Fix scoped session agent resolution

[dubh3124]

Summary

• Fixes scoped API-created agents being visible through GET /agents/{name} but rejected by POST /sessions with Invalid or unknown agent.
• Passes the request effective_scope into session agent_name validation for both session creation and session update.
• Adds a Kennel-shaped regression covering scoped agent creation, same-scope readback, wrong-scope isolation, POST /sessions, and PATCH /sessions/{id}.
• Adds roadmap and unreleased changelog entries.

Root Cause

GET /agents/{name} resolved agents with request scope, but POST /sessions and PATCH /sessions/{id} called config_store.is_valid_primary(agent_name) without scope. Scoped API-created agents therefore looked absent to session validation even though the agent API could read them.

Validation

• UV_CACHE_DIR=/tmp/uv-cache uv sync --all-extras --dev — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run pytest tests/unit/test_rest_api.py::TestScopedSessionAgentName -q — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run pytest tests/unit -q — 785 passed, 4 skipped
• UV_CACHE_DIR=/tmp/uv-cache uv run ruff check . — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run mypy . — passed
• UV_CACHE_DIR=/tmp/uv-cache uv run mkdocs build --strict — passed
• git diff --check — passed

Release Note

This is not included in the existing v0.11.0-rc.2 tag. It is marked as Unreleased until the next RC/final release tag is cut.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cognition	Ready	Preview, Comment	Jun 27, 2026 5:16pm