Agy dispatch blocked by provider state-link verification before execution

[James3014]

Problem

Agy subagent dispatch is currently blocked before provider execution by DevSpace provider state-link verification.

Observed twice on 2026-09-15 while dispatching a bounded RepoLearn REP2/G1 task:

1. advertised profile agy-medium-implement (agy 1.2.3, gemini-3.8-flash-medium)
2. direct provider/model dispatch (provider=agy, model=gemini-3.8-flash-medium, effort=medium)

Both terminated with the same sanitized error:

Agy provider state link verification failed for antigravity-oauth-token=[REDACTED]

Physical reconciliation

Profile attempt:

agentId: agt_9059624d
terminalReason: provider_error
changedPaths: []
workspace dirty: false
candidate present: false

Direct attempt:

agentId: agt_1647f963
terminalReason: provider_error
changedPaths: []
workspace dirty: false
candidate present: false

No mutation/retry ambiguity remains for these two attempts.

Control-plane evidence

capability_convergence_status reported the authoritative primary role converged at the runtime/build layer while session convergence separately required reconnect. This issue should keep those dimensions separate: provider auth/state-link failure is not model capability evidence and should not be normalized into a source/code failure.

Expected behavior

A configured Agy identity should either:

• pass state-link verification and enter provider execution; or
• return a typed actionable auth/reconnect blocker that distinguishes stale/missing state-link from invalid provider credentials.

Scope

Repair/diagnose the Agy state-link/auth seam only. Do not weaken provider identity verification, bypass OAuth checks, or treat a failed state link as authorization to invoke the provider anyway.

Acceptance

• reproduce with an Agy preflight/dispatch fixture or safe bounded live probe;
• classify root cause (session reconnect vs state-link persistence vs provider auth identity mismatch);
• preserve fail-closed behavior;
• add regression coverage;
• prove successful bounded Agy dispatch after repair or return a precise external-account blocker;
• no unrelated provider or worker authority changes.