@kici-dev/engine 0.4.0 → 0.5.0

package/dist/context/host-match.js

@@ -1,6 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { matcherMatches } from "../labels-match.js";
-import { assertSafeRegex, toLabelMatcher } from "../labels/compile.js";
+import { assertSafeRegex } from "../safe-regex.js";
+import { toLabelMatcher } from "../labels/compile.js";
 //#region src/context/host-match.ts
 /** `'**'`, empty, or absent means "matches every host". */
 function matchesAllHosts(pattern) {

package/dist/index.d.ts

@@ -45,9 +45,11 @@ export * from './protocol/messages/log-stream.js';
 export * from './protocol/messages/orchestrator-agent.js';
 export * from './sandbox/capabilities.js';
 export * from './trigger/types.js';
+export * from './trigger/text-match.js';
 export * from './trigger/trigger-event-type.js';
 export * from './trigger/decision-trace.js';
 export * from './trigger/matcher.js';
+export { getRepoGlobMatcher } from './trigger/compiled-matchers.js';
 export * from './trigger/event-buckets.js';
 export { scheduleTriggerKey } from './trigger/schedule-key.js';
 export * from './inputs/index.js';
@@ -61,7 +63,7 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './context/index.js';
-export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, INIT_LABEL, PRIVILEGED_ROOT_LABEL, } from './labels.js';
+export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, INIT_LABEL, PRIVILEGED_ROOT_LABEL, INIT_RUNNER_ROLE_LABEL, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export type { ScalerPlatform } from './labels.js';

package/dist/index.js

@@ -21,7 +21,7 @@ import { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_IN
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approvalTimeoutSecondsSchema, approverClauseSchema } from "./approval/types.js";
 import { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus } from "./status/presentation.js";
-import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./context/concurrency-strategy.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
@@ -42,10 +42,12 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
-import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
+import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
-import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
+import { TraceCheck, TraceVerdict, appendChecks, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
+import { getRepoGlobMatcher } from "./trigger/compiled-matchers.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchTrigger, matchWorkflowTriggers } from "./trigger/matcher.js";
 import { TRIGGER_TYPE_TO_EVENT_TYPES, matchWorkflowsForEvent, prepareEventBuckets } from "./trigger/event-buckets.js";
 import { scheduleTriggerKey } from "./trigger/schedule-key.js";
@@ -73,7 +75,7 @@ import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-conte
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./context/scope-name.js";
 import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./context/secret-key.js";
 import "./context/index.js";
-import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
+import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
@@ -84,4 +86,4 @@ import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, MAX_MATRIX_MATERIALIZATION,
 import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, artifactInvalidNameError, checkArtifactName } from "./artifacts/name.js";
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SecretKeyError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SecretKeyError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveContentFormat, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/labels/compile.d.ts

@@ -1,11 +1,6 @@
 import type { LabelMatcher } from '../labels-match.js';
-/**
- * Reject a ReDoS-prone regex. `safe-regex` is a star-height heuristic — the
- * orchestrator is single-tenant, so a slipped-through pattern only stalls the
- * author's own orchestrator. Globs are linear by construction but pass through
- * here for uniformity.
- */
-export declare function assertSafeRegex(source: string, flags: string, ctx: string): void;
+import { assertSafeRegex } from '../safe-regex.js';
+export { assertSafeRegex };
 /**
  * Convert one author selector element into a `LabelMatcher`.
  * - `RegExp` → regex matcher (source + flags captured verbatim).

package/dist/labels/compile.js

@@ -1,17 +1,8 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { assertSafeRegex } from "../safe-regex.js";
 import picomatch from "picomatch";
-import safeRegex from "safe-regex";
 //#region src/labels/compile.ts
 /**
-* Reject a ReDoS-prone regex. `safe-regex` is a star-height heuristic — the
-* orchestrator is single-tenant, so a slipped-through pattern only stalls the
-* author's own orchestrator. Globs are linear by construction but pass through
-* here for uniformity.
-*/
-function assertSafeRegex(source, flags, ctx) {
-	if (!safeRegex(new RegExp(source, flags))) throw new Error(`${ctx}: regex /${source}/${flags} is ReDoS-prone — rejected`);
-}
-/**
 * Convert one author selector element into a `LabelMatcher`.
 * - `RegExp` → regex matcher (source + flags captured verbatim).
 * - string that picomatch detects as a glob → regex via `picomatch.makeRe`.

package/dist/labels.d.ts

@@ -194,6 +194,14 @@ export declare const ROLE_LABEL_PREFIX = "kici:role:";
  * Convert a role name to its corresponding label.
  */
 export declare function roleToLabel(role: AgentRole): string;
+/**
+ * The label every pre-run evaluation job routes to.
+ *
+ * Exported because three dispatch sites and the global eval round all target
+ * it, and each had spelled the string out. Derived from {@link roleToLabel} so
+ * it cannot drift from the prefix or from `KNOWN_ROLES`.
+ */
+export declare const INIT_RUNNER_ROLE_LABEL: string;
 /**
  * Resolve a roles configuration into role labels.
  *

package/dist/labels.js

@@ -274,6 +274,14 @@ function roleToLabel(role) {
 	return `${ROLE_LABEL_PREFIX}${role}`;
 }
 /**
+* The label every pre-run evaluation job routes to.
+*
+* Exported because three dispatch sites and the global eval round all target
+* it, and each had spelled the string out. Derived from {@link roleToLabel} so
+* it cannot drift from the prefix or from `KNOWN_ROLES`.
+*/
+const INIT_RUNNER_ROLE_LABEL = roleToLabel("init-runner");
+/**
 * Resolve a roles configuration into role labels.
 *
 * - undefined → all roles (backward compat: existing agents get all capabilities)
@@ -352,6 +360,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
+export { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/metrics/catalog-policy.d.ts

@@ -59,6 +59,17 @@ export declare const ORCH_PUSHED_METRIC_NAMES: ReadonlySet<MetricName>;
  * `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
  */
 export declare const ORCH_SCALER_VALUES: readonly ["__global__", "stateful", "container", "firecracker", "bare-metal"];
+/**
+ * Closed enum of the scheduled jobs the orchestrator runs. MUST mirror
+ * `OrchestratorScheduledJobName` (`packages/orchestrator/src/queue/scheduled-job.ts`)
+ * exactly — a job missing here has its whole `kici_orch_job_*` series
+ * dropped by the Platform filter with `reason="bad_label_value"`, so the
+ * job silently loses every health metric. The engine cannot import the
+ * orchestrator (dependency runs the other way), so the parity assertion
+ * lives on the orchestrator side in `scheduled-job.test.ts`. Exported so
+ * that test can assert against it.
+ */
+export declare const ORCH_JOB_VALUES: readonly ['cleanup', 'orphan-secret-cleanup', 'token-cleanup', 'cold-store-archive', 'cold-store-purge', 'unroutable-probe'];
 /**
  * Per-metric, per-label value policy. Missing entries (or missing label
  * keys within an entry) mean "no value-level constraint" — the label key

package/dist/metrics/catalog-policy.js

@@ -55,13 +55,23 @@ const AGENT_SCALER_VALUES = [
 * `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
 */
 const ORCH_SCALER_VALUES = ["__global__", ...AGENT_SCALER_VALUES];
-/** Closed enum of the five scheduled jobs the orchestrator runs (mirrors `OrchestratorScheduledJobName`). */
+/**
+* Closed enum of the scheduled jobs the orchestrator runs. MUST mirror
+* `OrchestratorScheduledJobName` (`packages/orchestrator/src/queue/scheduled-job.ts`)
+* exactly — a job missing here has its whole `kici_orch_job_*` series
+* dropped by the Platform filter with `reason="bad_label_value"`, so the
+* job silently loses every health metric. The engine cannot import the
+* orchestrator (dependency runs the other way), so the parity assertion
+* lives on the orchestrator side in `scheduled-job.test.ts`. Exported so
+* that test can assert against it.
+*/
 const ORCH_JOB_VALUES = [
 	"cleanup",
 	"orphan-secret-cleanup",
 	"token-cleanup",
 	"cold-store-archive",
-	"cold-store-purge"
+	"cold-store-purge",
+	"unroutable-probe"
 ];
 /**
 * Per-metric, per-label value policy. Missing entries (or missing label
@@ -277,6 +287,6 @@ const METRIC_LABEL_POLICY = {
 	}
 };
 //#endregion
-export { METRIC_LABEL_POLICY, ORCH_PUSHED_METRIC_NAMES, ORCH_SCALER_VALUES, OVERFLOW_LABEL_VALUE };
+export { METRIC_LABEL_POLICY, ORCH_JOB_VALUES, ORCH_PUSHED_METRIC_NAMES, ORCH_SCALER_VALUES, OVERFLOW_LABEL_VALUE };
 
 //# sourceMappingURL=catalog-policy.js.map

package/dist/metrics/metric-catalog.generated.d.ts

@@ -44,6 +44,11 @@ export declare const MetricNames: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'kici_orch_execution_duration_seconds';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'kici_orch_executions_total';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'kici_orch_github_check_run_total';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'kici_orch_global_eval_cache_lookups_total';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'kici_orch_global_eval_candidates_total';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'kici_orch_global_eval_jobs_generated';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'kici_orch_global_eval_round_duration_seconds';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'kici_orch_global_eval_verdicts_total';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'kici_orch_ingest_admitted_total';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'kici_orch_ingest_event_loop_delay_max_ms';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'kici_orch_ingest_event_loop_delay_p99_ms';
@@ -94,6 +99,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'kici_orch_trust_match_refused_no_id_total';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'kici_orch_trust_policy_decisions_total';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'kici_orch_unroutable_fast_failed_total';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'kici_orch_webhook_pipeline_failures_total';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'kici_orch_webhooks_processed_total';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'kici_orch_webhooks_received_total';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'kici_orch_ws_nack_received_total';
@@ -246,6 +252,11 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_EXECUTIONS_TOTAL: readonly ['status'];
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: readonly ['operation'];
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: readonly ['result'];
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: readonly [];
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: readonly [];
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: readonly ['result'];
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: readonly ['outcome'];
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: readonly [];
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: readonly [];
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: readonly [];
@@ -296,6 +307,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: readonly ['reason'];
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: readonly ['arm', 'action'];
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: readonly [];
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: readonly ['phase'];
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: readonly ['result'];
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: readonly ['source', 'event'];
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: readonly [];
@@ -447,6 +459,11 @@ export declare const MetricKind: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'histogram';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'counter';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'counter';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'counter';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'counter';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'histogram';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'histogram';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'counter';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'counter';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'observableGauge';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'observableGauge';
@@ -497,6 +514,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'counter';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'counter';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'counter';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'counter';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'counter';
@@ -648,6 +666,11 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'Duration of execution runs in seconds';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'Total number of execution runs';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'Total number of GitHub check run API calls';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'Tier-2 global eval round cache lookups by outcome';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'Global workflow candidates handed to a Tier-2 eval round';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'Jobs generated by a Tier-2 global eval round';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'Duration of one dispatched Tier-2 global eval round in seconds';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'Per-candidate verdicts produced by a Tier-2 global eval round';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'Total webhook ingest admissions granted by the admission controller';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'Event-loop delay max (ms) observed by the ingest admission sampler';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'Event-loop delay p99 (ms) observed by the ingest admission sampler';
@@ -698,6 +721,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'Trust-resolution attempts refused because the provider numeric id was missing or did not match';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'Total org trust-policy gate decisions by arm and action';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'Webhook match-and-dispatch pipelines that threw. Labels: phase (post_ack — failed after the delivery was acknowledged)';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'Total number of webhooks processed';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'Total number of webhooks received';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'NACKs received from the Platform for a message it could not process (version skew)';
@@ -856,6 +880,11 @@ export declare const MetricService: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'orchestrator';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'orchestrator';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'orchestrator';
@@ -906,6 +935,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'orchestrator';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'orchestrator';

package/dist/metrics/metric-catalog.generated.js

@@ -46,6 +46,11 @@ const MetricNames = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "kici_orch_execution_duration_seconds",
 	KICI_ORCH_EXECUTIONS_TOTAL: "kici_orch_executions_total",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "kici_orch_github_check_run_total",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "kici_orch_global_eval_cache_lookups_total",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "kici_orch_global_eval_candidates_total",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "kici_orch_global_eval_jobs_generated",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "kici_orch_global_eval_round_duration_seconds",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "kici_orch_global_eval_verdicts_total",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "kici_orch_ingest_admitted_total",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "kici_orch_ingest_event_loop_delay_max_ms",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "kici_orch_ingest_event_loop_delay_p99_ms",
@@ -96,6 +101,7 @@ const MetricNames = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "kici_orch_trust_match_refused_no_id_total",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "kici_orch_trust_policy_decisions_total",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "kici_orch_unroutable_fast_failed_total",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "kici_orch_webhook_pipeline_failures_total",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "kici_orch_webhooks_processed_total",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "kici_orch_webhooks_received_total",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "kici_orch_ws_nack_received_total",
@@ -247,6 +253,11 @@ const MetricLabels = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: [],
 	KICI_ORCH_EXECUTIONS_TOTAL: ["status"],
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: ["operation"],
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: ["result"],
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: [],
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: [],
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: ["result"],
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: ["outcome"],
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: [],
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: [],
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: [],
@@ -309,6 +320,7 @@ const MetricLabels = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: ["reason"],
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: ["arm", "action"],
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: [],
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: ["phase"],
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: ["result"],
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: ["source", "event"],
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: [],
@@ -464,6 +476,11 @@ const MetricKind = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "histogram",
 	KICI_ORCH_EXECUTIONS_TOTAL: "counter",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "counter",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "counter",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "counter",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "histogram",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "histogram",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "counter",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "counter",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "observableGauge",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "observableGauge",
@@ -514,6 +531,7 @@ const MetricKind = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "counter",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "counter",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "counter",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "counter",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "counter",
@@ -665,6 +683,11 @@ const MetricDescription = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "Duration of execution runs in seconds",
 	KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "Tier-2 global eval round cache lookups by outcome",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "Global workflow candidates handed to a Tier-2 eval round",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "Jobs generated by a Tier-2 global eval round",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "Duration of one dispatched Tier-2 global eval round in seconds",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "Per-candidate verdicts produced by a Tier-2 global eval round",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "Total webhook ingest admissions granted by the admission controller",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "Event-loop delay max (ms) observed by the ingest admission sampler",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "Event-loop delay p99 (ms) observed by the ingest admission sampler",
@@ -715,6 +738,7 @@ const MetricDescription = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "Trust-resolution attempts refused because the provider numeric id was missing or did not match",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "Total org trust-policy gate decisions by arm and action",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "Webhook match-and-dispatch pipelines that threw. Labels: phase (post_ack — failed after the delivery was acknowledged)",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "Total number of webhooks processed",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "Total number of webhooks received",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "NACKs received from the Platform for a message it could not process (version skew)",
@@ -873,6 +897,11 @@ const MetricService = {
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_EXECUTIONS_TOTAL: "orchestrator",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: "orchestrator",
+	KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: "orchestrator",
 	KICI_ORCH_INGEST_ADMITTED_TOTAL: "orchestrator",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: "orchestrator",
 	KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: "orchestrator",
@@ -923,6 +952,7 @@ const MetricService = {
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "orchestrator",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "orchestrator",
 	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "orchestrator",
+	KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "orchestrator",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "orchestrator",
@@ -1075,6 +1105,11 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_execution_duration_seconds",
 	"kici_orch_executions_total",
 	"kici_orch_github_check_run_total",
+	"kici_orch_global_eval_cache_lookups_total",
+	"kici_orch_global_eval_candidates_total",
+	"kici_orch_global_eval_jobs_generated",
+	"kici_orch_global_eval_round_duration_seconds",
+	"kici_orch_global_eval_verdicts_total",
 	"kici_orch_ingest_admitted_total",
 	"kici_orch_ingest_event_loop_delay_max_ms",
 	"kici_orch_ingest_event_loop_delay_p99_ms",
@@ -1125,6 +1160,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_trust_match_refused_no_id_total",
 	"kici_orch_trust_policy_decisions_total",
 	"kici_orch_unroutable_fast_failed_total",
+	"kici_orch_webhook_pipeline_failures_total",
 	"kici_orch_webhooks_processed_total",
 	"kici_orch_webhooks_received_total",
 	"kici_orch_ws_nack_received_total",

package/dist/protocol/messages/dashboard-global-workflows.d.ts

@@ -17,7 +17,8 @@
  * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
  *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
  *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
- *   - `elevatedRepos` lists workflow-author repos with access to source secrets.
+ *   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
+ *     below and `docs/user/deprecations.md`.
  */
 import { z } from 'zod';
 /**
@@ -85,6 +86,11 @@ export declare const globalWorkflowsGetRequestSchema: z.ZodObject<{
  *
  * Every field is optional. `null` clears the corresponding list column
  * (e.g., `allowedRepos: null` means "all repos pass the allow-list").
+ *
+ * The master enable switch is NOT here: it is fleet-wide
+ * (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+ * cluster-settings`), not per-org. `.strict()` so a client that still sends
+ * `enabled` gets a validation failure instead of a silently dropped field.
  */
 export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.update">;
@@ -115,7 +121,6 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -128,7 +133,7 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export declare const globalWorkflowsGetResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.get.response">;
     requestId: z.ZodString;

package/dist/protocol/messages/dashboard-global-workflows.js

@@ -21,7 +21,8 @@ import { z } from "zod";
 * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
 *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
 *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
-*   - `elevatedRepos` lists workflow-author repos with access to source secrets.
+*   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
+*     below and `docs/user/deprecations.md`.
 */
 /**
 * One entry in any of the three repo-pattern lists. `routingKey` is the
@@ -34,9 +35,20 @@ const repoPatternEntrySchema = z.object({
 /** Projected org-level global workflow settings. */
 const globalWorkflowSettingsSchema = z.object({
 	customerId: z.string(),
+	/**
+	* The effective fleet-wide master switch
+	* (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+	* cluster-settings`). Read-only here — the dashboard renders it as a status
+	* badge; it is not a per-org value and cannot be flipped from the dashboard.
+	*/
 	enabled: z.boolean(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable(),
+	/**
+	* @deprecated Stored and echoed back, but never enforced: an organization-wide
+	* workflow's job is dispatched with no secret material at all, so there is no
+	* secret access for this list to widen. Removal at v1.0.0.
+	*/
 	elevatedRepos: z.array(repoPatternEntrySchema).nullable(),
 	createdAt: z.string().nullable(),
 	updatedAt: z.string().nullable()
@@ -52,16 +64,21 @@ const globalWorkflowsGetRequestSchema = z.object({
 *
 * Every field is optional. `null` clears the corresponding list column
 * (e.g., `allowedRepos: null` means "all repos pass the allow-list").
+*
+* The master enable switch is NOT here: it is fleet-wide
+* (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+* cluster-settings`), not per-org. `.strict()` so a client that still sends
+* `enabled` gets a validation failure instead of a silently dropped field.
 */
 const globalWorkflowsUpdateRequestSchema = z.object({
 	type: z.literal("dashboard.global-workflows.update"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	enabled: z.boolean().optional(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
+	/** @deprecated Accepted and stored, but never enforced. Removal at v1.0.0. */
 	elevatedRepos: z.array(repoPatternEntrySchema).nullable().optional()
-});
+}).strict();
 const globalWorkflowsGetResponseSchema = z.object({
 	type: z.literal("dashboard.global-workflows.get.response"),
 	requestId: z.string(),