List interactive sessions visible to the caller.

Authentication accepts a browser session or a WorkOS user token; an rsk API key or a BYOA OAuth-agent token authenticates successfully but is rejected 403 because interactive sessions require a human user identity for driver/viewer grant derivation. Typed clients submit revision-pinned executionSelection refs from the project launch-options endpoint; stale, unavailable, unauthorized, or incompatible refs fail closed with 409. The repository, capacity pool, model profile, and harness axes are optional per axis: an axis the project has not configured is materialized at dispatch or omitted (the matching interactive_session_meta columns are nullable). Credential sets are resolved from project configuration, not a request axis: the canonical launch needs a resolvable default credential set, so a project with no visible credential set, several visible sets with no pinned default, or a stale pinned default that is no longer visible to the project refuses 409 (code=interactive_launch_credential_unavailable) before any workflow instance is created. Callers may omit executionSelection entirely and use the project/org default cascade; raw axis pins are rejected. When initialPrompt is supplied, the handler trims it and enforces an exact 1,023 UTF-8-byte limit without truncation. An optional workspace block (branchName/worktreeName/setupCommand) layers a bootstrap on top of the resolved repository axis; a non-empty bootstrap on a session with no resolved repository refuses 409 (code=INTERACTIVE_LAUNCH_NOT_CONFIGURED, reasonCode=WORKSPACE_BOOTSTRAP_NO_REPOSITORY) rather than being silently dropped. Entitlement-gated and quota-gated; never routes through MAB. An optional capabilities map lets the caller selectively disable a Composer-resolved capability/provider (memory, a2a, codeIntel, architecture, credential, issueTracker, kit, model); absent ⇒ everything the Composer resolved stays active. A machine principal (rsk key / OAuth agent) presenting a x-interactive-spawn-credential header carrying a valid spawn credential is routed to a separate machine-principal delegation path instead of the 403 above: gated behind the org's interactive_agent_spawn flag, a Cedar delegate_task permit, and a non-empty delegation policy on the credentialed parent session. The body is the smaller delegation shape (projectId, optional requestedCeiling/timeouts/initialPrompt/agentHandle/executionSelection/capabilities/workspace). A refusal returns the typed delegation envelope { code, class, message, axis?, limit?, current?, bindingLevel, bindingScopeId, retryAt?, remedy } - terminal/terminal_for_subtree classes as 403, retryable_when_child_exits/retryable_at as 429. A spawn body MAY additionally carry executionSelection (launch-axis intent refs: pool/harness/modelProfile/repository/agentCard StableExecutionRefs) and capabilities (memory scope / a2a handle). These are INTENT REFS ONLY, resolved through the exact same dispatchInteractiveSession cascade + admission gate the human launch path above uses - no new placement/selection authority. A viable ref outside the child's derived delegation ceiling still refuses (delegation_ceiling_violation) exactly as an omitted axis that resolved outside it always has.