@kici-dev/engine 0.3.0 → 0.5.0

package/dist/metrics/metric-catalog.generated.js

@@ -46,6 +46,11 @@ const MetricNames = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "kici_orch_execution_duration_seconds",
 	KICI_ORCH_EXECUTIONS_TOTAL: "kici_orch_executions_total",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "kici_orch_github_check_run_total",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "kici_orch_global_eval_cache_lookups_total",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "kici_orch_global_eval_candidates_total",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "kici_orch_global_eval_jobs_generated",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "kici_orch_global_eval_round_duration_seconds",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "kici_orch_global_eval_verdicts_total",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "kici_orch_ingest_admitted_total",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "kici_orch_ingest_event_loop_delay_max_ms",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "kici_orch_ingest_event_loop_delay_p99_ms",
@@ -96,6 +101,7 @@ const MetricNames = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "kici_orch_trust_match_refused_no_id_total",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "kici_orch_trust_policy_decisions_total",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "kici_orch_unroutable_fast_failed_total",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "kici_orch_webhook_pipeline_failures_total",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "kici_orch_webhooks_processed_total",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "kici_orch_webhooks_received_total",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "kici_orch_ws_nack_received_total",
@@ -247,6 +253,11 @@ const MetricLabels = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: [],
 	KICI_ORCH_EXECUTIONS_TOTAL: ["status"],
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: ["operation"],
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: ["result"],
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: [],
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: [],
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: ["result"],
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: ["outcome"],
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: [],
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: [],
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: [],
@@ -309,6 +320,7 @@ const MetricLabels = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: ["reason"],
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: ["arm", "action"],
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: [],
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: ["phase"],
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: ["result"],
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: ["source", "event"],
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: [],
@@ -464,6 +476,11 @@ const MetricKind = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "histogram",
 	KICI_ORCH_EXECUTIONS_TOTAL: "counter",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "counter",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "counter",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "counter",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "histogram",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "histogram",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "counter",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "counter",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "observableGauge",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "observableGauge",
@@ -514,6 +531,7 @@ const MetricKind = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "counter",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "counter",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "counter",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "counter",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "counter",
@@ -665,6 +683,11 @@ const MetricDescription = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "Duration of execution runs in seconds",
 	KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "Tier-2 global eval round cache lookups by outcome",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "Global workflow candidates handed to a Tier-2 eval round",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "Jobs generated by a Tier-2 global eval round",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "Duration of one dispatched Tier-2 global eval round in seconds",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "Per-candidate verdicts produced by a Tier-2 global eval round",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "Total webhook ingest admissions granted by the admission controller",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "Event-loop delay max (ms) observed by the ingest admission sampler",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "Event-loop delay p99 (ms) observed by the ingest admission sampler",
@@ -715,6 +738,7 @@ const MetricDescription = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "Trust-resolution attempts refused because the provider numeric id was missing or did not match",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "Total org trust-policy gate decisions by arm and action",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "Webhook match-and-dispatch pipelines that threw. Labels: phase (post_ack — failed after the delivery was acknowledged)",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "Total number of webhooks processed",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "Total number of webhooks received",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "NACKs received from the Platform for a message it could not process (version skew)",
@@ -873,6 +897,11 @@ const MetricService = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_EXECUTIONS_TOTAL: "orchestrator",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "orchestrator",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "orchestrator",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "orchestrator",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "orchestrator",
@@ -923,6 +952,7 @@ const MetricService = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "orchestrator",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "orchestrator",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "orchestrator",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "orchestrator",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "orchestrator",
@@ -1075,6 +1105,11 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_execution_duration_seconds",
 	"kici_orch_executions_total",
 	"kici_orch_github_check_run_total",
+	"kici_orch_global_eval_cache_lookups_total",
+	"kici_orch_global_eval_candidates_total",
+	"kici_orch_global_eval_jobs_generated",
+	"kici_orch_global_eval_round_duration_seconds",
+	"kici_orch_global_eval_verdicts_total",
 	"kici_orch_ingest_admitted_total",
 	"kici_orch_ingest_event_loop_delay_max_ms",
 	"kici_orch_ingest_event_loop_delay_p99_ms",
@@ -1125,6 +1160,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_trust_match_refused_no_id_total",
 	"kici_orch_trust_policy_decisions_total",
 	"kici_orch_unroutable_fast_failed_total",
+	"kici_orch_webhook_pipeline_failures_total",
 	"kici_orch_webhooks_processed_total",
 	"kici_orch_webhooks_received_total",
 	"kici_orch_ws_nack_received_total",

package/dist/protocol/messages/dashboard-global-workflows.d.ts

@@ -17,7 +17,8 @@
  * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
  *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
  *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
- *   - `elevatedRepos` lists workflow-author repos with access to source secrets.
+ *   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
+ *     below and `docs/user/deprecations.md`.
  */
 import { z } from 'zod';
 /**
@@ -85,6 +86,11 @@ export declare const globalWorkflowsGetRequestSchema: z.ZodObject<{
  *
  * Every field is optional. `null` clears the corresponding list column
  * (e.g., `allowedRepos: null` means "all repos pass the allow-list").
+ *
+ * The master enable switch is NOT here: it is fleet-wide
+ * (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+ * cluster-settings`), not per-org. `.strict()` so a client that still sends
+ * `enabled` gets a validation failure instead of a silently dropped field.
  */
 export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.update">;
@@ -115,7 +121,6 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -128,7 +133,7 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export declare const globalWorkflowsGetResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.get.response">;
     requestId: z.ZodString;

package/dist/protocol/messages/dashboard-global-workflows.js

@@ -21,7 +21,8 @@ import { z } from "zod";
 * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
 *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
 *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
-*   - `elevatedRepos` lists workflow-author repos with access to source secrets.
+*   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
+*     below and `docs/user/deprecations.md`.
 */
 /**
 * One entry in any of the three repo-pattern lists. `routingKey` is the
@@ -34,9 +35,20 @@ const repoPatternEntrySchema = z.object({
 /** Projected org-level global workflow settings. */
 const globalWorkflowSettingsSchema = z.object({
 	customerId: z.string(),
+	/**
+	* The effective fleet-wide master switch
+	* (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+	* cluster-settings`). Read-only here — the dashboard renders it as a status
+	* badge; it is not a per-org value and cannot be flipped from the dashboard.
+	*/
 	enabled: z.boolean(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable(),
+	/**
+	* @deprecated Stored and echoed back, but never enforced: an organization-wide
+	* workflow's job is dispatched with no secret material at all, so there is no
+	* secret access for this list to widen. Removal at v1.0.0.
+	*/
 	elevatedRepos: z.array(repoPatternEntrySchema).nullable(),
 	createdAt: z.string().nullable(),
 	updatedAt: z.string().nullable()
@@ -52,16 +64,21 @@ const globalWorkflowsGetRequestSchema = z.object({
 *
 * Every field is optional. `null` clears the corresponding list column
 * (e.g., `allowedRepos: null` means "all repos pass the allow-list").
+*
+* The master enable switch is NOT here: it is fleet-wide
+* (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+* cluster-settings`), not per-org. `.strict()` so a client that still sends
+* `enabled` gets a validation failure instead of a silently dropped field.
 */
 const globalWorkflowsUpdateRequestSchema = z.object({
 	type: z.literal("dashboard.global-workflows.update"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	enabled: z.boolean().optional(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
+	/** @deprecated Accepted and stored, but never enforced. Removal at v1.0.0. */
 	elevatedRepos: z.array(repoPatternEntrySchema).nullable().optional()
-});
+}).strict();
 const globalWorkflowsGetResponseSchema = z.object({
 	type: z.literal("dashboard.global-workflows.get.response"),
 	requestId: z.string(),

package/dist/protocol/messages/dashboard.d.ts

@@ -299,6 +299,7 @@ export declare const dashboardRunStateResponseSchema: z.ZodObject<{
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;
@@ -6616,7 +6617,6 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -6629,7 +6629,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
     actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -7296,6 +7296,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;
@@ -8821,6 +8822,7 @@ export declare const runListItemSchema: z.ZodObject<{
     workflowName: z.ZodString;
     status: z.ZodString;
     repoIdentifier: z.ZodNullable<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     sha: z.ZodNullable<z.ZodString>;
     ref: z.ZodNullable<z.ZodString>;
     triggerEvent: z.ZodNullable<z.ZodString>;
@@ -8878,6 +8880,7 @@ export declare const runListResponseSchema: z.ZodObject<{
         workflowName: z.ZodString;
         status: z.ZodString;
         repoIdentifier: z.ZodNullable<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         sha: z.ZodNullable<z.ZodString>;
         ref: z.ZodNullable<z.ZodString>;
         triggerEvent: z.ZodNullable<z.ZodString>;

package/dist/protocol/messages/dashboard.js

@@ -2203,6 +2203,13 @@ const runListItemSchema = z.object({
 	workflowName: z.string(),
 	status: z.string(),
 	repoIdentifier: z.string().nullable(),
+	/**
+	* The repository that DEFINES this run's workflow. Non-null only when it
+	* differs from `repoIdentifier` — i.e. this is an organization-wide global
+	* run, whose workflow file lives in another repo entirely. Optional so a
+	* client parsing a response from an older Platform still validates.
+	*/
+	workflowRepoIdentifier: z.string().nullable().optional(),
 	sha: z.string().nullable(),
 	ref: z.string().nullable(),
 	triggerEvent: z.string().nullable(),

package/dist/protocol/messages/execution-status.d.ts

@@ -264,6 +264,7 @@ export declare const executionStatusSchema: z.ZodObject<{
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     repoProvider: z.ZodOptional<z.ZodString>;
     localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
@@ -417,6 +418,7 @@ export declare const stateReplayRunSchema: z.ZodObject<{
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     sha: z.ZodOptional<z.ZodString>;
     ref: z.ZodOptional<z.ZodString>;
     triggerEvent: z.ZodOptional<z.ZodString>;
@@ -468,6 +470,7 @@ export declare const stateReplaySchema: z.ZodObject<{
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/execution-status.js

@@ -239,6 +239,15 @@ const executionStatusSchema = z.object({
 	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
 	/**
+	* The repository that DEFINES the workflow, when that is not
+	* `repoIdentifier` — a global workflow authored in one repository and
+	* dispatched against another. Absent for every per-repository run, where the
+	* two are the same repository, so "present" is a precise marker for a
+	* cross-repository global run. Optional for backward compatibility with an
+	* older orchestrator that never sends it.
+	*/
+	workflowRepoIdentifier: z.string().max(256).optional(),
+	/**
 	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
 	* `local`). Distinct from the routing-key-derived source provider; drives the
 	* dashboard's provider-aware repo links.
@@ -359,6 +368,13 @@ const stateReplayRunSchema = z.object({
 	status: ExecutionRunStatus,
 	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
+	/**
+	* The repository that DEFINES the workflow, when that is not
+	* `repoIdentifier`. Same meaning and same absent-for-per-repository-runs
+	* contract as on `execution.status`; carried here so a run that reaches the
+	* Platform only through the reconnect replay keeps its attribution.
+	*/
+	workflowRepoIdentifier: z.string().max(256).optional(),
 	sha: z.string().max(128).optional(),
 	ref: z.string().max(128).optional(),
 	triggerEvent: z.string().max(128).optional(),

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { LockJob } from '../../trigger/types.js';
 /**
  * Cache write scope for a job's user-facing cache.
  *
@@ -232,6 +233,54 @@ export declare const jobStatusSchema: z.ZodObject<{
         encrypted: z.ZodString;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/**
+ * One candidate workflow's verdict from the pre-run global eval round — the
+ * job the agent runs once per (event × workflow repo) before any run row
+ * exists, evaluating each candidate's `filter` and then its `DynamicJobFn`s on
+ * a single dual checkout.
+ *
+ * `jobs` carries `LockJob[]` as an unvalidated pass-through, the same shape and
+ * for the same reason as `jobDispatchSchema.jobConfig`: the lock-file job shape
+ * has no Zod mirror anywhere in this package, its single source of truth is the
+ * `LockJob` interface in `trigger/types.ts`, and a hand-written Zod copy would
+ * drift and start rejecting legitimate generated jobs.
+ *
+ * Every field beyond the verdict itself is `.optional()` so an older peer
+ * tolerates the message unchanged.
+ */
+export declare const globalEvalCandidateResultSchema: z.ZodObject<{
+    workflowName: z.ZodString;
+    run: z.ZodBoolean;
+    jobs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    indeterminate: z.ZodOptional<z.ZodBoolean>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Every candidate's verdict from one global eval round, in candidate order. */
+export declare const globalEvalRoundResultSchema: z.ZodObject<{
+    candidates: z.ZodArray<z.ZodObject<{
+        workflowName: z.ZodString;
+        run: z.ZodBoolean;
+        jobs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        indeterminate: z.ZodOptional<z.ZodBoolean>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Typed view of {@link globalEvalCandidateResultSchema}. Declared rather than
+ * inferred so `jobs` is the real `LockJob[]` on both sides of the wire; the Zod
+ * schema stays the loose validator (see its doc comment).
+ */
+export interface GlobalEvalCandidateResult {
+    workflowName: string;
+    run: boolean;
+    jobs?: LockJob[];
+    indeterminate?: boolean;
+    reason?: string;
+}
+/** Typed view of {@link globalEvalRoundResultSchema}. */
+export interface GlobalEvalRoundResult {
+    candidates: GlobalEvalCandidateResult[];
+}
 /** Reasons an agent can refuse a job.dispatch. */
 export declare const JobRejectReason: z.ZodEnum<{
     busy: "busy";

package/dist/protocol/messages/orchestrator-agent.js

@@ -288,6 +288,39 @@ const jobStatusSchema = z.object({
 		encrypted: z.string()
 	})).optional()
 });
+/**
+* One candidate workflow's verdict from the pre-run global eval round — the
+* job the agent runs once per (event × workflow repo) before any run row
+* exists, evaluating each candidate's `filter` and then its `DynamicJobFn`s on
+* a single dual checkout.
+*
+* `jobs` carries `LockJob[]` as an unvalidated pass-through, the same shape and
+* for the same reason as `jobDispatchSchema.jobConfig`: the lock-file job shape
+* has no Zod mirror anywhere in this package, its single source of truth is the
+* `LockJob` interface in `trigger/types.ts`, and a hand-written Zod copy would
+* drift and start rejecting legitimate generated jobs.
+*
+* Every field beyond the verdict itself is `.optional()` so an older peer
+* tolerates the message unchanged.
+*/
+const globalEvalCandidateResultSchema = z.object({
+	/** The candidate workflow's name, as it appears in the lock file. */
+	workflowName: z.string(),
+	/** Whether this workflow applies to the source repo that triggered the round. */
+	run: z.boolean(),
+	jobs: z.array(z.record(z.string(), z.unknown())).optional().describe("Jobs generated by the workflow DynamicJobFns (LockJob[])"),
+	/**
+	* Set when the verdict could not be established — the filter or a generator
+	* threw, or blew the per-candidate budget. `run` is `false` alongside it, but
+	* that is a "could not decide", not a clean "does not apply": one bad
+	* candidate never fails the round, so its siblings still carry real verdicts.
+	*/
+	indeterminate: z.boolean().optional(),
+	/** Human-readable cause, present when `indeterminate` is set. */
+	reason: z.string().optional()
+});
+/** Every candidate's verdict from one global eval round, in candidate order. */
+const globalEvalRoundResultSchema = z.object({ candidates: z.array(globalEvalCandidateResultSchema) });
 /** Reasons an agent can refuse a job.dispatch. */
 const JobRejectReason = z.enum(["busy", "draining"]);
 /**
@@ -945,6 +978,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
+export { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -215,6 +215,7 @@ export declare const staleCheckrunCleanupSchema: z.ZodObject<{
         repoIdentifier: z.ZodString;
         sha: z.ZodString;
         workflowName: z.ZodString;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         jobNames: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -562,6 +563,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         repoIdentifier: z.ZodString;
         sha: z.ZodString;
         workflowName: z.ZodString;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         jobNames: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -2762,7 +2764,6 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -2775,7 +2776,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
     actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -3207,6 +3208,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     repoProvider: z.ZodOptional<z.ZodString>;
     localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
@@ -3349,6 +3351,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/platform-orchestrator.js

@@ -239,6 +239,20 @@ const staleCheckrunCleanupSchema = z.object({
 		repoIdentifier: z.string(),
 		sha: z.string(),
 		workflowName: z.string(),
+		/**
+		* The repository that DEFINES the workflow, when that is not the
+		* repository the run acted on — an organization-wide workflow dispatched
+		* against another repository. The orchestrator qualifies the check-run
+		* names it looks for with it, so a cleanup cannot time out the acted-on
+		* repository's own same-named check; see the orchestrator's
+		* `workflowLabel`.
+		*
+		* Additive and optional. The Platform sends it on exactly the condition
+		* that writes the mirror column — only when the two repositories differ —
+		* so an absent field and a value equal to `repoIdentifier` mean the same
+		* thing and both name the unqualified check.
+		*/
+		workflowRepoIdentifier: z.string().max(256).optional(),
 		jobNames: z.array(z.string())
 	}))
 });

package/dist/provider/check-status-poster.d.ts

@@ -34,5 +34,19 @@ export interface CheckStatusPoster {
      * unblocking a branch protection rule that requires the security check.
      */
     postGlobalWorkflowsSkippedCheck(repoIdentifier: string, commitSha: string, summary: string, credentials: unknown): Promise<void>;
+    /**
+     * Post a failing check recording that the pre-run evaluation of the
+     * organization's global workflows could not be completed, so none of the
+     * workflows it was deciding on ran for this commit.
+     *
+     * Its own check name, for the same reason as the two notices above: the
+     * security-hold check is a single named run per commit, so posting this
+     * through `postCheckStatus` would UPDATE that run and replace a pending
+     * "Held for approval" state with a completed conclusion.
+     *
+     * Optional so a provider bundle that has no notion of commit checks — or a
+     * hand-built one — is simply silent rather than failing the delivery.
+     */
+    postGlobalEvalFailedCheck?(repoIdentifier: string, commitSha: string, summary: string, credentials: unknown): Promise<void>;
 }
 //# sourceMappingURL=check-status-poster.d.ts.map

package/dist/provider/file-contents-fetcher.d.ts

@@ -0,0 +1,39 @@
+/**
+ * FileContentsFetcher interface.
+ *
+ * Fetches the contents of an arbitrary repository file at a specific ref via a
+ * provider's repository API. Used by the orchestrator to evaluate content-match
+ * triggers without cloning the repo.
+ */
+import type { ProviderType } from './types.js';
+export interface FileContentsFetcher {
+    readonly provider: ProviderType;
+    /**
+     * Fetch the contents of a file in a repository at a specific ref.
+     *
+     * Result shape:
+     * - `{ present: false }` -- the file does not exist (a 404 from the provider,
+     *   or the path resolves to a directory rather than a file).
+     * - `{ present: true, bytes }` -- the file exists and the provider returned
+     *   its inline content, decoded to a string.
+     * - `{ present: true }` (no `bytes`) -- the file exists but the provider did
+     *   not return inline content (e.g. GitHub's Contents API omits content for
+     *   files larger than 1 MiB). A caller MUST NOT read a missing `bytes` as an
+     *   absent file.
+     *
+     * Implementations do not cap the returned content -- any size limit is the
+     * caller's concern (the orchestrator's content matcher enforces a
+     * post-materialization cap). Implementations MUST NOT fall back to a raw
+     * blob download to defeat a provider's inline-content size limit.
+     *
+     * @param owner - Repository owner (e.g. "my-org")
+     * @param repo - Repository name (e.g. "my-app")
+     * @param path - Repo-relative file path (e.g. ".kici/workflows/ci.ts")
+     * @param ref - Git ref (branch name, tag, or SHA)
+     */
+    getFileContents(owner: string, repo: string, path: string, ref: string): Promise<{
+        present: boolean;
+        bytes?: string;
+    }>;
+}
+//# sourceMappingURL=file-contents-fetcher.d.ts.map

package/dist/provider/file-contents-fetcher.js

@@ -0,0 +1,2 @@
+import "../rolldown-runtime-ClRpJifh.js";
+export {};

package/dist/provider/index.d.ts

@@ -8,6 +8,7 @@
  * - WebhookNormalizer: Webhook ingestion and event normalization
  * - LockFileFetcher: Repository API access for lock files
  * - ChangedFilesFetcher: Repository API access for changed files
+ * - FileContentsFetcher: Repository API access for arbitrary file contents
  * - CloneTokenProvider: Auth token generation for agent clone
  * - RepoUrlBuilder: Provider-specific URL construction
  */
@@ -16,6 +17,7 @@ export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-norma
 export type { LockFileFetcher } from './lock-file-fetcher.js';
 export { LockFileParseError } from './lock-file-parse-error.js';
 export type { ChangedFilesFetcher, ChangedFilesResult } from './changed-files-fetcher.js';
+export type { FileContentsFetcher } from './file-contents-fetcher.js';
 export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider.js';
 export type { RepoUrlBuilder } from './repo-url-builder.js';
 export type { ContributorResolver, ContributorInfo, ContributorPermission, } from './contributor-resolver.js';

package/dist/safe-regex.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reject a ReDoS-prone author-supplied regex before it is compiled.
+ *
+ * `safe-regex` is a star-height heuristic. The orchestrator is single-tenant, so
+ * a slipped-through pattern only stalls the author's own orchestrator — but every
+ * author regex the orchestrator compiles from lock-file data on the webhook path
+ * (label selectors, branch/tag/repo patterns, embedded JSONPath `/re/flags`,
+ * comment `bodyMatch`) must be checked so a catastrophic pattern is rejected at
+ * compile/registration time rather than silently compiled. Globs are linear by
+ * construction but pass through here for uniformity.
+ *
+ * `ctx` is a human label (e.g. "branch pattern", "job 'web' runsOn") woven into
+ * the thrown error so an operator can identify the offending pattern.
+ */
+export declare function assertSafeRegex(source: string, flags: string, ctx: string): void;
+//# sourceMappingURL=safe-regex.d.ts.map

package/dist/safe-regex.js

@@ -0,0 +1,24 @@
+import "./rolldown-runtime-ClRpJifh.js";
+import safeRegex from "safe-regex";
+//#region src/safe-regex.ts
+/**
+* Reject a ReDoS-prone author-supplied regex before it is compiled.
+*
+* `safe-regex` is a star-height heuristic. The orchestrator is single-tenant, so
+* a slipped-through pattern only stalls the author's own orchestrator — but every
+* author regex the orchestrator compiles from lock-file data on the webhook path
+* (label selectors, branch/tag/repo patterns, embedded JSONPath `/re/flags`,
+* comment `bodyMatch`) must be checked so a catastrophic pattern is rejected at
+* compile/registration time rather than silently compiled. Globs are linear by
+* construction but pass through here for uniformity.
+*
+* `ctx` is a human label (e.g. "branch pattern", "job 'web' runsOn") woven into
+* the thrown error so an operator can identify the offending pattern.
+*/
+function assertSafeRegex(source, flags, ctx) {
+	if (!safeRegex(new RegExp(source, flags))) throw new Error(`${ctx}: regex /${source}/${flags} is ReDoS-prone — rejected`);
+}
+//#endregion
+export { assertSafeRegex };
+
+//# sourceMappingURL=safe-regex.js.map