Run an ingest

Pulls documents in scope and writes them into the connection's target namespace. SYNCHRONOUS and BOUNDED: one call ingests at most 20 documents. When the scope holds more, the response carries next_cursor and done: false — call again with ?cursor=<next_cursor> until done is true.

Per-document failures (a PDF, an oversized file, a permission error) are reported in documents_skipped and do NOT fail the run. A failed WRITE does: status becomes error and error is set.

Requires BOTH connectors:write and ingest:write — it uses a stored third-party credential AND writes memories. Chunks are written through the same /v1/execute batching path as file ingest, so they are metered identically.

Requires the connectors:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying connectors:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include connectors:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).