@kici-dev/engine 0.1.3 → 0.1.6

package/dist/metrics/metric-catalog.generated.js

@@ -16,6 +16,7 @@ const MetricNames = {
 	KICI_CACHE_MISSES_TOTAL: "kici_cache_misses_total",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "kici_cross_source_errors_total",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "kici_cross_source_fanout_size",
+	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "kici_dashboard_relay_latency_seconds",
 	KICI_ORCH_AGENTS_ACTIVE: "kici_orch_agents_active",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "kici_orch_build_duration_seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "kici_orch_config_reload_total",
@@ -38,6 +39,11 @@ const MetricNames = {
 	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "kici_orch_install_secrets_decisions_total",
 	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "kici_orch_install_secrets_npm_registry_used_total",
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "kici_orch_install_secrets_token_resolution_duration_seconds",
+	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "kici_orch_job_consecutive_failures",
+	KICI_ORCH_JOB_DURATION_SECONDS: "kici_orch_job_duration_seconds",
+	KICI_ORCH_JOB_LAST_FAILURE_TIMESTAMP_SECONDS: "kici_orch_job_last_failure_timestamp_seconds",
+	KICI_ORCH_JOB_LAST_SUCCESS_TIMESTAMP_SECONDS: "kici_orch_job_last_success_timestamp_seconds",
+	KICI_ORCH_JOB_RUNS_TOTAL: "kici_orch_job_runs_total",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "kici_orch_log_bytes_stored_total",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "kici_orch_log_chunks_received_total",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "kici_orch_scaler_config_reloads_total",
@@ -79,8 +85,10 @@ const MetricNames = {
 	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "kici_platform_log_lines_forwarded_total",
 	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "kici_platform_metrics_query_rate_limited_total",
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "kici_platform_mimir_relay_errors_total",
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "kici_platform_orch_metrics_filtered_total",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "kici_platform_orphan_connections_swept_total",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "kici_platform_stale_orchestrators_total",
+	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "kici_platform_stale_platform_connections_evicted_total",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "kici_platform_stale_runs_failed_total",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "kici_platform_step_status_forwards_total",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "kici_universal_git_registration_errors_total",
@@ -97,7 +105,21 @@ const MetricNames = {
 	KICI_WS_MESSAGES_RECEIVED_TOTAL: "kici_ws_messages_received_total",
 	KICI_WS_MESSAGES_SENT_TOTAL: "kici_ws_messages_sent_total",
 	KICI_WS_RELAY_ATTEMPTS_TOTAL: "kici_ws_relay_attempts_total",
-	KICI_WS_RELAY_DURATION_SECONDS: "kici_ws_relay_duration_seconds"
+	KICI_WS_RELAY_DURATION_SECONDS: "kici_ws_relay_duration_seconds",
+	NODEJS_EVENTLOOP_DELAY_MAX: "nodejs.eventloop.delay.max",
+	NODEJS_EVENTLOOP_DELAY_MEAN: "nodejs.eventloop.delay.mean",
+	NODEJS_EVENTLOOP_DELAY_MIN: "nodejs.eventloop.delay.min",
+	NODEJS_EVENTLOOP_DELAY_P50: "nodejs.eventloop.delay.p50",
+	NODEJS_EVENTLOOP_DELAY_P90: "nodejs.eventloop.delay.p90",
+	NODEJS_EVENTLOOP_DELAY_P99: "nodejs.eventloop.delay.p99",
+	NODEJS_EVENTLOOP_DELAY_STDDEV: "nodejs.eventloop.delay.stddev",
+	NODEJS_EVENTLOOP_TIME: "nodejs.eventloop.time",
+	NODEJS_EVENTLOOP_UTILIZATION: "nodejs.eventloop.utilization",
+	V8JS_GC_DURATION: "v8js.gc.duration",
+	V8JS_MEMORY_HEAP_LIMIT: "v8js.memory.heap.limit",
+	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "v8js.memory.heap.space.available_size",
+	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "v8js.memory.heap.space.physical_size",
+	V8JS_MEMORY_HEAP_USED: "v8js.memory.heap.used"
 };
 const MetricLabels = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: ["scaler"],
@@ -115,6 +137,7 @@ const MetricLabels = {
 	KICI_CACHE_MISSES_TOTAL: ["cache_type"],
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: ["reason"],
 	KICI_CROSS_SOURCE_FANOUT_SIZE: [],
+	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: ["outcome"],
 	KICI_ORCH_AGENTS_ACTIVE: [],
 	KICI_ORCH_BUILD_DURATION_SECONDS: [],
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: ["result", "source"],
@@ -141,11 +164,16 @@ const MetricLabels = {
 		"scope"
 	],
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: ["environment"],
+	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: ["job"],
+	KICI_ORCH_JOB_DURATION_SECONDS: ["job"],
+	KICI_ORCH_JOB_LAST_FAILURE_TIMESTAMP_SECONDS: ["job"],
+	KICI_ORCH_JOB_LAST_SUCCESS_TIMESTAMP_SECONDS: ["job"],
+	KICI_ORCH_JOB_RUNS_TOTAL: ["job", "result"],
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: [],
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: [],
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: ["result"],
-	KICI_ORCH_SCALER_CPUS_USED: [],
-	KICI_ORCH_SCALER_MEMORY_BYTES_USED: [],
+	KICI_ORCH_SCALER_CPUS_USED: ["scaler", "machinePool"],
+	KICI_ORCH_SCALER_MEMORY_BYTES_USED: ["scaler", "machinePool"],
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: [],
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: [],
 	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: [],
@@ -182,8 +210,10 @@ const MetricLabels = {
 	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: [],
 	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: [],
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: ["reason"],
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: [],
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: [],
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: [],
+	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: ["org_id"],
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: [],
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: ["state"],
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: ["reason"],
@@ -204,7 +234,21 @@ const MetricLabels = {
 	KICI_WS_MESSAGES_RECEIVED_TOTAL: ["type"],
 	KICI_WS_MESSAGES_SENT_TOTAL: ["type"],
 	KICI_WS_RELAY_ATTEMPTS_TOTAL: ["status"],
-	KICI_WS_RELAY_DURATION_SECONDS: ["status"]
+	KICI_WS_RELAY_DURATION_SECONDS: ["status"],
+	NODEJS_EVENTLOOP_DELAY_MAX: ["scaler"],
+	NODEJS_EVENTLOOP_DELAY_MEAN: ["scaler"],
+	NODEJS_EVENTLOOP_DELAY_MIN: ["scaler"],
+	NODEJS_EVENTLOOP_DELAY_P50: ["scaler"],
+	NODEJS_EVENTLOOP_DELAY_P90: ["scaler"],
+	NODEJS_EVENTLOOP_DELAY_P99: ["scaler"],
+	NODEJS_EVENTLOOP_DELAY_STDDEV: ["scaler"],
+	NODEJS_EVENTLOOP_TIME: ["nodejs.eventloop.state", "scaler"],
+	NODEJS_EVENTLOOP_UTILIZATION: ["scaler"],
+	V8JS_GC_DURATION: ["v8js.gc.type", "scaler"],
+	V8JS_MEMORY_HEAP_LIMIT: ["v8js.heap.space.name", "scaler"],
+	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: ["v8js.heap.space.name", "scaler"],
+	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: ["v8js.heap.space.name", "scaler"],
+	V8JS_MEMORY_HEAP_USED: ["v8js.heap.space.name", "scaler"]
 };
 const MetricKind = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: "histogram",
@@ -222,6 +266,7 @@ const MetricKind = {
 	KICI_CACHE_MISSES_TOTAL: "counter",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "counter",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "histogram",
+	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "histogram",
 	KICI_ORCH_AGENTS_ACTIVE: "observableGauge",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "histogram",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "counter",
@@ -244,6 +289,11 @@ const MetricKind = {
 	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "counter",
 	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "counter",
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "histogram",
+	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "observableGauge",
+	KICI_ORCH_JOB_DURATION_SECONDS: "histogram",
+	KICI_ORCH_JOB_LAST_FAILURE_TIMESTAMP_SECONDS: "observableGauge",
+	KICI_ORCH_JOB_LAST_SUCCESS_TIMESTAMP_SECONDS: "observableGauge",
+	KICI_ORCH_JOB_RUNS_TOTAL: "counter",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "counter",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "counter",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "counter",
@@ -285,8 +335,10 @@ const MetricKind = {
 	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "counter",
 	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "counter",
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "counter",
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "counter",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "counter",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "counter",
+	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "counter",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "counter",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "counter",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "counter",
@@ -303,7 +355,21 @@ const MetricKind = {
 	KICI_WS_MESSAGES_RECEIVED_TOTAL: "counter",
 	KICI_WS_MESSAGES_SENT_TOTAL: "counter",
 	KICI_WS_RELAY_ATTEMPTS_TOTAL: "counter",
-	KICI_WS_RELAY_DURATION_SECONDS: "histogram"
+	KICI_WS_RELAY_DURATION_SECONDS: "histogram",
+	NODEJS_EVENTLOOP_DELAY_MAX: "gauge",
+	NODEJS_EVENTLOOP_DELAY_MEAN: "gauge",
+	NODEJS_EVENTLOOP_DELAY_MIN: "gauge",
+	NODEJS_EVENTLOOP_DELAY_P50: "gauge",
+	NODEJS_EVENTLOOP_DELAY_P90: "gauge",
+	NODEJS_EVENTLOOP_DELAY_P99: "gauge",
+	NODEJS_EVENTLOOP_DELAY_STDDEV: "gauge",
+	NODEJS_EVENTLOOP_TIME: "counter",
+	NODEJS_EVENTLOOP_UTILIZATION: "gauge",
+	V8JS_GC_DURATION: "histogram",
+	V8JS_MEMORY_HEAP_LIMIT: "gauge",
+	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "gauge",
+	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "gauge",
+	V8JS_MEMORY_HEAP_USED: "gauge"
 };
 const MetricDescription = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: "Git clone duration in seconds",
@@ -321,6 +387,7 @@ const MetricDescription = {
 	KICI_CACHE_MISSES_TOTAL: "Total cache misses by type",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "Errors encountered during cross-source webhook dispatch",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "Number of webhook-trigger registrations matched when an inbound generic webhook fans out across sources in the same org",
+	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "Round-trip latency of a cross-instance dashboard relay request",
 	KICI_ORCH_AGENTS_ACTIVE: "Current number of active agents connected",
 	KICI_ORCH_BUILD_DURATION_SECONDS: "Duration of build agent operations in seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "Total number of config reload operations",
@@ -343,6 +410,11 @@ const MetricDescription = {
 	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)",
 	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope",
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation",
+	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success",
+	KICI_ORCH_JOB_DURATION_SECONDS: "Scheduled job tick duration in seconds",
+	KICI_ORCH_JOB_LAST_FAILURE_TIMESTAMP_SECONDS: "Unix timestamp of the most recent failed scheduled job tick",
+	KICI_ORCH_JOB_LAST_SUCCESS_TIMESTAMP_SECONDS: "Unix timestamp of the most recent successful scheduled job tick",
+	KICI_ORCH_JOB_RUNS_TOTAL: "Scheduled job run outcomes, by job and result (success/failure)",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "Total bytes of log data written to storage",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "Total number of log chunks received from agents",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "Total number of scaler config reload operations",
@@ -384,8 +456,10 @@ const MetricDescription = {
 	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "Total log lines forwarded from orchestrators",
 	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "Total dashboard metric-query requests rate-limited (429).",
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "Total Mimir push-relay errors (Platform-embedded metrics). Labels: reason.",
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason.",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected",
+	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "Total execution runs failed due to orchestrator staleness",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "Total step status forwards received",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "Errors encountered while registering universal-git provider bundles",
@@ -402,7 +476,149 @@ const MetricDescription = {
 	KICI_WS_MESSAGES_RECEIVED_TOTAL: "Total messages received from orchestrators",
 	KICI_WS_MESSAGES_SENT_TOTAL: "Total messages sent to orchestrators",
 	KICI_WS_RELAY_ATTEMPTS_TOTAL: "Total number of webhook relay attempts",
-	KICI_WS_RELAY_DURATION_SECONDS: "Duration of webhook relay operations in seconds"
+	KICI_WS_RELAY_DURATION_SECONDS: "Duration of webhook relay operations in seconds",
+	NODEJS_EVENTLOOP_DELAY_MAX: "Event loop maximum delay",
+	NODEJS_EVENTLOOP_DELAY_MEAN: "Event loop mean delay",
+	NODEJS_EVENTLOOP_DELAY_MIN: "Event loop minimum delay",
+	NODEJS_EVENTLOOP_DELAY_P50: "Event loop 50th-percentile delay",
+	NODEJS_EVENTLOOP_DELAY_P90: "Event loop 90th-percentile delay",
+	NODEJS_EVENTLOOP_DELAY_P99: "Event loop 99th-percentile delay",
+	NODEJS_EVENTLOOP_DELAY_STDDEV: "Event loop delay standard deviation",
+	NODEJS_EVENTLOOP_TIME: "Cumulative event loop time by state",
+	NODEJS_EVENTLOOP_UTILIZATION: "Event loop utilization ratio",
+	V8JS_GC_DURATION: "Garbage-collection pause duration by GC type",
+	V8JS_MEMORY_HEAP_LIMIT: "V8 heap size limit by heap space",
+	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "V8 available heap size by heap space",
+	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "V8 physical heap size by heap space",
+	V8JS_MEMORY_HEAP_USED: "V8 used heap size by heap space"
+};
+/**
+* Service that owns each metric (the package whose meter created it).
+* Consumed by the Platform's orchestrator-metrics filter to drop
+* `kici_platform_*` (and other Platform-only) series that should never
+* appear on the wire — the orchestrator and forwarded-agent metrics are
+* the only valid push payloads.
+*/
+const MetricService = {
+	KICI_AGENT_CLONE_DURATION_SECONDS: "agent",
+	KICI_AGENT_CONNECTION_STATUS: "agent",
+	KICI_AGENT_JOBS_ACTIVE: "agent",
+	KICI_AGENT_JOBS_TOTAL: "agent",
+	KICI_AGENT_LOG_BACKPRESSURE_ACTIVE: "agent",
+	KICI_AGENT_LOG_BACKPRESSURE_EVENTS_TOTAL: "agent",
+	KICI_AGENT_LOG_BYTES_TOTAL: "agent",
+	KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "agent",
+	KICI_AGENT_STEP_DURATION_SECONDS: "agent",
+	KICI_AGENT_STEPS_TOTAL: "agent",
+	KICI_BUILD_JOBS_TOTAL: "platform",
+	KICI_CACHE_HITS_TOTAL: "platform",
+	KICI_CACHE_MISSES_TOTAL: "platform",
+	KICI_CROSS_SOURCE_ERRORS_TOTAL: "orchestrator",
+	KICI_CROSS_SOURCE_FANOUT_SIZE: "orchestrator",
+	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "platform",
+	KICI_ORCH_AGENTS_ACTIVE: "orchestrator",
+	KICI_ORCH_BUILD_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_CONFIG_RELOAD_TOTAL: "orchestrator",
+	KICI_ORCH_CONFIG_VERSION: "orchestrator",
+	KICI_ORCH_DEDUP_HITS_TOTAL: "orchestrator",
+	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "orchestrator",
+	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "orchestrator",
+	KICI_ORCH_DISPATCH_QUEUE_DEPTH: "orchestrator",
+	KICI_ORCH_DISPATCH_QUEUE_DEPTH_BY_LABEL: "orchestrator",
+	KICI_ORCH_EVENT_ATTEMPTS: "orchestrator",
+	KICI_ORCH_EVENT_DISPATCH_SUCCESS_TOTAL: "orchestrator",
+	KICI_ORCH_EVENT_DLQ_DEPTH: "orchestrator",
+	KICI_ORCH_EVENT_DLQ_TOTAL: "orchestrator",
+	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: "orchestrator",
+	KICI_ORCH_EVENT_RETRY_TOTAL: "orchestrator",
+	KICI_ORCH_EXECUTION_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_EXECUTIONS_TOTAL: "orchestrator",
+	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "orchestrator",
+	KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "orchestrator",
+	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "orchestrator",
+	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "orchestrator",
+	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "orchestrator",
+	KICI_ORCH_JOB_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_JOB_LAST_FAILURE_TIMESTAMP_SECONDS: "orchestrator",
+	KICI_ORCH_JOB_LAST_SUCCESS_TIMESTAMP_SECONDS: "orchestrator",
+	KICI_ORCH_JOB_RUNS_TOTAL: "orchestrator",
+	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "orchestrator",
+	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "orchestrator",
+	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "orchestrator",
+	KICI_ORCH_SCALER_CPUS_USED: "orchestrator",
+	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "orchestrator",
+	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "orchestrator",
+	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "orchestrator",
+	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "orchestrator",
+	KICI_ORCH_STALE_DETECTION_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_STALE_RUNS_CURRENT: "orchestrator",
+	KICI_ORCH_STALE_RUNS_DETECTED_TOTAL: "orchestrator",
+	KICI_ORCH_STEPS_TOTAL: "orchestrator",
+	KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "orchestrator",
+	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "orchestrator",
+	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "orchestrator",
+	KICI_ORG_AGENT_MINUTES: "platform",
+	KICI_ORG_CONNECTIONS: "platform",
+	KICI_ORG_EXECUTIONS_COUNT: "platform",
+	KICI_ORG_LOG_BYTES: "platform",
+	KICI_ORG_STATUS_EVENTS_TOTAL: "platform",
+	KICI_ORGS_TOTAL: "platform",
+	KICI_PLAN_CAP_EXCEEDED_TOTAL: "platform",
+	KICI_PLAN_USAGE_RATIO: "platform",
+	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "platform",
+	KICI_PLATFORM_DASHBOARD_PROXY_DURATION_SECONDS: "platform",
+	KICI_PLATFORM_DASHBOARD_PROXY_PENDING: "platform",
+	KICI_PLATFORM_DASHBOARD_PROXY_REQUESTS_TOTAL: "platform",
+	KICI_PLATFORM_EXECUTION_EVENTS_TOTAL: "platform",
+	KICI_PLATFORM_EXECUTION_STATUS_UPDATES_TOTAL: "platform",
+	KICI_PLATFORM_IDENTITY_LINKS_MISSING_PROVIDER_USER_ID: "platform",
+	KICI_PLATFORM_JOB_CONSECUTIVE_FAILURES: "platform",
+	KICI_PLATFORM_JOB_DURATION_SECONDS: "platform",
+	KICI_PLATFORM_JOB_LAST_FAILURE_TIMESTAMP_SECONDS: "platform",
+	KICI_PLATFORM_JOB_LAST_SUCCESS_TIMESTAMP_SECONDS: "platform",
+	KICI_PLATFORM_JOB_RUNS_TOTAL: "platform",
+	KICI_PLATFORM_JOB_STATUS_FORWARDS_TOTAL: "platform",
+	KICI_PLATFORM_LOG_CHUNKS_FORWARDED_TOTAL: "platform",
+	KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "platform",
+	KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "platform",
+	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "platform",
+	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "platform",
+	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "platform",
+	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "platform",
+	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform",
+	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "platform",
+	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "platform",
+	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "orchestrator",
+	KICI_VALKEY_CONNECTION_STATUS: "platform",
+	KICI_VALKEY_PUBLISH_TOTAL: "platform",
+	KICI_VALKEY_RELAY_LATENCY_SECONDS: "platform",
+	KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "platform",
+	KICI_WEBHOOK_PROCESSING_SECONDS: "platform",
+	KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "platform",
+	KICI_WEBHOOKS_RECEIVED_TOTAL: "platform",
+	KICI_WS_CONNECTIONS_ACTIVE: "platform",
+	KICI_WS_CONNECTIONS_TOTAL: "platform",
+	KICI_WS_HEARTBEAT_AGE_SECONDS: "platform",
+	KICI_WS_MESSAGES_RECEIVED_TOTAL: "platform",
+	KICI_WS_MESSAGES_SENT_TOTAL: "platform",
+	KICI_WS_RELAY_ATTEMPTS_TOTAL: "platform",
+	KICI_WS_RELAY_DURATION_SECONDS: "platform",
+	NODEJS_EVENTLOOP_DELAY_MAX: "runtime",
+	NODEJS_EVENTLOOP_DELAY_MEAN: "runtime",
+	NODEJS_EVENTLOOP_DELAY_MIN: "runtime",
+	NODEJS_EVENTLOOP_DELAY_P50: "runtime",
+	NODEJS_EVENTLOOP_DELAY_P90: "runtime",
+	NODEJS_EVENTLOOP_DELAY_P99: "runtime",
+	NODEJS_EVENTLOOP_DELAY_STDDEV: "runtime",
+	NODEJS_EVENTLOOP_TIME: "runtime",
+	NODEJS_EVENTLOOP_UTILIZATION: "runtime",
+	V8JS_GC_DURATION: "runtime",
+	V8JS_MEMORY_HEAP_LIMIT: "runtime",
+	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "runtime",
+	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "runtime",
+	V8JS_MEMORY_HEAP_USED: "runtime"
 };
 /** Set of every catalog metric name — O(1) membership for lint / filter UI. */
 const ALL_METRIC_NAMES = [
@@ -421,6 +637,7 @@ const ALL_METRIC_NAMES = [
 	"kici_cache_misses_total",
 	"kici_cross_source_errors_total",
 	"kici_cross_source_fanout_size",
+	"kici_dashboard_relay_latency_seconds",
 	"kici_orch_agents_active",
 	"kici_orch_build_duration_seconds",
 	"kici_orch_config_reload_total",
@@ -443,6 +660,11 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_install_secrets_decisions_total",
 	"kici_orch_install_secrets_npm_registry_used_total",
 	"kici_orch_install_secrets_token_resolution_duration_seconds",
+	"kici_orch_job_consecutive_failures",
+	"kici_orch_job_duration_seconds",
+	"kici_orch_job_last_failure_timestamp_seconds",
+	"kici_orch_job_last_success_timestamp_seconds",
+	"kici_orch_job_runs_total",
 	"kici_orch_log_bytes_stored_total",
 	"kici_orch_log_chunks_received_total",
 	"kici_orch_scaler_config_reloads_total",
@@ -484,8 +706,10 @@ const ALL_METRIC_NAMES = [
 	"kici_platform_log_lines_forwarded_total",
 	"kici_platform_metrics_query_rate_limited_total",
 	"kici_platform_mimir_relay_errors_total",
+	"kici_platform_orch_metrics_filtered_total",
 	"kici_platform_orphan_connections_swept_total",
 	"kici_platform_stale_orchestrators_total",
+	"kici_platform_stale_platform_connections_evicted_total",
 	"kici_platform_stale_runs_failed_total",
 	"kici_platform_step_status_forwards_total",
 	"kici_universal_git_registration_errors_total",
@@ -502,9 +726,23 @@ const ALL_METRIC_NAMES = [
 	"kici_ws_messages_received_total",
 	"kici_ws_messages_sent_total",
 	"kici_ws_relay_attempts_total",
-	"kici_ws_relay_duration_seconds"
+	"kici_ws_relay_duration_seconds",
+	"nodejs.eventloop.delay.max",
+	"nodejs.eventloop.delay.mean",
+	"nodejs.eventloop.delay.min",
+	"nodejs.eventloop.delay.p50",
+	"nodejs.eventloop.delay.p90",
+	"nodejs.eventloop.delay.p99",
+	"nodejs.eventloop.delay.stddev",
+	"nodejs.eventloop.time",
+	"nodejs.eventloop.utilization",
+	"v8js.gc.duration",
+	"v8js.memory.heap.limit",
+	"v8js.memory.heap.space.available_size",
+	"v8js.memory.heap.space.physical_size",
+	"v8js.memory.heap.used"
 ];
 //#endregion
-export { ALL_METRIC_NAMES, MetricDescription, MetricKind, MetricLabels, MetricNames };
+export { ALL_METRIC_NAMES, MetricDescription, MetricKind, MetricLabels, MetricNames, MetricService };
 
 //# sourceMappingURL=metric-catalog.generated.js.map

package/dist/protocol/cluster-name.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Cluster name format for orchestrator identity.
+ *
+ * Subpath export: consumers import from
+ * `@kici-dev/engine/protocol/cluster-name`. Pure Zod + plain TypeScript
+ * with no node built-ins; browser-safe.
+ *
+ * Three audiences validate against the same regex:
+ *   - Orchestrator: boot resolver + `kici-admin cluster-name set`.
+ *   - Platform: `source.register` defense-in-depth on wire payload.
+ *   - Dashboard: client-side input validation on future rename UI.
+ *
+ * DNS-label-ish: lowercase letters, digits, hyphens; starts with a
+ * letter; max 63 chars. Matches RFC 1035 label rules narrowed to
+ * lowercase, which keeps cluster names safe for URLs without encoding
+ * and for filesystem / log identifiers.
+ */
+import { z } from 'zod';
+export declare const CLUSTER_NAME_REGEX: RegExp;
+export declare const CLUSTER_NAME_MAX_LENGTH = 63;
+export declare const CLUSTER_NAME_FORMAT_MESSAGE: string;
+export declare const clusterNameSchema: z.ZodString;
+export type ClusterName = z.infer<typeof clusterNameSchema>;
+/**
+ * Generate a random auto-name in the `cluster-<6hex>` form used when an
+ * operator has not supplied a name. The 6-hex suffix gives ~16M values
+ * per org; same-org collisions are caught by the Platform's UNIQUE
+ * constraint and the orch retries with a fresh suffix.
+ *
+ * Accepts an injected `randomBytes` to keep the function testable and
+ * to allow the orchestrator caller to use `node:crypto.randomBytes`
+ * without pulling a node built-in into this browser-safe module.
+ */
+export declare function generateClusterName(randomBytes: (size: number) => Uint8Array): ClusterName;
+//# sourceMappingURL=cluster-name.d.ts.map

package/dist/protocol/cluster-name.js

@@ -0,0 +1,43 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/protocol/cluster-name.ts
+/**
+* Cluster name format for orchestrator identity.
+*
+* Subpath export: consumers import from
+* `@kici-dev/engine/protocol/cluster-name`. Pure Zod + plain TypeScript
+* with no node built-ins; browser-safe.
+*
+* Three audiences validate against the same regex:
+*   - Orchestrator: boot resolver + `kici-admin cluster-name set`.
+*   - Platform: `source.register` defense-in-depth on wire payload.
+*   - Dashboard: client-side input validation on future rename UI.
+*
+* DNS-label-ish: lowercase letters, digits, hyphens; starts with a
+* letter; max 63 chars. Matches RFC 1035 label rules narrowed to
+* lowercase, which keeps cluster names safe for URLs without encoding
+* and for filesystem / log identifiers.
+*/
+const CLUSTER_NAME_REGEX = /^[a-z][a-z0-9-]{0,62}$/;
+const CLUSTER_NAME_MAX_LENGTH = 63;
+const CLUSTER_NAME_FORMAT_MESSAGE = "Cluster name must match ^[a-z][a-z0-9-]{0,62}$ (lowercase letters, digits, hyphens; start with a letter; ≤63 chars)";
+const clusterNameSchema = z.string().min(1, CLUSTER_NAME_FORMAT_MESSAGE).max(63, CLUSTER_NAME_FORMAT_MESSAGE).regex(CLUSTER_NAME_REGEX, CLUSTER_NAME_FORMAT_MESSAGE);
+/**
+* Generate a random auto-name in the `cluster-<6hex>` form used when an
+* operator has not supplied a name. The 6-hex suffix gives ~16M values
+* per org; same-org collisions are caught by the Platform's UNIQUE
+* constraint and the orch retries with a fresh suffix.
+*
+* Accepts an injected `randomBytes` to keep the function testable and
+* to allow the orchestrator caller to use `node:crypto.randomBytes`
+* without pulling a node built-in into this browser-safe module.
+*/
+function generateClusterName(randomBytes) {
+	const bytes = randomBytes(3);
+	const candidate = `cluster-${Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")}`;
+	return clusterNameSchema.parse(candidate);
+}
+//#endregion
+export { CLUSTER_NAME_FORMAT_MESSAGE, CLUSTER_NAME_MAX_LENGTH, CLUSTER_NAME_REGEX, clusterNameSchema, generateClusterName };
+
+//# sourceMappingURL=cluster-name.js.map

package/dist/protocol/dashboard-write-operations.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Registry of dashboard write operations governed by the per-orch
+ * dashboard-write policy.
+ *
+ * Subpath export: consumers import from
+ * `@kici-dev/engine/protocol/dashboard-write-operations`. The file is pure
+ * Zod + plain TypeScript with no node built-ins, so it remains
+ * browser-safe and is also imported directly by the dashboard SPA for
+ * capability rendering.
+ *
+ * Three audiences read this registry:
+ *   - Orchestrator: enforces the policy per operation in dashboard.* handlers.
+ *   - Platform: gates HTTP routes that proxy to the orch.
+ *   - Dashboard: renders per-control state (enabled / disabled / loading).
+ *
+ * Adding a new operation: append an entry to `DashboardWriteOperation`
+ * (the Zod enum) and `DASHBOARD_WRITE_OPERATIONS` (the descriptor array).
+ * The runtime build-time tests on the orchestrator and Platform sides
+ * fail until at least one gate handler references the new operation.
+ */
+import { z } from 'zod';
+export declare const DashboardWriteOperation: z.ZodEnum<{
+    "secrets.set": "secrets.set";
+    "secrets.delete": "secrets.delete";
+    "secrets.scope.create": "secrets.scope.create";
+    "secrets.scope.rename": "secrets.scope.rename";
+    "secrets.scope.delete": "secrets.scope.delete";
+    "variables.set": "variables.set";
+    "variables.delete": "variables.delete";
+    "environments.create": "environments.create";
+    "environments.update": "environments.update";
+    "environments.delete": "environments.delete";
+    "environments.bindings.set": "environments.bindings.set";
+    "environments.source_overrides.set": "environments.source_overrides.set";
+    "environments.source_overrides.delete": "environments.source_overrides.delete";
+    "held_runs.approve": "held_runs.approve";
+    "held_runs.reject": "held_runs.reject";
+    "event_dlq.retry": "event_dlq.retry";
+    "event_dlq.discard": "event_dlq.discard";
+    "registration.disable": "registration.disable";
+    "registration.delete": "registration.delete";
+    "global_workflows.update": "global_workflows.update";
+    "backends.sync": "backends.sync";
+    "backends.sync_one": "backends.sync_one";
+    "backends.test": "backends.test";
+}>;
+export type DashboardWriteOperation = z.infer<typeof DashboardWriteOperation>;
+/** Stable list of every operation in enum-declaration order. */
+export declare const DASHBOARD_WRITE_OPERATION_VALUES: readonly DashboardWriteOperation[];
+export declare const DashboardWriteCategory: z.ZodEnum<{
+    Secrets: "Secrets";
+    Variables: "Variables";
+    Environments: "Environments";
+    Bindings: "Bindings";
+    "Held runs": "Held runs";
+    DLQ: "DLQ";
+    Registrations: "Registrations";
+    Topology: "Topology";
+}>;
+export type DashboardWriteCategory = z.infer<typeof DashboardWriteCategory>;
+export declare const DashboardWriteSensitivity: z.ZodEnum<{
+    plaintext: "plaintext";
+    authority: "authority";
+    dispatch: "dispatch";
+}>;
+export type DashboardWriteSensitivity = z.infer<typeof DashboardWriteSensitivity>;
+/**
+ * Descriptor for one dashboard write operation. The fields that don't
+ * affect enforcement (label, cliEquivalent) are read by the dashboard
+ * SPA to render policy-aware UI and by the docs generator.
+ */
+export interface DashboardWriteOperationDescriptor {
+    /** The operation enum value used by enforcement helpers. */
+    readonly name: DashboardWriteOperation;
+    /** The wire message type the operation maps to (dashboard.* on Platform→Orch). */
+    readonly wireMessageType: string;
+    /** Grouping for UI rendering. */
+    readonly category: DashboardWriteCategory;
+    /** Human-facing label for tooltips and the Security policy page. */
+    readonly label: string;
+    /** Threat-model bucket — used by docs + the --sensitivity CLI sugar. */
+    readonly sensitivity: DashboardWriteSensitivity;
+    /** kici-admin invocation hint shown in the CLI snippet copied from the UI. */
+    readonly cliEquivalent: string;
+}
+export declare const DASHBOARD_WRITE_OPERATIONS: readonly DashboardWriteOperationDescriptor[];
+/** O(1) lookup of a descriptor by operation name. */
+export declare const DASHBOARD_WRITE_OPERATIONS_BY_NAME: ReadonlyMap<DashboardWriteOperation, DashboardWriteOperationDescriptor>;
+/** O(1) lookup of a descriptor by wire-message type. */
+export declare const DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE: ReadonlyMap<string, DashboardWriteOperationDescriptor>;
+export declare function getDashboardWriteOperationDescriptor(op: DashboardWriteOperation): DashboardWriteOperationDescriptor;
+export declare function getDashboardWriteOperationsByCategory(category: DashboardWriteCategory): readonly DashboardWriteOperationDescriptor[];
+export declare function getDashboardWriteOperationsBySensitivity(sensitivity: DashboardWriteSensitivity): readonly DashboardWriteOperationDescriptor[];
+/**
+ * Map of operation → enabled flag. Omitted operations default to true
+ * (permissive). The orch persists this shape verbatim as JSONB; the
+ * Platform mirrors it in its per-org cache.
+ */
+export type DashboardWritePolicyMap = Partial<Record<DashboardWriteOperation, boolean>>;
+/**
+ * Validates a sparse policy map. Use this where the value is required
+ * but may be empty (e.g. the JSONB column on the orch). For optional
+ * fields on outer schemas, embed `dashboardWritePolicyMap` directly
+ * with `.optional()` so omission stays as `undefined` rather than being
+ * coerced to `{}`.
+ */
+export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
+    "secrets.set": "secrets.set";
+    "secrets.delete": "secrets.delete";
+    "secrets.scope.create": "secrets.scope.create";
+    "secrets.scope.rename": "secrets.scope.rename";
+    "secrets.scope.delete": "secrets.scope.delete";
+    "variables.set": "variables.set";
+    "variables.delete": "variables.delete";
+    "environments.create": "environments.create";
+    "environments.update": "environments.update";
+    "environments.delete": "environments.delete";
+    "environments.bindings.set": "environments.bindings.set";
+    "environments.source_overrides.set": "environments.source_overrides.set";
+    "environments.source_overrides.delete": "environments.source_overrides.delete";
+    "held_runs.approve": "held_runs.approve";
+    "held_runs.reject": "held_runs.reject";
+    "event_dlq.retry": "event_dlq.retry";
+    "event_dlq.discard": "event_dlq.discard";
+    "registration.disable": "registration.disable";
+    "registration.delete": "registration.delete";
+    "global_workflows.update": "global_workflows.update";
+    "backends.sync": "backends.sync";
+    "backends.sync_one": "backends.sync_one";
+    "backends.test": "backends.test";
+}> & z.core.$partial, z.ZodBoolean>;
+export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+    "secrets.set": "secrets.set";
+    "secrets.delete": "secrets.delete";
+    "secrets.scope.create": "secrets.scope.create";
+    "secrets.scope.rename": "secrets.scope.rename";
+    "secrets.scope.delete": "secrets.scope.delete";
+    "variables.set": "variables.set";
+    "variables.delete": "variables.delete";
+    "environments.create": "environments.create";
+    "environments.update": "environments.update";
+    "environments.delete": "environments.delete";
+    "environments.bindings.set": "environments.bindings.set";
+    "environments.source_overrides.set": "environments.source_overrides.set";
+    "environments.source_overrides.delete": "environments.source_overrides.delete";
+    "held_runs.approve": "held_runs.approve";
+    "held_runs.reject": "held_runs.reject";
+    "event_dlq.retry": "event_dlq.retry";
+    "event_dlq.discard": "event_dlq.discard";
+    "registration.disable": "registration.disable";
+    "registration.delete": "registration.delete";
+    "global_workflows.update": "global_workflows.update";
+    "backends.sync": "backends.sync";
+    "backends.sync_one": "backends.sync_one";
+    "backends.test": "backends.test";
+}> & z.core.$partial, z.ZodBoolean>>;
+/**
+ * Resolve the effective state of an operation given a (possibly sparse)
+ * policy map. Treats `undefined` as enabled by the permissive default.
+ */
+export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
+/**
+ * Expand a (possibly sparse) policy map into the full effective state
+ * for all 23 operations. Operations the policy doesn't mention come
+ * back as `true` (permissive). Used by the orch HTTP admin response,
+ * the WS `orch.capabilities` broadcast, and the dashboard's policy
+ * page so consumers see the full picture, not the sparse storage shape.
+ */
+export declare function resolveFullPolicyView(policy: DashboardWritePolicyMap | null | undefined): Record<DashboardWriteOperation, boolean>;
+//# sourceMappingURL=dashboard-write-operations.d.ts.map