fix(gastown): Mayor loses org billing context after model change — bills to personal account

[jrf0110]

Bug

On org-owned towns, after refreshing the container token and changing the mayor's model in settings, the mayor's LLM calls start billing to the user's personal account instead of the organization. The refinery (which was not restarted) continues billing correctly through the org. The mayor reports "this is a paid model and you don't have the balance" even though the org has credits.

Root Cause

The organizationId for billing is passed to the container only once — in the initial POST /agents/start request body (container-dispatch.ts:441):

organizationId: params.townConfig.organization_id,

This gets embedded into KILO_CONFIG_CONTENT via buildKiloConfigContent (agent-runner.ts:51-53):

if (organizationId) {
  providerOptions.kilocodeOrganizationId = organizationId;
}

When updateMayorModel triggers a model change, the PATCH /agents/:agentId/model request does NOT include organizationId (container-dispatch.ts:687-694):

body: JSON.stringify({
  model,
  ...(smallModel ? { smallModel } : {}),
  ...(conversationHistory ? { conversationHistory } : {}),
  // ❌ organizationId is MISSING
}),

The container-side updateAgentModel (process-manager.ts:807-808) tries to preserve the org by extracting it from process.env.KILO_CONFIG_CONTENT:

const organizationId = extractOrganizationId();

This extraction is fragile. It fails when:

1. process.env.KILO_CONFIG_CONTENT was cleared or corrupted by a prior failed model update
2. The token refresh caused KILOCODE_TOKEN to be momentarily undefined, causing buildKiloConfigContent to skip the rebuild (guarded by if (kilocodeToken) at line 813)
3. The PATCH handler's X-Town-Config header sync overwrote env vars without preserving the config content
4. A container restart between the token refresh and model change cleared process.env entirely

Once extractOrganizationId() returns undefined, the rebuilt KILO_CONFIG_CONTENT omits kilocodeOrganizationId. All subsequent LLM calls go through the user's personal account.

Why the Refinery Is Unaffected

The refinery was started before the token refresh and model change. Its KILO_CONFIG_CONTENT still contains the original kilocodeOrganizationId from its initial dispatch. Since it was not restarted, its env was never overwritten.

Fix

Fix 1 (Recommended): Store organizationId as a standalone env var

At container startup (control-server.ts, start handler), set:

process.env.GASTOWN_ORGANIZATION_ID = request.organizationId ?? "";

In extractOrganizationId() (process-manager.ts:752-765), read from the standalone var first:

function extractOrganizationId(): string | undefined {
  // Authoritative source — set once at container startup, never overwritten
  if (process.env.GASTOWN_ORGANIZATION_ID) {
    return process.env.GASTOWN_ORGANIZATION_ID;
  }
  // Fallback — extract from KILO_CONFIG_CONTENT
  // ... existing extraction logic
}

This is resilient to config rebuilds, token refreshes, and model changes.

Fix 2 (Belt-and-suspenders): Pass organizationId in the model update request

Add organizationId to updateAgentModelInContainer (container-dispatch.ts:672-700):

body: JSON.stringify({
  model,
  ...(smallModel ? { smallModel } : {}),
  ...(conversationHistory ? { conversationHistory } : {}),
  organizationId: townConfig.organization_id,  // ← ADD THIS
}),

And resolve townConfig in updateMayorModel to pass it through.

Fix 3 (Defense-in-depth): Include organization_id in buildContainerConfig

config.ts:136-154 builds the X-Town-Config payload but omits organization_id. Add it:

return {
  ...existing fields,
  organization_id: townConfig.organization_id,
};

The PATCH handler in control-server.ts can then extract it and ensure GASTOWN_ORGANIZATION_ID stays current.

Files

File	Line	Issue
container-dispatch.ts	687-694	updateAgentModelInContainer body missing organizationId
container-dispatch.ts	441	Only place organizationId is passed (initial start)
src/dos/town/config.ts	136-154	buildContainerConfig missing organization_id
container/src/process-manager.ts	752-765	extractOrganizationId — fragile, reads from KILO_CONFIG_CONTENT JSON
container/src/process-manager.ts	807-818	Model update relies on fragile extraction
container/src/control-server.ts	214-255	PATCH handler syncs config but not org ID
src/dos/Town.do.ts	2053-2089	updateMayorModel does not pass org context

Impact

High — org customers get billed to their personal account after any model change or mayor restart. This causes confusing "insufficient balance" errors when the org has ample credits.

[jrf0110]

Mayor debug sweep diagnostic note (2026-04-03 UTC)

Per-issue checklist

• Symptom: org-owned town loses org billing context after model change, billing routed to personal account
• Subsystem: organization context propagation during model updates (gt:core + gt:container + gt:mayor)
• Expected evidence: town/agent runtime shows missing org context after model mutation/restart boundary

Endpoint doc/source used

• cloudflare-gastown/docs/post-deploy-monitoring.md on branch gastown-staging

Reproducible diagnostic calls used

• curl -s -H "CF-Access-Client-Id: $GASTOWN_SERVICE_CF_ACCESS_CLIENT_ID" -H "CF-Access-Client-Secret: $GASTOWN_SERVICE_CF_ACCESS_CLIENT_SECRET" "https://gastown.kiloapps.io/debug/towns/8a6f9375-b806-4ee0-ad6e-1697ea2dbfff/status"
  • Timestamp: 2026-04-03T10:34:13Z
  • Status: HTTP/2 200
  • CF-Ray: 9e676b684bd355c1-DFW
  • Relevant fields: active agents and normal reconciler counters, but no exposed org-billing context fields
• Access control validation:
  • Same endpoint without Access headers returns HTTP/2 302 (CF-Ray 9e676c008c5a55c1-DFW), confirming diagnostics require privileged service token

Observed anomalies

• No debug field currently surfaces effective billing org context for mayor sessions, preventing runtime confirmation of routing to org vs personal account.

Conclusion

• Confirmed vs unconfirmed: Unconfirmed from staging debug endpoints (insufficient billing-context observability in debug payload).
• Likely fault domain: gt:core + gt:container (context propagation), with mayor as consumer.
• Immediate next engineering action: add redacted runtime fields to debug status for effective organizationId and billing routing target per agent session, then run model-change probe on an org-owned town.