@kici-dev/engine 0.15.0 → 0.16.0

package/dist/protocol/messages/capabilities.js

@@ -1,30 +1,24 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { dashboardWritePolicyMap } from "../dashboard-write-operations.js";
 import { dashboardEncryptionJwkSchema } from "./dashboard-sealed-write.js";
-import { DASHBOARD_REQUEST_TYPES } from "./dashboard.js";
 import { z } from "zod";
 //#region src/protocol/messages/capabilities.ts
 /**
-* Capability negotiation schemas — bidirectional.
+* Capability schemas — bidirectional.
 *
 * Modeled after peerCapabilitiesSchema in peer.ts.
 *
-* Two directions, each advertised as the sending side learns what the other
-* understands:
-* - **orchestrator → Platform** (`orchCapabilitiesSchema`, sent in `auth.request`):
-*   the Platform pre-flight-checks orchestrator capabilities before sending
-*   feature-gated messages (e.g. the dashboard-request manifest).
+* - **orchestrator → Platform** (`orchCapabilitiesSchema`, sent in `auth.request`
+*   and rebroadcast as `orch.capabilities.update`): the orchestrator's role and
+*   the dashboard settings the Platform caches per org.
 * - **Platform → orchestrator** (`platformCapabilitiesSchema`, advertised once
-*   after auth): a self-hosted orchestrator can run *ahead* of the hosted
-*   Platform, so it pre-flight-checks its own feature-gated sends against what
-*   the Platform advertises — surfacing a diagnosable capability gap instead of
-*   firing a frame the Platform would drop.
+*   after auth), **orchestrator → agent** (`orchAgentCapabilitiesSchema`, on
+*   `register.ack`) and **agent → orchestrator** (`agentCapabilitiesSchema`, on
+*   `agent.register`): each defines no flag at protocol 4 and is advertised
+*   empty. A later release adds a flag to one of them without a protocol bump.
 *
-* Pattern (both directions): each field indicates support for an optional
-* protocol feature. Missing fields default to unsupported for backward
-* compatibility; `.passthrough()` preserves unknown flags from a newer peer.
-* A peer that never advertises at all is treated as "unknown" (optimistic),
-* never as "supports nothing".
+* Every schema uses `.passthrough()`, so a newer peer's unknown fields are
+* preserved rather than stripped.
 */
 /** Orchestrator role in a cluster topology. */
 const OrchRole = z.enum(["coordinator", "worker"]);
@@ -34,7 +28,7 @@ const OrchRole = z.enum(["coordinator", "worker"]);
 */
 const orchCapabilitiesSchema = z.object({
 	/** Orchestrator's role in the cluster (coordinator manages DB/vault, worker is stateless). */
-	orchRole: OrchRole.optional(),
+	orchRole: OrchRole,
 	/**
 	* Per-operation dashboard-write policy. Sparse map where each
 	* present key flips one `DashboardWriteOperation` to false. Missing
@@ -45,15 +39,6 @@ const orchCapabilitiesSchema = z.object({
 	*/
 	dashboardWrites: dashboardWritePolicyMap.optional(),
 	/**
-	* Every `dashboard.*` request type this orchestrator build understands.
-	* The Platform pre-flight-checks an incoming dashboard request against this
-	* set and refuses (with a precise "upgrade orchestrator" error) when the
-	* type is absent. Derived from the orchestrator's own protocol schema, so it
-	* cannot drift. Absent on pre-capability builds → treated as "unknown",
-	* never as "supports nothing".
-	*/
-	supportedDashboardRequests: z.array(z.string()).optional(),
-	/**
 	* The orchestrator's active X25519 dashboard-encryption public key. Feeds
 	* the Convenient tier: the key reaches the hosted control plane over the
 	* authenticated orchestrator connection, and the dashboard fetches it from
@@ -68,118 +53,23 @@ const orchCapabilitiesSchema = z.object({
 	* `dashboard_verified_issuer` cluster setting. Null/absent ⇒ the Verified
 	* tier is not offered and the Convenient tier applies.
 	*/
-	dashboardVerifiedIssuer: z.string().nullable().optional(),
-	/**
-	* The orchestrator answers join protocol v2 `join.request` frames. The Platform
-	* relays a join only to an orchestrator that advertises this, because an older
-	* build drops a v2 frame without a reply.
-	*/
-	clusterJoinV2: z.boolean().optional()
+	dashboardVerifiedIssuer: z.string().nullable().optional()
 }).passthrough();
 /** Default orchestrator capabilities sent in auth.request. */
-const ORCH_CAPABILITIES = Object.freeze({
-	orchRole: OrchRole.enum.coordinator,
-	supportedDashboardRequests: [...DASHBOARD_REQUEST_TYPES]
-});
-/**
-* Check whether an orchestrator advertises a specific capability flag.
-*
-* Takes `string` (not `keyof`) because newer versions may have flags the current code
-* doesn't know about. Returns false if capabilities is undefined (pre-capability
-* orchestrator) or the flag is missing/false.
-*/
-function hasOrchCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
-/** Flag names of {@link orchCapabilitiesSchema}, for {@link hasOrchCapability} lookups. */
-const OrchCapabilityFlag = z.enum(["clusterJoinV2"]);
-/**
-* Platform-advertised capabilities sent to the orchestrator after auth.
-* Uses .passthrough() so a newer Platform's unknown flags are preserved.
-* Every field is optional and absent = unsupported (same evolution contract as
-* `orchCapabilitiesSchema`).
-*/
-const platformCapabilitiesSchema = z.object({ 
-/** Platform ingests periodic `orch.metrics` telemetry pushes. */
-orchMetrics: z.boolean().optional() }).passthrough();
+const ORCH_CAPABILITIES = Object.freeze({ orchRole: OrchRole.enum.coordinator });
+/** Platform-advertised capabilities sent to the orchestrator after auth. */
+const platformCapabilitiesSchema = z.object({}).passthrough();
 /** Default Platform capabilities advertised to the orchestrator after auth. */
-const PLATFORM_CAPABILITIES = Object.freeze({ orchMetrics: true });
-/**
-* Check whether the Platform advertises a specific capability flag.
-*
-* Takes `string` (not `keyof`) because a newer Platform may advertise flags the
-* current orchestrator build doesn't know about. Returns false if capabilities
-* is undefined (nothing advertised yet) or the flag is missing/false.
-*
-* NOTE: "undefined → false" here is the plain reader semantics. A feature-gated
-* SEND that must stay backward-safe against a pre-capability Platform (which
-* never advertises) treats "nothing advertised yet" as optimistic-send — that
-* layer lives in the orchestrator's `sendIfPlatformSupports`, not here.
-*/
-function hasPlatformCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
-/**
-* Orchestrator -> Agent capabilities, advertised on `register.ack`. Same
-* evolution contract as the other two directions: every field optional,
-* absent = unsupported, `.passthrough()` preserves a newer orchestrator's
-* unknown flags. Lets the agent learn which optional agent-facing protocol
-* features this orchestrator build supports.
-*/
-const orchAgentCapabilitiesSchema = z.object({ 
-/**
-* Orchestrator acks `artifacts.upload.complete` (with committed|failed) so
-* the agent can fail the workflow step on a lost commit instead of losing
-* the artifact silently. Absent -> agent stays fire-and-forget.
-*/
-artifactCompleteAck: z.boolean().optional() }).passthrough();
+const PLATFORM_CAPABILITIES = Object.freeze({});
+/** Orchestrator -> agent capabilities, advertised on `register.ack`. */
+const orchAgentCapabilitiesSchema = z.object({}).passthrough();
 /** Default orchestrator -> agent capabilities advertised on register.ack. */
-const ORCH_AGENT_CAPABILITIES = Object.freeze({ artifactCompleteAck: true });
-/**
-* Check whether an orchestrator advertises a specific agent-facing capability
-* flag.
-*
-* Takes `string` (not `keyof`) because a newer orchestrator may advertise flags
-* this agent build doesn't know about. Returns false if capabilities is
-* undefined (pre-capability orchestrator) or the flag is missing/false.
-*/
-function hasOrchAgentCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
-/**
-* Agent -> Orchestrator capabilities, advertised on `agent.register`. Same
-* evolution contract as the other directions: every field optional, absent =
-* unsupported, `.passthrough()` preserves a newer agent's unknown flags. Lets
-* the orchestrator route work that depends on an optional agent behaviour only
-* to agents that implement it.
-*/
-const agentCapabilitiesSchema = z.object({ 
-/**
-* In a pre-run global eval round the agent runs only the needs-free
-* `DynamicJobFn`s and skips every generator declared with upstream `needs`
-* (a result-aware generator). Such a generator runs later, on the run's
-* deferred path, with its upstream outputs. An agent without this flag runs
-* every generator in the round — including a result-aware one, which then
-* sees no upstream outputs and produces the wrong jobs — so the
-* orchestrator sends a round containing a result-aware generator only to an
-* agent that advertises it.
-*/
-globalEvalSkipsResultAwareGenerators: z.boolean().optional() }).passthrough();
-/** Flag names of {@link agentCapabilitiesSchema}, for {@link hasAgentCapability} lookups. */
-const AgentCapabilityFlag = z.enum(["globalEvalSkipsResultAwareGenerators"]);
+const ORCH_AGENT_CAPABILITIES = Object.freeze({});
+/** Agent -> orchestrator capabilities, advertised on `agent.register`. */
+const agentCapabilitiesSchema = z.object({}).passthrough();
 /** Default agent -> orchestrator capabilities advertised on agent.register. */
-const AGENT_CAPABILITIES = Object.freeze({ globalEvalSkipsResultAwareGenerators: true });
-/**
-* Check whether an agent advertises a specific capability flag.
-*
-* Takes `string` (not `keyof`) because a newer agent may advertise flags this
-* orchestrator build doesn't know about. Returns false if capabilities is
-* undefined (pre-capability agent) or the flag is missing/false.
-*/
-function hasAgentCapability(capabilities, flag) {
-	return capabilities?.[flag] === true;
-}
+const AGENT_CAPABILITIES = Object.freeze({});
 //#endregion
-export { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchCapabilityFlag, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
+export { AGENT_CAPABILITIES, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
 
 //# sourceMappingURL=capabilities.js.map

package/dist/protocol/messages/dashboard.d.ts

@@ -319,7 +319,7 @@ export declare const dashboardRunStateResponseSchema: z.ZodObject<{
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -1041,6 +1041,7 @@ export declare const dashboardAttestationGetResponseSchema: z.ZodObject<{
             "offline-backfill": "offline-backfill";
         }>>;
     }, z.core.$strip>>;
+    trustedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type DashboardAttestationGetResponse = z.infer<typeof dashboardAttestationGetResponseSchema>;
@@ -1424,7 +1425,7 @@ export declare const runRerunRequestSchema: z.ZodObject<{
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
-    routingKey: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
 }, z.core.$strip>;
 /** Request to manually trigger a cron-scheduled workflow. */
 export declare const manualScheduleRequestSchema: z.ZodObject<{
@@ -3218,7 +3219,7 @@ export type FleetPreviewHost = z.infer<typeof fleetPreviewHostSchema>;
  * A roster host as the dashboard sees it: the SDK inventory entry plus whether
  * an agent registration or an operator declaration confirmed it. An
  * unconfirmed host was created from the dashboard and is not a fan-out or
- * inventory target. Optional so an older orchestrator's frames still parse.
+ * inventory target.
  */
 export declare const fleetHostEntrySchema: z.ZodObject<{
     agentId: z.ZodString;
@@ -3237,7 +3238,7 @@ export declare const fleetHostEntrySchema: z.ZodObject<{
         unreachable: "unreachable";
     }>;
     lastSeen: z.ZodString;
-    confirmed: z.ZodOptional<z.ZodBoolean>;
+    confirmed: z.ZodBoolean;
 }, z.core.$strip>;
 export type FleetHostEntry = z.infer<typeof fleetHostEntrySchema>;
 export declare const dashboardFleetHostsRequestSchema: z.ZodObject<{
@@ -3352,7 +3353,7 @@ export declare const dashboardFleetHostsResponseSchema: z.ZodObject<{
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
-        confirmed: z.ZodOptional<z.ZodBoolean>;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const dashboardFleetHostResponseSchema: z.ZodObject<{
@@ -3375,7 +3376,7 @@ export declare const dashboardFleetHostResponseSchema: z.ZodObject<{
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
-        confirmed: z.ZodOptional<z.ZodBoolean>;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
     runs: z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
@@ -5033,7 +5034,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
-    routingKey: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"run.manual_schedule.request">;
     requestId: z.ZodString;
@@ -6870,6 +6871,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -6913,6 +6915,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -7501,7 +7504,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -7656,6 +7659,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "offline-backfill": "offline-backfill";
         }>>;
     }, z.core.$strip>>;
+    trustedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.attestation.retry.response">;
@@ -8194,7 +8198,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
-        confirmed: z.ZodOptional<z.ZodBoolean>;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.response">;
@@ -8216,7 +8220,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
-        confirmed: z.ZodOptional<z.ZodBoolean>;
+        confirmed: z.ZodBoolean;
     }, z.core.$strip>>;
     runs: z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
@@ -8617,6 +8621,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "db.create_role": "db.create_role";
             "db.ensure": "db.ensure";
             "db.fresh": "db.fresh";
+            "db.migrate": "db.migrate";
             "db.refresh_collation_version": "db.refresh_collation_version";
             "db.reindex": "db.reindex";
             "diagnostics.read": "diagnostics.read";
@@ -8660,6 +8665,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "scaler.capacity.read": "scaler.capacity.read";
             "scaler.orphan.stop": "scaler.orphan.stop";
             "scaler.orphans.read": "scaler.orphans.read";
+            "scaler.reload": "scaler.reload";
             "secret.delete": "secret.delete";
             "secret.list.read": "secret.list.read";
             "secret.reveal": "secret.reveal";
@@ -8973,14 +8979,12 @@ export declare const dashboardStepLogsApiResponseSchema: z.ZodObject<{
     recorded: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
- * REST API response for the run attestations list. The orchestrator-relayed
- * `attestations` array is augmented by Platform with the provenance trust root
- * from its own `oidcIssuer` config: `trustedIssuer` is the issuer the dashboard
- * pins each bundle's identity token to (never the bundle's own `iss`), and
- * `jwksUri` is the discovery JWKS endpoint the dashboard fetches to verify.
- * Both are null when the Platform has no provenance issuer configured — the
- * dashboard then lists + downloads the bundles but renders the badge as
- * "verification unavailable".
+ * REST API response for the run attestations list. `trustedIssuer` is the
+ * signing orchestrator's provenance issuer, which the dashboard pins each
+ * bundle's identity token to (never the bundle's own `iss`), and `jwksUri` is
+ * the discovery JWKS endpoint the dashboard fetches to verify. Both are null
+ * when the orchestrator does not sign — the dashboard then lists + downloads
+ * the bundles but renders the badge as "verification unavailable".
  */
 export declare const dashboardAttestationsApiResponseSchema: z.ZodObject<{
     trustedIssuer: z.ZodNullable<z.ZodString>;
@@ -9429,18 +9433,10 @@ export declare const runEventSchema: z.ZodObject<{
     parentSpanId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type RunEvent = z.infer<typeof runEventSchema>;
-/**
- * Trust policy response (from trust_policies table).
- *
- * `approvalExpirySeconds` is the authoritative window and `approvalExpiryHours`
- * its coarse, rounded-up view, so a client reading only the older field still
- * gets a usable number. Both are always sent by this build; the seconds field is
- * optional so a dashboard build reading an older Platform still parses.
- */
+/** Trust policy response (from trust_policies table). The window is in seconds. */
 export declare const trustPolicyResponseSchema: z.ZodObject<{
     forkPolicy: z.ZodString;
-    approvalExpiryHours: z.ZodNumber;
-    approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+    approvalExpirySeconds: z.ZodNumber;
 }, z.core.$strip>;
 export type TrustPolicy = z.infer<typeof trustPolicyResponseSchema>;
 /** Single identity link item. */

package/dist/protocol/messages/dashboard.js

@@ -6,14 +6,14 @@ import { actorPrincipalSchema } from "./actor.js";
 import { HeldRunStatus } from "../../context/held-run-status.js";
 import { dashboardSealedEnvelopeSchema } from "./dashboard-sealed-write.js";
 import { JobKind, StepConcurrencyKind, initFailureSchema, stateReplayRunSchema } from "./execution-status.js";
+import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
+import { SourceSubtype } from "./source-registration.js";
 import { TrustTierSchema } from "../../context/types.js";
 import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
-import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
-import { SourceSubtype } from "./source-registration.js";
 import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
 import { NeedsRunOn, OnUnreachableMode } from "../../trigger/types.js";
@@ -131,8 +131,6 @@ const dashboardJobDetailSchema = z.object({
 	* Job kind: `standard` runs steps on an agent, `gate` is an invoke gate, and
 	* `proxy` mirrors a summoned source-repo run. Absent/null for a standard job.
 	*
-	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
-	* protected, so an orchestrator that predates invoke gates omits it.
 	*/
 	jobKind: JobKind.nullable().optional(),
 	/**
@@ -150,10 +148,6 @@ const dashboardJobDetailSchema = z.object({
 	* Why this job cannot currently be routed to any agent, present only while it
 	* is still queued and nothing in the fleet matches its `runsOn`; cleared once
 	* a matching agent or scaler backend appears.
-	*
-	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
-	* protected, so an orchestrator that predates the unroutable probe
-	* omits it.
 	*/
 	routingReason: z.string().nullable().optional(),
 	/** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). */
@@ -311,9 +305,8 @@ const dashboardAttestationsListResponseSchema = z.object({
 	* The provenance issuer that signs this orchestrator's attestations, when it
 	* owns signing (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`). The Platform surfaces
 	* it as `trustedIssuer` so the dashboard / CLI verify against the orchestrator
-	* that actually signed the bundles; absent → the Platform falls back to its own
-	* issuer (for historical Platform-signed bundles). Optional for backward
-	* compatibility with older orchestrators.
+	* that signed the bundles; null or absent → no trust root, and the dashboard
+	* shows verification as unavailable. Absent on an error response.
 	*/
 	trustedIssuer: z.string().nullable().optional(),
 	error: z.string().optional()
@@ -347,8 +340,7 @@ const dashboardArtifactsListResponseSchema = z.object({
 	* Signature-validity window (seconds) of the presigned `downloadUrl`s in this
 	* response, from the storage backend's presigned-GET expiry; the dashboard
 	* refreshes the list on a fraction of it so a displayed link is never stale.
-	* Optional for backward compatibility with older orchestrators (mirrors
-	* `trustedIssuer`).
+	* Absent on an error response.
 	*/
 	downloadUrlExpiresInSeconds: z.number().int().positive().optional(),
 	error: z.string().optional()
@@ -429,6 +421,8 @@ const dashboardAttestationGetResponseSchema = z.object({
 	type: z.literal("dashboard.attestation.get.response"),
 	requestId: z.string(),
 	attestation: attestationListItemSchema.nullable(),
+	/** See `dashboardAttestationsListResponseSchema.trustedIssuer`. */
+	trustedIssuer: z.string().nullable().optional(),
 	error: z.string().optional()
 });
 /** Request an on-demand drain of the deferred-attestation outbox (optionally one run). */
@@ -607,12 +601,9 @@ const runRerunRequestSchema = z.object({
 	/**
 	* The Platform forwards the original run's `routing_key` so the
 	* orchestrator can probe its cold-store under the right tenant prefix
-	* when the run is missing from PG. Optional for backwards compatibility
-	* with older Platform versions in mixed deploys; if absent, the
-	* orchestrator skips the cold-store probe and surfaces the legacy
-	* `runArchivedNotRerunnable` / "Run not found" branches.
+	* when the run is missing from PG.
 	*/
-	routingKey: z.string().optional()
+	routingKey: z.string()
 });
 /** Response to a re-run request. */
 const runRerunResponseSchema = z.object({
@@ -1516,9 +1507,9 @@ const fleetPreviewHostSchema = z.object({
 * A roster host as the dashboard sees it: the SDK inventory entry plus whether
 * an agent registration or an operator declaration confirmed it. An
 * unconfirmed host was created from the dashboard and is not a fan-out or
-* inventory target. Optional so an older orchestrator's frames still parse.
+* inventory target.
 */
-const fleetHostEntrySchema = HostInventoryEntry.extend({ confirmed: z.boolean().optional() });
+const fleetHostEntrySchema = HostInventoryEntry.extend({ confirmed: z.boolean() });
 const dashboardFleetHostsRequestSchema = z.object({
 	type: z.literal("dashboard.fleet.hosts"),
 	requestId: z.string(),
@@ -2300,14 +2291,12 @@ const dashboardStepLogsApiResponseSchema = z.object({
 	recorded: z.boolean().optional()
 });
 /**
-* REST API response for the run attestations list. The orchestrator-relayed
-* `attestations` array is augmented by Platform with the provenance trust root
-* from its own `oidcIssuer` config: `trustedIssuer` is the issuer the dashboard
-* pins each bundle's identity token to (never the bundle's own `iss`), and
-* `jwksUri` is the discovery JWKS endpoint the dashboard fetches to verify.
-* Both are null when the Platform has no provenance issuer configured — the
-* dashboard then lists + downloads the bundles but renders the badge as
-* "verification unavailable".
+* REST API response for the run attestations list. `trustedIssuer` is the
+* signing orchestrator's provenance issuer, which the dashboard pins each
+* bundle's identity token to (never the bundle's own `iss`), and `jwksUri` is
+* the discovery JWKS endpoint the dashboard fetches to verify. Both are null
+* when the orchestrator does not sign — the dashboard then lists + downloads
+* the bundles but renders the badge as "verification unavailable".
 */
 const dashboardAttestationsApiResponseSchema = z.object({
 	trustedIssuer: z.string().nullable(),
@@ -2560,18 +2549,10 @@ const runEventSchema = z.object({
 	spanId: z.string().nullable(),
 	parentSpanId: z.string().nullable()
 });
-/**
-* Trust policy response (from trust_policies table).
-*
-* `approvalExpirySeconds` is the authoritative window and `approvalExpiryHours`
-* its coarse, rounded-up view, so a client reading only the older field still
-* gets a usable number. Both are always sent by this build; the seconds field is
-* optional so a dashboard build reading an older Platform still parses.
-*/
+/** Trust policy response (from trust_policies table). The window is in seconds. */
 const trustPolicyResponseSchema = z.object({
 	forkPolicy: z.string(),
-	approvalExpiryHours: z.number(),
-	approvalExpirySeconds: z.number().optional()
+	approvalExpirySeconds: z.number()
 });
 /** Single identity link item. */
 const identityLinkItemSchema = z.object({

package/dist/protocol/messages/execution-status.d.ts

@@ -352,7 +352,7 @@ export declare const executionStatusSchema: z.ZodObject<{
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
-    statusEpoch: z.ZodOptional<z.ZodNumber>;
+    statusEpoch: z.ZodNumber;
 }, z.core.$strip>;
 /** Per-step status forwarded from agent to Platform (real-time). */
 export declare const stepStatusForwardSchema: z.ZodObject<{
@@ -485,7 +485,7 @@ export declare const stateReplayRunSchema: z.ZodObject<{
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
-    statusEpoch: z.ZodOptional<z.ZodNumber>;
+    statusEpoch: z.ZodNumber;
     jobs: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         jobName: z.ZodString;
@@ -538,7 +538,7 @@ export declare const stateReplaySchema: z.ZodObject<{
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;

package/dist/protocol/messages/execution-status.js

@@ -269,8 +269,8 @@ const executionStatusSchema = z.object({
 	workflowName: z.string().max(128),
 	status: ExecutionRunStatus,
 	/**
-	* Routing key of the run's own source. Optional for backward compatibility
-	* with older orchestrators (absent → the Platform falls back to the WS
+	* Routing key of the run's own source. Absent for a run the orchestrator
+	* recorded no routing key for (the Platform then falls back to the WS
 	* connection's first routing key). Lets the Platform mirror attribute each
 	* run to its real source even when one orchestrator serves multiple sources.
 	*/
@@ -281,8 +281,7 @@ const executionStatusSchema = z.object({
 	* `repoIdentifier` — a global workflow authored in one repository and
 	* dispatched against another. Absent for every per-repository run, where the
 	* two are the same repository, so "present" is a precise marker for a
-	* cross-repository global run. Optional for backward compatibility with an
-	* older orchestrator that never sends it.
+	* cross-repository global run.
 	*/
 	workflowRepoIdentifier: z.string().max(256).optional(),
 	/**
@@ -292,8 +291,7 @@ const executionStatusSchema = z.object({
 	* The Platform mirrors it so its own re-run refusal can admit a round: a
 	* round is definitionally cross-repository, and re-running one re-evaluates
 	* the original event instead of resolving a workflow out of the acted-on
-	* repository's lock file. Absent means an ordinary run — optional for
-	* backward compatibility with an orchestrator that never sends it.
+	* repository's lock file. Absent means an ordinary run.
 	*/
 	isGlobalEvalRound: z.boolean().optional(),
 	/**
@@ -358,10 +356,8 @@ const executionStatusSchema = z.object({
 	* already dispatched reported in, and then continues). The Platform keeps a
 	* terminal status against a non-terminal frame unless the frame's generation
 	* is newer, so a frame that arrives late cannot move a finished run back.
-	* Optional for backward compatibility: an older orchestrator omits it, and the
-	* Platform then applies the frame unguarded.
 	*/
-	statusEpoch: statusEpochSchema.optional()
+	statusEpoch: statusEpochSchema
 });
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
@@ -413,8 +409,7 @@ const jobStatusForwardSchema = z.object({
 	initFailure: initFailureSchema.optional(),
 	/**
 	* Job kind. Absent means an ordinary `standard` job. `gate`/`proxy` mark an
-	* invoke gate and its per-run proxy children. Additive/optional — an older
-	* peer ignores it.
+	* invoke gate and its per-run proxy children.
 	*/
 	jobKind: JobKind.optional(),
 	/** For a `proxy` job, the summoned run it mirrors. Additive/optional. */
@@ -459,7 +454,7 @@ const stateReplayRunSchema = z.object({
 	/** Why the run failed (`RunFailureClass`); only present for failed/cancelled runs. */
 	failureClass: RunFailureClass.optional(),
 	/** The run's status generation, with the same meaning as on `execution.status`. */
-	statusEpoch: statusEpochSchema.optional(),
+	statusEpoch: statusEpochSchema,
 	jobs: z.array(z.object({
 		jobId: z.string().max(128),
 		jobName: z.string().max(128),