@kici-dev/engine 0.1.27 → 0.3.0

package/dist/protocol/messages/platform-orchestrator.js

@@ -1,32 +1,54 @@
 import "../../rolldown-runtime-ClRpJifh.js";
-import { heartbeatSchema } from "./common.js";
+import { heartbeatSchema, nackSchema } from "./common.js";
 import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
 import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
 import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./source-registration.js";
 import { dashboardPlatformToOrchSchema } from "./dashboard.js";
-import { orchCapabilitiesSchema } from "./capabilities.js";
+import { OrchRole, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";
+import { LogStream } from "./log-stream.js";
 import { oidcMintRequestSchema, oidcMintResponseSchema } from "./oidc-mint.js";
 import { z } from "zod";
 //#region src/protocol/messages/platform-orchestrator.ts
+/**
+* Org trust policy — Platform-owned tenant policy pushed to the orchestrator.
+* The orchestrator caches and enforces it; it never owns it. Named separately
+* from the enclosing message so the orchestrator's evaluator and cache can type
+* against the policy alone.
+*/
+/**
+* Documented default hours a security hold stays open.
+*
+* The single owner of the value: the fail-closed policy, the orchestrator's
+* stored-policy default, and the hold-sizing fallback all read it, so the
+* number cannot drift between the two packages that enforce it.
+*/
+const DEFAULT_APPROVAL_EXPIRY_HOURS = 72;
+const trustPolicySchema = z.object({
+	forkPolicy: z.enum([
+		"hold",
+		"reject",
+		"allow"
+	]),
+	unknownContributorPolicy: z.enum(["hold", "reject"]),
+	workflowChangePolicy: z.enum([
+		"hold",
+		"reject",
+		"allow"
+	]),
+	/**
+	* Hours a security hold stays open. Integer and positive: the column is
+	* INTEGER NOT NULL, so a fractional value throws inside the fire-and-forget
+	* persist and the policy is then silently never stored, and a zero or
+	* negative value mints an already-expired hold.
+	*/
+	approvalExpiryHours: z.number().int().min(1)
+});
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
 const trustPolicyUpdateSchema = z.object({
 	type: z.literal("trust_policy.update"),
 	orgId: z.string(),
-	policy: z.object({
-		forkPolicy: z.enum([
-			"hold",
-			"reject",
-			"allow"
-		]),
-		unknownContributorPolicy: z.enum(["hold", "reject"]),
-		workflowChangePolicy: z.enum([
-			"hold",
-			"reject",
-			"allow"
-		]),
-		approvalExpiryHours: z.number()
-	}),
+	policy: trustPolicySchema,
 	identityLinks: z.array(z.object({
 		userId: z.string(),
 		provider: z.string(),
@@ -101,12 +123,18 @@ const webhookRelaySchema = z.object({
 *   is malformed (e.g. invalid JSON in generic_webhook_sources.verification_config) or
 *   the chunked stream itself was malformed (out-of-order, oversize, base64 decode fail,
 *   missing chunks at finalization, TTL expiry). Maps to HTTP 500.
+* - `shed_retry_later`: the orchestrator's ingest admission controller is
+*   saturated and shed this delivery (event-loop overload or per-org/global
+*   cap). Maps to HTTP 429 + Retry-After — a terminal, RETRYABLE result: the
+*   caller redelivers, the delivery is not lost, and Platform does NOT fail
+*   over to a pool peer (peers share the same overloaded orchestrator DB).
 */
 const WebhookRelayResult = z.enum([
 	"accepted",
 	"rejected_signature",
 	"rejected_unknown_source",
-	"rejected_misconfigured"
+	"rejected_misconfigured",
+	"shed_retry_later"
 ]);
 /**
 * Maximum total body size accepted by the chunked webhook relay protocol.
@@ -193,7 +221,7 @@ const peerUpdateSchema = z.object({
 		instanceId: z.string().optional(),
 		address: z.string().nullable(),
 		routingKeys: z.array(z.string()),
-		orchRole: z.enum(["coordinator", "worker"]).optional()
+		orchRole: OrchRole.optional()
 	}))
 });
 /**
@@ -215,6 +243,19 @@ const staleCheckrunCleanupSchema = z.object({
 	}))
 });
 /**
+* Platform capability advertisement, sent once by the Platform after the
+* orchestrator authenticates. The orchestrator caches it per connection and
+* pre-flight-checks its own feature-gated sends against it, so a self-hosted
+* orchestrator running ahead of the hosted Platform surfaces a diagnosable
+* capability gap instead of firing a frame the Platform would silently drop.
+* Payload is `platformCapabilitiesSchema` (`.passthrough()`, absent =
+* unsupported).
+*/
+const platformCapabilitiesMessageSchema = z.object({
+	type: z.literal("platform.capabilities"),
+	capabilities: platformCapabilitiesSchema
+});
+/**
 * Periodic OTel metrics push from orchestrator to Platform for centralized observability.
 *
 * Schema bounds are the first line of defence against pollution of the
@@ -296,7 +337,46 @@ const logChunkSchema = z.object({
 	jobId: z.string(),
 	stepIndex: z.number(),
 	lines: z.array(z.string()),
-	timestamp: z.number()
+	timestamp: z.number(),
+	/**
+	* Which stream these lines came from. Optional for backward compatibility
+	* with orchestrators that do not send it; absent is read as `stdout`.
+	*/
+	stream: LogStream.optional()
+});
+/**
+* Phase of an orchestration/provisioning log line. Mirrors the phases the
+* orchestrator writes into its per-job orchestration/provisioning JSONL files
+* and that the dashboard splits the run-detail orch-log viewer by. `unknown`
+* is the fallback for a line whose stored phase is missing/unrecognized.
+*/
+const OrchLogPhase = z.enum([
+	"dispatch",
+	"setup",
+	"provisioning",
+	"teardown",
+	"unknown"
+]);
+/**
+* Live orchestration/provisioning log line(s) pushed orchestrator -> Platform.
+*
+* Emitted at the orchestrator's `writeOrchLog` / provisioning-write tap points
+* (in addition to persisting to LogStorage, which stays the authoritative
+* backfill source). Platform fans this out to browser subscribers keyed by
+* `(runId, jobId)` as an `orch-log.lines` message. `lines` carries the raw
+* message strings for this phase; `ts` is the write timestamp (ms).
+*
+* Best-effort: a push failure never breaks dispatch (fire-and-forget at the
+* write site). Not correlated/acked, so — unlike step `log.chunk` — it is not
+* fast-pathed and carries no `messageId`.
+*/
+const orchLogChunkSchema = z.object({
+	type: z.literal("orch-log.chunk"),
+	runId: z.string(),
+	jobId: z.string(),
+	phase: OrchLogPhase,
+	lines: z.array(z.string()),
+	ts: z.number()
 });
 /** Cache lookup statistics forwarded from orchestrator to Platform for centralized metrics. */
 const cacheStatsSchema = z.object({
@@ -340,6 +420,8 @@ const platformToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	peerUpdateSchema,
 	staleCheckrunCleanupSchema,
 	oidcMintResponseSchema,
+	platformCapabilitiesMessageSchema,
+	nackSchema,
 	...dashboardPlatformToOrchSchema.options
 ]);
 /** All messages that flow from Orchestrator to Platform.
@@ -353,6 +435,7 @@ const orchestratorToPlatformMessageSchema = z.discriminatedUnion("type", [
 	webhookAckSchema,
 	executionEventSchema,
 	logChunkSchema,
+	orchLogChunkSchema,
 	executionStatusSchema,
 	stepStatusForwardSchema,
 	jobStatusForwardSchema,
@@ -366,9 +449,36 @@ const orchestratorToPlatformMessageSchema = z.discriminatedUnion("type", [
 	runEventMessageSchema,
 	jobContextMessageSchema,
 	orchMetricsSchema,
-	oidcMintRequestSchema
+	oidcMintRequestSchema,
+	nackSchema
 ]);
+/**
+* Extract the discriminator `type` values a schema recognizes: every option of a
+* discriminated union, or the single `type` literal of an object schema. Reuses
+* the `schema.options.map((o) => o.shape.type.value)` idiom already used for
+* `DASHBOARD_REQUEST_TYPES`, so a recognized-type set derived through this helper
+* can never drift from the schema it is built from.
+*/
+function collectDiscriminatorTypes(schema) {
+	if ("options" in schema) return schema.options.map((option) => option.shape.type.value);
+	return [schema.shape.type.value];
+}
+/**
+* Every message `type` the orchestrator→Platform mainline union recognizes.
+* The Platform WS handler unions this with its extra recognition-chain schemas
+* (log-pull, dashboard responses, cluster join) to decide whether a frame that
+* failed validation is a known-but-invalid type (close the connection) or a
+* genuinely-unknown one (version-skew NACK + keep alive).
+*/
+const ORCH_TO_PLATFORM_RECOGNIZED_TYPES = new Set(collectDiscriminatorTypes(orchestratorToPlatformMessageSchema));
+/**
+* Every message `type` the Platform→orchestrator mainline union recognizes
+* (dashboard request types included — they are members of this union). The
+* orchestrator's platform client unions this with its extra recognition-chain
+* schemas to make the same known-but-invalid vs unknown decision.
+*/
+const PLATFORM_TO_ORCH_RECOGNIZED_TYPES = new Set(collectDiscriminatorTypes(platformToOrchestratorMessageSchema));
 //#endregion
-export { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchCapabilitiesUpdateSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { DEFAULT_APPROVAL_EXPIRY_HOURS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchCapabilitiesUpdateSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
 
 //# sourceMappingURL=platform-orchestrator.js.map

package/dist/protocol/messages/run-events.d.ts

@@ -15,8 +15,8 @@ export declare const runEventMessageSchema: z.ZodObject<{
     timestampMs: z.ZodNumber;
     sourceService: z.ZodEnum<{
         agent: "agent";
-        platform: "platform";
         orchestrator: "orchestrator";
+        platform: "platform";
     }>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     traceId: z.ZodOptional<z.ZodString>;
@@ -41,10 +41,10 @@ export declare const jobContextMessageSchema: z.ZodObject<{
             name: z.ZodString;
             value: z.ZodString;
             category: z.ZodEnum<{
-                user: "user";
-                system: "system";
                 inherited: "inherited";
                 secret: "secret";
+                system: "system";
+                user: "user";
             }>;
         }, z.core.$strip>>>;
         runtime: z.ZodOptional<z.ZodObject<{
@@ -93,10 +93,10 @@ export declare const browserJobContextSchema: z.ZodObject<{
             name: z.ZodString;
             value: z.ZodString;
             category: z.ZodEnum<{
-                user: "user";
-                system: "system";
                 inherited: "inherited";
                 secret: "secret";
+                system: "system";
+                user: "user";
             }>;
         }, z.core.$strip>>>;
         runtime: z.ZodOptional<z.ZodObject<{

package/dist/protocol/messages/scaler-event.d.ts

@@ -9,11 +9,11 @@ import { z } from 'zod';
  * notation: `ScalerEventType.enum['scaler.failed']`.
  */
 export declare const ScalerEventType: z.ZodEnum<{
-    "scaler.provisioning": "scaler.provisioning";
+    "agent.connecting": "agent.connecting";
+    "scaler.failed": "scaler.failed";
     "scaler.network": "scaler.network";
+    "scaler.provisioning": "scaler.provisioning";
     "scaler.ready": "scaler.ready";
-    "scaler.failed": "scaler.failed";
-    "agent.connecting": "agent.connecting";
 }>;
 export type ScalerEventType = z.infer<typeof ScalerEventType>;
 //# sourceMappingURL=scaler-event.d.ts.map

package/dist/protocol/messages/source-registration.d.ts

@@ -18,12 +18,52 @@ import { z } from 'zod';
  *                      cloned via `file://`).
  */
 export declare const SourceSubtype: z.ZodEnum<{
-    github_app: "github_app";
     generic_webhook: "generic_webhook";
-    universal_git: "universal_git";
+    github_app: "github_app";
     local: "local";
+    universal_git: "universal_git";
 }>;
 export type SourceSubtype = z.infer<typeof SourceSubtype>;
+/**
+ * Operating mode of a customer-deployed orchestrator. The single source of
+ * truth for the `KICI_MODE` vocabulary — the orchestrator config schema, the
+ * `source.register` protocol message, and the Platform's relay-eligibility
+ * filter all read it from here.
+ *
+ * - `platform`    — the hosted Platform relays every webhook; no local ingress.
+ * - `hybrid`      — Platform relay **plus** the orchestrator's own direct
+ *                   (GitHub / generic) ingress; full hosted observability.
+ * - `observed`    — the orchestrator ingests only its OWN webhooks (nothing
+ *                   transits the Platform) but keeps its Platform WebSocket for
+ *                   hosted observability. The Platform never relays to it and
+ *                   records its sources as observe-only.
+ * - `independent` — own ingress only, no Platform connection at all.
+ */
+export declare const OrchestratorMode: z.ZodEnum<{
+    hybrid: "hybrid";
+    independent: "independent";
+    observed: "observed";
+    platform: "platform";
+}>;
+export type OrchestratorMode = z.infer<typeof OrchestratorMode>;
+/**
+ * Modes in which the orchestrator holds a Platform WebSocket connection (and so
+ * requires `KICI_PLATFORM_URL` + `KICI_PLATFORM_TOKEN`). `observed` connects for
+ * observability + observe-only source registration; `independent` never does.
+ */
+export declare const PLATFORM_CONNECTED_MODES: readonly OrchestratorMode[];
+/**
+ * Modes in which the orchestrator accepts Platform-relayed webhooks. `observed`
+ * is deliberately absent: it ingests only its own webhooks, and both sides
+ * enforce that (the orchestrator refuses any relay it receives, and the Platform
+ * excludes observed connections from every relay-candidate lookup).
+ */
+export declare const RELAY_INGRESS_MODES: readonly OrchestratorMode[];
+/**
+ * Modes in which the orchestrator serves its OWN webhook ingress (the direct
+ * GitHub route plus generic webhook sources).
+ */
+export declare const OWN_INGRESS_MODES: readonly OrchestratorMode[];
 /**
  * Source provider family used by Platform's webhook router. Coarser-grained
  * than `SourceSubtype` — every universal-git / generic_webhook / local row
@@ -31,10 +71,10 @@ export type SourceSubtype = z.infer<typeof SourceSubtype>;
  * generic webhook ingress.
  */
 export declare const SourceProvider: z.ZodEnum<{
-    github: "github";
-    gitlab: "gitlab";
     bitbucket: "bitbucket";
     generic: "generic";
+    github: "github";
+    gitlab: "gitlab";
 }>;
 export type SourceProvider = z.infer<typeof SourceProvider>;
 /** Source registration sent by orchestrator to Platform after auth.success. */
@@ -43,18 +83,18 @@ export declare const sourceRegistrationSchema: z.ZodObject<{
     messageId: z.ZodString;
     sources: z.ZodArray<z.ZodObject<{
         provider: z.ZodEnum<{
-            github: "github";
-            gitlab: "gitlab";
             bitbucket: "bitbucket";
             generic: "generic";
+            github: "github";
+            gitlab: "gitlab";
         }>;
         routingKey: z.ZodString;
         name: z.ZodString;
         subtype: z.ZodEnum<{
-            github_app: "github_app";
             generic_webhook: "generic_webhook";
-            universal_git: "universal_git";
+            github_app: "github_app";
             local: "local";
+            universal_git: "universal_git";
         }>;
         slug: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
@@ -64,24 +104,27 @@ export declare const sourceRegistrationSchema: z.ZodObject<{
     address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     version: z.ZodOptional<z.ZodString>;
     mode: z.ZodOptional<z.ZodEnum<{
-        platform: "platform";
         hybrid: "hybrid";
         independent: "independent";
+        observed: "observed";
+        platform: "platform";
     }>>;
     scalerBackends: z.ZodOptional<z.ZodArray<z.ZodString>>;
     deployment: z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{
-            unknown: "unknown";
-            systemd: "systemd";
+            compose: "compose";
             launchd: "launchd";
+            systemd: "systemd";
+            unknown: "unknown";
             windows: "windows";
-            compose: "compose";
         }>;
         containerName: z.ZodOptional<z.ZodString>;
         containerRuntime: z.ZodOptional<z.ZodEnum<{
-            podman: "podman";
             docker: "docker";
+            podman: "podman";
         }>>;
+        adminInvocation: z.ZodOptional<z.ZodString>;
+        adminPath: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     s3LogAccess: z.ZodOptional<z.ZodBoolean>;
     queueTimeoutMs: z.ZodOptional<z.ZodNumber>;

package/dist/protocol/messages/source-registration.js

@@ -27,6 +27,53 @@ const SourceSubtype = z.enum([
 	"local"
 ]);
 /**
+* Operating mode of a customer-deployed orchestrator. The single source of
+* truth for the `KICI_MODE` vocabulary — the orchestrator config schema, the
+* `source.register` protocol message, and the Platform's relay-eligibility
+* filter all read it from here.
+*
+* - `platform`    — the hosted Platform relays every webhook; no local ingress.
+* - `hybrid`      — Platform relay **plus** the orchestrator's own direct
+*                   (GitHub / generic) ingress; full hosted observability.
+* - `observed`    — the orchestrator ingests only its OWN webhooks (nothing
+*                   transits the Platform) but keeps its Platform WebSocket for
+*                   hosted observability. The Platform never relays to it and
+*                   records its sources as observe-only.
+* - `independent` — own ingress only, no Platform connection at all.
+*/
+const OrchestratorMode = z.enum([
+	"platform",
+	"hybrid",
+	"independent",
+	"observed"
+]);
+/**
+* Modes in which the orchestrator holds a Platform WebSocket connection (and so
+* requires `KICI_PLATFORM_URL` + `KICI_PLATFORM_TOKEN`). `observed` connects for
+* observability + observe-only source registration; `independent` never does.
+*/
+const PLATFORM_CONNECTED_MODES = [
+	OrchestratorMode.enum.platform,
+	OrchestratorMode.enum.hybrid,
+	OrchestratorMode.enum.observed
+];
+/**
+* Modes in which the orchestrator accepts Platform-relayed webhooks. `observed`
+* is deliberately absent: it ingests only its own webhooks, and both sides
+* enforce that (the orchestrator refuses any relay it receives, and the Platform
+* excludes observed connections from every relay-candidate lookup).
+*/
+const RELAY_INGRESS_MODES = [OrchestratorMode.enum.platform, OrchestratorMode.enum.hybrid];
+/**
+* Modes in which the orchestrator serves its OWN webhook ingress (the direct
+* GitHub route plus generic webhook sources).
+*/
+const OWN_INGRESS_MODES = [
+	OrchestratorMode.enum.hybrid,
+	OrchestratorMode.enum.independent,
+	OrchestratorMode.enum.observed
+];
+/**
 * Source provider family used by Platform's webhook router. Coarser-grained
 * than `SourceSubtype` — every universal-git / generic_webhook / local row
 * collapses to `'generic'` here because Platform routes them through the same
@@ -93,11 +140,7 @@ const sourceRegistrationSchema = z.object({
 	/** Orchestrator version (e.g. "0.0.1"). Optional for backward compatibility with older orchestrators. */
 	version: z.string().optional(),
 	/** Orchestrator config mode. Optional for backward compatibility. */
-	mode: z.enum([
-		"platform",
-		"hybrid",
-		"independent"
-	]).optional(),
+	mode: OrchestratorMode.optional(),
 	/** Scaler backends configured on this orchestrator (e.g. ["container", "firecracker"]). */
 	scalerBackends: z.array(z.string()).optional(),
 	/**
@@ -154,6 +197,6 @@ const sourceDeregisterAckSchema = z.object({
 	removed: z.array(z.string())
 });
 //#endregion
-export { SourceProvider, SourceSubtype, acceptedSourceSchema, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
+export { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, acceptedSourceSchema, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
 
 //# sourceMappingURL=source-registration.js.map

package/dist/protocol/source-origin.d.ts

@@ -13,8 +13,8 @@ import { z } from 'zod';
  * infrastructure.
  */
 export declare const SourceOrigin: z.ZodEnum<{
-    triggered: "triggered";
     "run-remote": "run-remote";
+    triggered: "triggered";
 }>;
 export type SourceOrigin = z.infer<typeof SourceOrigin>;
 //# sourceMappingURL=source-origin.d.ts.map

package/dist/provenance/attestation-origin.d.ts

@@ -10,8 +10,8 @@ import { z } from 'zod';
  *   is disclosed, never hidden.
  */
 export declare const AttestationOrigin: z.ZodEnum<{
-    live: "live";
     deferred: "deferred";
+    live: "live";
     "offline-backfill": "offline-backfill";
 }>;
 export type AttestationOrigin = z.infer<typeof AttestationOrigin>;

package/dist/provenance/schema.d.ts

@@ -28,11 +28,11 @@ export declare const KICI_WORKFLOW_BUILD_TYPE = "https://kici.dev/buildtypes/wor
  * documents the common set so producer code and tests don't repeat literals.
  */
 export declare const DigestAlgorithm: z.ZodEnum<{
+    dirHash: "dirHash";
+    gitCommit: "gitCommit";
+    sha1: "sha1";
     sha256: "sha256";
     sha512: "sha512";
-    sha1: "sha1";
-    gitCommit: "gitCommit";
-    dirHash: "dirHash";
 }>;
 export type DigestAlgorithm = z.infer<typeof DigestAlgorithm>;
 /**
@@ -214,12 +214,12 @@ export declare const kiciWorkflowInternalParametersSchema: z.ZodObject<{
     jobId: z.ZodOptional<z.ZodString>;
     orgId: z.ZodOptional<z.ZodString>;
     sourceOrigin: z.ZodOptional<z.ZodEnum<{
-        triggered: "triggered";
         "run-remote": "run-remote";
+        triggered: "triggered";
     }>>;
     attestationOrigin: z.ZodOptional<z.ZodEnum<{
-        live: "live";
         deferred: "deferred";
+        live: "live";
         "offline-backfill": "offline-backfill";
     }>>;
     statementHash: z.ZodOptional<z.ZodString>;
@@ -251,12 +251,12 @@ export declare const kiciBuildDefinitionSchema: z.ZodObject<{
         jobId: z.ZodOptional<z.ZodString>;
         orgId: z.ZodOptional<z.ZodString>;
         sourceOrigin: z.ZodOptional<z.ZodEnum<{
-            triggered: "triggered";
             "run-remote": "run-remote";
+            triggered: "triggered";
         }>>;
         attestationOrigin: z.ZodOptional<z.ZodEnum<{
-            live: "live";
             deferred: "deferred";
+            live: "live";
             "offline-backfill": "offline-backfill";
         }>>;
         statementHash: z.ZodOptional<z.ZodString>;
@@ -324,12 +324,12 @@ export declare const kiciProvenancePredicateSchema: z.ZodObject<{
             jobId: z.ZodOptional<z.ZodString>;
             orgId: z.ZodOptional<z.ZodString>;
             sourceOrigin: z.ZodOptional<z.ZodEnum<{
-                triggered: "triggered";
                 "run-remote": "run-remote";
+                triggered: "triggered";
             }>>;
             attestationOrigin: z.ZodOptional<z.ZodEnum<{
-                live: "live";
                 deferred: "deferred";
+                live: "live";
                 "offline-backfill": "offline-backfill";
             }>>;
             statementHash: z.ZodOptional<z.ZodString>;
@@ -406,12 +406,12 @@ export declare const kiciProvenanceStatementSchema: z.ZodObject<{
                 jobId: z.ZodOptional<z.ZodString>;
                 orgId: z.ZodOptional<z.ZodString>;
                 sourceOrigin: z.ZodOptional<z.ZodEnum<{
-                    triggered: "triggered";
                     "run-remote": "run-remote";
+                    triggered: "triggered";
                 }>>;
                 attestationOrigin: z.ZodOptional<z.ZodEnum<{
-                    live: "live";
                     deferred: "deferred";
+                    live: "live";
                     "offline-backfill": "offline-backfill";
                 }>>;
                 statementHash: z.ZodOptional<z.ZodString>;

package/dist/provenance/verify.js

@@ -82,7 +82,8 @@ async function verifyKiciBundle(opts) {
 	try {
 		const { payload } = await jwtVerify(bundle.verificationMaterial.identityToken, createLocalJWKSet(opts.jwks), {
 			issuer: opts.expectedIssuer,
-			audience: opts.expectedAudience
+			audience: opts.expectedAudience,
+			algorithms: ["ES256"]
 		});
 		claims = payload;
 		checks.jwt = "pass";

package/dist/provider/changed-files-fetcher.d.ts

@@ -5,6 +5,25 @@
  * Used by the orchestrator for path-based trigger filtering.
  */
 import type { ProviderType } from './types.js';
+import type { ChangedFilesStatus } from '../trigger/types.js';
+/**
+ * Result of a changed-files fetch.
+ *
+ * `status` distinguishes an authoritative diff from a capability gap so path
+ * filters never infer a no-match from an empty list:
+ * - `fetched` — the list is authoritative; an empty `files` genuinely means
+ *   "no files changed" and does NOT match a path filter.
+ * - `unavailable` — the diff could not be determined (e.g. a universal-git PR
+ *   event with no per-commit diff in the webhook body). Path filters match
+ *   conservatively so a real change is never silently dropped.
+ *
+ * `skipped` is intentionally NOT a fetcher outcome — it is set by the pipeline
+ * when no trigger has path patterns and the fetch never runs.
+ */
+export interface ChangedFilesResult {
+    files: string[];
+    status: Extract<ChangedFilesStatus, 'fetched' | 'unavailable'>;
+}
 export interface ChangedFilesFetcher {
     readonly provider: ProviderType;
     /**
@@ -17,8 +36,8 @@ export interface ChangedFilesFetcher {
      * @param eventType - Normalized event type ("pull_request" or "push")
      * @param payload - Raw webhook payload (provider-specific)
      * @param credentials - Provider-specific auth credentials
-     * @returns Array of changed file paths (relative to repo root)
+     * @returns The changed file paths (relative to repo root) plus an availability status.
      */
-    getChangedFiles(repoIdentifier: string, eventType: string, payload: unknown, credentials: unknown): Promise<string[]>;
+    getChangedFiles(repoIdentifier: string, eventType: string, payload: unknown, credentials: unknown): Promise<ChangedFilesResult>;
 }
 //# sourceMappingURL=changed-files-fetcher.d.ts.map

package/dist/provider/check-run-conclusion.d.ts

@@ -6,10 +6,10 @@ import { z } from 'zod';
  * Access values: CheckRunConclusion.enum.success, CheckRunConclusion.enum.failure, etc.
  */
 export declare const CheckRunConclusion: z.ZodEnum<{
-    success: "success";
     cancelled: "cancelled";
-    timed_out: "timed_out";
     failure: "failure";
+    success: "success";
+    timed_out: "timed_out";
 }>;
 export type CheckRunConclusion = z.infer<typeof CheckRunConclusion>;
 //# sourceMappingURL=check-run-conclusion.d.ts.map

package/dist/provider/check-status-poster.d.ts

@@ -7,9 +7,32 @@
 import type { ProviderType } from './types.js';
 /** Status values for a check run. */
 export type CheckStatus = 'pending' | 'success' | 'failure' | 'neutral';
+/** A single workflow-file change detected between base and head lock files. */
+export interface WorkflowModificationInfo {
+    changeType: string;
+    workflowName: string;
+}
 /** Posts check statuses to a git hosting provider. */
 export interface CheckStatusPoster {
     readonly provider: ProviderType;
     postCheckStatus(repoIdentifier: string, commitSha: string, status: CheckStatus, title: string, summary: string, credentials: unknown): Promise<void>;
+    /**
+     * Post an informational (neutral) check listing workflow-file modifications
+     * detected in a PR. Uses a distinct check name from the security-hold check so
+     * the two never overwrite each other.
+     */
+    postWorkflowModificationCheck(repoIdentifier: string, commitSha: string, modifications: WorkflowModificationInfo[], credentials: unknown): Promise<void>;
+    /**
+     * Post an informational (neutral) check recording that the organization's
+     * global workflows were skipped because the org trust policy held or rejected
+     * the event.
+     *
+     * Its own check name, for the same reason as the workflow-modification check:
+     * the security-hold check is a single named run per commit, so posting this
+     * notice through `postCheckStatus` would UPDATE that run and replace the
+     * pending "Held for approval" state with a completed neutral conclusion —
+     * unblocking a branch protection rule that requires the security check.
+     */
+    postGlobalWorkflowsSkippedCheck(repoIdentifier: string, commitSha: string, summary: string, credentials: unknown): Promise<void>;
 }
 //# sourceMappingURL=check-status-poster.d.ts.map