Record flow or agent identity of MCP-started Duo sessions

What does this MR do and why?

MCP sessions for GitLab flows, foundational agents and custom flows (by item ID) did not record which flow or agent ran. This MR adds that identity to the agent_platform_session_created event and to the duo_session_created line in mcp.log. It uses the same property names as trigger_ai_catalog_item.

References

• Work item: #630114 (closed)
• Epic: gitlab-org#23391
• Builds on: !259605 (merged)

Screenshots or screen recordings

Example mcp.log line for a developer/v1 session:

{"severity":"INFO","time":"2026-10-06T10:00:00.000Z","correlation_id":"29d8d33c-b727-4910-98c9-5b029299f323","meta.caller_id":"POST /api/:version/mcp","meta.feature_category":"mcp_server","message":"Duo session created over MCP","event_name":"duo_session_created","ai_component":"mcp_server","gl_user_id":1,"source_type":"mcp","duo_workflow_id":123,"item_type":"foundational_flow","item_version":"^3.0.0","item_schema_version":"v1","flow_name":"developer"}

How to set up and validate locally

1. You need a GDK with GitLab Duo Agent Platform and the MCP server, a project where you have at least the Developer role, and a personal access token with the mcp scope. You do not need a runner to see the log line, because the line is written when the session is created.

2. In the GDK gitlab directory, follow the log:

   tail -f log/mcp.log | grep duo_session_created

3. Start a session for a GitLab flow:

   curl --request POST "http://gdk.test:3000/api/v4/mcp" \
     --header "Authorization: Bearer <your_access_token>" \
     --header "Content-Type: application/json" \
     --header "Accept: application/json, text/event-stream" \
     --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"start_duo_session","arguments":{"project_id":"<group/project>","goal":"Add a README section","flow":"developer/v1"}}}'

   The new log line should have "item_type":"foundational_flow", "flow_name":"developer", "item_schema_version":"v1" and an item_version.

4. Run the same request with "agent":"analytics_agent/v1" instead of "flow":"developer/v1". The log line should have "item_type":"foundational_agent", "flow_name":"chat" and "component_name":"analytics_agent".

5. Optional: check the same properties in the Rails console (bin/rails console):

   workflow = Ai::DuoWorkflows::Workflow.source_mcp.last
   Ai::Catalog::Tracking::WorkflowIdentityPropertiesBuilder.new(workflow).to_h

   These are the properties sent on the agent_platform_session_created event.

6. Negative check: start a session from the GitLab UI. No new duo_session_created line is added to mcp.log.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.