[CRITICAL] Every agent execute/chain/mixture call with a supplied authority reference raises an unhandled TypeError

[jsogarro]

[CRITICAL] Agent execution endpoints 500 on every call that supplies the now-required authority reference

Summary
agent_api.py's authority-check helper calls _resolve_execution_authority with only one positional argument, but the callee requires a keyword-only organization_id parameter with no default. Any call that supplies an authority reference (which is otherwise mandatory — omitting it returns 422) raises a TypeError that isn't caught by the route's exception handling, producing a 500.

Evidence
src/api/routes/agent_api.py:92-95

    resolver = getattr(backend, "_resolve_execution_authority", None)
    ...
    try:
        resolver(reference)
    except ExecutionAuthorityError as exc:

src/api/services/direct_execution_service.py:1620-1625

    def _resolve_execution_authority(
        self,
        authority_reference: ExecutionAuthorityReference | None,
        *,
        organization_id: str | None,
    ) -> ExecutionAuthorityBinding:

organization_id is keyword-only with no default, so resolver(reference) raises TypeError: _resolve_execution_authority() missing 1 required keyword-only argument: 'organization_id'. The except clause only catches ExecutionAuthorityError (a ValueError subclass), so the TypeError propagates to the route's outer except Exception and returns a 500. The correct call pattern already exists elsewhere in the same file — direct_execution_service.py:1399-1401 calls self._resolve_execution_authority(authority_reference, organization_id=organization_id).

Failure scenario: POST /api/v1/agents/{agent_type}/execute (and the /chain, /mixture, and convenience-wrapper endpoints that share this helper) — omit authority_reference → 422 (by design); supply the now-required reference → guaranteed 500, every time.

Impact
The core direct-agent-execution API is non-functional for any caller that follows the documented required-field contract. No existing test exercises this path (tests either hit the 422 branch by omitting the reference, or mock the kernel such that isinstance(execution_service, ResearchKernel) is false and the buggy line is never reached).

Remediation
Pass organization_id through to the resolver call, e.g. resolver(reference, organization_id=organization_id), sourcing organization_id the same way the working call site does. Add a regression test that supplies a valid authority reference and asserts a non-500 response.

Acceptance

uv run pytest tests/test_agent_api.py -v