Durably accept a session and its first input

Creates a session for a catalog profile and repository and queues message as turn 1. Whether repository_id is sent follows the profile's repository_mode (GET /v1/profiles): where the catalog judges the pair, none refuses it, optional takes either, and required needs it. A session on the agent's own GitHub settings (the agent has a settings row) or on a workspace-scoped profile is judged by the workspace ceiling and the agent's list instead, and may start without one whatever the mode. A repository named here is checked against the agent's GitHub settings list where those apply and against the workspace ceiling where the profile uses it, else 403 GITHUB_REFUSED. A session created without one starts in an empty workspace, has no default push target (POST /v1/sessions/{id}/push-requests must name an attached repository, else it answers 409 PUSH_SOURCE_MISSING) and its detail's repository_id is null. The 201 means the input is stored, not that it ran: follow the turn with GET /v1/sessions/{id}/turns/{turn_id} or the event stream. model picks one of the models the profile offers (its model or models in the catalog); omitted, the model of the release's card runs when agent_release_id is sent, else the profile's default. The session's detail reports it as model. The model stays until the session's profile is changed (POST /v1/sessions/{id}/profile), which runs the new profile's default. A session waits in queued while no execution slot is free; it is never refused for that. agent_release_id pins the session to that release of an agent, so a key bound to the agent may create it (it reads the agent's active_release_id from GET /v1/agents);profile_id may then be omitted for the release's runtime profile, and sent it must be that profile (409 RELEASE_PROFILE_MISMATCH). Omitted, an agent with GitHub settings starts without a repository and attaches what it needs, and an agent with none uses the release's repository_id. A release whose profile is no longer in the catalog, or changed since, answers 409 PROFILE_DIGEST_MISMATCH. A profile the operator blocked, or a workspace profile over a blocked one, answers 409 PROFILE_BLOCKED, with a release or without. A private agent (GET /v1/agents/{id}/usage) is used only by the members of its teams, the workspace's owners and admins, its admins and the members of its managing team; for anyone else its release answers 404, the very answer of a release that does not exist, before the integrity, profile and state refusals below and whatever else the caller lacks (a key without the scope, or bound to another agent, or a Slack channel past its ceiling, included). An agent that is paused or archived answers 409 AGENT_NOT_RUNNABLE with details.reason_code agent_inactive, and a release no activation ever approved answers it with release_unapproved; an older release that was approved still starts while the agent is active, and a retry of a session made earlier gets its first answer. Every credential the release names must still be bound to its agent; otherwise 409 CREDENTIAL_UNBOUND, whose details carry the guidance to show the requester and the agent's admins to ask (SessionCredentialUnboundDetails), never the missing names. The caller limits of the agent (GET /v1/agents/{id}/caller-limits) that reach the caller are merged (the workspace's, those of the teams the caller is in, and the Slack channel's) and fixed on the session as caller_limit; the first turn runs under the creator's limit, so a start is checked on all four dimensions the way an input is: a repository outside the merged repositories, a credential the merged credentials_deny names, an MCP server outside mcp_servers, or a tool the release loads that tools_deny names answers 403 FORBIDDEN with details {reason_code: caller_limited, dimension: repository | credential | mcp_server | tool} and no session. The write merges the limits again under lock, and its result wins over a rule changed since. The receipt settles with turn 1: succeeded when it completes, failed when it fails or is interrupted or cancelled, unknown when its outcome is unknown.

Scope: sessions:write (API key or cookie session). Idempotency-Key: required.