@hotmeshio/long-tail 0.7.4 → 0.8.0

package/build/api/roles.d.ts

@@ -91,6 +91,10 @@ export declare function updateRole(input: {
     sla_minutes?: number | null;
     target_per_hour?: number | null;
     worker_count?: number | null;
+    /** Max age (minutes) before a pending unclaimed item counts as priority on the Pace Board. Falls back to sla_minutes. */
+    priority_threshold_minutes?: number | null;
+    /** Escalation metadata key holding the age origin (ISO 8601 UTC timestamp). Falls back to created_at. */
+    priority_facet?: string | null;
     /** Replace the upstream-input set (omitted = preserve; null or [] = clear). */
     upstream_roles?: string[] | null;
     /** Recorded on the schema snapshot when this update changes a schema field. */

package/build/api/roles.js

@@ -46,6 +46,7 @@ exports.getRoleSchema = getRoleSchema;
 exports.listRoleSchemaVersions = listRoleSchemaVersions;
 exports.deleteRole = deleteRole;
 const roleService = __importStar(require("../services/role"));
+const facet_sql_1 = require("../services/escalation/facet-sql");
 /**
  * List all distinct role names in the system.
  *
@@ -207,7 +208,7 @@ async function updateRole(input) {
         if (!input.role) {
             return { status: 400, error: 'role is required' };
         }
-        for (const field of ['sla_minutes', 'target_per_hour', 'worker_count']) {
+        for (const field of ['sla_minutes', 'target_per_hour', 'worker_count', 'priority_threshold_minutes']) {
             const value = input[field];
             if (value !== undefined && value !== null && (typeof value !== 'number' || !Number.isFinite(value) || value < 0)) {
                 return { status: 400, error: `${field} must be a non-negative number or null` };
@@ -216,6 +217,9 @@ async function updateRole(input) {
         if (input.worker_count != null && !Number.isInteger(input.worker_count)) {
             return { status: 400, error: 'worker_count must be a whole number' };
         }
+        if (input.priority_facet != null && (typeof input.priority_facet !== 'string' || !facet_sql_1.FACET_KEY.test(input.priority_facet))) {
+            return { status: 400, error: 'priority_facet must be a metadata key (letters, numbers, underscores) or null' };
+        }
         if (input.ops_visible !== undefined && typeof input.ops_visible !== 'boolean') {
             return { status: 400, error: 'ops_visible must be a boolean' };
         }
@@ -246,6 +250,8 @@ async function updateRole(input) {
             sla_minutes: input.sla_minutes,
             target_per_hour: input.target_per_hour,
             worker_count: input.worker_count,
+            priority_threshold_minutes: input.priority_threshold_minutes,
+            priority_facet: input.priority_facet,
             upstream_roles: input.upstream_roles,
             change_summary: input.change_summary,
         });

package/build/api/workflows/config.d.ts

@@ -22,11 +22,16 @@ export declare function getWorkflowConfig(input: {
  *
  * @param input.type — workflow type name
  * @param input.invocable — whether the workflow can be started via the API
+ * @param input.certified — explicit HITL certification (interceptor treatment).
+ *   Omitted → derived from roles/consumes presence, preserving the behavior of
+ *   callers that predate the explicit flag.
  * @param input.task_queue — HotMesh task queue
  * @param input.default_role — default escalation role
  * @param input.description — human-readable description
  * @param input.execute_as — service account for proxy invocation
- * @param input.roles — roles that can resolve escalations
+ * @param input.roles — interceptor default for who resolves interceptor-raised
+ *   escalations (deprecated as formalization — the escalation's role carries
+ *   the versioned schema and takes precedence)
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
@@ -38,6 +43,7 @@ export declare function getWorkflowConfig(input: {
 export declare function upsertWorkflowConfig(input: {
     type: string;
     invocable?: boolean;
+    certified?: boolean;
     task_queue?: string | null;
     default_role?: string;
     description?: string | null;

package/build/api/workflows/config.js

@@ -80,11 +80,16 @@ async function getWorkflowConfig(input) {
  *
  * @param input.type — workflow type name
  * @param input.invocable — whether the workflow can be started via the API
+ * @param input.certified — explicit HITL certification (interceptor treatment).
+ *   Omitted → derived from roles/consumes presence, preserving the behavior of
+ *   callers that predate the explicit flag.
  * @param input.task_queue — HotMesh task queue
  * @param input.default_role — default escalation role
  * @param input.description — human-readable description
  * @param input.execute_as — service account for proxy invocation
- * @param input.roles — roles that can resolve escalations
+ * @param input.roles — interceptor default for who resolves interceptor-raised
+ *   escalations (deprecated as formalization — the escalation's role carries
+ *   the versioned schema and takes precedence)
  * @param input.invocation_roles — roles that can invoke this workflow
  * @param input.consumes — workflow types whose data this workflow consumes
  * @param input.tool_tags — MCP tool tags for discovery
@@ -103,6 +108,7 @@ async function upsertWorkflowConfig(input) {
         const config = await configService.upsertWorkflowConfig({
             workflow_type: input.type,
             invocable: input.invocable ?? false,
+            certified: input.certified,
             task_queue: input.task_queue ?? null,
             default_role: input.default_role ?? 'reviewer',
             description: input.description ?? null,

package/build/api/workflows/discovery.js

@@ -105,10 +105,7 @@ async function listDiscoveredWorkflows(input) {
             .map((workflowType) => {
             const config = configMap.get(workflowType);
             const worker = activeWorkers.get(workflowType);
-            const hasCertification = !!(config &&
-                ((config.roles?.length ?? 0) > 0 ||
-                    (config.consumes?.length ?? 0) > 0));
-            const tier = !config ? 'durable' : hasCertification ? 'certified' : 'configured';
+            const tier = !config ? 'durable' : config.certified ? 'certified' : 'registered';
             return {
                 workflow_type: workflowType,
                 task_queue: config?.task_queue ?? worker?.taskQueue ?? null,

package/build/lib/db/schemas/019_role_priority.sql

@@ -0,0 +1,28 @@
+-- Migration 019: Role priority threshold
+--
+-- Per-role tuning for the Pace Board priority count: pending, unclaimed
+-- escalations whose age exceeds the threshold appear as a count the floor
+-- pulls to the front of the rack. The signal is deliberately boolean per
+-- item (past threshold or not) — a count to rebalance by, not a queue to
+-- keep re-sorting.
+--
+--   priority_threshold_minutes — max age before an item counts as priority.
+--                                Falls back to sla_minutes when NULL.
+--   priority_facet             — lt_escalations.metadata key holding the age
+--                                origin as an ISO 8601 UTC timestamp (e.g.
+--                                the order's authorized date). Falls back to
+--                                created_at when NULL. When set, items
+--                                missing the key or holding an unparseable
+--                                value are not counted.
+--
+-- With both NULL the count still works for any role with sla_minutes set
+-- (age from created_at) — one signal, no parallel SLA pattern.
+--
+-- No new lt_escalations index: the count rides the bounded pending-only scan
+-- in STATION_LIVE_COUNTS_SQL. The GIN metadata index only serves containment
+-- (@>), not age comparisons, and the pending working set is bounded by real
+-- backlog depth.
+
+ALTER TABLE lt_roles
+  ADD COLUMN IF NOT EXISTS priority_threshold_minutes NUMERIC,
+  ADD COLUMN IF NOT EXISTS priority_facet             TEXT;

package/build/lib/db/schemas/020_workflow_certified.sql

@@ -0,0 +1,34 @@
+-- Migration 020: Explicit workflow certification
+--
+-- Certification becomes a declared property of the workflow registration,
+-- stored on the row. Before this, the tier was derived: a registered workflow
+-- counted as certified whenever it had escalation roles or consumes — so
+-- demoting a certified workflow to plain registered meant deleting its
+-- escalation roles and provider references. With the explicit flag, the three
+-- tiers are direct states:
+--
+--   default    — no row in lt_config_workflows (ad-hoc durable workflow)
+--   registered — row exists, certified = false (invocation + entry schema)
+--   certified  — row exists, certified = true  (interceptor: task tracking,
+--                escalation handling, re-run detection)
+--
+-- Escalation formalization (who resolves, with what schema) belongs to the
+-- escalation and its role — roles carry the versioned escalation schema and
+-- take precedence. The workflow-level roles/resolver_schema remain as
+-- interceptor defaults only.
+--
+-- The backfill runs once (schema_migrations tracked): rows that were
+-- implicitly certified under the derived rule keep their tier.
+
+ALTER TABLE lt_config_workflows
+  ADD COLUMN IF NOT EXISTS certified BOOLEAN NOT NULL DEFAULT false;
+
+UPDATE lt_config_workflows w
+SET certified = true
+WHERE certified = false
+  AND (
+    cardinality(w.consumes) > 0
+    OR EXISTS (
+      SELECT 1 FROM lt_config_roles r WHERE r.workflow_type = w.workflow_type
+    )
+  );

package/build/modules/ltconfig.d.ts

@@ -19,8 +19,9 @@ declare class LTConfigCache {
      *
      * The interceptor uses this to decide whether to wrap the workflow
      * with task tracking, escalation handling, and re-run detection.
-     * Configured-but-not-certified workflows (no roles, no consumes)
-     * return null so the interceptor skips them.
+     * Certification is the explicit `certified` flag on the registration —
+     * registered-but-not-certified workflows return null so the interceptor
+     * skips them.
      */
     getResolvedConfig(name: string): Promise<LTResolvedConfig | null>;
     /**

package/build/modules/ltconfig.js

@@ -106,15 +106,15 @@ class LTConfigCache {
      *
      * The interceptor uses this to decide whether to wrap the workflow
      * with task tracking, escalation handling, and re-run detection.
-     * Configured-but-not-certified workflows (no roles, no consumes)
-     * return null so the interceptor skips them.
+     * Certification is the explicit `certified` flag on the registration —
+     * registered-but-not-certified workflows return null so the interceptor
+     * skips them.
      */
     async getResolvedConfig(name) {
         const config = await this.get(name);
         if (!config)
             return null;
-        const isCertified = (config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0;
-        return isCertified ? config : null;
+        return config.certified ? config : null;
     }
     /**
      * Get the config for any workflow REGISTERED in lt_config_workflows (a row

package/build/routes/roles.js

@@ -95,7 +95,7 @@ router.delete('/escalation-chains', auth_1.requireRoleManager, async (req, res)
 /**
  * PATCH /api/roles/:role
  * Update role metadata. Requires admin.
- * Body: { title?, description?, form_schema?, metadata_schema?, properties?, ops_visible?, parent_role?, sla_minutes?, target_per_hour?, worker_count? }
+ * Body: { title?, description?, form_schema?, metadata_schema?, properties?, ops_visible?, parent_role?, sla_minutes?, target_per_hour?, worker_count?, priority_threshold_minutes?, priority_facet? }
  */
 router.patch('/:role', auth_1.requireRoleManager, async (req, res) => {
     // URL is the resource identity — a `role` key in the body must not redirect

package/build/routes/workflows/config.js

@@ -63,6 +63,7 @@ router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
     const result = await api.upsertWorkflowConfig({
         type: req.params.type,
         invocable: req.body.invocable,
+        certified: req.body.certified,
         task_queue: req.body.task_queue,
         default_role: req.body.default_role,
         description: req.body.description,

package/build/scripts/ortho-populate.d.ts

@@ -39,6 +39,12 @@
  * down gradually, and resolves feed the next station a trickle instead of a
  * wave.
  *
+ * Every escalation this run creates carries `metadata.authorized_at` — an ISO
+ * 8601 UTC timestamp stamped when the order arrives, identical across all of
+ * that order's stages (main line and shoe side-quest). Point a role's
+ * `priority_facet` at `authorized_at` with a threshold (e.g. 1 minute) and the
+ * Pace Board priority count lights up as orders age through the run.
+ *
  * ── The shoe side-quest ──────────────────────────────────────────────────────
  * A shoe order exercises the cross-sequence model (ordering → inserting feeds
  * ship via upstream_roles — its own Operations sequence, not a bend in the
@@ -94,7 +100,7 @@ declare function holdFor(esc: {
 declare function api(method: string, path: string, body?: unknown): Promise<any>;
 declare function login(): Promise<void>;
 declare function ensureSideQuestRoles(): Promise<void>;
-declare function createSideEscalation(role: string, workflowId: string, orderId: string, runId: string, description: string): Promise<boolean>;
+declare function createSideEscalation(role: string, workflowId: string, orderId: string, runId: string, description: string, authorizedAt: string): Promise<boolean>;
 declare function claimBatch(batchTag: string): Promise<number>;
 declare function resolveBatch(batchTag: string, runId: string): Promise<number>;
 interface PlannedOrder {

package/build/scripts/ortho-populate.js

@@ -40,6 +40,12 @@
  * down gradually, and resolves feed the next station a trickle instead of a
  * wave.
  *
+ * Every escalation this run creates carries `metadata.authorized_at` — an ISO
+ * 8601 UTC timestamp stamped when the order arrives, identical across all of
+ * that order's stages (main line and shoe side-quest). Point a role's
+ * `priority_facet` at `authorized_at` with a threshold (e.g. 1 minute) and the
+ * Pace Board priority count lights up as orders age through the run.
+ *
  * ── The shoe side-quest ──────────────────────────────────────────────────────
  * A shoe order exercises the cross-sequence model (ordering → inserting feeds
  * ship via upstream_roles — its own Operations sequence, not a bend in the
@@ -158,7 +164,7 @@ async function ensureSideQuestRoles() {
     console.log(`[${ts()}] Side-quest roles ready (ordering → inserting ⇒ ship)`);
 }
 // ── Side-quest escalations (standalone rows — no workflow behind them) ────────
-async function createSideEscalation(role, workflowId, orderId, runId, description) {
+async function createSideEscalation(role, workflowId, orderId, runId, description, authorizedAt) {
     try {
         await api('POST', '/api/escalations', {
             type: 'ortho-stage',
@@ -167,7 +173,7 @@ async function createSideEscalation(role, workflowId, orderId, runId, descriptio
             description,
             workflow_id: workflowId,
             envelope: JSON.stringify({ order_id: orderId }),
-            metadata: { order_id: orderId, source: 'populate', run_id: runId },
+            metadata: { order_id: orderId, source: 'populate', run_id: runId, authorized_at: authorizedAt },
         });
         return true;
     }
@@ -237,10 +243,11 @@ async function resolveBatch(batchTag, runId) {
                 resolved++;
                 console.log(`[${ts()}]   [resolve] ${esc.role.padEnd(9)} ${esc.id.slice(0, 8)}… held ${heldS.toFixed(1)}s [${totalResolved} total]`);
                 // Shoes arrived — the side quest advances to inserting, which sits
-                // available until the manufactured inserts catch up with it.
+                // available until the manufactured inserts catch up with it. The
+                // order's authorized_at rides along from the ordering escalation.
                 if (esc.role === 'ordering') {
                     const orderId = esc.metadata?.order_id ?? '';
-                    await createSideEscalation('inserting', esc.workflow_id, orderId, runId, `Stuff inserts into shoes for ${orderId}`);
+                    await createSideEscalation('inserting', esc.workflow_id, orderId, runId, `Stuff inserts into shoes for ${orderId}`, esc.metadata?.authorized_at ?? new Date().toISOString());
                 }
             }
             catch (err) {
@@ -264,10 +271,18 @@ async function runOrders(batchTag, runId, plan, target) {
         for (const order of plan) {
             if (done)
                 break;
+            // The order's authorization moment — stamped once at arrival and carried
+            // on every stage escalation via the workflow's metadata passthrough, so
+            // an `authorized_at` priority facet measures journey age.
+            const authorizedAt = new Date().toISOString();
             try {
                 await api('POST', '/api/workflows/orthoPipeline/invoke', {
                     workflowId: order.wfId,
-                    data: { order_id: order.orderId, item_type: 'insole-standard' },
+                    data: {
+                        order_id: order.orderId,
+                        item_type: 'insole-standard',
+                        metadata: { source: 'populate', run_id: runId, authorized_at: authorizedAt },
+                    },
                     metadata: { source: 'populate', run_id: runId, shoes: order.shoes },
                 });
                 workflowIds.push(order.wfId);
@@ -279,7 +294,7 @@ async function runOrders(batchTag, runId, plan, target) {
                 continue;
             }
             if (order.shoes) {
-                const ok = await createSideEscalation('ordering', `${order.wfId}-shoes`, order.orderId, runId, `Order shoes for ${order.orderId}`);
+                const ok = await createSideEscalation('ordering', `${order.wfId}-shoes`, order.orderId, runId, `Order shoes for ${order.orderId}`, authorizedAt);
                 if (!ok)
                     target.value -= 2;
             }

package/build/services/config/cache.js

@@ -8,6 +8,7 @@ async function loadAllConfigs() {
     for (const c of configs) {
         map.set(c.workflow_type, {
             invocable: c.invocable,
+            certified: c.certified ?? false,
             taskQueue: c.task_queue,
             role: c.default_role,
             roles: c.roles,

package/build/services/config/read.js

@@ -17,6 +17,7 @@ async function getWorkflowConfig(workflowType) {
     return {
         workflow_type: wf.workflow_type,
         invocable: wf.invocable,
+        certified: wf.certified ?? false,
         task_queue: wf.task_queue,
         default_role: wf.default_role,
         description: wf.description,
@@ -53,6 +54,7 @@ async function listWorkflowConfigs() {
     return wfResult.rows.map((wf) => ({
         workflow_type: wf.workflow_type,
         invocable: wf.invocable,
+        certified: wf.certified ?? false,
         task_queue: wf.task_queue,
         default_role: wf.default_role,
         description: wf.description,

package/build/services/config/sql.d.ts

@@ -5,13 +5,13 @@ export declare const LIST_ALL_WORKFLOWS = "SELECT * FROM lt_config_workflows ORD
 export declare const LIST_ALL_ROLES = "SELECT * FROM lt_config_roles ORDER BY workflow_type, role";
 export declare const LIST_ALL_INVOCATION_ROLES = "SELECT * FROM lt_config_invocation_roles ORDER BY workflow_type, role";
 export declare const ENSURE_ROLE_EXISTS = "INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING";
-export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as";
+export declare const UPSERT_WORKFLOW = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO UPDATE SET\n  invocable = EXCLUDED.invocable,\n  task_queue = EXCLUDED.task_queue,\n  default_role = EXCLUDED.default_role,\n  description = EXCLUDED.description,\n  consumes = EXCLUDED.consumes,\n  envelope_schema = EXCLUDED.envelope_schema,\n  resolver_schema = EXCLUDED.resolver_schema,\n  cron_schedule = EXCLUDED.cron_schedule,\n  tool_tags = EXCLUDED.tool_tags,\n  execute_as = EXCLUDED.execute_as,\n  certified = EXCLUDED.certified";
 export declare const DELETE_CONFIG_ROLES = "DELETE FROM lt_config_roles WHERE workflow_type = $1";
 export declare const INSERT_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_INVOCATION_ROLES = "DELETE FROM lt_config_invocation_roles WHERE workflow_type = $1";
 export declare const INSERT_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)";
 export declare const DELETE_WORKFLOW = "DELETE FROM lt_config_workflows WHERE workflow_type = $1";
-export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)\nON CONFLICT (workflow_type) DO NOTHING";
+export declare const SEED_WORKFLOW_CONFIG = "INSERT INTO lt_config_workflows\n  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)\nVALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)\nON CONFLICT (workflow_type) DO NOTHING";
 export declare const SEED_CONFIG_ROLE = "INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const SEED_INVOCATION_ROLE = "INSERT INTO lt_config_invocation_roles (workflow_type, role) VALUES ($1, $2)\nON CONFLICT (workflow_type, role) DO NOTHING";
 export declare const GET_PROVIDER_DATA = "SELECT workflow_type, data, completed_at\n  FROM lt_tasks\n WHERE origin_id = $1\n   AND workflow_type = ANY($2)\n   AND status = 'completed'\n ORDER BY completed_at DESC";

package/build/services/config/sql.js

@@ -23,8 +23,8 @@ exports.ENSURE_ROLE_EXISTS = `\
 INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING`;
 exports.UPSERT_WORKFLOW = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
 ON CONFLICT (workflow_type) DO UPDATE SET
   invocable = EXCLUDED.invocable,
   task_queue = EXCLUDED.task_queue,
@@ -35,7 +35,8 @@ ON CONFLICT (workflow_type) DO UPDATE SET
   resolver_schema = EXCLUDED.resolver_schema,
   cron_schedule = EXCLUDED.cron_schedule,
   tool_tags = EXCLUDED.tool_tags,
-  execute_as = EXCLUDED.execute_as`;
+  execute_as = EXCLUDED.execute_as,
+  certified = EXCLUDED.certified`;
 exports.DELETE_CONFIG_ROLES = `\
 DELETE FROM lt_config_roles WHERE workflow_type = $1`;
 exports.INSERT_CONFIG_ROLE = `\
@@ -51,8 +52,8 @@ DELETE FROM lt_config_workflows WHERE workflow_type = $1`;
 // ------------------------------------------------------------------ //
 exports.SEED_WORKFLOW_CONFIG = `\
 INSERT INTO lt_config_workflows
-  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+  (workflow_type, invocable, task_queue, default_role, description, consumes, envelope_schema, resolver_schema, cron_schedule, tool_tags, execute_as, certified)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
 ON CONFLICT (workflow_type) DO NOTHING`;
 exports.SEED_CONFIG_ROLE = `\
 INSERT INTO lt_config_roles (workflow_type, role) VALUES ($1, $2)

package/build/services/config/write.js

@@ -7,6 +7,15 @@ const db_1 = require("../../lib/db");
 const read_1 = require("./read");
 const logger_1 = require("../../lib/logger");
 const sql_1 = require("./sql");
+/**
+ * Certification fallback for writers that omit the explicit flag (older SDKs,
+ * seed blocks without `certified`): derived from roles/consumes presence —
+ * the rule that governed the tier before the flag existed.
+ */
+function resolveCertified(config) {
+    return (config.certified ??
+        ((config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0));
+}
 async function upsertWorkflowConfig(config) {
     const pool = (0, db_1.getPool)();
     const client = await pool.connect();
@@ -34,6 +43,7 @@ async function upsertWorkflowConfig(config) {
             config.cron_schedule ?? null,
             config.tool_tags || [],
             config.execute_as ?? null,
+            resolveCertified(config),
         ]);
         // Replace roles
         await client.query(sql_1.DELETE_CONFIG_ROLES, [config.workflow_type]);
@@ -90,6 +100,7 @@ async function seedWorkflowConfig(config) {
         config.cron_schedule ?? null,
         config.tool_tags || [],
         config.execute_as ?? null,
+        resolveCertified(config),
     ]);
     const inserted = (rowCount ?? 0) > 0;
     if (inserted) {
@@ -110,6 +121,8 @@ async function seedWorkflowConfig(config) {
                 drifts.push('description');
             if (config.invocable !== existing.invocable)
                 drifts.push('invocable');
+            if (resolveCertified(config) !== existing.certified)
+                drifts.push('certified');
             if (config.default_role !== existing.default_role)
                 drifts.push('default_role');
             if (JSON.stringify(config.envelope_schema) !== JSON.stringify(existing.envelope_schema))

package/build/services/escalation/bulk.d.ts

@@ -32,6 +32,8 @@ export declare function bulkCancelEscalations(ids: string[]): Promise<{
 /**
  * Bulk resolve escalations for AI triage.
  * Returns full records so the caller can start triage workflows. No signal is
- * delivered — the triage workflow takes over handling.
+ * delivered — the triage workflow takes over handling. Rows backing a live
+ * `condition()` waiter (`signal_key` set) are skipped by the store and stay
+ * `pending`; only the returned rows enter triage.
  */
 export declare function bulkResolveForTriage(ids: string[], hint?: string): Promise<LTEscalationRecord[]>;

package/build/services/escalation/bulk.js

@@ -65,7 +65,9 @@ async function bulkCancelEscalations(ids) {
 /**
  * Bulk resolve escalations for AI triage.
  * Returns full records so the caller can start triage workflows. No signal is
- * delivered — the triage workflow takes over handling.
+ * delivered — the triage workflow takes over handling. Rows backing a live
+ * `condition()` waiter (`signal_key` set) are skipped by the store and stay
+ * `pending`; only the returned rows enter triage.
  */
 async function bulkResolveForTriage(ids, hint) {
     if (ids.length === 0)

package/build/services/escalation/crud.d.ts

@@ -30,9 +30,10 @@ export declare function resolveEscalation(id: string, resolverPayload: Record<st
  * Use this over a per-row `resolveEscalation` loop when every row takes the SAME
  * resolverPayload and the rows are woken collectively (or are bookkeeping rows with
  * no signal_key). NOTE: unlike the single `resolve`, this does NOT deliver per-row
- * signals — `resolveMany` is UPDATE-only. Do not use it for signal_key adverts whose
- * resolution must wake a parked workflow; those require the per-row `resolveEscalation`
- * (which delivers the signal).
+ * signals — `resolveMany` is UPDATE-only, and the store enforces it: rows with
+ * `signal_key` set (live `condition()` waiters) are skipped, stay `pending`, and
+ * drop out of the return set. Waking a parked workflow requires the per-row
+ * `resolveEscalation` (which delivers the signal).
  */
 export declare function resolveEscalationsByIds(ids: string[], resolverPayload: Record<string, any>, metadata?: Record<string, any>): Promise<LTEscalationRecord[]>;
 /**

package/build/services/escalation/crud.js

@@ -140,9 +140,10 @@ async function resolveEscalation(id, resolverPayload, metadata) {
  * Use this over a per-row `resolveEscalation` loop when every row takes the SAME
  * resolverPayload and the rows are woken collectively (or are bookkeeping rows with
  * no signal_key). NOTE: unlike the single `resolve`, this does NOT deliver per-row
- * signals — `resolveMany` is UPDATE-only. Do not use it for signal_key adverts whose
- * resolution must wake a parked workflow; those require the per-row `resolveEscalation`
- * (which delivers the signal).
+ * signals — `resolveMany` is UPDATE-only, and the store enforces it: rows with
+ * `signal_key` set (live `condition()` waiters) are skipped, stay `pending`, and
+ * drop out of the return set. Waking a parked workflow requires the per-row
+ * `resolveEscalation` (which delivers the signal).
  */
 async function resolveEscalationsByIds(ids, resolverPayload, metadata) {
     if (ids.length === 0)

package/build/services/escalation/facet-sql.d.ts

@@ -1,4 +1,5 @@
 import type { FacetOrder, FacetQuery } from '../../types';
+export declare const FACET_KEY: RegExp;
 /**
  * Build the WHERE clause for a faceted query, pushing bound params into `params`.
  * Every value is parameterized; only validated column names / metadata keys and

package/build/services/escalation/facet-sql.js

@@ -7,7 +7,7 @@
 // as services/escalation/sql.ts. Metadata facets use the GIN index (`@>`).
 // ---------------------------------------------------------------------------
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENSURE_ORIGIN_INDEX = void 0;
+exports.ENSURE_ORIGIN_INDEX = exports.FACET_KEY = void 0;
 exports.buildFacetWhere = buildFacetWhere;
 exports.buildFacetOrder = buildFacetOrder;
 exports.buildGroupOrder = buildGroupOrder;
@@ -16,7 +16,8 @@ exports.buildGroupOrder = buildGroupOrder;
 const ORDER_COLUMNS = new Set(['priority', 'created_at', 'updated_at', 'status', 'role']);
 const RANGE_OPS = new Set(['<', '<=', '>', '>=', '=']);
 // Metadata keys are interpolated (as a JSON path), so they are strictly validated.
-const FACET_KEY = /^[a-zA-Z0-9_]+$/;
+// Exported so role config (priority_facet) validates keys against the same rule.
+exports.FACET_KEY = /^[a-zA-Z0-9_]+$/;
 /** A metadata extraction expression for a validated key (text or numeric). */
 function metaExpr(key, numeric = false) {
     return numeric ? `(metadata->>'${key}')::numeric` : `(metadata->>'${key}')`;
@@ -49,13 +50,13 @@ function buildFacetWhere(q, params) {
         clauses.push(`NOT (metadata @> ANY($${params.length}::jsonb[]))`);
     }
     for (const r of q.range ?? []) {
-        if (!FACET_KEY.test(r.facet) || !RANGE_OPS.has(r.op))
+        if (!exports.FACET_KEY.test(r.facet) || !RANGE_OPS.has(r.op))
             continue;
         params.push(r.value);
         clauses.push(`${metaExpr(r.facet, true)} ${r.op} $${params.length}`);
     }
     for (const key of q.exists ?? []) {
-        if (!FACET_KEY.test(key))
+        if (!exports.FACET_KEY.test(key))
             continue;
         clauses.push(`metadata ? '${key}'`);
     }
@@ -80,7 +81,7 @@ function buildFacetOrder(orderBy) {
         }
         else if (o.field.startsWith('metadata.')) {
             const key = o.field.slice('metadata.'.length);
-            if (!FACET_KEY.test(key))
+            if (!exports.FACET_KEY.test(key))
                 continue;
             parts.push(`${metaExpr(key, o.numeric)} ${dir} NULLS LAST`);
         }
@@ -106,7 +107,7 @@ function buildGroupOrder(orderBy) {
         }
         else if (o.field.startsWith('metadata.')) {
             const key = o.field.slice('metadata.'.length);
-            if (!FACET_KEY.test(key))
+            if (!exports.FACET_KEY.test(key))
                 continue;
             parts.push(`${agg}(${metaExpr(key, o.numeric)}) ${dir} NULLS LAST`);
         }

package/build/services/escalation/queries.js

@@ -212,6 +212,22 @@ async function listDistinctTypes() {
     const client = await (0, client_1.escalations)();
     return client.listDistinctTypes();
 }
+/**
+ * Narrow the caller's explicit role filter WITHIN their read scope. The SDK
+ * store gives `roles[]` precedence over `role` when both are set, so passing
+ * both would silently DROP the explicit filter for scoped (non-global)
+ * callers — a role-filtered list would return the scope's rows instead.
+ * Intersecting first keeps the plain path's semantics identical to the
+ * faceted path's: a role filter can only narrow scope, never widen past it,
+ * and an out-of-scope role yields an empty result, not someone else's rows.
+ */
+function narrowRoleWithinScope(role, visibleRoles) {
+    if (!role || !visibleRoles)
+        return { role, roles: visibleRoles, empty: false };
+    if (!visibleRoles.includes(role))
+        return { empty: true };
+    return { role, roles: undefined, empty: false };
+}
 async function listEscalations(filters) {
     // Active claim semantics: assigned_to-active and `claimed` both mean "held now".
     const heldNow = !!(filters.assigned_to || filters.claimed);
@@ -240,15 +256,18 @@ async function listEscalations(filters) {
             order: filters.order,
         });
     }
+    const scoped = narrowRoleWithinScope(filters.role, filters.visibleRoles);
+    if (scoped.empty)
+        return { escalations: [], total: 0 };
     const client = await (0, client_1.escalations)();
     // Shared filter — passed to both list() and count() so totals stay in sync.
     const where = {
         status: filters.status,
-        role: filters.role,
+        role: scoped.role,
         type: filters.type,
         subtype: filters.subtype,
         priority: filters.priority,
-        roles: filters.visibleRoles,
+        roles: scoped.roles,
     };
     if (filters.assigned_to)
         where.assignedTo = filters.assigned_to;
@@ -292,15 +311,18 @@ async function listAvailableEscalations(filters) {
             order: filters.order,
         });
     }
+    const scoped = narrowRoleWithinScope(filters.role, filters.visibleRoles);
+    if (scoped.empty)
+        return { escalations: [], total: 0 };
     const client = await (0, client_1.escalations)();
     const where = {
         status: 'pending',
         available: true,
-        role: filters.role,
+        role: scoped.role,
         type: filters.type,
         subtype: filters.subtype,
         priority: filters.priority,
-        roles: filters.visibleRoles,
+        roles: scoped.roles,
     };
     const [rows, total] = await Promise.all([
         client.list({
@@ -359,7 +381,7 @@ async function getStationMetrics(visibleRoles, period) {
             pending: Number(c.pending ?? 0),
             claimed: Number(c.claimed ?? 0),
             resolved: Number(p?.resolved ?? 0),
-            in_arrears: Number(c.in_arrears ?? 0),
+            priority_count: Number(c.priority_count ?? 0),
             throughput_pct: p?.throughput_pct != null ? Number(p.throughput_pct) : null,
             wait: {
                 p99: toNum(p?.p99_wait_min),