6K · Cached: 428.3K}

_{Review guidance: REVIEW.md from base branch browser-task-0787}