@kici-dev/engine 0.1.23 → 0.1.24

package/dist/protocol/messages/dashboard.js

@@ -1,13 +1,14 @@
 import "../../chunk-BTugEXQM.js";
 import { CheckMode, CheckStepOutcome } from "../../check-mode.js";
 import { actorPrincipalSchema } from "./actor.js";
-import { initFailureSchema } from "./execution-status.js";
-import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
-import { SourceSubtype } from "./source-registration.js";
+import { StepConcurrencyKind, initFailureSchema } from "./execution-status.js";
+import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
+import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
+import { SourceSubtype } from "./source-registration.js";
 import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
 import { NeedsRunOn, OnUnreachableMode } from "../../trigger/types.js";
@@ -23,6 +24,24 @@ const dashboardRunDetailRequestSchema = z.object({
 	actor: actorPrincipalSchema,
 	runId: z.string()
 });
+/**
+* Request the machine-first, provenance-tagged structured run result from the
+* orchestrator (user-plane equivalent of the orchestrator-admin
+* `/runs/:id/structured` endpoint). Reuses the Phase-1 `AgentRunResult` shape.
+*/
+const dashboardRunStructuredRequestSchema = z.object({
+	type: z.literal("dashboard.run.structured"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string()
+});
+/** Response carrying the provenance-tagged AgentRunResult (null when not found). */
+const dashboardRunStructuredResponseSchema = z.object({
+	type: z.literal("dashboard.run.structured.response"),
+	requestId: z.string(),
+	result: agentRunResultSchema.nullable(),
+	error: z.string().optional()
+});
 /** Request step logs from orchestrator. */
 const dashboardStepLogsRequestSchema = z.object({
 	type: z.literal("dashboard.step.logs"),
@@ -49,7 +68,11 @@ const dashboardStepDetailSchema = z.object({
 	/** Idempotent per-step outcome under a check mode. null/absent for non-check runs. */
 	checkOutcome: CheckStepOutcome.nullable().optional(),
 	/** Human-readable drift summary, present when the step reported drift. */
-	driftSummary: z.string().nullable().optional()
+	driftSummary: z.string().nullable().optional(),
+	/** Step concurrency role; absent/`sequential` for ordinary steps. */
+	concurrencyKind: StepConcurrencyKind.nullable().optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().nullable().optional()
 });
 /** Job detail within a run detail response. */
 const dashboardJobDetailSchema = z.object({
@@ -71,6 +94,12 @@ const dashboardJobDetailSchema = z.object({
 	errorMessage: z.string().nullable(),
 	/** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). */
 	runsOnLabels: z.array(z.string()).nullable().optional(),
+	/**
+	* Ordered bound deployment-environment names for this job, in merge order
+	* (later environments override earlier on key collisions). A `(dynamic)`
+	* entry marks an element resolved at runtime. null/absent = no binding.
+	*/
+	environments: z.array(z.string()).nullable().optional(),
 	/** Aggregated step outputs (step-keyed map). Present when job completed successfully with outputs. */
 	outputs: z.record(z.string(), z.record(z.string(), z.unknown())).nullable().optional(),
 	/** Secret output key names produced by this job (values are NOT included -- display masked). */
@@ -132,6 +161,22 @@ const dashboardAttestationsListRequestSchema = z.object({
 	runId: z.string()
 });
 /**
+* Server-side verification verdict for an attestation, computed at ingest.
+* - `verified` — `verifyKiciBundle` succeeded.
+* - `failed` — verification ran and the bundle failed (signature / identity /
+*   build-context / unsupported mode). A provenance-integrity signal.
+* - `unverifiable` — no verdict could be computed (no trust root configured, or
+*   the JWKS / bundle could not be read). NOT a forgery signal.
+* - `pending` — verdict not yet computed (pre-backfill row, or ingest raced the
+*   trust root).
+*/
+const attestationVerifyStatusSchema = z.enum([
+	"verified",
+	"failed",
+	"unverifiable",
+	"pending"
+]);
+/**
 * Single attestation in the list response, with its bundle inlined from object
 * storage so the dashboard verifies it without a second fetch. The bundle is a
 * KiCI Mode-A bundle (`@kici-dev/engine/provenance/bundle`).
@@ -145,7 +190,16 @@ const attestationListItemSchema = z.object({
 	mode: z.string(),
 	mediaType: z.string(),
 	createdAt: z.string(),
-	bundle: kiciBundleSchema
+	bundle: kiciBundleSchema,
+	/**
+	* Owning run id — populated by the single-attestation detail get (for the
+	* "view run" link); omitted by the per-run list (the run is already known).
+	*/
+	runId: z.string().optional(),
+	/** Stored server-side verdict — populated by the detail get (omitted per-run). */
+	verifyStatus: attestationVerifyStatusSchema.optional(),
+	/** First failure reason for the stored verdict, when failed (detail get only). */
+	verifyReason: z.string().nullable().optional()
 });
 /** Response with the run's attestations (correlates to dashboard.attestations.list). */
 const dashboardAttestationsListResponseSchema = z.object({
@@ -155,6 +209,70 @@ const dashboardAttestationsListResponseSchema = z.object({
 	error: z.string().optional()
 });
 /**
+* Metadata-only summary row for the org-wide list. No inlined bundle (keeps the
+* list cheap). `repository` / `workflow` are joined from `execution_runs` when
+* available.
+*/
+const attestationListSummarySchema = z.object({
+	id: z.string(),
+	runId: z.string(),
+	jobId: z.string(),
+	jobName: z.string().nullable(),
+	subjectName: z.string(),
+	subjectDigest: z.string(),
+	mode: z.string(),
+	mediaType: z.string(),
+	createdAt: z.string(),
+	verifyStatus: attestationVerifyStatusSchema,
+	verifyReason: z.string().nullable(),
+	repository: z.string().nullable(),
+	workflow: z.string().nullable()
+});
+/** Filters for the org-wide attestations list. */
+const attestationListFiltersSchema = z.object({
+	digest: z.string().optional(),
+	name: z.string().optional(),
+	status: attestationVerifyStatusSchema.optional(),
+	repository: z.string().optional(),
+	workflow: z.string().optional(),
+	job: z.string().optional(),
+	createdAfter: z.string().optional(),
+	createdBefore: z.string().optional()
+});
+/** Request the org-wide, paginated, filtered list of attestations. */
+const dashboardAttestationsListAllRequestSchema = z.object({
+	type: z.literal("dashboard.attestations.list.all"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	page: z.number().int().positive(),
+	sort: z.string().optional(),
+	filters: attestationListFiltersSchema.default({})
+});
+/** Response with one page of org-wide attestation summaries. */
+const dashboardAttestationsListAllResponseSchema = z.object({
+	type: z.literal("dashboard.attestations.list.all.response"),
+	requestId: z.string(),
+	attestations: z.array(attestationListSummarySchema),
+	page: z.number().int(),
+	pageSize: z.number().int(),
+	total: z.number().int(),
+	error: z.string().optional()
+});
+/** Request a single attestation by id (detail page; inlines the one bundle). */
+const dashboardAttestationGetRequestSchema = z.object({
+	type: z.literal("dashboard.attestation.get"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	attestationId: z.string()
+});
+/** Response with one attestation (the existing item shape with bundle), or null. */
+const dashboardAttestationGetResponseSchema = z.object({
+	type: z.literal("dashboard.attestation.get.response"),
+	requestId: z.string(),
+	attestation: attestationListItemSchema.nullable(),
+	error: z.string().optional()
+});
+/**
 * Run-summary projection from the orchestrator's execution_runs table.
 *
 * The required fields (`runId` / `routingKey` / `status`) are always present.
@@ -175,6 +293,8 @@ const dashboardRunSummarySchema = z.object({
 	triggerEvent: z.string().optional(),
 	commitMessage: z.string().optional(),
 	jobCount: z.number().optional(),
+	/** Distinct bound deployment-environment names across the run's jobs (first-seen order). */
+	environments: z.array(z.string()).optional(),
 	startedAt: z.string().optional(),
 	completedAt: z.string().optional(),
 	durationMs: z.number().optional(),
@@ -1645,8 +1765,11 @@ const testRelayCancelResponseSchema = z.object({
 /** Dashboard messages flowing from Platform to Orchestrator. */
 const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailRequestSchema,
+	dashboardRunStructuredRequestSchema,
 	dashboardStepLogsRequestSchema,
 	dashboardAttestationsListRequestSchema,
+	dashboardAttestationsListAllRequestSchema,
+	dashboardAttestationGetRequestSchema,
 	dashboardRunsListRequestSchema,
 	dashboardRunsFiltersRequestSchema,
 	dashboardSourcesListRequestSchema,
@@ -1715,8 +1838,11 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 /** Dashboard messages flowing from Orchestrator to Platform. */
 const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailResponseSchema,
+	dashboardRunStructuredResponseSchema,
 	dashboardStepLogsResponseSchema,
 	dashboardAttestationsListResponseSchema,
+	dashboardAttestationsListAllResponseSchema,
+	dashboardAttestationGetResponseSchema,
 	dashboardRunsListResponseSchema,
 	dashboardRunsFiltersResponseSchema,
 	dashboardSourcesListResponseSchema,
@@ -1852,6 +1978,19 @@ const runListItemSchema = z.object({
 	failureReason: z.string().optional(),
 	hadCompileJob: z.boolean(),
 	compileJobId: z.string().nullable(),
+	/**
+	* Distinct bound deployment-environment names across the run's jobs
+	* (first-seen order). Drives the run-list environment chips; empty/absent
+	* when no job binds an environment.
+	*/
+	environments: z.array(z.string()).optional(),
+	/**
+	* Run-level repo provider (origin host) — distinct from `source.provider`
+	* which is derived from the routing key. Drives provider-aware repo links.
+	*/
+	repoProvider: z.string().nullable(),
+	/** True when the run executed a developer's local working tree (`kici run remote`). */
+	localWorkingTree: z.boolean(),
 	source: runListSourceSchema.nullable()
 });
 /** Paginated run list response envelope. */
@@ -2030,7 +2169,23 @@ const orgMemberSchema = z.object({
 });
 /** Response for org members list endpoint. */
 const memberListResponseSchema = z.object({ members: z.array(orgMemberSchema) });
+/**
+* Every dashboard request type the local build understands, derived from the
+* discriminated union so it can never drift. A component advertises this set to
+* describe ITSELF; gating decisions always compare against the REMOTE's
+* advertised set, never this local one.
+*/
+const DASHBOARD_REQUEST_TYPES = dashboardPlatformToOrchSchema.options.map((o) => o.shape.type.value);
+/** Membership-test form of {@link DASHBOARD_REQUEST_TYPES}. */
+const DASHBOARD_REQUEST_TYPE_SET = new Set(DASHBOARD_REQUEST_TYPES);
+/** Structured error code on a dashboard `*.response` frame's `code` field. */
+const DashboardResponseErrorCode = z.enum([
+	"unsupported_request_type",
+	"invalid_payload",
+	"unsupported_message_type",
+	"internal_error"
+]);
 //#endregion
-export { EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/execution-status.d.ts

@@ -1,4 +1,18 @@
 import { z } from 'zod';
+/** Max length for ids and short identifier fields (runId, jobId, sha, ref, …). */
+export declare const STATUS_ID_MAX = 128;
+/** Max length for the repo identifier (`owner/repo` can be long). */
+export declare const REPO_IDENTIFIER_MAX = 256;
+/** Max length for free-text fields (commit message, failure/error reason). */
+export declare const STATUS_FREE_TEXT_MAX = 2000;
+/** Max number of runs in a single `state.replay` snapshot. */
+export declare const STATE_REPLAY_MAX_RUNS = 500;
+/** Max number of jobs attached to a single run in a `state.replay` snapshot. */
+export declare const MAX_JOBS_PER_RUN = 1000;
+/** Max number of `runsOn` / `secretsAccessed` label entries on a job/step. */
+export declare const RUNS_ON_LABELS_MAX = 30;
+/** Max number of bound deployment-environment names on a job. */
+export declare const ENVIRONMENTS_MAX = 30;
 /**
  * Status values for execution runs (execution_runs table).
  *
@@ -34,14 +48,36 @@ export declare const ExecutionJobStatus: z.ZodEnum<{
     drift_dropped: "drift_dropped";
 }>;
 export type ExecutionJobStatus = z.infer<typeof ExecutionJobStatus>;
-/** Status values for execution steps (execution_steps table + step.status protocol messages). */
+/**
+ * Status values for execution steps (execution_steps table + step.status protocol messages).
+ *
+ *  - `pending`   — a parallel-group child queued behind `maxParallel`, not yet launched.
+ *  - `cancelled` — a parallel-group sibling aborted by fail-fast (NOT a failure).
+ */
 export declare const ExecutionStepStatus: z.ZodEnum<{
     skipped: "skipped";
     success: "success";
+    pending: "pending";
     running: "running";
     failed: "failed";
+    cancelled: "cancelled";
 }>;
 export type ExecutionStepStatus = z.infer<typeof ExecutionStepStatus>;
+/**
+ * How a step participates in a job's step concurrency model.
+ *
+ *  - `sequential`     — an ordinary step in the flat step sequence.
+ *  - `parallel-child` — a child of a `parallel()` group, running concurrently
+ *                       with its siblings, each its own observable step.
+ *  - `parallel-group` — the structural group wrapper (no flat step index); used
+ *                       only for the dashboard band aggregate, not persisted per step.
+ */
+export declare const StepConcurrencyKind: z.ZodEnum<{
+    sequential: "sequential";
+    "parallel-child": "parallel-child";
+    "parallel-group": "parallel-group";
+}>;
+export type StepConcurrencyKind = z.infer<typeof StepConcurrencyKind>;
 /**
  * Distinct reasons a run/job ended because a configured wall-clock timeout
  * was exceeded. Surfaced in the failure/cancel reason so the dashboard can
@@ -159,6 +195,8 @@ export declare const executionStatusSchema: z.ZodObject<{
         held: "held";
     }>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    repoProvider: z.ZodOptional<z.ZodString>;
+    localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
     ref: z.ZodOptional<z.ZodString>;
     triggerEvent: z.ZodOptional<z.ZodString>;
@@ -171,6 +209,9 @@ export declare const executionStatusSchema: z.ZodObject<{
     parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggerActorProvider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggerActorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggerActorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     failureReason: z.ZodOptional<z.ZodString>;
     logBytes: z.ZodOptional<z.ZodNumber>;
     initFailure: z.ZodOptional<z.ZodObject<{
@@ -204,12 +245,20 @@ export declare const stepStatusForwardSchema: z.ZodObject<{
     state: z.ZodEnum<{
         skipped: "skipped";
         success: "success";
+        pending: "pending";
         running: "running";
         failed: "failed";
+        cancelled: "cancelled";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyKind: z.ZodOptional<z.ZodEnum<{
+        sequential: "sequential";
+        "parallel-child": "parallel-child";
+        "parallel-group": "parallel-group";
+    }>>;
+    groupId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Per-job status forwarded from orchestrator to Platform (real-time). */
 export declare const jobStatusForwardSchema: z.ZodObject<{
@@ -239,6 +288,7 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
     agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    environments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     logBytes: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
     initFailure: z.ZodOptional<z.ZodObject<{
@@ -300,6 +350,7 @@ export declare const stateReplaySchema: z.ZodObject<{
             errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            environments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     timestamp: z.ZodNumber;

package/dist/protocol/messages/execution-status.js

@@ -1,6 +1,20 @@
 import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/execution-status.ts
+/** Max length for ids and short identifier fields (runId, jobId, sha, ref, …). */
+const STATUS_ID_MAX = 128;
+/** Max length for the repo identifier (`owner/repo` can be long). */
+const REPO_IDENTIFIER_MAX = 256;
+/** Max length for free-text fields (commit message, failure/error reason). */
+const STATUS_FREE_TEXT_MAX = 2e3;
+/** Max number of runs in a single `state.replay` snapshot. */
+const STATE_REPLAY_MAX_RUNS = 500;
+/** Max number of jobs attached to a single run in a `state.replay` snapshot. */
+const MAX_JOBS_PER_RUN = 1e3;
+/** Max number of `runsOn` / `secretsAccessed` label entries on a job/step. */
+const RUNS_ON_LABELS_MAX = 30;
+/** Max number of bound deployment-environment names on a job. */
+const ENVIRONMENTS_MAX = 30;
 /**
 * Status values for execution runs (execution_runs table).
 *
@@ -34,12 +48,33 @@ const ExecutionJobStatus = z.enum([
 	"timed_out_stale",
 	"drift_dropped"
 ]);
-/** Status values for execution steps (execution_steps table + step.status protocol messages). */
+/**
+* Status values for execution steps (execution_steps table + step.status protocol messages).
+*
+*  - `pending`   — a parallel-group child queued behind `maxParallel`, not yet launched.
+*  - `cancelled` — a parallel-group sibling aborted by fail-fast (NOT a failure).
+*/
 const ExecutionStepStatus = z.enum([
 	"running",
 	"success",
 	"failed",
-	"skipped"
+	"skipped",
+	"pending",
+	"cancelled"
+]);
+/**
+* How a step participates in a job's step concurrency model.
+*
+*  - `sequential`     — an ordinary step in the flat step sequence.
+*  - `parallel-child` — a child of a `parallel()` group, running concurrently
+*                       with its siblings, each its own observable step.
+*  - `parallel-group` — the structural group wrapper (no flat step index); used
+*                       only for the dashboard band aggregate, not persisted per step.
+*/
+const StepConcurrencyKind = z.enum([
+	"sequential",
+	"parallel-child",
+	"parallel-group"
 ]);
 /**
 * Distinct reasons a run/job ended because a configured wall-clock timeout
@@ -109,9 +144,9 @@ const initFailureSchema = z.object({
 	scope: z.enum(["run", "job"]),
 	category: InitFailureCategory,
 	/** Human-readable failure message (same content surfaced by RunFailureSummary). */
-	message: z.string(),
+	message: z.string().max(STATUS_FREE_TEXT_MAX),
 	/** Set when scope === 'job'. */
-	jobName: z.string().optional()
+	jobName: z.string().max(128).optional()
 });
 /** Terminal run states that indicate the run has completed. */
 const TERMINAL_RUN_STATES = new Set([
@@ -131,31 +166,50 @@ const TERMINAL_JOB_STATES = new Set([
 /** Structured execution status update for Platform metadata tracking. */
 const executionStatusSchema = z.object({
 	type: z.literal("execution.status"),
-	messageId: z.string(),
-	runId: z.string(),
-	workflowName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	workflowName: z.string().max(128),
 	status: ExecutionRunStatus,
-	repoIdentifier: z.string().optional(),
-	sha: z.string().optional(),
+	repoIdentifier: z.string().max(256).optional(),
+	/**
+	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
+	* `local`). Distinct from the routing-key-derived source provider; drives the
+	* dashboard's provider-aware repo links.
+	*/
+	repoProvider: z.string().max(128).optional(),
+	/** True when the run executed a developer's uploaded local working tree (`kici run remote`). */
+	localWorkingTree: z.boolean().optional(),
+	sha: z.string().max(128).optional(),
 	/** Git branch or tag (e.g. "main", "refs/tags/v1.0"). */
-	ref: z.string().optional(),
+	ref: z.string().max(128).optional(),
 	/** Trigger event type (e.g. "push", "pr:open"). */
-	triggerEvent: z.string().optional(),
+	triggerEvent: z.string().max(128).optional(),
 	/** First line of the commit message. */
-	commitMessage: z.string().optional(),
+	commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	jobCount: z.number().optional(),
 	startedAt: z.number(),
 	completedAt: z.number().optional(),
 	durationMs: z.number().optional(),
 	timestamp: z.number(),
 	/** Parent run ID for re-run lineage (null/undefined for original runs). */
-	parentRunId: z.string().nullable().optional(),
+	parentRunId: z.string().max(128).nullable().optional(),
 	/** Root ancestor run ID for re-run lineage (null/undefined for original runs). Always points to the first run in the chain. */
-	originalRunId: z.string().nullable().optional(),
+	originalRunId: z.string().max(128).nullable().optional(),
 	/** User identity that triggered this re-run (null/undefined for webhook-triggered). */
-	triggeredBy: z.string().nullable().optional(),
+	triggeredBy: z.string().max(128).nullable().optional(),
+	/**
+	* Triggering-actor identity captured from the provider event (the pusher / PR
+	* author), distinct from `triggeredBy` (the KiCI re-run user). Provider
+	* identities only — never tenant attribution (the wire-schema invariant: no
+	* `orgId` here). Powers the dashboard "triggered by @x" and actor-scope
+	* notifications. `triggerActorUsername` uses the wider repo-identifier bound
+	* because provider logins can be long display names.
+	*/
+	triggerActorProvider: z.string().max(128).nullable().optional(),
+	triggerActorUsername: z.string().max(256).nullable().optional(),
+	triggerActorUserId: z.string().max(128).nullable().optional(),
 	/** Human-readable reason why the run failed (only present for failed runs). */
-	failureReason: z.string().optional(),
+	failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	/**
 	* Total raw log bytes accumulated across all jobs of this run, summed by the
 	* orchestrator from per-step `logBytesStreamed` values reported by the agent.
@@ -173,35 +227,41 @@ const executionStatusSchema = z.object({
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
 	type: z.literal("step.status.forward"),
-	messageId: z.string(),
-	runId: z.string(),
-	jobId: z.string(),
-	jobName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	jobId: z.string().max(128),
+	jobName: z.string().max(128),
 	stepIndex: z.number(),
-	stepName: z.string(),
+	stepName: z.string().max(256),
 	state: ExecutionStepStatus,
 	timestamp: z.number(),
-	data: z.record(z.string(), z.unknown()).optional(),
+	data: z.record(z.string().max(128), z.unknown()).optional(),
 	/** Secret key names accessed by this step. Forwarded from agent for dashboard display. */
-	secretsAccessed: z.array(z.string()).optional()
+	secretsAccessed: z.array(z.string().max(128)).max(30).optional(),
+	/** Step concurrency role; absent means an ordinary sequential step. */
+	concurrencyKind: StepConcurrencyKind.optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().max(128).optional()
 });
 /** Per-job status forwarded from orchestrator to Platform (real-time). */
 const jobStatusForwardSchema = z.object({
 	type: z.literal("job.status.forward"),
-	messageId: z.string(),
-	runId: z.string(),
-	jobId: z.string(),
-	jobName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	jobId: z.string().max(128),
+	jobName: z.string().max(128),
 	status: ExecutionJobStatus,
-	matrixValues: z.record(z.string(), z.unknown()).optional(),
+	matrixValues: z.record(z.string().max(128), z.unknown()).optional(),
 	startedAt: z.number().optional(),
 	completedAt: z.number().optional(),
 	durationMs: z.number().optional(),
-	errorMessage: z.string().nullable().optional(),
-	agentId: z.string().nullable().optional(),
-	orchestratorId: z.string().nullable().optional(),
+	errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+	agentId: z.string().max(128).nullable().optional(),
+	orchestratorId: z.string().max(128).nullable().optional(),
 	/** Labels used for agent routing. */
-	runsOnLabels: z.array(z.string()).optional(),
+	runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+	/** Ordered bound deployment-environment names for this job (multi-env jobs). */
+	environments: z.array(z.string().max(128)).max(30).optional(),
 	/**
 	* Total raw log bytes accumulated across all steps of this job, summed by
 	* the orchestrator from per-step `logBytesStreamed` values reported by the
@@ -216,41 +276,42 @@ const jobStatusForwardSchema = z.object({
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 const stateReplaySchema = z.object({
 	type: z.literal("state.replay"),
-	messageId: z.string(),
+	messageId: z.string().max(128),
 	runs: z.array(z.object({
-		runId: z.string(),
-		workflowName: z.string(),
+		runId: z.string().max(128),
+		workflowName: z.string().max(128),
 		status: ExecutionRunStatus,
-		routingKey: z.string().optional(),
-		repoIdentifier: z.string().optional(),
-		sha: z.string().optional(),
-		ref: z.string().optional(),
-		triggerEvent: z.string().optional(),
-		commitMessage: z.string().optional(),
+		routingKey: z.string().max(128).optional(),
+		repoIdentifier: z.string().max(256).optional(),
+		sha: z.string().max(128).optional(),
+		ref: z.string().max(128).optional(),
+		triggerEvent: z.string().max(128).optional(),
+		commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobCount: z.number(),
 		startedAt: z.number(),
 		completedAt: z.number().optional(),
 		durationMs: z.number().optional(),
-		parentRunId: z.string().nullable().optional(),
-		originalRunId: z.string().nullable().optional(),
-		triggeredBy: z.string().nullable().optional(),
+		parentRunId: z.string().max(128).nullable().optional(),
+		originalRunId: z.string().max(128).nullable().optional(),
+		triggeredBy: z.string().max(128).nullable().optional(),
 		/** Human-readable reason why the run failed (only present for failed runs). */
-		failureReason: z.string().optional(),
+		failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobs: z.array(z.object({
-			jobId: z.string(),
-			jobName: z.string(),
-			status: z.string(),
+			jobId: z.string().max(128),
+			jobName: z.string().max(128),
+			status: z.string().max(128),
 			startedAt: z.number().optional(),
 			completedAt: z.number().optional(),
 			durationMs: z.number().optional(),
-			errorMessage: z.string().nullable().optional(),
-			agentId: z.string().nullable().optional(),
-			runsOnLabels: z.array(z.string()).optional()
-		}))
-	})),
+			errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+			agentId: z.string().max(128).nullable().optional(),
+			runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+			environments: z.array(z.string().max(128)).max(30).optional()
+		})).max(MAX_JOBS_PER_RUN)
+	})).max(500),
 	timestamp: z.number()
 });
 //#endregion
-export { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
+export { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map