feat(server): add HTTP POST /v1/sessions/{id}/steer (mirroring approve/cancel) #873

Parent

Sub-issue of #821 (Prototype @stacklok/mecatl TypeScript SDK).

Problem

Mid-run steer is gRPC-only today. ADR 0232 states this explicitly and names the deferral on purpose:

gRPC-only v1. The steer rides a new steer/steer_cancel oneof arm on the existing bidi Converse stream... HTTP/SSE and ACP steer are deferred — the HTTP run path (POST /v1/sessions/{id}/prompt) ... [has] no client→server mid-run channel; a unary POST .../steer (mirroring approve/cancel) is the cheap follow-up shape.

Approve and cancel already have unary HTTP endpoints. Steer does not. This means any browser-only consumer of @stacklok/mecatl (Studio, or any app that never runs a Node/Bun backend holding a real gRPC connection) can never steer a running agent — not because of a hard architectural limit, but because the "cheap follow-up" named in the ADR was never filed as tracked work.

Note: PR #828 already hardened expected_run_id/strict-steer semantics on the existing gRPC path — this issue is specifically about adding the missing HTTP transport for the same capability, not revisiting that design.

Proposal

Add POST /v1/sessions/{id}/steer (and a steer_cancel equivalent), mirroring the existing approve/cancel HTTP endpoints:

• Same request/response shape discipline as approve/cancel (optional expected_run_id, RFC 9457 application/problem+json on the stale_run_control rejection — reusing the registry from ADR 0248, not a bespoke error path).
• Same SteerOutcome enum (accepted/appended/retracted/none_pending/too_late) surfaced over HTTP as it already is over the gRPC ack.
• No change to the engine-side steer inbox/mutex/watermark mechanics in ADR 0232 — this is purely a new transport-layer entry point into the existing Service.Steer/Service.CancelSteer calls.

References

• ADR 0232 (steer-while-running) — names this exact follow-up
• PR feat(server): expected_run_id on controls, and strict steer #828 (expected_run_id + strict steer, gRPC-only)
• ADR 0248 (RFC 9457 problem-details registry, to reuse for the HTTP error path)

Fully or partially written by an AI agent.