@kici-dev/engine 0.14.2 → 0.16.0

package/dist/labels.js

@@ -58,35 +58,6 @@ function deriveOsArchLabels(platform, arch) {
 	return labels;
 }
 /**
-* Plain OS/arch labels that gate a bare-metal scaler as a mandatory taint.
-* A pool whose declared labels include one of these only accepts jobs that
-* explicitly request that platform. Linux and x64/amd64 are the defaults and
-* are absent on purpose — an unqualified `runsOn: 'bare-metal'` job must still
-* land on a Linux-x64 scaler.
-*/
-const PLATFORM_TAINT_LABELS = /* @__PURE__ */ new Set([
-	"windows",
-	"win32",
-	"macos",
-	"darwin",
-	"arm64",
-	"aarch64",
-	"arm"
-]);
-/**
-* Intersect a pool's declared labels with {@link PLATFORM_TAINT_LABELS},
-* returning the de-duplicated plain platform-taint labels (lowercased) in
-* input order.
-*/
-function derivePlatformTaints(declaredLabels) {
-	const seen = /* @__PURE__ */ new Set();
-	for (const raw of declaredLabels) {
-		const label = raw.toLowerCase();
-		if (PLATFORM_TAINT_LABELS.has(label)) seen.add(label);
-	}
-	return [...seen];
-}
-/**
 * Operating systems a scaler pool can declare via the structured `platform`
 * field. `linux` is the default and carries no taint; `macos` / `windows` are
 * non-default and taint the pool.
@@ -132,9 +103,8 @@ function platformToOsArchLabels(platform) {
 * Derive the plain platform-taint labels for a declared structured platform.
 * Returns the canonical tokens (`macos`, `windows`, `arm64`) that a job's
 * `runsOn` must include to allocate on the pool. The linux/x64 default carries
-* no taint. Unlike {@link derivePlatformTaints} (which intersects declared
-* labels against a denylist), this derives from the structured field, so a pool
-* labeled `windows-2022` still taints correctly.
+* no taint. It derives from the structured field, so a pool labeled
+* `windows-2022` still taints correctly.
 */
 function platformToTaints(platform) {
 	const taints = [];
@@ -452,6 +422,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, JOB_IMAGE_RUNTIME_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentFeatureLabel, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
+export { AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, JOB_IMAGE_RUNTIME_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentFeatureLabel, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/mcp/held-run-resolve.d.ts

@@ -10,9 +10,7 @@ export interface HeldRunSummary {
     status: string;
     /**
      * Persisted `held_runs.hold_type`, when the orchestrator's list response
-     * carried one. Optional and un-normalized: callers pass it through
-     * `normalizePersistedHoldType` before branching. Absent from an older
-     * orchestrator's response.
+     * carried one. Absent from an older orchestrator's response.
      */
     holdType?: string;
     /**
@@ -51,8 +49,7 @@ export interface HeldRunFilter {
     holdId?: string;
     /**
      * Narrow to holds of one type (`reviewer` / `timer` / `concurrency` /
-     * `security`), normalized through `normalizePersistedHoldType` on both sides
-     * so a legacy `approval` row answers to `reviewer`.
+     * `security`), compared verbatim.
      *
      * Composes with {@link job} / {@link step} rather than replacing them: a
      * matrix whose children each carry two holds needs both halves.

package/dist/mcp/held-run-resolve.js

@@ -1,6 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { HeldRunStatus } from "../context/held-run-status.js";
-import { normalizePersistedHoldType } from "../context/hold-type.js";
 //#region src/mcp/held-run-resolve.ts
 /**
 * Shared held-run resolution for the `kici approve` / `kici reject` commands and
@@ -32,7 +31,7 @@ import { normalizePersistedHoldType } from "../context/hold-type.js";
 function describeHold(hold) {
 	const job = hold.jobId || "(unnamed hold)";
 	const base = hold.holdScope === "step" && hold.stepIndex != null ? `step ${hold.stepIndex} of ${job}` : job;
-	return hold.holdType ? `${base} (${normalizePersistedHoldType(hold.holdType)})` : base;
+	return hold.holdType ? `${base} (${hold.holdType})` : base;
 }
 /**
 * The hold descriptions, in listing order, for an error message.
@@ -89,8 +88,8 @@ function resolveHeldRunId(holds, filter) {
 		error: "No pending approval holds found for this run."
 	};
 	if (filter.holdId !== void 0) return pickSingle(pending.filter((h) => h.id === filter.holdId), `hold '${filter.holdId}'`, pending);
-	const wanted = filter.holdType && normalizePersistedHoldType(filter.holdType);
-	const byType = (candidates) => wanted === void 0 ? candidates : candidates.filter((h) => h.holdType && normalizePersistedHoldType(h.holdType) === wanted);
+	const wanted = filter.holdType;
+	const byType = (candidates) => wanted === void 0 ? candidates : candidates.filter((h) => h.holdType === wanted);
 	const typeLabel = wanted ? ` of type '${wanted}'` : "";
 	if (filter.step !== void 0) {
 		if (!filter.job) return {

package/dist/metrics/metric-catalog.generated.d.ts

@@ -136,7 +136,6 @@ export declare const MetricNames: {
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'kici_orch_webhooks_processed_total';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'kici_orch_webhooks_received_total';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'kici_orch_ws_nack_received_total';
-    readonly KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: 'kici_orch_ws_platform_capability_gap_total';
     readonly KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: 'kici_orch_ws_unsupported_message_sent_total';
     readonly KICI_ORCHESTRATOR_DRAINING: 'kici_orchestrator_draining';
     readonly KICI_ORG_AGENT_MINUTES: 'kici_org_agent_minutes';
@@ -386,7 +385,6 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: readonly ['result'];
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: readonly ['source', 'event'];
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: readonly [];
-    readonly KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: readonly [];
     readonly KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: readonly [];
     readonly KICI_ORCHESTRATOR_DRAINING: readonly [];
     readonly KICI_ORG_AGENT_MINUTES: readonly ['org_id', 'status'];
@@ -635,7 +633,6 @@ export declare const MetricKind: {
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'counter';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'counter';
-    readonly KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: 'counter';
     readonly KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: 'counter';
     readonly KICI_ORCHESTRATOR_DRAINING: 'observableGauge';
     readonly KICI_ORG_AGENT_MINUTES: 'observableGauge';
@@ -884,7 +881,6 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'Total number of webhooks processed';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'Total number of webhooks received';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'NACKs received from the Platform for a message it could not process (version skew)';
-    readonly KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: 'Feature-gated sends suppressed because the Platform does not advertise the capability';
     readonly KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: 'NACKs sent to the Platform for an unrecognized inbound message type (version skew)';
     readonly KICI_ORCHESTRATOR_DRAINING: 'Whether this coordinator is draining (1) or accepting new jobs (0)';
     readonly KICI_ORG_AGENT_MINUTES: 'Per-org total agent runtime in minutes, by terminal status over a rolling window (DB-derived, top-N active orgs, leader-only, operator-side capacity-planning aggregate)';
@@ -1140,7 +1136,6 @@ export declare const MetricService: {
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'orchestrator';
-    readonly KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: 'orchestrator';
     readonly KICI_ORCHESTRATOR_DRAINING: 'orchestrator';
     readonly KICI_ORG_AGENT_MINUTES: 'platform';

package/dist/metrics/metric-catalog.generated.js

@@ -138,7 +138,6 @@ const MetricNames = {
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "kici_orch_webhooks_processed_total",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "kici_orch_webhooks_received_total",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "kici_orch_ws_nack_received_total",
-	KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: "kici_orch_ws_platform_capability_gap_total",
 	KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: "kici_orch_ws_unsupported_message_sent_total",
 	KICI_ORCHESTRATOR_DRAINING: "kici_orchestrator_draining",
 	KICI_ORG_AGENT_MINUTES: "kici_org_agent_minutes",
@@ -399,7 +398,6 @@ const MetricLabels = {
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: ["result"],
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: ["source", "event"],
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: [],
-	KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: [],
 	KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: [],
 	KICI_ORCHESTRATOR_DRAINING: [],
 	KICI_ORG_AGENT_MINUTES: ["org_id", "status"],
@@ -652,7 +650,6 @@ const MetricKind = {
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "counter",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "counter",
-	KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: "counter",
 	KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: "counter",
 	KICI_ORCHESTRATOR_DRAINING: "observableGauge",
 	KICI_ORG_AGENT_MINUTES: "observableGauge",
@@ -901,7 +898,6 @@ const MetricDescription = {
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "Total number of webhooks processed",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "Total number of webhooks received",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "NACKs received from the Platform for a message it could not process (version skew)",
-	KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: "Feature-gated sends suppressed because the Platform does not advertise the capability",
 	KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: "NACKs sent to the Platform for an unrecognized inbound message type (version skew)",
 	KICI_ORCHESTRATOR_DRAINING: "Whether this coordinator is draining (1) or accepting new jobs (0)",
 	KICI_ORG_AGENT_MINUTES: "Per-org total agent runtime in minutes, by terminal status over a rolling window (DB-derived, top-N active orgs, leader-only, operator-side capacity-planning aggregate)",
@@ -1157,7 +1153,6 @@ const MetricService = {
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "orchestrator",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "orchestrator",
-	KICI_ORCH_WS_PLATFORM_CAPABILITY_GAP_TOTAL: "orchestrator",
 	KICI_ORCH_WS_UNSUPPORTED_MESSAGE_SENT_TOTAL: "orchestrator",
 	KICI_ORCHESTRATOR_DRAINING: "orchestrator",
 	KICI_ORG_AGENT_MINUTES: "platform",
@@ -1407,7 +1402,6 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_webhooks_processed_total",
 	"kici_orch_webhooks_received_total",
 	"kici_orch_ws_nack_received_total",
-	"kici_orch_ws_platform_capability_gap_total",
 	"kici_orch_ws_unsupported_message_sent_total",
 	"kici_orchestrator_draining",
 	"kici_org_agent_minutes",

package/dist/protocol/messages/access-log.d.ts

@@ -82,6 +82,7 @@ export declare const AccessLogAction: z.ZodEnum<{
     "db.create_role": "db.create_role";
     "db.ensure": "db.ensure";
     "db.fresh": "db.fresh";
+    "db.migrate": "db.migrate";
     "db.refresh_collation_version": "db.refresh_collation_version";
     "db.reindex": "db.reindex";
     "diagnostics.read": "diagnostics.read";
@@ -125,6 +126,7 @@ export declare const AccessLogAction: z.ZodEnum<{
     "scaler.capacity.read": "scaler.capacity.read";
     "scaler.orphan.stop": "scaler.orphan.stop";
     "scaler.orphans.read": "scaler.orphans.read";
+    "scaler.reload": "scaler.reload";
     "secret.delete": "secret.delete";
     "secret.list.read": "secret.list.read";
     "secret.reveal": "secret.reveal";
@@ -191,6 +193,7 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -234,6 +237,7 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -327,6 +331,7 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -370,6 +375,7 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -493,6 +499,7 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -536,6 +543,7 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -640,6 +648,7 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "db.create_role": "db.create_role";
             "db.ensure": "db.ensure";
             "db.fresh": "db.fresh";
+            "db.migrate": "db.migrate";
             "db.refresh_collation_version": "db.refresh_collation_version";
             "db.reindex": "db.reindex";
             "diagnostics.read": "diagnostics.read";
@@ -683,6 +692,7 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "scaler.capacity.read": "scaler.capacity.read";
             "scaler.orphan.stop": "scaler.orphan.stop";
             "scaler.orphans.read": "scaler.orphans.read";
+            "scaler.reload": "scaler.reload";
             "secret.delete": "secret.delete";
             "secret.list.read": "secret.list.read";
             "secret.reveal": "secret.reveal";

package/dist/protocol/messages/access-log.js

@@ -126,6 +126,7 @@ const AccessLogAction = z.enum([
 	"cluster_name.update",
 	"attestation.retry",
 	"scaler.orphan.stop",
+	"scaler.reload",
 	"peer.forget",
 	"access_log.list.read",
 	"event_dlq.list.read",
@@ -134,6 +135,7 @@ const AccessLogAction = z.enum([
 	"archive_chunk",
 	"purge_chunk",
 	"db.fresh",
+	"db.migrate",
 	"db.ensure",
 	"db.create_role",
 	"db.create_readonly_user",

package/dist/protocol/messages/auth.d.ts

@@ -4,11 +4,11 @@ export declare const authRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"auth.request">;
     token: z.ZodString;
     protocolVersion: z.ZodNumber;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
+    capabilities: z.ZodObject<{
+        orchRole: z.ZodEnum<{
             coordinator: "coordinator";
             worker: "worker";
-        }>>;
+        }>;
         dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
@@ -42,7 +42,6 @@ export declare const authRequestSchema: z.ZodObject<{
             encrypted: "encrypted";
             permissive: "permissive";
         }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
             crv: z.ZodLiteral<"X25519">;
@@ -51,15 +50,15 @@ export declare const authRequestSchema: z.ZodObject<{
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$loose>>;
+    }, z.core.$loose>;
 }, z.core.$strip>;
 /** Auth success response sent by Platform to orchestrator after successful authentication. */
 export declare const authSuccessSchema: z.ZodObject<{
     type: z.ZodLiteral<"auth.success">;
     connectionId: z.ZodString;
-    orgPublicAlias: z.ZodOptional<z.ZodString>;
-    orgId: z.ZodOptional<z.ZodString>;
-    provenanceIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orgPublicAlias: z.ZodString;
+    orgId: z.ZodString;
+    githubWebhookUrl: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 /** Auth failure response sent by Platform to orchestrator when authentication fails. */
 export declare const authFailureSchema: z.ZodObject<{

package/dist/protocol/messages/auth.js

@@ -7,8 +7,8 @@ const authRequestSchema = z.object({
 	type: z.literal("auth.request"),
 	token: z.string().min(1),
 	protocolVersion: z.number().int().positive(),
-	/** Orchestrator capabilities (optional for backward compat with pre-capability orchestrators). */
-	capabilities: orchCapabilitiesSchema.optional()
+	/** Orchestrator capabilities. */
+	capabilities: orchCapabilitiesSchema
 });
 /** Auth success response sent by Platform to orchestrator after successful authentication. */
 const authSuccessSchema = z.object({
@@ -19,29 +19,24 @@ const authSuccessSchema = z.object({
 	* (`oal_<12-char>`). Used by the orchestrator's check-run emitter to
 	* build a `details_url` that points at the dashboard's resolver
 	* route, so the canonical `org_<12-char>` id never appears in URLs
-	* that reach public surfaces. Optional for back-compat with Platforms
-	* that don't yet supply it; when absent, the orchestrator skips
-	* `details_url` (preserving today's behaviour).
+	* that reach public surfaces.
 	*/
-	orgPublicAlias: z.string().optional(),
+	orgPublicAlias: z.string(),
 	/**
 	* Canonical org id (`org_<…>`) of the authenticated orchestrator's owning
 	* org. The orchestrator auto-provisions a `remote_sources` anchor
 	* (`remote:<orgId>`) from this so `kici run remote` relayed through the
-	* Platform resolves the real tenant. Optional for back-compat with Platforms
-	* that don't yet supply it; when absent, the orchestrator skips
-	* remote-source provisioning.
+	* Platform resolves the real tenant.
 	*/
-	orgId: z.string().optional(),
+	orgId: z.string(),
 	/**
-	* Provenance trust root (the OIDC issuer) the Platform mints build-provenance
-	* tokens under. The orchestrator uses it to verify provenance bundles at
-	* ingest: it derives the JWKS URI (`<issuer>/.well-known/jwks.json`) and
-	* caches the key set. `null` (or absent) means provenance is not configured —
-	* the orchestrator records each attestation's verdict as `unverifiable`
-	* rather than silently `verified`.
+	* The Platform's org-scoped GitHub App webhook URL
+	* (`<WEBHOOK_PUBLIC_URL>/webhook/<orgId>/github`). It is known before any
+	* App exists, so the orchestrator's manifest flow bakes it into a new App in
+	* platform and hybrid mode. `null` when the Platform has no public webhook
+	* base.
 	*/
-	provenanceIssuer: z.string().nullable().optional()
+	githubWebhookUrl: z.string().nullable()
 });
 /** Auth failure response sent by Platform to orchestrator when authentication fails. */
 const authFailureSchema = z.object({

package/dist/protocol/messages/browser.js

@@ -1,7 +1,7 @@
 import "../../rolldown-runtime-ClRpJifh.js";
+import { LogStream } from "./log-stream.js";
 import { browserJobContextSchema, browserRunEventSchema } from "./run-events.js";
 import { browserEventLogPayloadChunkSchema } from "./dashboard.js";
-import { LogStream } from "./log-stream.js";
 import { OrchLogPhase } from "./platform-orchestrator.js";
 import { z } from "zod";
 //#region src/protocol/messages/browser.ts

package/dist/protocol/messages/capabilities.d.ts

@@ -1,24 +1,19 @@
 /**
- * Capability negotiation schemas — bidirectional.
+ * Capability schemas — bidirectional.
  *
  * Modeled after peerCapabilitiesSchema in peer.ts.
  *
- * Two directions, each advertised as the sending side learns what the other
- * understands:
- * - **orchestrator → Platform** (`orchCapabilitiesSchema`, sent in `auth.request`):
- *   the Platform pre-flight-checks orchestrator capabilities before sending
- *   feature-gated messages (e.g. the dashboard-request manifest).
+ * - **orchestrator → Platform** (`orchCapabilitiesSchema`, sent in `auth.request`
+ *   and rebroadcast as `orch.capabilities.update`): the orchestrator's role and
+ *   the dashboard settings the Platform caches per org.
  * - **Platform → orchestrator** (`platformCapabilitiesSchema`, advertised once
- *   after auth): a self-hosted orchestrator can run *ahead* of the hosted
- *   Platform, so it pre-flight-checks its own feature-gated sends against what
- *   the Platform advertises — surfacing a diagnosable capability gap instead of
- *   firing a frame the Platform would drop.
+ *   after auth), **orchestrator → agent** (`orchAgentCapabilitiesSchema`, on
+ *   `register.ack`) and **agent → orchestrator** (`agentCapabilitiesSchema`, on
+ *   `agent.register`): each defines no flag at protocol 4 and is advertised
+ *   empty. A later release adds a flag to one of them without a protocol bump.
  *
- * Pattern (both directions): each field indicates support for an optional
- * protocol feature. Missing fields default to unsupported for backward
- * compatibility; `.passthrough()` preserves unknown flags from a newer peer.
- * A peer that never advertises at all is treated as "unknown" (optimistic),
- * never as "supports nothing".
+ * Every schema uses `.passthrough()`, so a newer peer's unknown fields are
+ * preserved rather than stripped.
  */
 import { z } from 'zod';
 /** Orchestrator role in a cluster topology. */
@@ -32,10 +27,10 @@ export type OrchRole = z.infer<typeof OrchRole>;
  * Uses .passthrough() so newer orchestrators sending unknown flags are preserved.
  */
 export declare const orchCapabilitiesSchema: z.ZodObject<{
-    orchRole: z.ZodOptional<z.ZodEnum<{
+    orchRole: z.ZodEnum<{
         coordinator: "coordinator";
         worker: "worker";
-    }>>;
+    }>;
     dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
         "attestations.retry": "attestations.retry";
         "backends.sync": "backends.sync";
@@ -69,7 +64,6 @@ export declare const orchCapabilitiesSchema: z.ZodObject<{
         encrypted: "encrypted";
         permissive: "permissive";
     }>>>;
-    supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
     dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
         kty: z.ZodLiteral<"OKP">;
         crv: z.ZodLiteral<"X25519">;
@@ -84,96 +78,23 @@ export type OrchCapabilities = z.infer<typeof orchCapabilitiesSchema>;
 /** Default orchestrator capabilities sent in auth.request. */
 export declare const ORCH_CAPABILITIES: Readonly<{
     orchRole: "coordinator";
-    supportedDashboardRequests: string[];
 }>;
-/**
- * Check whether an orchestrator advertises a specific capability flag.
- *
- * Takes `string` (not `keyof`) because newer versions may have flags the current code
- * doesn't know about. Returns false if capabilities is undefined (pre-capability
- * orchestrator) or the flag is missing/false.
- */
-export declare function hasOrchCapability(capabilities: OrchCapabilities | undefined, flag: string): boolean;
-/**
- * Platform-advertised capabilities sent to the orchestrator after auth.
- * Uses .passthrough() so a newer Platform's unknown flags are preserved.
- * Every field is optional and absent = unsupported (same evolution contract as
- * `orchCapabilitiesSchema`).
- */
-export declare const platformCapabilitiesSchema: z.ZodObject<{
-    orchMetrics: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$loose>;
+/** Platform-advertised capabilities sent to the orchestrator after auth. */
+export declare const platformCapabilitiesSchema: z.ZodObject<{}, z.core.$loose>;
 /** Inferred type for Platform capabilities. */
 export type PlatformCapabilities = z.infer<typeof platformCapabilitiesSchema>;
 /** Default Platform capabilities advertised to the orchestrator after auth. */
-export declare const PLATFORM_CAPABILITIES: Readonly<{
-    orchMetrics: true;
-}>;
-/**
- * Check whether the Platform advertises a specific capability flag.
- *
- * Takes `string` (not `keyof`) because a newer Platform may advertise flags the
- * current orchestrator build doesn't know about. Returns false if capabilities
- * is undefined (nothing advertised yet) or the flag is missing/false.
- *
- * NOTE: "undefined → false" here is the plain reader semantics. A feature-gated
- * SEND that must stay backward-safe against a pre-capability Platform (which
- * never advertises) treats "nothing advertised yet" as optimistic-send — that
- * layer lives in the orchestrator's `sendIfPlatformSupports`, not here.
- */
-export declare function hasPlatformCapability(capabilities: PlatformCapabilities | undefined, flag: string): boolean;
-/**
- * Orchestrator -> Agent capabilities, advertised on `register.ack`. Same
- * evolution contract as the other two directions: every field optional,
- * absent = unsupported, `.passthrough()` preserves a newer orchestrator's
- * unknown flags. Lets the agent learn which optional agent-facing protocol
- * features this orchestrator build supports.
- */
-export declare const orchAgentCapabilitiesSchema: z.ZodObject<{
-    artifactCompleteAck: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$loose>;
+export declare const PLATFORM_CAPABILITIES: Readonly<{}>;
+/** Orchestrator -> agent capabilities, advertised on `register.ack`. */
+export declare const orchAgentCapabilitiesSchema: z.ZodObject<{}, z.core.$loose>;
 /** Inferred type for orchestrator -> agent capabilities. */
 export type OrchAgentCapabilities = z.infer<typeof orchAgentCapabilitiesSchema>;
 /** Default orchestrator -> agent capabilities advertised on register.ack. */
-export declare const ORCH_AGENT_CAPABILITIES: Readonly<{
-    artifactCompleteAck: true;
-}>;
-/**
- * Check whether an orchestrator advertises a specific agent-facing capability
- * flag.
- *
- * Takes `string` (not `keyof`) because a newer orchestrator may advertise flags
- * this agent build doesn't know about. Returns false if capabilities is
- * undefined (pre-capability orchestrator) or the flag is missing/false.
- */
-export declare function hasOrchAgentCapability(capabilities: OrchAgentCapabilities | undefined, flag: string): boolean;
-/**
- * Agent -> Orchestrator capabilities, advertised on `agent.register`. Same
- * evolution contract as the other directions: every field optional, absent =
- * unsupported, `.passthrough()` preserves a newer agent's unknown flags. Lets
- * the orchestrator route work that depends on an optional agent behaviour only
- * to agents that implement it.
- */
-export declare const agentCapabilitiesSchema: z.ZodObject<{
-    globalEvalSkipsResultAwareGenerators: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$loose>;
-/** Flag names of {@link agentCapabilitiesSchema}, for {@link hasAgentCapability} lookups. */
-export declare const AgentCapabilityFlag: z.ZodEnum<{
-    globalEvalSkipsResultAwareGenerators: "globalEvalSkipsResultAwareGenerators";
-}>;
-export type AgentCapabilityFlag = z.infer<typeof AgentCapabilityFlag>;
+export declare const ORCH_AGENT_CAPABILITIES: Readonly<{}>;
+/** Agent -> orchestrator capabilities, advertised on `agent.register`. */
+export declare const agentCapabilitiesSchema: z.ZodObject<{}, z.core.$loose>;
 /** Inferred type for agent -> orchestrator capabilities. */
 export type AgentCapabilities = z.infer<typeof agentCapabilitiesSchema>;
 /** Default agent -> orchestrator capabilities advertised on agent.register. */
-export declare const AGENT_CAPABILITIES: Readonly<{
-    globalEvalSkipsResultAwareGenerators: true;
-}>;
-/**
- * Check whether an agent advertises a specific capability flag.
- *
- * Takes `string` (not `keyof`) because a newer agent may advertise flags this
- * orchestrator build doesn't know about. Returns false if capabilities is
- * undefined (pre-capability agent) or the flag is missing/false.
- */
-export declare function hasAgentCapability(capabilities: AgentCapabilities | null | undefined, flag: string): boolean;
+export declare const AGENT_CAPABILITIES: Readonly<{}>;
 //# sourceMappingURL=capabilities.d.ts.map