@kici-dev/engine 0.1.24 → 0.1.25

package/dist/metrics/metric-catalog.generated.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/metrics/metric-catalog.generated.ts
 const MetricNames = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: "kici_agent_clone_duration_seconds",
@@ -17,6 +17,11 @@ const MetricNames = {
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "kici_cross_source_errors_total",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "kici_cross_source_fanout_size",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "kici_dashboard_relay_latency_seconds",
+	KICI_MCP_AUTH_REJECTIONS_TOTAL: "kici_mcp_auth_rejections_total",
+	KICI_MCP_DB_POOL_CONNECTIONS: "kici_mcp_db_pool_connections",
+	KICI_MCP_RATE_LIMITED_TOTAL: "kici_mcp_rate_limited_total",
+	KICI_MCP_TOOL_DURATION_SECONDS: "kici_mcp_tool_duration_seconds",
+	KICI_MCP_TOOL_REQUESTS_TOTAL: "kici_mcp_tool_requests_total",
 	KICI_ORCH_AGENTS_ACTIVE: "kici_orch_agents_active",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "kici_orch_build_duration_seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "kici_orch_config_reload_total",
@@ -47,7 +52,10 @@ const MetricNames = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "kici_orch_job_runs_total",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "kici_orch_log_bytes_stored_total",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "kici_orch_log_chunks_received_total",
+	KICI_ORCH_PENDING_ATTESTATION_OLDEST_AGE_SECONDS: "kici_orch_pending_attestation_oldest_age_seconds",
+	KICI_ORCH_PENDING_ATTESTATIONS_CURRENT: "kici_orch_pending_attestations_current",
 	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_orch_pg_pool_client_errors_total",
+	KICI_ORCH_REJECTED_ATTESTATIONS_CURRENT: "kici_orch_rejected_attestations_current",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "kici_orch_scaler_config_reloads_total",
 	KICI_ORCH_SCALER_CPUS_USED: "kici_orch_scaler_cpus_used",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "kici_orch_scaler_memory_bytes_used",
@@ -71,6 +79,11 @@ const MetricNames = {
 	KICI_ORGS_TOTAL: "kici_orgs_total",
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "kici_plan_cap_exceeded_total",
 	KICI_PLAN_USAGE_RATIO: "kici_plan_usage_ratio",
+	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "kici_platform_coordinator_pool_size",
+	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "kici_platform_coordinator_probe_latency_ms",
+	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "kici_platform_coordinator_probe_timeouts_total",
+	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "kici_platform_coordinator_stale_entries",
+	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "kici_platform_coordinator_zombie_entries_total",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "kici_platform_cross_tenant_rejections_total",
 	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: "kici_platform_dashboard_proxy_duration_seconds",
 	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: "kici_platform_dashboard_proxy_pending",
@@ -94,6 +107,10 @@ const MetricNames = {
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "kici_platform_orphan_connections_swept_total",
 	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_platform_pg_pool_client_errors_total",
 	KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "kici_platform_plan_cap_check_errors_total",
+	KICI_PLATFORM_RELAY_BREAKER_STATE: "kici_platform_relay_breaker_state",
+	KICI_PLATFORM_RELAY_BREAKER_TRIPS_TOTAL: "kici_platform_relay_breaker_trips_total",
+	KICI_PLATFORM_RELAY_REQUEST_DURATION_MS: "kici_platform_relay_request_duration_ms",
+	KICI_PLATFORM_RELAY_REQUEST_OUTCOME_TOTAL: "kici_platform_relay_request_outcome_total",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "kici_platform_stale_orchestrators_total",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "kici_platform_stale_platform_connections_evicted_total",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "kici_platform_stale_runs_failed_total",
@@ -156,6 +173,11 @@ const MetricLabels = {
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: ["reason"],
 	KICI_CROSS_SOURCE_FANOUT_SIZE: ["event"],
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: ["outcome"],
+	KICI_MCP_AUTH_REJECTIONS_TOTAL: ["reason"],
+	KICI_MCP_DB_POOL_CONNECTIONS: ["state"],
+	KICI_MCP_RATE_LIMITED_TOTAL: ["kind"],
+	KICI_MCP_TOOL_DURATION_SECONDS: ["tool"],
+	KICI_MCP_TOOL_REQUESTS_TOTAL: ["tool", "outcome"],
 	KICI_ORCH_AGENTS_ACTIVE: [],
 	KICI_ORCH_BUILD_DURATION_SECONDS: [],
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: ["result", "source"],
@@ -190,7 +212,10 @@ const MetricLabels = {
 	KICI_ORCH_JOB_RUNS_TOTAL: ["job", "result"],
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: [],
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: [],
+	KICI_ORCH_PENDING_ATTESTATION_OLDEST_AGE_SECONDS: [],
+	KICI_ORCH_PENDING_ATTESTATIONS_CURRENT: [],
 	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: ["source"],
+	KICI_ORCH_REJECTED_ATTESTATIONS_CURRENT: [],
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: ["result"],
 	KICI_ORCH_SCALER_CPUS_USED: [
 		"scaler",
@@ -222,6 +247,11 @@ const MetricLabels = {
 	KICI_ORGS_TOTAL: ["plan_type"],
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: ["org_id", "dimension"],
 	KICI_PLAN_USAGE_RATIO: ["org_id", "dimension"],
+	KICI_PLATFORM_COORDINATOR_POOL_SIZE: ["routingKey"],
+	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: ["clusterName", "connectionId"],
+	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: ["clusterName", "connectionId"],
+	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: [],
+	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: ["clusterName"],
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: ["reason"],
 	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: ["outcome"],
 	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: [],
@@ -245,6 +275,10 @@ const MetricLabels = {
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: [],
 	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: ["source"],
 	KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: ["org_id"],
+	KICI_PLATFORM_RELAY_BREAKER_STATE: ["clusterName", "connectionId"],
+	KICI_PLATFORM_RELAY_BREAKER_TRIPS_TOTAL: ["clusterName", "connectionId"],
+	KICI_PLATFORM_RELAY_REQUEST_DURATION_MS: ["kind"],
+	KICI_PLATFORM_RELAY_REQUEST_OUTCOME_TOTAL: ["outcome", "kind"],
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: [],
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: ["org_id"],
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: [],
@@ -311,6 +345,11 @@ const MetricKind = {
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "counter",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "histogram",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "histogram",
+	KICI_MCP_AUTH_REJECTIONS_TOTAL: "counter",
+	KICI_MCP_DB_POOL_CONNECTIONS: "observableGauge",
+	KICI_MCP_RATE_LIMITED_TOTAL: "counter",
+	KICI_MCP_TOOL_DURATION_SECONDS: "histogram",
+	KICI_MCP_TOOL_REQUESTS_TOTAL: "counter",
 	KICI_ORCH_AGENTS_ACTIVE: "observableGauge",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "histogram",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "counter",
@@ -341,7 +380,10 @@ const MetricKind = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "counter",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "counter",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "counter",
+	KICI_ORCH_PENDING_ATTESTATION_OLDEST_AGE_SECONDS: "observableGauge",
+	KICI_ORCH_PENDING_ATTESTATIONS_CURRENT: "observableGauge",
 	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "counter",
+	KICI_ORCH_REJECTED_ATTESTATIONS_CURRENT: "observableGauge",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "counter",
 	KICI_ORCH_SCALER_CPUS_USED: "observableGauge",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "observableGauge",
@@ -365,6 +407,11 @@ const MetricKind = {
 	KICI_ORGS_TOTAL: "observableGauge",
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "counter",
 	KICI_PLAN_USAGE_RATIO: "observableGauge",
+	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "observableGauge",
+	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "histogram",
+	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "counter",
+	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "observableGauge",
+	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "counter",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "counter",
 	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: "histogram",
 	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: "observableGauge",
@@ -388,6 +435,10 @@ const MetricKind = {
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "counter",
 	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "counter",
 	KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "counter",
+	KICI_PLATFORM_RELAY_BREAKER_STATE: "observableGauge",
+	KICI_PLATFORM_RELAY_BREAKER_TRIPS_TOTAL: "counter",
+	KICI_PLATFORM_RELAY_REQUEST_DURATION_MS: "histogram",
+	KICI_PLATFORM_RELAY_REQUEST_OUTCOME_TOTAL: "counter",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "counter",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "counter",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "counter",
@@ -450,6 +501,11 @@ const MetricDescription = {
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "Errors encountered during cross-source webhook dispatch",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "Number of webhook-trigger registrations matched when an inbound generic webhook fans out across sources in the same org",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "Round-trip latency of a cross-instance dashboard relay request",
+	KICI_MCP_AUTH_REJECTIONS_TOTAL: "Developer-MCP requests rejected by the agent-credential gate",
+	KICI_MCP_DB_POOL_CONNECTIONS: "MCP-dedicated Postgres pool connection counts",
+	KICI_MCP_RATE_LIMITED_TOTAL: "Developer-MCP requests rejected by the per-credential rate limiter",
+	KICI_MCP_TOOL_DURATION_SECONDS: "Developer-MCP tool invocation duration in seconds",
+	KICI_MCP_TOOL_REQUESTS_TOTAL: "Total developer-MCP tool invocations by tool and outcome",
 	KICI_ORCH_AGENTS_ACTIVE: "Current number of active agents connected",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "Duration of build agent operations in seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "Total number of config reload operations",
@@ -480,7 +536,10 @@ const MetricDescription = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "Scheduled job run outcomes, by job and result (success/failure)",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "Total bytes of log data written to storage",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "Total number of log chunks received from agents",
+	KICI_ORCH_PENDING_ATTESTATION_OLDEST_AGE_SECONDS: "Age of the oldest deferred attestation in the outbox",
+	KICI_ORCH_PENDING_ATTESTATIONS_CURRENT: "Deferred attestations awaiting a later mint",
 	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart",
+	KICI_ORCH_REJECTED_ATTESTATIONS_CURRENT: "Deferred attestations permanently rejected (run/job absent on Platform); terminal, re-attempted only via kici-admin attestations retry --include-rejected",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "Total number of scaler config reload operations",
 	KICI_ORCH_SCALER_CPUS_USED: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.",
@@ -504,6 +563,11 @@ const MetricDescription = {
 	KICI_ORGS_TOTAL: "Total organizations by plan type",
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "Total times an org hit a plan cap (per dimension)",
 	KICI_PLAN_USAGE_RATIO: "Per-org per-dimension usage ratio (current / cap)",
+	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "Coordinator pool size per routing key",
+	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "Active coordinator liveness-probe round-trip latency in ms",
+	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "Active coordinator liveness-probe timeouts",
+	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "Stale (non-OPEN socket) coordinator entries in the pool per routing key",
+	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "Zombie (non-OPEN) coordinator entries encountered during relay selection",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "Total cross-tenant WS messages rejected by the Platform (security invariant). Labels: reason.",
 	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: "Dashboard proxy request round-trip duration in seconds",
 	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: "In-flight dashboard proxy requests (Platform → orchestrator)",
@@ -527,6 +591,10 @@ const MetricDescription = {
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections",
 	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart",
 	KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "WS connection rejected because the plan-limit check errored (fail-closed)",
+	KICI_PLATFORM_RELAY_BREAKER_STATE: "Relay circuit-breaker state per coordinator (0=closed,1=half-open,2=open)",
+	KICI_PLATFORM_RELAY_BREAKER_TRIPS_TOTAL: "Relay circuit-breaker open transitions per coordinator",
+	KICI_PLATFORM_RELAY_REQUEST_DURATION_MS: "End-to-end dashboard-proxy relay latency incl. failover, in ms",
+	KICI_PLATFORM_RELAY_REQUEST_OUTCOME_TOTAL: "Dashboard-proxy relay request outcomes (incl. sibling failover)",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "Total execution runs failed due to orchestrator staleness",
@@ -596,6 +664,11 @@ const MetricService = {
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "orchestrator",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "orchestrator",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "platform",
+	KICI_MCP_AUTH_REJECTIONS_TOTAL: "platform",
+	KICI_MCP_DB_POOL_CONNECTIONS: "platform",
+	KICI_MCP_RATE_LIMITED_TOTAL: "platform",
+	KICI_MCP_TOOL_DURATION_SECONDS: "platform",
+	KICI_MCP_TOOL_REQUESTS_TOTAL: "platform",
 	KICI_ORCH_AGENTS_ACTIVE: "orchestrator",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "orchestrator",
@@ -626,7 +699,10 @@ const MetricService = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "orchestrator",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "orchestrator",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "orchestrator",
+	KICI_ORCH_PENDING_ATTESTATION_OLDEST_AGE_SECONDS: "orchestrator",
+	KICI_ORCH_PENDING_ATTESTATIONS_CURRENT: "orchestrator",
 	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "orchestrator",
+	KICI_ORCH_REJECTED_ATTESTATIONS_CURRENT: "orchestrator",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "orchestrator",
 	KICI_ORCH_SCALER_CPUS_USED: "orchestrator",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "orchestrator",
@@ -650,6 +726,11 @@ const MetricService = {
 	KICI_ORGS_TOTAL: "platform",
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "platform",
 	KICI_PLAN_USAGE_RATIO: "platform",
+	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "platform",
+	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "platform",
+	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "platform",
+	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "platform",
+	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "platform",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "platform",
 	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: "platform",
 	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: "platform",
@@ -673,6 +754,10 @@ const MetricService = {
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "platform",
 	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "platform",
 	KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "platform",
+	KICI_PLATFORM_RELAY_BREAKER_STATE: "platform",
+	KICI_PLATFORM_RELAY_BREAKER_TRIPS_TOTAL: "platform",
+	KICI_PLATFORM_RELAY_REQUEST_DURATION_MS: "platform",
+	KICI_PLATFORM_RELAY_REQUEST_OUTCOME_TOTAL: "platform",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "platform",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "platform",
@@ -736,6 +821,11 @@ const ALL_METRIC_NAMES = [
 	"kici_cross_source_errors_total",
 	"kici_cross_source_fanout_size",
 	"kici_dashboard_relay_latency_seconds",
+	"kici_mcp_auth_rejections_total",
+	"kici_mcp_db_pool_connections",
+	"kici_mcp_rate_limited_total",
+	"kici_mcp_tool_duration_seconds",
+	"kici_mcp_tool_requests_total",
 	"kici_orch_agents_active",
 	"kici_orch_build_duration_seconds",
 	"kici_orch_config_reload_total",
@@ -766,7 +856,10 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_job_runs_total",
 	"kici_orch_log_bytes_stored_total",
 	"kici_orch_log_chunks_received_total",
+	"kici_orch_pending_attestation_oldest_age_seconds",
+	"kici_orch_pending_attestations_current",
 	"kici_orch_pg_pool_client_errors_total",
+	"kici_orch_rejected_attestations_current",
 	"kici_orch_scaler_config_reloads_total",
 	"kici_orch_scaler_cpus_used",
 	"kici_orch_scaler_memory_bytes_used",
@@ -790,6 +883,11 @@ const ALL_METRIC_NAMES = [
 	"kici_orgs_total",
 	"kici_plan_cap_exceeded_total",
 	"kici_plan_usage_ratio",
+	"kici_platform_coordinator_pool_size",
+	"kici_platform_coordinator_probe_latency_ms",
+	"kici_platform_coordinator_probe_timeouts_total",
+	"kici_platform_coordinator_stale_entries",
+	"kici_platform_coordinator_zombie_entries_total",
 	"kici_platform_cross_tenant_rejections_total",
 	"kici_platform_dashboard_proxy_duration_seconds",
 	"kici_platform_dashboard_proxy_pending",
@@ -813,6 +911,10 @@ const ALL_METRIC_NAMES = [
 	"kici_platform_orphan_connections_swept_total",
 	"kici_platform_pg_pool_client_errors_total",
 	"kici_platform_plan_cap_check_errors_total",
+	"kici_platform_relay_breaker_state",
+	"kici_platform_relay_breaker_trips_total",
+	"kici_platform_relay_request_duration_ms",
+	"kici_platform_relay_request_outcome_total",
 	"kici_platform_stale_orchestrators_total",
 	"kici_platform_stale_platform_connections_evicted_total",
 	"kici_platform_stale_runs_failed_total",

package/dist/protocol/analytics-events.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/analytics-events.ts
 const AnalyticsEvent = z.enum([

package/dist/protocol/cluster-name.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/cluster-name.ts
 /**

package/dist/protocol/dashboard-global-workflows.js

@@ -1,3 +1,3 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema } from "./messages/dashboard-global-workflows.js";
 export { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema };

package/dist/protocol/dashboard-write-operations.d.ts

@@ -38,6 +38,7 @@ export declare const DashboardWriteOperation: z.ZodEnum<{
     "held_runs.reject": "held_runs.reject";
     "event_dlq.retry": "event_dlq.retry";
     "event_dlq.discard": "event_dlq.discard";
+    "attestations.retry": "attestations.retry";
     "registration.disable": "registration.disable";
     "registration.delete": "registration.delete";
     "global_workflows.update": "global_workflows.update";
@@ -57,6 +58,7 @@ export declare const DashboardWriteCategory: z.ZodEnum<{
     Bindings: "Bindings";
     "Held runs": "Held runs";
     DLQ: "DLQ";
+    Attestations: "Attestations";
     Registrations: "Registrations";
     Topology: "Topology";
     Fleet: "Fleet";
@@ -127,6 +129,7 @@ export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
     "held_runs.reject": "held_runs.reject";
     "event_dlq.retry": "event_dlq.retry";
     "event_dlq.discard": "event_dlq.discard";
+    "attestations.retry": "attestations.retry";
     "registration.disable": "registration.disable";
     "registration.delete": "registration.delete";
     "global_workflows.update": "global_workflows.update";
@@ -155,6 +158,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
     "held_runs.reject": "held_runs.reject";
     "event_dlq.retry": "event_dlq.retry";
     "event_dlq.discard": "event_dlq.discard";
+    "attestations.retry": "attestations.retry";
     "registration.disable": "registration.disable";
     "registration.delete": "registration.delete";
     "global_workflows.update": "global_workflows.update";
@@ -171,7 +175,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
 export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
 /**
  * Expand a (possibly sparse) policy map into the full effective state
- * for all 26 operations. Operations the policy doesn't mention come
+ * for all 27 operations. Operations the policy doesn't mention come
  * back as `true` (permissive). Used by the orch HTTP admin response,
  * the WS `orch.capabilities` broadcast, and the dashboard's policy
  * page so consumers see the full picture, not the sparse storage shape.

package/dist/protocol/dashboard-write-operations.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/dashboard-write-operations.ts
 /**
@@ -40,6 +40,7 @@ const DashboardWriteOperation = z.enum([
 	"held_runs.reject",
 	"event_dlq.retry",
 	"event_dlq.discard",
+	"attestations.retry",
 	"registration.disable",
 	"registration.delete",
 	"global_workflows.update",
@@ -69,6 +70,7 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
 	"held_runs.reject",
 	"event_dlq.retry",
 	"event_dlq.discard",
+	"attestations.retry",
 	"registration.disable",
 	"registration.delete",
 	"global_workflows.update",
@@ -85,6 +87,7 @@ const DashboardWriteCategory = z.enum([
 	"Bindings",
 	"Held runs",
 	"DLQ",
+	"Attestations",
 	"Registrations",
 	"Topology",
 	"Fleet"
@@ -239,6 +242,14 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		sensitivity: "dispatch",
 		cliEquivalent: "kici-admin event-dlq discard"
 	},
+	{
+		name: "attestations.retry",
+		wireMessageType: "dashboard.attestation.retry",
+		category: "Attestations",
+		label: "Retry deferred attestations",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin attestations retry"
+	},
 	{
 		name: "registration.disable",
 		wireMessageType: "dashboard.registration.disable",
@@ -339,7 +350,7 @@ function isDashboardWriteOperationEnabled(policy, op) {
 }
 /**
 * Expand a (possibly sparse) policy map into the full effective state
-* for all 26 operations. Operations the policy doesn't mention come
+* for all 27 operations. Operations the policy doesn't mention come
 * back as `true` (permissive). Used by the orch HTTP admin response,
 * the WS `orch.capabilities` broadcast, and the dashboard's policy
 * page so consumers see the full picture, not the sparse storage shape.

package/dist/protocol/event-log-payload.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/protocol/event-log-payload.ts
 /**
 * Constants for the chunked event-log payload streaming transport.

package/dist/protocol/messages/access-log.d.ts

@@ -28,9 +28,9 @@ export declare const AccessLogOutcome: z.ZodEnum<{
 export type AccessLogOutcome = z.infer<typeof AccessLogOutcome>;
 /** Target object category. */
 export declare const AccessLogTargetType: z.ZodEnum<{
-    run: "run";
     job: "job";
     step: "step";
+    run: "run";
     environment: "environment";
     payload: "payload";
     event_log: "event_log";
@@ -221,9 +221,9 @@ export declare const accessLogItemSchema: z.ZodObject<{
         purge_chunk: "purge_chunk";
     }>;
     targetType: z.ZodNullable<z.ZodEnum<{
-        run: "run";
         job: "job";
         step: "step";
+        run: "run";
         environment: "environment";
         payload: "payload";
         event_log: "event_log";
@@ -255,6 +255,7 @@ export declare const accessLogItemSchema: z.ZodObject<{
         denied: "denied";
     }>;
     errorMessage: z.ZodNullable<z.ZodString>;
+    agentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     createdAt: z.ZodString;
 }, z.core.$strip>;
 export type AccessLogItem = z.infer<typeof accessLogItemSchema>;
@@ -352,9 +353,9 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         denied: "denied";
     }>>;
     targetType: z.ZodOptional<z.ZodEnum<{
-        run: "run";
         job: "job";
         step: "step";
+        run: "run";
         environment: "environment";
         payload: "payload";
         event_log: "event_log";
@@ -375,6 +376,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
     targetId: z.ZodOptional<z.ZodString>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
     toTimestamp: z.ZodOptional<z.ZodString>;
+    agentLabel: z.ZodOptional<z.ZodString>;
+    agentOnly: z.ZodOptional<z.ZodBoolean>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -393,6 +396,9 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
         keyId: z.ZodString;
         ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"service_account">;
         id: z.ZodString;
@@ -498,9 +504,9 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         denied: "denied";
     }>>;
     targetType: z.ZodOptional<z.ZodEnum<{
-        run: "run";
         job: "job";
         step: "step";
+        run: "run";
         environment: "environment";
         payload: "payload";
         event_log: "event_log";
@@ -522,6 +528,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
     fromTimestamp: z.ZodOptional<z.ZodString>;
     toTimestamp: z.ZodOptional<z.ZodString>;
     q: z.ZodOptional<z.ZodString>;
+    agentLabel: z.ZodOptional<z.ZodString>;
+    agentOnly: z.ZodOptional<z.ZodBoolean>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -617,9 +625,9 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             purge_chunk: "purge_chunk";
         }>;
         targetType: z.ZodNullable<z.ZodEnum<{
-            run: "run";
             job: "job";
             step: "step";
+            run: "run";
             environment: "environment";
             payload: "payload";
             event_log: "event_log";
@@ -651,6 +659,7 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             denied: "denied";
         }>;
         errorMessage: z.ZodNullable<z.ZodString>;
+        agentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         createdAt: z.ZodString;
     }, z.core.$strip>>>;
     nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/protocol/messages/access-log.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { ActorType, actorPrincipalSchema } from "./actor.js";
 import { z } from "zod";
 //#region src/protocol/messages/access-log.ts
@@ -149,6 +149,12 @@ const accessLogItemSchema = z.object({
 	source: AccessLogSource,
 	outcome: AccessLogOutcome,
 	errorMessage: z.string().nullable(),
+	/**
+	* Agent provenance label promoted from the dedicated `agent_label` column
+	* (not parsed out of `actor_meta`) so consumers can filter/display it
+	* directly. Null for ordinary human / API-key / system actors.
+	*/
+	agentLabel: z.string().nullable().optional(),
 	createdAt: z.string()
 });
 /** Shared filter shape reused by Platform proxy + orchestrator HTTP + CLI. */
@@ -162,6 +168,8 @@ const accessLogFilterSchema = z.object({
 	targetId: z.string().optional(),
 	fromTimestamp: z.string().optional(),
 	toTimestamp: z.string().optional(),
+	agentLabel: z.string().optional(),
+	agentOnly: z.boolean().optional(),
 	limit: z.number().int().positive().max(200).optional(),
 	cursor: z.string().optional()
 });
@@ -181,6 +189,10 @@ const dashboardAccessLogListRequestSchema = z.object({
 	toTimestamp: z.string().optional(),
 	/** Full-text search over `error_message` (trigram-indexed via migration 009). */
 	q: z.string().optional(),
+	/** Exact-match filter on the agent provenance label (`agent_label` column). */
+	agentLabel: z.string().max(255).optional(),
+	/** When true, return only agent-attributed rows (`agent_label IS NOT NULL`). */
+	agentOnly: z.boolean().optional(),
 	limit: z.number().int().positive().max(200).optional(),
 	cursor: z.string().optional()
 });

package/dist/protocol/messages/actor.d.ts

@@ -30,6 +30,9 @@ export declare const apiKeyActorSchema: z.ZodObject<{
     type: z.ZodLiteral<"api_key">;
     keyId: z.ZodString;
     ownerSub: z.ZodString;
+    agent: z.ZodOptional<z.ZodObject<{
+        label: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ApiKeyActor = z.infer<typeof apiKeyActorSchema>;
 export declare const serviceAccountActorSchema: z.ZodObject<{
@@ -60,6 +63,9 @@ export declare const actorPrincipalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
     type: z.ZodLiteral<"api_key">;
     keyId: z.ZodString;
     ownerSub: z.ZodString;
+    agent: z.ZodOptional<z.ZodObject<{
+        label: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"service_account">;
     id: z.ZodString;
@@ -107,4 +113,11 @@ export declare function flattenActor(actor: ActorPrincipal): {
     actorId: string;
     actorMeta: Record<string, unknown> | null;
 };
+/**
+ * Extract the agent provenance label from an actor, when present. Returns the
+ * label for agent-kind `user` (PAT) and `api_key` (org key) actors, else null.
+ * The single label extractor reused by run capture and the access-log writer so
+ * both credential families surface agent provenance identically.
+ */
+export declare function agentLabelOf(actor: ActorPrincipal): string | null;
 //# sourceMappingURL=actor.d.ts.map

package/dist/protocol/messages/actor.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/actor.ts
 /**
@@ -39,7 +39,14 @@ const apiKeyActorSchema = z.object({
 	/** Opaque key identifier (not the secret). */
 	keyId: z.string().min(1),
 	/** Keycloak sub of the human who owns this key. */
-	ownerSub: z.string().min(1)
+	ownerSub: z.string().min(1),
+	/**
+	* Present when the org API key is agent-kind (e.g. a service account driving
+	* KiCI via the developer MCP server). Unlike the user actor's agent, no
+	* separate id is needed — `keyId` already identifies the credential. The key
+	* still inherits the org's permissions; the label is provenance only.
+	*/
+	agent: z.object({ label: z.string().min(1) }).optional()
 });
 const serviceAccountActorSchema = z.object({
 	type: z.literal(ActorType.enum.service_account),
@@ -89,7 +96,7 @@ const actorPrincipalSchema = z.discriminatedUnion("type", [
 function stringifyActor(actor) {
 	switch (actor.type) {
 		case "user": return actor.agent ? `user:${actor.sub} via agent:${actor.agent.label}` : `user:${actor.sub}`;
-		case "api_key": return `api_key:${actor.keyId}`;
+		case "api_key": return actor.agent ? `api_key:${actor.keyId} via agent:${actor.agent.label}` : `api_key:${actor.keyId}`;
 		case "service_account": return `service_account:${actor.id}`;
 		case "platform_operator": return `platform_operator:${actor.sub}`;
 		case "system": return `system:${actor.component}`;
@@ -135,7 +142,10 @@ function flattenActor(actor) {
 		case "api_key": return {
 			actorType: "api_key",
 			actorId: actor.keyId,
-			actorMeta: { ownerSub: actor.ownerSub }
+			actorMeta: actor.agent ? {
+				ownerSub: actor.ownerSub,
+				agentLabel: actor.agent.label
+			} : { ownerSub: actor.ownerSub }
 		};
 		case "service_account": return {
 			actorType: "service_account",
@@ -157,7 +167,17 @@ function flattenActor(actor) {
 		};
 	}
 }
+/**
+* Extract the agent provenance label from an actor, when present. Returns the
+* label for agent-kind `user` (PAT) and `api_key` (org key) actors, else null.
+* The single label extractor reused by run capture and the access-log writer so
+* both credential families surface agent provenance identically.
+*/
+function agentLabelOf(actor) {
+	if (actor.type === "user" || actor.type === "api_key") return actor.agent?.label ?? null;
+	return null;
+}
 //#endregion
-export { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema };
+export { ActorType, actorPrincipalSchema, agentLabelOf, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema };
 
 //# sourceMappingURL=actor.js.map