feat(auth): remaining token families (3/3)

[pandemicsyn]

Change

Add the remaining token families: native/mobile, Chat, explicit delegation, benchmark, Gastown/Wasteland, and automation Workers. Update rollout documentation for the stack.

Stack: foundation #5974 → Cloud Agent #5975 → remaining families #5976.

Defaults

No additional issuance flag ships on. Cloud Agent isolation is already enabled by #5975. The shared web master may already be on; these independent family gates remain off.

Flag	Why it stays off initially
CHAT_RESOURCE_TOKENS_ENABLED	Verify Chat, Events, and Notifications together
DELEGATED_RESOURCE_TOKENS_ENABLED	Lowest-risk early candidate: explicit client opt-in; verify requested resource paths first
WORKFLOW_GATEWAY_RESOURCE_TOKENS_ENABLED	Verify a real automation job with scoped gateway credentials
BENCHMARK_RESOURCE_TOKENS_ENABLED	Verify the benchmark CLI/container and account eligibility
NATIVE_RESOURCE_TOKENS_ENABLED	Preserve legacy issuance; device validation incomplete
GASTOWN_RESOURCE_TOKENS_ENABLED	Missing Session Ingest audience and safe live credential renewal
WASTELAND_RESOURCE_TOKENS_ENABLED	Consumer-chain verification incomplete
Worker-local SHARED_RESOURCE_TOKENS_ENABLED in Security Auto Analysis and Webhook Agent Ingest	Verify each job/callback chain separately

After verification, enable one family at a time. Web families also require web SHARED_RESOURCE_TOKENS_ENABLED=true; Worker-local settings are independent. Rollback retains support for already-issued credentials.

Validation and preservation

632 focused tests, eight Gastown storage integration tests, affected typechecks, lint, and diff checks passed during extraction. This follow-up changes rollout documentation only within this PR's diff; Markdown checks pass.

The complete implementation from ad3dbc51a is retained. The stack includes the isolation configuration/generated types, rollout documentation, and reviewed Cloud Agent registration/recovery fixes. Physical-device, real-provider, and complete Cloud Agent smoke coverage remain incomplete.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• apps/mobile/src/lib/auth/native-auth-contract.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/runtime-authorization.ts
• services/gastown/src/dos/town/runtime-authorization.test.ts
• services/gastown/src/dos/town/unattended-token-renewal.ts
• services/gastown/src/dos/town/unattended-token-renewal.test.ts
• services/gastown/src/middleware/town-auth.middleware.ts
• services/gastown/src/middleware/town-auth.middleware.test.ts
• services/gastown/test/integration/town-private-identity.test.ts
• services/security-auto-analysis/src/token.ts

Previous Review Summary (commit 287ed27)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 287ed27)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/gastown/src/middleware/town-auth.middleware.ts	45	Admin bypass skipped for unmigrated towns
services/gastown/src/dos/town/runtime-authorization.ts	157	Split DO writes can brick a town as invalid
services/gastown/src/dos/town/runtime-authorization.ts	155	Org reauthorize requires original creator, not current owner

Files Reviewed (109 files)

• services/gastown/src/middleware/town-auth.middleware.ts - 1 issue
• services/gastown/src/dos/town/runtime-authorization.ts - 2 issues
• apps/mobile/src/lib/auth/* and related mobile auth call sites
• apps/web/src/app/api/auth/native/*, device-auth, resource-token, gastown/token, wasteland/token, kilo-chat/token, organizations/*/user-tokens, benchmark token routes
• packages/app-shared/src/native-auth.ts
• services/gastown remaining handlers, middleware, tRPC, renewal, and tests
• services/security-auto-analysis token minting and wrangler defaults
• services/webhook-agent-ingest token minting, callbacks, wrangler defaults
• docs/token-issuance-policy.md
• Generated worker-configuration.d.ts and pnpm-lock.yaml skipped for findings

Fix these issues in Kilo Cloud

---

_{Reviewed by grok-4.6 · Input: 95.8K · Output: 20.6K · Cached: 831.6K}

_{Review guidance: REVIEW.md from base branch split/token-cloud-agent}