@kici-dev/engine 0.1.12 → 0.1.14

package/dist/index.js

@@ -4,7 +4,7 @@ import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSche
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
-import { ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
 import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
@@ -43,4 +43,4 @@ import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, val
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HeldRunQueueType, HeldRunStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HeldRunQueueType, HeldRunStatus, InitFailureCategory, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/metrics/catalog-policy.js

@@ -159,16 +159,48 @@ const METRIC_LABEL_POLICY = {
 	kici_orch_install_secrets_contributor_stripped_total: { trust_tier: { values: ["unknown", "known"] } },
 	kici_orch_install_secrets_token_resolution_duration_seconds: { environment: { maxUniqueValues: 50 } },
 	kici_cross_source_errors_total: { reason: { values: ["clone_token", "bundle_missing"] } },
+	kici_cross_source_fanout_size: { event: { maxUniqueValues: 50 } },
 	kici_universal_git_registration_errors_total: { reason: { values: [
 		"invalid_config",
 		"bundle_build",
-		"registration"
+		"registration",
+		"no_secret_resolver"
 	] } },
 	kici_orch_trust_match_refused_no_id_total: { reason: { values: [
 		"event_missing",
 		"link_missing",
 		"id_mismatch"
 	] } },
+	kici_orch_event_dispatch_success_total: { event_name: { maxUniqueValues: 50 } },
+	kici_orch_event_retry_total: { event_name: { maxUniqueValues: 50 } },
+	kici_orch_event_dlq_total: {
+		event_name: { maxUniqueValues: 50 },
+		reason: { values: ["exhausted_retries"] }
+	},
+	kici_orch_event_attempts: {
+		event_name: { maxUniqueValues: 50 },
+		result: { values: ["success", "dlq"] }
+	},
+	kici_platform_cross_tenant_rejections_total: { reason: { values: [
+		"join_token_org_mismatch",
+		"wire_orgid_label_strip",
+		"dashboard_relay_source_mismatch",
+		"dashboard_relay_org_mismatch",
+		"response_source_mismatch",
+		"payload_stream_source_mismatch",
+		"ack_source_mismatch"
+	] } },
+	kici_platform_orch_metrics_filtered_total: {
+		reason: { values: [
+			"unknown_metric",
+			"type_mismatch",
+			"unexpected_label",
+			"bad_label_value",
+			"cardinality_cap_overflow"
+		] },
+		metric: { maxUniqueValues: 200 }
+	},
+	kici_platform_metrics_query_rate_limited_total: { org_id: { maxUniqueValues: 200 } },
 	kici_orch_job_runs_total: {
 		job: { values: ORCH_JOB_VALUES },
 		result: { values: ["success", "failure"] }

package/dist/metrics/metric-catalog.generated.d.ts

@@ -136,7 +136,7 @@ export declare const MetricLabels: {
     readonly KICI_CACHE_HITS_TOTAL: readonly ["cache_type"];
     readonly KICI_CACHE_MISSES_TOTAL: readonly ["cache_type"];
     readonly KICI_CROSS_SOURCE_ERRORS_TOTAL: readonly ["reason"];
-    readonly KICI_CROSS_SOURCE_FANOUT_SIZE: readonly [];
+    readonly KICI_CROSS_SOURCE_FANOUT_SIZE: readonly ["event"];
     readonly KICI_DASHBOARD_RELAY_LATENCY_SECONDS: readonly ["outcome"];
     readonly KICI_ORCH_AGENTS_ACTIVE: readonly [];
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: readonly [];
@@ -147,12 +147,12 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_DEP_CACHE_MISSES_TOTAL: readonly [];
     readonly KICI_ORCH_DISPATCH_QUEUE_DEPTH: readonly ["status"];
     readonly KICI_ORCH_DISPATCH_QUEUE_DEPTH_BY_LABEL: readonly ["status", "label"];
-    readonly KICI_ORCH_EVENT_ATTEMPTS: readonly [];
-    readonly KICI_ORCH_EVENT_DISPATCH_SUCCESS_TOTAL: readonly [];
+    readonly KICI_ORCH_EVENT_ATTEMPTS: readonly ["event_name", "result"];
+    readonly KICI_ORCH_EVENT_DISPATCH_SUCCESS_TOTAL: readonly ["event_name"];
     readonly KICI_ORCH_EVENT_DLQ_DEPTH: readonly [];
-    readonly KICI_ORCH_EVENT_DLQ_TOTAL: readonly [];
+    readonly KICI_ORCH_EVENT_DLQ_TOTAL: readonly ["event_name", "reason"];
     readonly KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: readonly [];
-    readonly KICI_ORCH_EVENT_RETRY_TOTAL: readonly [];
+    readonly KICI_ORCH_EVENT_RETRY_TOTAL: readonly ["event_name"];
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_EXECUTIONS_TOTAL: readonly ["status"];
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: readonly ["operation"];
@@ -190,7 +190,7 @@ export declare const MetricLabels: {
     readonly KICI_ORGS_TOTAL: readonly ["plan_type"];
     readonly KICI_PLAN_CAP_EXCEEDED_TOTAL: readonly ["org_id", "dimension"];
     readonly KICI_PLAN_USAGE_RATIO: readonly ["org_id", "dimension"];
-    readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: readonly [];
+    readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: readonly ["reason"];
     readonly KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: readonly ["outcome"];
     readonly KICI_PLATFORM_DASHBOARD_PROXY_PENDING: readonly [];
     readonly KICI_PLATFORM_DASHBOARD_PROXY_REQUESTS_TOTAL: readonly ["outcome"];
@@ -205,9 +205,9 @@ export declare const MetricLabels: {
     readonly KICI_PLATFORM_JOB_STATUS_FORWARDS_TOTAL: readonly ["status"];
     readonly KICI_PLATFORM_LOG_CHUNKS_FORWARDED_TOTAL: readonly [];
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: readonly [];
-    readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: readonly [];
+    readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: readonly ["org_id"];
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: readonly ["reason"];
-    readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: readonly [];
+    readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: readonly ["reason", "metric"];
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: readonly [];
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: readonly [];
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: readonly ["org_id"];
@@ -451,7 +451,7 @@ export declare const MetricDescription: {
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "Total log lines forwarded from orchestrators";
     readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "Total dashboard metric-query requests rate-limited (429).";
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "Total Mimir push-relay errors (Platform-embedded metrics). Labels: reason.";
-    readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason.";
+    readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason, metric.";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)";

package/dist/metrics/metric-catalog.generated.js

@@ -137,7 +137,7 @@ const MetricLabels = {
 	KICI_CACHE_HITS_TOTAL: ["cache_type"],
 	KICI_CACHE_MISSES_TOTAL: ["cache_type"],
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: ["reason"],
-	KICI_CROSS_SOURCE_FANOUT_SIZE: [],
+	KICI_CROSS_SOURCE_FANOUT_SIZE: ["event"],
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: ["outcome"],
 	KICI_ORCH_AGENTS_ACTIVE: [],
 	KICI_ORCH_BUILD_DURATION_SECONDS: [],
@@ -148,12 +148,12 @@ const MetricLabels = {
 	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: [],
 	KICI_ORCH_DISPATCH_QUEUE_DEPTH: ["status"],
 	KICI_ORCH_DISPATCH_QUEUE_DEPTH_BY_LABEL: ["status", "label"],
-	KICI_ORCH_EVENT_ATTEMPTS: [],
-	KICI_ORCH_EVENT_DISPATCH_SUCCESS_TOTAL: [],
+	KICI_ORCH_EVENT_ATTEMPTS: ["event_name", "result"],
+	KICI_ORCH_EVENT_DISPATCH_SUCCESS_TOTAL: ["event_name"],
 	KICI_ORCH_EVENT_DLQ_DEPTH: [],
-	KICI_ORCH_EVENT_DLQ_TOTAL: [],
+	KICI_ORCH_EVENT_DLQ_TOTAL: ["event_name", "reason"],
 	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: [],
-	KICI_ORCH_EVENT_RETRY_TOTAL: [],
+	KICI_ORCH_EVENT_RETRY_TOTAL: ["event_name"],
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: [],
 	KICI_ORCH_EXECUTIONS_TOTAL: ["status"],
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: ["operation"],
@@ -195,7 +195,7 @@ const MetricLabels = {
 	KICI_ORGS_TOTAL: ["plan_type"],
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: ["org_id", "dimension"],
 	KICI_PLAN_USAGE_RATIO: ["org_id", "dimension"],
-	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: [],
+	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: ["reason"],
 	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: ["outcome"],
 	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: [],
 	KICI_PLATFORM_DASHBOARD_PROXY_REQUESTS_TOTAL: ["outcome"],
@@ -210,9 +210,9 @@ const MetricLabels = {
 	KICI_PLATFORM_JOB_STATUS_FORWARDS_TOTAL: ["status"],
 	KICI_PLATFORM_LOG_CHUNKS_FORWARDED_TOTAL: [],
 	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: [],
-	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: [],
+	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: ["org_id"],
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: ["reason"],
-	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: [],
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: ["reason", "metric"],
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: [],
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: [],
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: ["org_id"],
@@ -460,7 +460,7 @@ const MetricDescription = {
 	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "Total log lines forwarded from orchestrators",
 	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "Total dashboard metric-query requests rate-limited (429).",
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "Total Mimir push-relay errors (Platform-embedded metrics). Labels: reason.",
-	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason.",
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason, metric.",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)",

package/dist/protocol/messages/dashboard.d.ts

@@ -64,6 +64,24 @@ export declare const dashboardJobDetailSchema: z.ZodObject<{
     runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
     secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     steps: z.ZodArray<z.ZodObject<{
         stepIndex: z.ZodNumber;
         stepName: z.ZodString;
@@ -95,6 +113,24 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
         runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
         secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        initFailure: z.ZodOptional<z.ZodObject<{
+            scope: z.ZodEnum<{
+                run: "run";
+                job: "job";
+            }>;
+            category: z.ZodEnum<{
+                secret_resolution: "secret_resolution";
+                install_secrets: "install_secrets";
+                lock_resolution: "lock_resolution";
+                build_coordination: "build_coordination";
+                environment_rules: "environment_rules";
+                dynamic_eval: "dynamic_eval";
+                no_agent: "no_agent";
+                matrix_expansion: "matrix_expansion";
+            }>;
+            message: z.ZodString;
+            jobName: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         steps: z.ZodArray<z.ZodObject<{
             stepIndex: z.ZodNumber;
             stepName: z.ZodString;
@@ -120,6 +156,24 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
         }>>;
         contributorUsername: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Response with step log lines (correlates to dashboard.step.logs). */
@@ -3362,6 +3416,24 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
         secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        initFailure: z.ZodOptional<z.ZodObject<{
+            scope: z.ZodEnum<{
+                run: "run";
+                job: "job";
+            }>;
+            category: z.ZodEnum<{
+                secret_resolution: "secret_resolution";
+                install_secrets: "install_secrets";
+                lock_resolution: "lock_resolution";
+                build_coordination: "build_coordination";
+                environment_rules: "environment_rules";
+                dynamic_eval: "dynamic_eval";
+                no_agent: "no_agent";
+                matrix_expansion: "matrix_expansion";
+            }>;
+            message: z.ZodString;
+            jobName: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         steps: z.ZodArray<z.ZodObject<{
             stepIndex: z.ZodNumber;
             stepName: z.ZodString;
@@ -3387,6 +3459,24 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         }>>;
         contributorUsername: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.step.logs.response">;
@@ -4226,6 +4316,24 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
         runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
         secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        initFailure: z.ZodOptional<z.ZodObject<{
+            scope: z.ZodEnum<{
+                run: "run";
+                job: "job";
+            }>;
+            category: z.ZodEnum<{
+                secret_resolution: "secret_resolution";
+                install_secrets: "install_secrets";
+                lock_resolution: "lock_resolution";
+                build_coordination: "build_coordination";
+                environment_rules: "environment_rules";
+                dynamic_eval: "dynamic_eval";
+                no_agent: "no_agent";
+                matrix_expansion: "matrix_expansion";
+            }>;
+            message: z.ZodString;
+            jobName: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         steps: z.ZodArray<z.ZodObject<{
             stepIndex: z.ZodNumber;
             stepName: z.ZodString;
@@ -4251,6 +4359,24 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
         }>>;
         contributorUsername: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /** REST API response for step logs. */
 export declare const dashboardStepLogsApiResponseSchema: z.ZodObject<{

package/dist/protocol/messages/dashboard.js

@@ -1,5 +1,6 @@
 import "../../chunk-gOLHoazu.js";
 import { actorPrincipalSchema } from "./actor.js";
+import { initFailureSchema } from "./execution-status.js";
 import { SourceSubtype } from "./source-registration.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
@@ -56,6 +57,11 @@ const dashboardJobDetailSchema = z.object({
 	outputs: z.record(z.string(), z.record(z.string(), z.unknown())).nullable().optional(),
 	/** Secret output key names produced by this job (values are NOT included -- display masked). */
 	secretOutputKeys: z.array(z.string()).nullable().optional(),
+	/**
+	* Structured init-failure signal for jobs that never started. Presence means
+	* the job is a synthetic `rejected-*` or `init-failed-*` row; status will be 'failed'.
+	*/
+	initFailure: initFailureSchema.optional(),
 	steps: z.array(dashboardStepDetailSchema)
 });
 /** Trust context from orchestrator execution_runs (populated for PR-triggered runs). */
@@ -74,6 +80,11 @@ const dashboardRunDetailResponseSchema = z.object({
 	requestId: z.string(),
 	jobs: z.array(dashboardJobDetailSchema),
 	trustContext: trustContextSchema.optional(),
+	/**
+	* Structured init-failure signal for runs that never started. Set when the
+	* run row was created via recordInitFailureRun() on the orchestrator side.
+	*/
+	initFailure: initFailureSchema.optional(),
 	error: z.string().optional()
 });
 /** Response with step log lines (correlates to dashboard.step.logs). */
@@ -1251,7 +1262,14 @@ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 /** REST API response for run detail (jobs with nested steps). */
 const dashboardRunDetailApiResponseSchema = z.object({
 	jobs: z.array(dashboardJobDetailSchema),
-	trustContext: trustContextSchema.optional()
+	trustContext: trustContextSchema.optional(),
+	/**
+	* Structured init-failure signal for runs that never started a step. Set
+	* when the run row was created via `recordInitFailureRun()` on the
+	* orchestrator and surfaced to the dashboard so the banner can render
+	* even while the orchestrator is offline (Platform-DB fallback path).
+	*/
+	initFailure: initFailureSchema.optional()
 });
 /** REST API response for step logs. */
 const dashboardStepLogsApiResponseSchema = z.object({

package/dist/protocol/messages/execution-status.d.ts

@@ -32,6 +32,50 @@ export declare const ExecutionStepStatus: z.ZodEnum<{
     skipped: "skipped";
 }>;
 export type ExecutionStepStatus = z.infer<typeof ExecutionStepStatus>;
+/**
+ * Categories of init failure — i.e. failures that prevent a run from ever
+ * executing a step. Set by the orchestrator at the detection site and
+ * persisted alongside the run/job row so the dashboard can render an
+ * explanatory banner even when the orchestrator is offline.
+ *
+ * Scope is carried separately on `initFailureSchema.scope`:
+ *  - `run`-scoped categories fail the whole run before any job runs
+ *    (secret_resolution, install_secrets, lock_resolution,
+ *    build_coordination, matrix_expansion).
+ *  - `job`-scoped categories fail one job and leave siblings alone
+ *    (environment_rules, dynamic_eval, no_agent).
+ */
+export declare const InitFailureCategory: z.ZodEnum<{
+    secret_resolution: "secret_resolution";
+    install_secrets: "install_secrets";
+    lock_resolution: "lock_resolution";
+    build_coordination: "build_coordination";
+    environment_rules: "environment_rules";
+    dynamic_eval: "dynamic_eval";
+    no_agent: "no_agent";
+    matrix_expansion: "matrix_expansion";
+}>;
+export type InitFailureCategory = z.infer<typeof InitFailureCategory>;
+/** Structured init-failure signal. Presence on a run/job means "never started". */
+export declare const initFailureSchema: z.ZodObject<{
+    scope: z.ZodEnum<{
+        run: "run";
+        job: "job";
+    }>;
+    category: z.ZodEnum<{
+        secret_resolution: "secret_resolution";
+        install_secrets: "install_secrets";
+        lock_resolution: "lock_resolution";
+        build_coordination: "build_coordination";
+        environment_rules: "environment_rules";
+        dynamic_eval: "dynamic_eval";
+        no_agent: "no_agent";
+        matrix_expansion: "matrix_expansion";
+    }>;
+    message: z.ZodString;
+    jobName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InitFailure = z.infer<typeof initFailureSchema>;
 /** Terminal run states that indicate the run has completed. */
 export declare const TERMINAL_RUN_STATES: ReadonlySet<string>;
 /** Terminal job states that indicate the job is no longer running. */
@@ -65,6 +109,24 @@ export declare const executionStatusSchema: z.ZodObject<{
     triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     failureReason: z.ZodOptional<z.ZodString>;
     logBytes: z.ZodOptional<z.ZodNumber>;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /** Per-step status forwarded from agent to Platform (real-time). */
 export declare const stepStatusForwardSchema: z.ZodObject<{
@@ -115,6 +177,24 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
     runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     logBytes: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 export declare const stateReplaySchema: z.ZodObject<{

package/dist/protocol/messages/execution-status.js

@@ -31,6 +31,38 @@ const ExecutionStepStatus = z.enum([
 	"failed",
 	"skipped"
 ]);
+/**
+* Categories of init failure — i.e. failures that prevent a run from ever
+* executing a step. Set by the orchestrator at the detection site and
+* persisted alongside the run/job row so the dashboard can render an
+* explanatory banner even when the orchestrator is offline.
+*
+* Scope is carried separately on `initFailureSchema.scope`:
+*  - `run`-scoped categories fail the whole run before any job runs
+*    (secret_resolution, install_secrets, lock_resolution,
+*    build_coordination, matrix_expansion).
+*  - `job`-scoped categories fail one job and leave siblings alone
+*    (environment_rules, dynamic_eval, no_agent).
+*/
+const InitFailureCategory = z.enum([
+	"secret_resolution",
+	"install_secrets",
+	"lock_resolution",
+	"build_coordination",
+	"environment_rules",
+	"dynamic_eval",
+	"no_agent",
+	"matrix_expansion"
+]);
+/** Structured init-failure signal. Presence on a run/job means "never started". */
+const initFailureSchema = z.object({
+	scope: z.enum(["run", "job"]),
+	category: InitFailureCategory,
+	/** Human-readable failure message (same content surfaced by RunFailureSummary). */
+	message: z.string(),
+	/** Set when scope === 'job'. */
+	jobName: z.string().optional()
+});
 /** Terminal run states that indicate the run has completed. */
 const TERMINAL_RUN_STATES = new Set([
 	ExecutionRunStatus.enum.success,
@@ -80,7 +112,13 @@ const executionStatusSchema = z.object({
 	* Only set on terminal run states. Powers the operator-side
 	* `kici_org_log_bytes` capacity-planning gauge on the Platform.
 	*/
-	logBytes: z.number().int().nonnegative().optional()
+	logBytes: z.number().int().nonnegative().optional(),
+	/**
+	* Structured init-failure signal. Set by the orchestrator when the run
+	* never executed a single step. Persisted in execution_runs.init_failure
+	* on both orchestrator and Platform sides. Only present when status === 'failed'.
+	*/
+	initFailure: initFailureSchema.optional()
 });
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
@@ -121,7 +159,9 @@ const jobStatusForwardSchema = z.object({
 	* `kici_org_log_bytes` capacity-planning gauge on the Platform.
 	*/
 	logBytes: z.number().int().nonnegative().optional(),
-	timestamp: z.number()
+	timestamp: z.number(),
+	/** Structured init-failure signal — set for synthetic rejected-* / init-failed-* jobs. */
+	initFailure: initFailureSchema.optional()
 });
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 const stateReplaySchema = z.object({
@@ -161,6 +201,6 @@ const stateReplaySchema = z.object({
 	timestamp: z.number()
 });
 //#endregion
-export { ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
+export { ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -1822,6 +1822,24 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     failureReason: z.ZodOptional<z.ZodString>;
     logBytes: z.ZodOptional<z.ZodNumber>;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"step.status.forward">;
     messageId: z.ZodString;
@@ -1868,6 +1886,24 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     logBytes: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
+    initFailure: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodEnum<{
+            run: "run";
+            job: "job";
+        }>;
+        category: z.ZodEnum<{
+            secret_resolution: "secret_resolution";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
+            build_coordination: "build_coordination";
+            environment_rules: "environment_rules";
+            dynamic_eval: "dynamic_eval";
+            no_agent: "no_agent";
+            matrix_expansion: "matrix_expansion";
+        }>;
+        message: z.ZodString;
+        jobName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"state.replay">;
     messageId: z.ZodString;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "kici",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.1.12",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.12/6a5cbfae-b207-4442-b31b-a4befe0a503a",
+  "name": "@kici-dev/engine@0.1.14",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.14/e0f9b814-d366-4ae4-8be4-0663a2fdb6d7",
   "creationInfo": {
-    "created": "2026-05-27T16:57:30Z",
+    "created": "2026-05-30T03:05:55Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.12",
+      "versionInfo": "0.1.14",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.12"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.14"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",