@kici-dev/engine 0.1.23 → 0.1.25

package/dist/protocol/messages/execution-status.js

@@ -1,6 +1,20 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/execution-status.ts
+/** Max length for ids and short identifier fields (runId, jobId, sha, ref, …). */
+const STATUS_ID_MAX = 128;
+/** Max length for the repo identifier (`owner/repo` can be long). */
+const REPO_IDENTIFIER_MAX = 256;
+/** Max length for free-text fields (commit message, failure/error reason). */
+const STATUS_FREE_TEXT_MAX = 2e3;
+/** Max number of runs in a single `state.replay` snapshot. */
+const STATE_REPLAY_MAX_RUNS = 500;
+/** Max number of jobs attached to a single run in a `state.replay` snapshot. */
+const MAX_JOBS_PER_RUN = 1e3;
+/** Max number of `runsOn` / `secretsAccessed` label entries on a job/step. */
+const RUNS_ON_LABELS_MAX = 30;
+/** Max number of bound deployment-environment names on a job. */
+const ENVIRONMENTS_MAX = 30;
 /**
 * Status values for execution runs (execution_runs table).
 *
@@ -34,12 +48,45 @@ const ExecutionJobStatus = z.enum([
 	"timed_out_stale",
 	"drift_dropped"
 ]);
-/** Status values for execution steps (execution_steps table + step.status protocol messages). */
+/**
+* The status values a notification subscription may target at the given level.
+*
+* A run-level subscription matches against an `ExecutionRunStatus`; a job-level
+* subscription matches against an `ExecutionJobStatus` (which carries job-only
+* terminal states like `timed_out_stale` / `drift_dropped` / `skipped`). Both
+* the Platform validation and the dashboard editor derive their allowed set
+* from this single helper so server validation and UI options cannot diverge.
+*/
+function statusOptionsForLevel(level) {
+	return level === "job" ? ExecutionJobStatus.options : ExecutionRunStatus.options;
+}
+/**
+* Status values for execution steps (execution_steps table + step.status protocol messages).
+*
+*  - `pending`   — a parallel-group child queued behind `maxParallel`, not yet launched.
+*  - `cancelled` — a parallel-group sibling aborted by fail-fast (NOT a failure).
+*/
 const ExecutionStepStatus = z.enum([
 	"running",
 	"success",
 	"failed",
-	"skipped"
+	"skipped",
+	"pending",
+	"cancelled"
+]);
+/**
+* How a step participates in a job's step concurrency model.
+*
+*  - `sequential`     — an ordinary step in the flat step sequence.
+*  - `parallel-child` — a child of a `parallel()` group, running concurrently
+*                       with its siblings, each its own observable step.
+*  - `parallel-group` — the structural group wrapper (no flat step index); used
+*                       only for the dashboard band aggregate, not persisted per step.
+*/
+const StepConcurrencyKind = z.enum([
+	"sequential",
+	"parallel-child",
+	"parallel-group"
 ]);
 /**
 * Distinct reasons a run/job ended because a configured wall-clock timeout
@@ -109,18 +156,18 @@ const initFailureSchema = z.object({
 	scope: z.enum(["run", "job"]),
 	category: InitFailureCategory,
 	/** Human-readable failure message (same content surfaced by RunFailureSummary). */
-	message: z.string(),
+	message: z.string().max(STATUS_FREE_TEXT_MAX),
 	/** Set when scope === 'job'. */
-	jobName: z.string().optional()
+	jobName: z.string().max(128).optional()
 });
 /** Terminal run states that indicate the run has completed. */
-const TERMINAL_RUN_STATES = new Set([
+const TERMINAL_RUN_STATES = /* @__PURE__ */ new Set([
 	ExecutionRunStatus.enum.success,
 	ExecutionRunStatus.enum.failed,
 	ExecutionRunStatus.enum.cancelled
 ]);
 /** Terminal job states that indicate the job is no longer running. */
-const TERMINAL_JOB_STATES = new Set([
+const TERMINAL_JOB_STATES = /* @__PURE__ */ new Set([
 	ExecutionJobStatus.enum.success,
 	ExecutionJobStatus.enum.failed,
 	ExecutionJobStatus.enum.cancelled,
@@ -131,31 +178,52 @@ const TERMINAL_JOB_STATES = new Set([
 /** Structured execution status update for Platform metadata tracking. */
 const executionStatusSchema = z.object({
 	type: z.literal("execution.status"),
-	messageId: z.string(),
-	runId: z.string(),
-	workflowName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	workflowName: z.string().max(128),
 	status: ExecutionRunStatus,
-	repoIdentifier: z.string().optional(),
-	sha: z.string().optional(),
+	repoIdentifier: z.string().max(256).optional(),
+	/**
+	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
+	* `local`). Distinct from the routing-key-derived source provider; drives the
+	* dashboard's provider-aware repo links.
+	*/
+	repoProvider: z.string().max(128).optional(),
+	/** True when the run executed a developer's uploaded local working tree (`kici run remote`). */
+	localWorkingTree: z.boolean().optional(),
+	sha: z.string().max(128).optional(),
 	/** Git branch or tag (e.g. "main", "refs/tags/v1.0"). */
-	ref: z.string().optional(),
+	ref: z.string().max(128).optional(),
 	/** Trigger event type (e.g. "push", "pr:open"). */
-	triggerEvent: z.string().optional(),
+	triggerEvent: z.string().max(128).optional(),
 	/** First line of the commit message. */
-	commitMessage: z.string().optional(),
+	commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	jobCount: z.number().optional(),
 	startedAt: z.number(),
 	completedAt: z.number().optional(),
 	durationMs: z.number().optional(),
 	timestamp: z.number(),
 	/** Parent run ID for re-run lineage (null/undefined for original runs). */
-	parentRunId: z.string().nullable().optional(),
+	parentRunId: z.string().max(128).nullable().optional(),
 	/** Root ancestor run ID for re-run lineage (null/undefined for original runs). Always points to the first run in the chain. */
-	originalRunId: z.string().nullable().optional(),
+	originalRunId: z.string().max(128).nullable().optional(),
 	/** User identity that triggered this re-run (null/undefined for webhook-triggered). */
-	triggeredBy: z.string().nullable().optional(),
+	triggeredBy: z.string().max(128).nullable().optional(),
+	/** Agent provenance label when the run was triggered through an agent credential. */
+	triggeredByAgentLabel: z.string().max(128).nullable().optional(),
+	/**
+	* Triggering-actor identity captured from the provider event (the pusher / PR
+	* author), distinct from `triggeredBy` (the KiCI re-run user). Provider
+	* identities only — never tenant attribution (the wire-schema invariant: no
+	* `orgId` here). Powers the dashboard "triggered by @x" and actor-scope
+	* notifications. `triggerActorUsername` uses the wider repo-identifier bound
+	* because provider logins can be long display names.
+	*/
+	triggerActorProvider: z.string().max(128).nullable().optional(),
+	triggerActorUsername: z.string().max(256).nullable().optional(),
+	triggerActorUserId: z.string().max(128).nullable().optional(),
 	/** Human-readable reason why the run failed (only present for failed runs). */
-	failureReason: z.string().optional(),
+	failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	/**
 	* Total raw log bytes accumulated across all jobs of this run, summed by the
 	* orchestrator from per-step `logBytesStreamed` values reported by the agent.
@@ -173,35 +241,41 @@ const executionStatusSchema = z.object({
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
 	type: z.literal("step.status.forward"),
-	messageId: z.string(),
-	runId: z.string(),
-	jobId: z.string(),
-	jobName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	jobId: z.string().max(128),
+	jobName: z.string().max(128),
 	stepIndex: z.number(),
-	stepName: z.string(),
+	stepName: z.string().max(256),
 	state: ExecutionStepStatus,
 	timestamp: z.number(),
-	data: z.record(z.string(), z.unknown()).optional(),
+	data: z.record(z.string().max(128), z.unknown()).optional(),
 	/** Secret key names accessed by this step. Forwarded from agent for dashboard display. */
-	secretsAccessed: z.array(z.string()).optional()
+	secretsAccessed: z.array(z.string().max(128)).max(30).optional(),
+	/** Step concurrency role; absent means an ordinary sequential step. */
+	concurrencyKind: StepConcurrencyKind.optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().max(128).optional()
 });
 /** Per-job status forwarded from orchestrator to Platform (real-time). */
 const jobStatusForwardSchema = z.object({
 	type: z.literal("job.status.forward"),
-	messageId: z.string(),
-	runId: z.string(),
-	jobId: z.string(),
-	jobName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	jobId: z.string().max(128),
+	jobName: z.string().max(128),
 	status: ExecutionJobStatus,
-	matrixValues: z.record(z.string(), z.unknown()).optional(),
+	matrixValues: z.record(z.string().max(128), z.unknown()).optional(),
 	startedAt: z.number().optional(),
 	completedAt: z.number().optional(),
 	durationMs: z.number().optional(),
-	errorMessage: z.string().nullable().optional(),
-	agentId: z.string().nullable().optional(),
-	orchestratorId: z.string().nullable().optional(),
+	errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+	agentId: z.string().max(128).nullable().optional(),
+	orchestratorId: z.string().max(128).nullable().optional(),
 	/** Labels used for agent routing. */
-	runsOnLabels: z.array(z.string()).optional(),
+	runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+	/** Ordered bound deployment-environment names for this job (multi-env jobs). */
+	environments: z.array(z.string().max(128)).max(30).optional(),
 	/**
 	* Total raw log bytes accumulated across all steps of this job, summed by
 	* the orchestrator from per-step `logBytesStreamed` values reported by the
@@ -216,41 +290,43 @@ const jobStatusForwardSchema = z.object({
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 const stateReplaySchema = z.object({
 	type: z.literal("state.replay"),
-	messageId: z.string(),
+	messageId: z.string().max(128),
 	runs: z.array(z.object({
-		runId: z.string(),
-		workflowName: z.string(),
+		runId: z.string().max(128),
+		workflowName: z.string().max(128),
 		status: ExecutionRunStatus,
-		routingKey: z.string().optional(),
-		repoIdentifier: z.string().optional(),
-		sha: z.string().optional(),
-		ref: z.string().optional(),
-		triggerEvent: z.string().optional(),
-		commitMessage: z.string().optional(),
+		routingKey: z.string().max(128).optional(),
+		repoIdentifier: z.string().max(256).optional(),
+		sha: z.string().max(128).optional(),
+		ref: z.string().max(128).optional(),
+		triggerEvent: z.string().max(128).optional(),
+		commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobCount: z.number(),
 		startedAt: z.number(),
 		completedAt: z.number().optional(),
 		durationMs: z.number().optional(),
-		parentRunId: z.string().nullable().optional(),
-		originalRunId: z.string().nullable().optional(),
-		triggeredBy: z.string().nullable().optional(),
+		parentRunId: z.string().max(128).nullable().optional(),
+		originalRunId: z.string().max(128).nullable().optional(),
+		triggeredBy: z.string().max(128).nullable().optional(),
+		triggeredByAgentLabel: z.string().max(128).nullable().optional(),
 		/** Human-readable reason why the run failed (only present for failed runs). */
-		failureReason: z.string().optional(),
+		failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobs: z.array(z.object({
-			jobId: z.string(),
-			jobName: z.string(),
-			status: z.string(),
+			jobId: z.string().max(128),
+			jobName: z.string().max(128),
+			status: z.string().max(128),
 			startedAt: z.number().optional(),
 			completedAt: z.number().optional(),
 			durationMs: z.number().optional(),
-			errorMessage: z.string().nullable().optional(),
-			agentId: z.string().nullable().optional(),
-			runsOnLabels: z.array(z.string()).optional()
-		}))
-	})),
+			errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+			agentId: z.string().max(128).nullable().optional(),
+			runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+			environments: z.array(z.string().max(128)).max(30).optional()
+		})).max(MAX_JOBS_PER_RUN)
+	})).max(500),
 	timestamp: z.number()
 });
 //#endregion
-export { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
+export { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/join.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/join.ts
 /** Join request sent by a new orchestrator (via Platform relay or direct peer). */

package/dist/protocol/messages/log-pull.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/log-pull.ts
 /** Request historical logs for a completed or running execution. */

package/dist/protocol/messages/oidc-mint.d.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+/**
+ * Error discriminator for a failed provenance mint, carried on
+ * `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
+ * classes that consume it:
+ *   rejected    -> run/job missing or job terminal (MintRejectedError)
+ *   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
+ *   failed      -> any other Platform-side failure (MintRelayError)
+ */
+export declare const OidcMintErrorCode: z.ZodEnum<{
+    failed: "failed";
+    rejected: "rejected";
+    unavailable: "unavailable";
+}>;
+export type OidcMintErrorCode = z.infer<typeof OidcMintErrorCode>;
+/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
+export declare const oidcMintRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oidc.mint.request">;
+    requestId: z.ZodString;
+    orchestratorId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    audience: z.ZodString;
+    deferred: z.ZodOptional<z.ZodLiteral<true>>;
+    statementHash: z.ZodOptional<z.ZodString>;
+    origin: z.ZodOptional<z.ZodEnum<{
+        deferred: "deferred";
+        "offline-backfill": "offline-backfill";
+    }>>;
+}, z.core.$strip>;
+export type OidcMintRequest = z.infer<typeof oidcMintRequestSchema>;
+/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
+export declare const oidcMintResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oidc.mint.response">;
+    requestId: z.ZodString;
+    result: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+        expiresIn: z.ZodNumber;
+        jti: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodObject<{
+        code: z.ZodEnum<{
+            failed: "failed";
+            rejected: "rejected";
+            unavailable: "unavailable";
+        }>;
+        message: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type OidcMintResponse = z.infer<typeof oidcMintResponseSchema>;
+//# sourceMappingURL=oidc-mint.d.ts.map

package/dist/protocol/messages/oidc-mint.js

@@ -0,0 +1,55 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { AttestationOrigin } from "../../provenance/attestation-origin.js";
+import { z } from "zod";
+//#region src/protocol/messages/oidc-mint.ts
+/**
+* Error discriminator for a failed provenance mint, carried on
+* `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
+* classes that consume it:
+*   rejected    -> run/job missing or job terminal (MintRejectedError)
+*   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
+*   failed      -> any other Platform-side failure (MintRelayError)
+*/
+const OidcMintErrorCode = z.enum([
+	"rejected",
+	"unavailable",
+	"failed"
+]);
+/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
+const oidcMintRequestSchema = z.object({
+	type: z.literal("oidc.mint.request"),
+	requestId: z.string().min(1),
+	orchestratorId: z.string().min(1),
+	runId: z.string().min(1),
+	jobId: z.string().min(1),
+	audience: z.string().min(1).max(255),
+	/**
+	* Deferred fulfilment (attest-later): when true, the mint knowingly targets a
+	* completed job and binds `statementHash` + `origin` into the token. Absent
+	* for the live agent path. `orgId` is never on the wire — the Platform derives
+	* it from the authenticated connection.
+	*/
+	deferred: z.literal(true).optional(),
+	/** SHA-256 of the frozen DSSE statement the deferred token binds to. */
+	statementHash: z.string().optional(),
+	/** Mint-timing origin for a deferred fulfilment (never `live` here). */
+	origin: AttestationOrigin.extract(["deferred", "offline-backfill"]).optional()
+});
+/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
+const oidcMintResponseSchema = z.object({
+	type: z.literal("oidc.mint.response"),
+	requestId: z.string().min(1),
+	result: z.object({
+		token: z.string().min(1),
+		expiresIn: z.number().int().positive(),
+		jti: z.string().min(1)
+	}).optional(),
+	error: z.object({
+		code: OidcMintErrorCode,
+		message: z.string()
+	}).optional()
+}).refine((m) => m.result === void 0 !== (m.error === void 0), { message: "oidc.mint.response must carry exactly one of result | error" });
+//#endregion
+export { OidcMintErrorCode, oidcMintRequestSchema, oidcMintResponseSchema };
+
+//# sourceMappingURL=oidc-mint.js.map

package/dist/protocol/messages/oidc-token-relay.d.ts

@@ -18,14 +18,41 @@ export declare const oidcTokenRequestParamsSchema: z.ZodObject<{
     audience: z.ZodString;
 }, z.core.$strip>;
 export type OidcTokenRequestParams = z.infer<typeof oidcTokenRequestParamsSchema>;
+export { OidcMintErrorCode } from './oidc-mint.js';
+export type { OidcMintErrorCode as OidcMintErrorCodeType } from './oidc-mint.js';
+/** A successfully minted ID token bound to a job. */
+export declare const oidcMintedTokenSchema: z.ZodObject<{
+    token: z.ZodString;
+    expiresIn: z.ZodNumber;
+    jti: z.ZodString;
+}, z.core.$strip>;
+export type OidcMintedToken = z.infer<typeof oidcMintedTokenSchema>;
 /**
- * Result the orchestrator returns to the agent: the minted short-lived JWT
- * plus its lifetime and identifier.
+ * Result the orchestrator returns to the agent: either the minted short-lived
+ * JWT, or — when the mint failed transiently (`unavailable`/`failed`, never
+ * `rejected`) — a `deferred` signal so the agent freezes the statement and
+ * reports it for later fulfilment. A permanent `rejected` is thrown, never
+ * returned, so it is not part of this union.
  */
-export declare const oidcTokenResultSchema: z.ZodObject<{
+export declare const oidcTokenResultSchema: z.ZodUnion<readonly [z.ZodObject<{
     token: z.ZodString;
     expiresIn: z.ZodNumber;
     jti: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    deferred: z.ZodLiteral<true>;
+    code: z.ZodEnum<{
+        failed: "failed";
+        unavailable: "unavailable";
+    }>;
+}, z.core.$strip>]>;
 export type OidcTokenResult = z.infer<typeof oidcTokenResultSchema>;
+/** Extra fields a deferred *fulfilment* mint carries (orchestrator -> Platform). */
+export declare const deferredMintParamsSchema: z.ZodObject<{
+    statementHash: z.ZodString;
+    origin: z.ZodEnum<{
+        deferred: "deferred";
+        "offline-backfill": "offline-backfill";
+    }>;
+}, z.core.$strip>;
+export type DeferredMintParams = z.infer<typeof deferredMintParamsSchema>;
 //# sourceMappingURL=oidc-token-relay.d.ts.map

package/dist/protocol/messages/oidc-token-relay.js

@@ -1,4 +1,6 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
+import { AttestationOrigin } from "../../provenance/attestation-origin.js";
+import { OidcMintErrorCode } from "./oidc-mint.js";
 import { z } from "zod";
 //#region src/protocol/messages/oidc-token-relay.ts
 /**
@@ -19,16 +21,29 @@ const oidcTokenRequestParamsSchema = z.object({
 	jobId: z.string().min(1),
 	audience: z.string().min(1).max(255)
 });
-/**
-* Result the orchestrator returns to the agent: the minted short-lived JWT
-* plus its lifetime and identifier.
-*/
-const oidcTokenResultSchema = z.object({
+/** A successfully minted ID token bound to a job. */
+const oidcMintedTokenSchema = z.object({
 	token: z.string(),
 	expiresIn: z.number().int().positive(),
 	jti: z.string()
 });
+/**
+* Result the orchestrator returns to the agent: either the minted short-lived
+* JWT, or — when the mint failed transiently (`unavailable`/`failed`, never
+* `rejected`) — a `deferred` signal so the agent freezes the statement and
+* reports it for later fulfilment. A permanent `rejected` is thrown, never
+* returned, so it is not part of this union.
+*/
+const oidcTokenResultSchema = z.union([oidcMintedTokenSchema, z.object({
+	deferred: z.literal(true),
+	code: z.enum(["unavailable", "failed"])
+})]);
+/** Extra fields a deferred *fulfilment* mint carries (orchestrator -> Platform). */
+const deferredMintParamsSchema = z.object({
+	statementHash: z.string(),
+	origin: AttestationOrigin.extract(["deferred", "offline-backfill"])
+});
 //#endregion
-export { OIDC_TOKEN_REQUEST_METHOD, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
+export { OIDC_TOKEN_REQUEST_METHOD, OidcMintErrorCode, deferredMintParamsSchema, oidcMintedTokenSchema, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
 
 //# sourceMappingURL=oidc-token-relay.js.map

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -298,8 +298,10 @@ export declare const agentStepStatusSchema: z.ZodObject<{
     state: z.ZodEnum<{
         skipped: "skipped";
         success: "success";
+        pending: "pending";
         running: "running";
         failed: "failed";
+        cancelled: "cancelled";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -313,6 +315,12 @@ export declare const agentStepStatusSchema: z.ZodObject<{
         "hook:afterStep": "hook:afterStep";
     }>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyKind: z.ZodOptional<z.ZodEnum<{
+        sequential: "sequential";
+        "parallel-child": "parallel-child";
+        "parallel-group": "parallel-group";
+    }>>;
+    groupId: z.ZodOptional<z.ZodString>;
     logBytesStreamed: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /** Agent -> Orchestrator: report that a job belongs to a concurrency group. */
@@ -342,8 +350,8 @@ export declare const jobConcurrencyAckSchema: z.ZodObject<{
     type: z.ZodLiteral<"job.concurrency.ack">;
     requestId: z.ZodString;
     action: z.ZodEnum<{
-        proceed: "proceed";
         wait: "wait";
+        proceed: "proceed";
         cancel: "cancel";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -418,6 +426,32 @@ export declare const provenanceUploadCompleteSchema: z.ZodObject<{
     subjectDigest: z.ZodString;
     mediaType: z.ZodString;
 }, z.core.$strip>;
+/**
+ * Agent -> Orchestrator: capture a frozen, DSSE-signed provenance statement for
+ * later minting (the transient mint-failure path). No upload happens; the
+ * orchestrator persists the envelope in its deferred-attestation outbox and the
+ * job completes green. The identity token is minted later and bound to the
+ * frozen statement by `statementHash`.
+ */
+export declare const provenanceUploadDeferSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.defer">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    audience: z.ZodString;
+    mediaType: z.ZodString;
+    statementHash: z.ZodString;
+    dsseEnvelope: z.ZodObject<{
+        payloadType: z.ZodString;
+        payload: z.ZodString;
+        signatures: z.ZodArray<z.ZodObject<{
+            keyid: z.ZodString;
+            sig: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 export declare const eventEmitSchema: z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
@@ -513,8 +547,8 @@ export declare const fleetBundleErrorSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Outcome of a step-level approval hold, sent back to the waiting agent. */
 export declare const StepApprovalOutcome: z.ZodEnum<{
-    rejected: "rejected";
     approved: "approved";
+    rejected: "rejected";
     expired: "expired";
 }>;
 export type StepApprovalOutcome = z.infer<typeof StepApprovalOutcome>;
@@ -575,8 +609,8 @@ export declare const stepApprovalResolvedSchema: z.ZodObject<{
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
     outcome: z.ZodEnum<{
-        rejected: "rejected";
         approved: "approved";
+        rejected: "rejected";
         expired: "expired";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -674,8 +708,8 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     type: z.ZodLiteral<"job.concurrency.ack">;
     requestId: z.ZodString;
     action: z.ZodEnum<{
-        proceed: "proceed";
         wait: "wait";
+        proceed: "proceed";
         cancel: "cancel";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -729,8 +763,8 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
     outcome: z.ZodEnum<{
-        rejected: "rejected";
         approved: "approved";
+        rejected: "rejected";
         expired: "expired";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -825,8 +859,10 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     state: z.ZodEnum<{
         skipped: "skipped";
         success: "success";
+        pending: "pending";
         running: "running";
         failed: "failed";
+        cancelled: "cancelled";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -840,6 +876,12 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
         "hook:afterStep": "hook:afterStep";
     }>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyKind: z.ZodOptional<z.ZodEnum<{
+        sequential: "sequential";
+        "parallel-child": "parallel-child";
+        "parallel-group": "parallel-group";
+    }>>;
+    groupId: z.ZodOptional<z.ZodString>;
     logBytesStreamed: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"job.heartbeat">;
@@ -917,6 +959,24 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     subjectName: z.ZodString;
     subjectDigest: z.ZodString;
     mediaType: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.defer">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    audience: z.ZodString;
+    mediaType: z.ZodString;
+    statementHash: z.ZodString;
+    dsseEnvelope: z.ZodObject<{
+        payloadType: z.ZodString;
+        payload: z.ZodString;
+        signatures: z.ZodArray<z.ZodObject<{
+            keyid: z.ZodString;
+            sig: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
     jobId: z.ZodString;
@@ -1002,6 +1062,7 @@ export type CacheUserSaveComplete = z.infer<typeof cacheUserSaveCompleteSchema>;
 export type ProvenanceUploadRequest = z.infer<typeof provenanceUploadRequestSchema>;
 export type ProvenanceUploadResponse = z.infer<typeof provenanceUploadResponseSchema>;
 export type ProvenanceUploadComplete = z.infer<typeof provenanceUploadCompleteSchema>;
+export type ProvenanceUploadDefer = z.infer<typeof provenanceUploadDeferSchema>;
 export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
 export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
 export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;