fix(attribution): harden sessionless cleanup baseline

[LichKing-2234]

Summary

• harden the sessionless attribution baseline and fail-open behavior
• tighten checkpoint/tool-usage ownership checks and cleanup stale bindings
• align baseline docs with the post-merge sessionless cleanup state

Test Plan

• cd ae-cli && go test ./internal/attributionlocal ./internal/client ./internal/hooks ./cmd -count=1
• cd backend && AE_TEST_POSTGRES_DSN='postgres://postgres:postgres@127.0.0.1:15432/postgres?sslmode=disable' go test ./internal/toolusage ./internal/checkpoint ./internal/handler -count=1

[Copilot]

Pull request overview

This PR hardens the sessionless attribution path while clarifying that the repository still operates in a dual-track runtime model with the legacy ae-cli start flow as the primary workflow.

Changes:

• Adds authenticated-owner checks for tool-usage ingestion and session-bound checkpoint/rewrite writes.
• Removes the unused manual tool-usage bind API/client path and relies on checkpoint-time binding.
• Updates scanner behavior, sync fail-open handling, tests, and docs to reflect the current post-merge sessionless attribution state.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Clarifies legacy CLI workflow vs partial sessionless attribution rollout.
docs/architecture.md	Updates runtime status and attribution path wording.
docs/ae-cli/session-pr-attribution.md	Marks the runbook as legacy session/local-proxy focused.
docs/superpowers/specs/2026-05-13-sessionless-local-tool-attribution-design.md	Updates spec status and implementation notes.
docs/superpowers/plans/2026-05-13-sessionless-local-tool-attribution.md	Marks the first implementation slice as completed.
docs/superpowers/plans/2026-05-14-sessionless-attribution-post-merge-cleanup.md	Adds the completed cleanup plan and verification notes.
backend/internal/toolusage/service.go	Requires authenticated user ownership when creating tool-usage events.
backend/internal/toolusage/service_test.go	Adds cross-user tool-usage rejection coverage.
backend/internal/handler/tool_usage.go	Uses authenticated context for tool-usage creation and removes bind handler.
backend/internal/handler/tool_usage_test.go	Updates create/bind route tests for ownership checks and removed bind route.
backend/internal/handler/session.go	Uses authenticated user context when creating legacy sessions.
backend/internal/handler/router.go	Removes the manual tool-usage bind route.
backend/internal/handler/handler_test.go	Verifies legacy session creation persists the authenticated owner.
backend/internal/handler/handler_coverage_test.go	Wires checkpoint handler into full test router setup.
backend/internal/handler/checkpoint.go	Passes authenticated user context into checkpoint/rewrite service calls.
backend/internal/handler/checkpoint_test.go	Adds authenticated checkpoint handler tests and cross-user rejection coverage.
backend/internal/checkpoint/service.go	Adds user-aware checkpoint/rewrite methods and session owner validation.
ae-cli/internal/client/client.go	Removes the dead bind request type and client method.
ae-cli/internal/client/client_test.go	Removes bind client test coverage.
ae-cli/internal/attributionlocal/test_helpers_test.go	Adjusts fixtures for JSONL-focused scanner tests.
ae-cli/internal/attributionlocal/sync.go	Adds nil-client fail-open behavior and spooling on upload failure.
ae-cli/internal/attributionlocal/sync_test.go	Covers fail-open spooling behavior.
ae-cli/internal/attributionlocal/scanner.go	Removes global Codex SQLite scanning from workspace attribution.
ae-cli/internal/attributionlocal/scanner_test.go	Updates scanner tests for JSONL-only Codex behavior.

Comments suppressed due to low confidence (1)

ae-cli/internal/attributionlocal/scanner.go:37

• Removing the SQLite source leaves Codex events coming only from ParseCodexJSONLFallback, which currently does not populate ObservedStartAt or ObservedEndAt. The backend checkpoint binding window filters on tool_usage_events.observed_end_at, so these uploaded events are stored with the zero time and will not bind to any checkpoint. Please populate observed timestamps from the JSONL data (or another reliable source) before relying on JSONL as the only Codex sessionless input.

	for _, path := range findCodexJSONLFiles(workspaceRoot, homeDir) {
		items, err := ParseCodexJSONLFallback(path, workspaceRoot)
		if err != nil {
			continue
		}
		for _, item := range items {
			item.WorkspaceID = workspaceID
			out = append(out, item)
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.