@kici-dev/engine 0.14.2 → 0.16.0

package/dist/protocol/messages/capabilities.js

@@ -1,30 +1,24 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { dashboardWritePolicyMap } from "../dashboard-write-operations.js";
 import { dashboardEncryptionJwkSchema } from "./dashboard-sealed-write.js";
-import { DASHBOARD_REQUEST_TYPES } from "./dashboard.js";
 import { z } from "zod";
 //#region src/protocol/messages/capabilities.ts
 /**
-* Capability negotiation schemas — bidirectional.
+* Capability schemas — bidirectional.
 *
 * Modeled after peerCapabilitiesSchema in peer.ts.
 *
-* Two directions, each advertised as the sending side learns what the other
-* understands:
-* - **orchestrator → Platform** (`orchCapabilitiesSchema`, sent in `auth.request`):
-*   the Platform pre-flight-checks orchestrator capabilities before sending
-*   feature-gated messages (e.g. the dashboard-request manifest).
+* - **orchestrator → Platform** (`orchCapabilitiesSchema`, sent in `auth.request`
+*   and rebroadcast as `orch.capabilities.update`): the orchestrator's role and
+*   the dashboard settings the Platform caches per org.
 * - **Platform → orchestrator** (`platformCapabilitiesSchema`, advertised once
-*   after auth): a self-hosted orchestrator can run *ahead* of the hosted
-*   Platform, so it pre-flight-checks its own feature-gated sends against what
-*   the Platform advertises — surfacing a diagnosable capability gap instead of
-*   firing a frame the Platform would drop.
+*   after auth), **orchestrator → agent** (`orchAgentCapabilitiesSchema`, on
+*   `register.ack`) and **agent → orchestrator** (`agentCapabilitiesSchema`, on
+*   `agent.register`): each defines no flag at protocol 4 and is advertised
+*   empty. A later release adds a flag to one of them without a protocol bump.
 *
-* Pattern (both directions): each field indicates support for an optional
-* protocol feature. Missing fields default to unsupported for backward
-* compatibility; `.passthrough()` preserves unknown flags from a newer peer.
-* A peer that never advertises at all is treated as "unknown" (optimistic),
-* never as "supports nothing".
+* Every schema uses `.passthrough()`, so a newer peer's unknown fields are
+* preserved rather than stripped.
 */
 /** Orchestrator role in a cluster topology. */
 const OrchRole = z.enum(["coordinator", "worker"]);
@@ -34,7 +28,7 @@ const OrchRole = z.enum(["coordinator", "worker"]);
 */
 const orchCapabilitiesSchema = z.object({
 	/** Orchestrator's role in the cluster (coordinator manages DB/vault, worker is stateless). */
-	orchRole: OrchRole.optional(),
+	orchRole: OrchRole,
 	/**
 	* Per-operation dashboard-write policy. Sparse map where each
 	* present key flips one `DashboardWriteOperation` to false. Missing
@@ -45,15 +39,6 @@ const orchCapabilitiesSchema = z.object({
 	*/
 	dashboardWrites: dashboardWritePolicyMap.optional(),
 	/**
-	* Every `dashboard.*` request type this orchestrator build understands.
-	* The Platform pre-flight-checks an incoming dashboard request against this
-	* set and refuses (with a precise "upgrade orchestrator" error) when the
-	* type is absent. Derived from the orchestrator's own protocol schema, so it
-	* cannot drift. Absent on pre-capability builds → treated as "unknown",
-	* never as "supports nothing".
-	*/
-	supportedDashboardRequests: z.array(z.string()).optional(),
-	/**
 	* The orchestrator's active X25519 dashboard-encryption public key. Feeds
 	* the Convenient tier: the key reaches the hosted control plane over the
 	* authenticated orchestrator connection, and the dashboard fetches it from
@@ -71,107 +56,20 @@ const orchCapabilitiesSchema = z.object({
 	dashboardVerifiedIssuer: z.string().nullable().optional()
 }).passthrough();
 /** Default orchestrator capabilities sent in auth.request. */
-const ORCH_CAPABILITIES = Object.freeze({
-	orchRole: OrchRole.enum.coordinator,
-	supportedDashboardRequests: [...DASHBOARD_REQUEST_TYPES]
-});
-/**
-* Check whether an orchestrator advertises a specific capability flag.
-*
-* Takes `string` (not `keyof`) because newer versions may have flags the current code
-* doesn't know about. Returns false if capabilities is undefined (pre-capability
-* orchestrator) or the flag is missing/false.
-*/
-function hasOrchCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
-/**
-* Platform-advertised capabilities sent to the orchestrator after auth.
-* Uses .passthrough() so a newer Platform's unknown flags are preserved.
-* Every field is optional and absent = unsupported (same evolution contract as
-* `orchCapabilitiesSchema`).
-*/
-const platformCapabilitiesSchema = z.object({ 
-/** Platform ingests periodic `orch.metrics` telemetry pushes. */
-orchMetrics: z.boolean().optional() }).passthrough();
+const ORCH_CAPABILITIES = Object.freeze({ orchRole: OrchRole.enum.coordinator });
+/** Platform-advertised capabilities sent to the orchestrator after auth. */
+const platformCapabilitiesSchema = z.object({}).passthrough();
 /** Default Platform capabilities advertised to the orchestrator after auth. */
-const PLATFORM_CAPABILITIES = Object.freeze({ orchMetrics: true });
-/**
-* Check whether the Platform advertises a specific capability flag.
-*
-* Takes `string` (not `keyof`) because a newer Platform may advertise flags the
-* current orchestrator build doesn't know about. Returns false if capabilities
-* is undefined (nothing advertised yet) or the flag is missing/false.
-*
-* NOTE: "undefined → false" here is the plain reader semantics. A feature-gated
-* SEND that must stay backward-safe against a pre-capability Platform (which
-* never advertises) treats "nothing advertised yet" as optimistic-send — that
-* layer lives in the orchestrator's `sendIfPlatformSupports`, not here.
-*/
-function hasPlatformCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
-/**
-* Orchestrator -> Agent capabilities, advertised on `register.ack`. Same
-* evolution contract as the other two directions: every field optional,
-* absent = unsupported, `.passthrough()` preserves a newer orchestrator's
-* unknown flags. Lets the agent learn which optional agent-facing protocol
-* features this orchestrator build supports.
-*/
-const orchAgentCapabilitiesSchema = z.object({ 
-/**
-* Orchestrator acks `artifacts.upload.complete` (with committed|failed) so
-* the agent can fail the workflow step on a lost commit instead of losing
-* the artifact silently. Absent -> agent stays fire-and-forget.
-*/
-artifactCompleteAck: z.boolean().optional() }).passthrough();
+const PLATFORM_CAPABILITIES = Object.freeze({});
+/** Orchestrator -> agent capabilities, advertised on `register.ack`. */
+const orchAgentCapabilitiesSchema = z.object({}).passthrough();
 /** Default orchestrator -> agent capabilities advertised on register.ack. */
-const ORCH_AGENT_CAPABILITIES = Object.freeze({ artifactCompleteAck: true });
-/**
-* Check whether an orchestrator advertises a specific agent-facing capability
-* flag.
-*
-* Takes `string` (not `keyof`) because a newer orchestrator may advertise flags
-* this agent build doesn't know about. Returns false if capabilities is
-* undefined (pre-capability orchestrator) or the flag is missing/false.
-*/
-function hasOrchAgentCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
-/**
-* Agent -> Orchestrator capabilities, advertised on `agent.register`. Same
-* evolution contract as the other directions: every field optional, absent =
-* unsupported, `.passthrough()` preserves a newer agent's unknown flags. Lets
-* the orchestrator route work that depends on an optional agent behaviour only
-* to agents that implement it.
-*/
-const agentCapabilitiesSchema = z.object({ 
-/**
-* In a pre-run global eval round the agent runs only the needs-free
-* `DynamicJobFn`s and skips every generator declared with upstream `needs`
-* (a result-aware generator). Such a generator runs later, on the run's
-* deferred path, with its upstream outputs. An agent without this flag runs
-* every generator in the round — including a result-aware one, which then
-* sees no upstream outputs and produces the wrong jobs — so the
-* orchestrator sends a round containing a result-aware generator only to an
-* agent that advertises it.
-*/
-globalEvalSkipsResultAwareGenerators: z.boolean().optional() }).passthrough();
-/** Flag names of {@link agentCapabilitiesSchema}, for {@link hasAgentCapability} lookups. */
-const AgentCapabilityFlag = z.enum(["globalEvalSkipsResultAwareGenerators"]);
+const ORCH_AGENT_CAPABILITIES = Object.freeze({});
+/** Agent -> orchestrator capabilities, advertised on `agent.register`. */
+const agentCapabilitiesSchema = z.object({}).passthrough();
 /** Default agent -> orchestrator capabilities advertised on agent.register. */
-const AGENT_CAPABILITIES = Object.freeze({ globalEvalSkipsResultAwareGenerators: true });
-/**
-* Check whether an agent advertises a specific capability flag.
-*
-* Takes `string` (not `keyof`) because a newer agent may advertise flags this
-* orchestrator build doesn't know about. Returns false if capabilities is
-* undefined (pre-capability agent) or the flag is missing/false.
-*/
-function hasAgentCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
+const AGENT_CAPABILITIES = Object.freeze({});
 //#endregion
-export { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
+export { AGENT_CAPABILITIES, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
 
 //# sourceMappingURL=capabilities.js.map

package/dist/protocol/messages/dashboard.d.ts

@@ -319,7 +319,7 @@ export declare const dashboardRunStateResponseSchema: z.ZodObject<{
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -1041,6 +1041,7 @@ export declare const dashboardAttestationGetResponseSchema: z.ZodObject<{
             "offline-backfill": "offline-backfill";
         }>>;
     }, z.core.$strip>>;
+    trustedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type DashboardAttestationGetResponse = z.infer<typeof dashboardAttestationGetResponseSchema>;
@@ -1424,7 +1425,7 @@ export declare const runRerunRequestSchema: z.ZodObject<{
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
-    routingKey: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
 }, z.core.$strip>;
 /** Request to manually trigger a cron-scheduled workflow. */
 export declare const manualScheduleRequestSchema: z.ZodObject<{
@@ -3214,6 +3215,32 @@ export declare const fleetPreviewHostSchema: z.ZodObject<{
     }>;
 }, z.core.$strip>;
 export type FleetPreviewHost = z.infer<typeof fleetPreviewHostSchema>;
+/**
+ * A roster host as the dashboard sees it: the SDK inventory entry plus whether
+ * an agent registration or an operator declaration confirmed it. An
+ * unconfirmed host was created from the dashboard and is not a fan-out or
+ * inventory target.
+ */
+export declare const fleetHostEntrySchema: z.ZodObject<{
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    hostname: z.ZodNullable<z.ZodString>;
+    platform: z.ZodNullable<z.ZodString>;
+    arch: z.ZodNullable<z.ZodString>;
+    lifecycleClass: z.ZodEnum<{
+        ephemeral: "ephemeral";
+        static: "static";
+    }>;
+    status: z.ZodEnum<{
+        ready: "ready";
+        stale: "stale";
+        unreachable: "unreachable";
+    }>;
+    lastSeen: z.ZodString;
+    confirmed: z.ZodBoolean;
+}, z.core.$strip>;
+export type FleetHostEntry = z.infer<typeof fleetHostEntrySchema>;
 export declare const dashboardFleetHostsRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.hosts">;
     requestId: z.ZodString;
@@ -3326,6 +3353,7 @@ export declare const dashboardFleetHostsResponseSchema: z.ZodObject<{
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const dashboardFleetHostResponseSchema: z.ZodObject<{
@@ -3348,6 +3376,7 @@ export declare const dashboardFleetHostResponseSchema: z.ZodObject<{
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
     runs: z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
@@ -3467,6 +3496,20 @@ export declare const dashboardFleetWorkflowsForHostResponseSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type DashboardFleetWorkflowsForHostRequest = z.infer<typeof dashboardFleetWorkflowsForHostRequestSchema>;
 export type DashboardFleetWorkflowsForHostResponse = z.infer<typeof dashboardFleetWorkflowsForHostResponseSchema>;
+/**
+ * Why the orchestrator refused a Platform-relayed fleet host write. Travels in
+ * the response `error` field, as `operation_disabled` does.
+ *
+ * - `reserved_property` — a label or property key is in the reserved `kici:` namespace.
+ * - `host_exists` — a dashboard declare named a host that already exists.
+ * - `host_confirmed` — a dashboard remove named a host an agent or operator confirmed.
+ */
+export declare const FleetHostWriteRefusal: z.ZodEnum<{
+    host_confirmed: "host_confirmed";
+    host_exists: "host_exists";
+    reserved_property: "reserved_property";
+}>;
+export type FleetHostWriteRefusal = z.infer<typeof FleetHostWriteRefusal>;
 /** Declare a static host into the roster (wraps HostRosterStore.declareStatic). */
 export declare const fleetHostDeclareRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.declare">;
@@ -3508,6 +3551,7 @@ export declare const fleetHostDeclareResponseSchema: z.ZodObject<{
     declared: z.ZodOptional<z.ZodBoolean>;
     created: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
+    reservedKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 /** Remove a host from the roster by agent id (HostRosterStore.removeStatic). */
 export declare const fleetHostRemoveRequestSchema: z.ZodObject<{
@@ -4990,7 +5034,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
-    routingKey: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"run.manual_schedule.request">;
     requestId: z.ZodString;
@@ -6827,6 +6871,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -6870,6 +6915,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -7458,7 +7504,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -7613,6 +7659,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "offline-backfill": "offline-backfill";
         }>>;
     }, z.core.$strip>>;
+    trustedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.attestation.retry.response">;
@@ -8151,6 +8198,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.response">;
@@ -8172,6 +8220,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
     runs: z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
@@ -8237,6 +8286,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     declared: z.ZodOptional<z.ZodBoolean>;
     created: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
+    reservedKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.remove.response">;
     requestId: z.ZodString;
@@ -8571,6 +8621,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "db.create_role": "db.create_role";
             "db.ensure": "db.ensure";
             "db.fresh": "db.fresh";
+            "db.migrate": "db.migrate";
             "db.refresh_collation_version": "db.refresh_collation_version";
             "db.reindex": "db.reindex";
             "diagnostics.read": "diagnostics.read";
@@ -8614,6 +8665,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "scaler.capacity.read": "scaler.capacity.read";
             "scaler.orphan.stop": "scaler.orphan.stop";
             "scaler.orphans.read": "scaler.orphans.read";
+            "scaler.reload": "scaler.reload";
             "secret.delete": "secret.delete";
             "secret.list.read": "secret.list.read";
             "secret.reveal": "secret.reveal";
@@ -8927,14 +8979,12 @@ export declare const dashboardStepLogsApiResponseSchema: z.ZodObject<{
     recorded: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
- * REST API response for the run attestations list. The orchestrator-relayed
- * `attestations` array is augmented by Platform with the provenance trust root
- * from its own `oidcIssuer` config: `trustedIssuer` is the issuer the dashboard
- * pins each bundle's identity token to (never the bundle's own `iss`), and
- * `jwksUri` is the discovery JWKS endpoint the dashboard fetches to verify.
- * Both are null when the Platform has no provenance issuer configured — the
- * dashboard then lists + downloads the bundles but renders the badge as
- * "verification unavailable".
+ * REST API response for the run attestations list. `trustedIssuer` is the
+ * signing orchestrator's provenance issuer, which the dashboard pins each
+ * bundle's identity token to (never the bundle's own `iss`), and `jwksUri` is
+ * the discovery JWKS endpoint the dashboard fetches to verify. Both are null
+ * when the orchestrator does not sign — the dashboard then lists + downloads
+ * the bundles but renders the badge as "verification unavailable".
  */
 export declare const dashboardAttestationsApiResponseSchema: z.ZodObject<{
     trustedIssuer: z.ZodNullable<z.ZodString>;
@@ -9383,18 +9433,10 @@ export declare const runEventSchema: z.ZodObject<{
     parentSpanId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type RunEvent = z.infer<typeof runEventSchema>;
-/**
- * Trust policy response (from trust_policies table).
- *
- * `approvalExpirySeconds` is the authoritative window and `approvalExpiryHours`
- * its coarse, rounded-up view, so a client reading only the older field still
- * gets a usable number. Both are always sent by this build; the seconds field is
- * optional so a dashboard build reading an older Platform still parses.
- */
+/** Trust policy response (from trust_policies table). The window is in seconds. */
 export declare const trustPolicyResponseSchema: z.ZodObject<{
     forkPolicy: z.ZodString;
-    approvalExpiryHours: z.ZodNumber;
-    approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+    approvalExpirySeconds: z.ZodNumber;
 }, z.core.$strip>;
 export type TrustPolicy = z.infer<typeof trustPolicyResponseSchema>;
 /** Single identity link item. */

package/dist/protocol/messages/dashboard.js

@@ -6,14 +6,14 @@ import { actorPrincipalSchema } from "./actor.js";
 import { HeldRunStatus } from "../../context/held-run-status.js";
 import { dashboardSealedEnvelopeSchema } from "./dashboard-sealed-write.js";
 import { JobKind, StepConcurrencyKind, initFailureSchema, stateReplayRunSchema } from "./execution-status.js";
+import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
+import { SourceSubtype } from "./source-registration.js";
 import { TrustTierSchema } from "../../context/types.js";
 import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
-import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
-import { SourceSubtype } from "./source-registration.js";
 import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
 import { NeedsRunOn, OnUnreachableMode } from "../../trigger/types.js";
@@ -131,8 +131,6 @@ const dashboardJobDetailSchema = z.object({
 	* Job kind: `standard` runs steps on an agent, `gate` is an invoke gate, and
 	* `proxy` mirrors a summoned source-repo run. Absent/null for a standard job.
 	*
-	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
-	* protected, so an orchestrator that predates invoke gates omits it.
 	*/
 	jobKind: JobKind.nullable().optional(),
 	/**
@@ -150,10 +148,6 @@ const dashboardJobDetailSchema = z.object({
 	* Why this job cannot currently be routed to any agent, present only while it
 	* is still queued and nothing in the fleet matches its `runsOn`; cleared once
 	* a matching agent or scaler backend appears.
-	*
-	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
-	* protected, so an orchestrator that predates the unroutable probe
-	* omits it.
 	*/
 	routingReason: z.string().nullable().optional(),
 	/** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). */
@@ -311,9 +305,8 @@ const dashboardAttestationsListResponseSchema = z.object({
 	* The provenance issuer that signs this orchestrator's attestations, when it
 	* owns signing (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`). The Platform surfaces
 	* it as `trustedIssuer` so the dashboard / CLI verify against the orchestrator
-	* that actually signed the bundles; absent → the Platform falls back to its own
-	* issuer (for historical Platform-signed bundles). Optional for backward
-	* compatibility with older orchestrators.
+	* that signed the bundles; null or absent → no trust root, and the dashboard
+	* shows verification as unavailable. Absent on an error response.
 	*/
 	trustedIssuer: z.string().nullable().optional(),
 	error: z.string().optional()
@@ -347,8 +340,7 @@ const dashboardArtifactsListResponseSchema = z.object({
 	* Signature-validity window (seconds) of the presigned `downloadUrl`s in this
 	* response, from the storage backend's presigned-GET expiry; the dashboard
 	* refreshes the list on a fraction of it so a displayed link is never stale.
-	* Optional for backward compatibility with older orchestrators (mirrors
-	* `trustedIssuer`).
+	* Absent on an error response.
 	*/
 	downloadUrlExpiresInSeconds: z.number().int().positive().optional(),
 	error: z.string().optional()
@@ -429,6 +421,8 @@ const dashboardAttestationGetResponseSchema = z.object({
 	type: z.literal("dashboard.attestation.get.response"),
 	requestId: z.string(),
 	attestation: attestationListItemSchema.nullable(),
+	/** See `dashboardAttestationsListResponseSchema.trustedIssuer`. */
+	trustedIssuer: z.string().nullable().optional(),
 	error: z.string().optional()
 });
 /** Request an on-demand drain of the deferred-attestation outbox (optionally one run). */
@@ -607,12 +601,9 @@ const runRerunRequestSchema = z.object({
 	/**
 	* The Platform forwards the original run's `routing_key` so the
 	* orchestrator can probe its cold-store under the right tenant prefix
-	* when the run is missing from PG. Optional for backwards compatibility
-	* with older Platform versions in mixed deploys; if absent, the
-	* orchestrator skips the cold-store probe and surfaces the legacy
-	* `runArchivedNotRerunnable` / "Run not found" branches.
+	* when the run is missing from PG.
 	*/
-	routingKey: z.string().optional()
+	routingKey: z.string()
 });
 /** Response to a re-run request. */
 const runRerunResponseSchema = z.object({
@@ -1512,6 +1503,13 @@ const fleetPreviewHostSchema = z.object({
 	entry: HostInventoryEntry,
 	disposition: FleetHostDisposition
 });
+/**
+* A roster host as the dashboard sees it: the SDK inventory entry plus whether
+* an agent registration or an operator declaration confirmed it. An
+* unconfirmed host was created from the dashboard and is not a fan-out or
+* inventory target.
+*/
+const fleetHostEntrySchema = HostInventoryEntry.extend({ confirmed: z.boolean() });
 const dashboardFleetHostsRequestSchema = z.object({
 	type: z.literal("dashboard.fleet.hosts"),
 	requestId: z.string(),
@@ -1532,12 +1530,12 @@ const dashboardFleetPreviewRequestSchema = z.object({
 const dashboardFleetHostsResponseSchema = z.object({
 	type: z.literal("dashboard.fleet.hosts.response"),
 	requestId: z.string(),
-	hosts: z.array(HostInventoryEntry)
+	hosts: z.array(fleetHostEntrySchema)
 });
 const dashboardFleetHostResponseSchema = z.object({
 	type: z.literal("dashboard.fleet.host.response"),
 	requestId: z.string(),
-	host: HostInventoryEntry.nullable(),
+	host: fleetHostEntrySchema.nullable(),
 	runs: z.array(fleetPinnedRunSchema)
 });
 const dashboardFleetPreviewResponseSchema = z.object({
@@ -1567,6 +1565,19 @@ const dashboardFleetWorkflowsForHostResponseSchema = z.object({
 	requestId: z.string(),
 	workflows: z.array(fleetHostWorkflowSchema)
 });
+/**
+* Why the orchestrator refused a Platform-relayed fleet host write. Travels in
+* the response `error` field, as `operation_disabled` does.
+*
+* - `reserved_property` — a label or property key is in the reserved `kici:` namespace.
+* - `host_exists` — a dashboard declare named a host that already exists.
+* - `host_confirmed` — a dashboard remove named a host an agent or operator confirmed.
+*/
+const FleetHostWriteRefusal = z.enum([
+	"reserved_property",
+	"host_exists",
+	"host_confirmed"
+]);
 /** Declare a static host into the roster (wraps HostRosterStore.declareStatic). */
 const fleetHostDeclareRequestSchema = z.object({
 	type: z.literal("dashboard.fleet.host.declare"),
@@ -1586,7 +1597,9 @@ const fleetHostDeclareResponseSchema = z.object({
 	requestId: z.string(),
 	declared: z.boolean().optional(),
 	created: z.boolean().optional(),
-	error: z.string().optional()
+	error: z.string().optional(),
+	/** The reserved keys behind a `reserved_property` refusal. */
+	reservedKeys: z.array(z.string()).optional()
 });
 /** Remove a host from the roster by agent id (HostRosterStore.removeStatic). */
 const fleetHostRemoveRequestSchema = z.object({
@@ -2278,14 +2291,12 @@ const dashboardStepLogsApiResponseSchema = z.object({
 	recorded: z.boolean().optional()
 });
 /**
-* REST API response for the run attestations list. The orchestrator-relayed
-* `attestations` array is augmented by Platform with the provenance trust root
-* from its own `oidcIssuer` config: `trustedIssuer` is the issuer the dashboard
-* pins each bundle's identity token to (never the bundle's own `iss`), and
-* `jwksUri` is the discovery JWKS endpoint the dashboard fetches to verify.
-* Both are null when the Platform has no provenance issuer configured — the
-* dashboard then lists + downloads the bundles but renders the badge as
-* "verification unavailable".
+* REST API response for the run attestations list. `trustedIssuer` is the
+* signing orchestrator's provenance issuer, which the dashboard pins each
+* bundle's identity token to (never the bundle's own `iss`), and `jwksUri` is
+* the discovery JWKS endpoint the dashboard fetches to verify. Both are null
+* when the orchestrator does not sign — the dashboard then lists + downloads
+* the bundles but renders the badge as "verification unavailable".
 */
 const dashboardAttestationsApiResponseSchema = z.object({
 	trustedIssuer: z.string().nullable(),
@@ -2538,18 +2549,10 @@ const runEventSchema = z.object({
 	spanId: z.string().nullable(),
 	parentSpanId: z.string().nullable()
 });
-/**
-* Trust policy response (from trust_policies table).
-*
-* `approvalExpirySeconds` is the authoritative window and `approvalExpiryHours`
-* its coarse, rounded-up view, so a client reading only the older field still
-* gets a usable number. Both are always sent by this build; the seconds field is
-* optional so a dashboard build reading an older Platform still parses.
-*/
+/** Trust policy response (from trust_policies table). The window is in seconds. */
 const trustPolicyResponseSchema = z.object({
 	forkPolicy: z.string(),
-	approvalExpiryHours: z.number(),
-	approvalExpirySeconds: z.number().optional()
+	approvalExpirySeconds: z.number()
 });
 /** Single identity link item. */
 const identityLinkItemSchema = z.object({
@@ -2603,6 +2606,6 @@ const DashboardResponseErrorCode = z.enum([
 	"internal_error"
 ]);
 //#endregion
-export { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, FleetHostWriteRefusal, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostEntrySchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/execution-status.d.ts

@@ -352,7 +352,7 @@ export declare const executionStatusSchema: z.ZodObject<{
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
-    statusEpoch: z.ZodOptional<z.ZodNumber>;
+    statusEpoch: z.ZodNumber;
 }, z.core.$strip>;
 /** Per-step status forwarded from agent to Platform (real-time). */
 export declare const stepStatusForwardSchema: z.ZodObject<{
@@ -485,7 +485,7 @@ export declare const stateReplayRunSchema: z.ZodObject<{
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
-    statusEpoch: z.ZodOptional<z.ZodNumber>;
+    statusEpoch: z.ZodNumber;
     jobs: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         jobName: z.ZodString;
@@ -538,7 +538,7 @@ export declare const stateReplaySchema: z.ZodObject<{
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;