@kici-dev/engine 0.4.0 → 0.6.0

package/dist/protocol/messages/dashboard-global-workflows.d.ts

@@ -17,7 +17,8 @@
  * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
  *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
  *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
- *   - `elevatedRepos` lists workflow-author repos with access to source secrets.
+ *   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
+ *     below and `docs/user/deprecations.md`.
  */
 import { z } from 'zod';
 /**
@@ -29,6 +30,27 @@ export declare const repoPatternEntrySchema: z.ZodObject<{
     pattern: z.ZodString;
 }, z.core.$strip>;
 export type RepoPatternEntry = z.infer<typeof repoPatternEntrySchema>;
+/**
+ * Why a pattern may not be stored on a global-workflow policy list, or null
+ * when it is acceptable.
+ *
+ * The lists match each entry as a single glob, so a negated pattern inverts to
+ * "everything except" — on an allow list that allows almost every repo, on a
+ * deny list it denies almost every repo. The list's own direction already
+ * encodes allow/deny, so negation forms are rejected at write time.
+ *
+ * This is deliberately not folded into `repoPatternEntrySchema`: the schema is
+ * also the read path for rows already in `org_settings`, which must keep
+ * parsing. Evaluation handles a stored negation form by failing closed.
+ *
+ * Which forms count as a negation is not decided here: it comes from the one
+ * classifier in `repo/pattern-negation.js`, shared with the Platform's
+ * repo-scope allow-list. Keeping the verdict in one place is what stops this
+ * list and that one from reading the same pattern language two different ways —
+ * notably the regular-expression assertions `(?!…)` / `(?<!…)`, which picomatch
+ * compiles into a real inversion, and `[!…]`, which it does not.
+ */
+export declare function invalidRepoPatternReason(pattern: string): string | null;
 /** Projected org-level global workflow settings. */
 export declare const globalWorkflowSettingsSchema: z.ZodObject<{
     customerId: z.ZodString;
@@ -85,6 +107,11 @@ export declare const globalWorkflowsGetRequestSchema: z.ZodObject<{
  *
  * Every field is optional. `null` clears the corresponding list column
  * (e.g., `allowedRepos: null` means "all repos pass the allow-list").
+ *
+ * The master enable switch is NOT here: it is fleet-wide
+ * (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+ * cluster-settings`), not per-org. `.strict()` so a client that still sends
+ * `enabled` gets a validation failure instead of a silently dropped field.
  */
 export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.update">;
@@ -115,7 +142,6 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -128,7 +154,7 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export declare const globalWorkflowsGetResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.get.response">;
     requestId: z.ZodString;

package/dist/protocol/messages/dashboard-global-workflows.js

@@ -1,5 +1,6 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { actorPrincipalSchema } from "./actor.js";
+import { negatedPatternReason } from "../../repo/pattern-negation.js";
 import { z } from "zod";
 //#region src/protocol/messages/dashboard-global-workflows.ts
 /**
@@ -21,7 +22,8 @@ import { z } from "zod";
 * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
 *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
 *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
-*   - `elevatedRepos` lists workflow-author repos with access to source secrets.
+*   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
+*     below and `docs/user/deprecations.md`.
 */
 /**
 * One entry in any of the three repo-pattern lists. `routingKey` is the
@@ -31,12 +33,49 @@ const repoPatternEntrySchema = z.object({
 	routingKey: z.string().min(1).optional(),
 	pattern: z.string().min(1)
 });
+/**
+* Why a pattern may not be stored on a global-workflow policy list, or null
+* when it is acceptable.
+*
+* The lists match each entry as a single glob, so a negated pattern inverts to
+* "everything except" — on an allow list that allows almost every repo, on a
+* deny list it denies almost every repo. The list's own direction already
+* encodes allow/deny, so negation forms are rejected at write time.
+*
+* This is deliberately not folded into `repoPatternEntrySchema`: the schema is
+* also the read path for rows already in `org_settings`, which must keep
+* parsing. Evaluation handles a stored negation form by failing closed.
+*
+* Which forms count as a negation is not decided here: it comes from the one
+* classifier in `repo/pattern-negation.js`, shared with the Platform's
+* repo-scope allow-list. Keeping the verdict in one place is what stops this
+* list and that one from reading the same pattern language two different ways —
+* notably the regular-expression assertions `(?!…)` / `(?<!…)`, which picomatch
+* compiles into a real inversion, and `[!…]`, which it does not.
+*/
+function invalidRepoPatternReason(pattern) {
+	if (pattern.trim() === "") return "pattern is empty";
+	const negation = negatedPatternReason(pattern);
+	if (negation) return `${negation} is not allowed on a policy list — the list's direction already encodes allow/deny`;
+	return null;
+}
 /** Projected org-level global workflow settings. */
 const globalWorkflowSettingsSchema = z.object({
 	customerId: z.string(),
+	/**
+	* The effective fleet-wide master switch
+	* (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+	* cluster-settings`). Read-only here — the dashboard renders it as a status
+	* badge; it is not a per-org value and cannot be flipped from the dashboard.
+	*/
 	enabled: z.boolean(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable(),
+	/**
+	* @deprecated Stored and echoed back, but never enforced: an organization-wide
+	* workflow's job is dispatched with no secret material at all, so there is no
+	* secret access for this list to widen. Removal at v1.0.0.
+	*/
 	elevatedRepos: z.array(repoPatternEntrySchema).nullable(),
 	createdAt: z.string().nullable(),
 	updatedAt: z.string().nullable()
@@ -52,16 +91,21 @@ const globalWorkflowsGetRequestSchema = z.object({
 *
 * Every field is optional. `null` clears the corresponding list column
 * (e.g., `allowedRepos: null` means "all repos pass the allow-list").
+*
+* The master enable switch is NOT here: it is fleet-wide
+* (`cluster_settings.global_workflows_enabled`, set with `kici-admin
+* cluster-settings`), not per-org. `.strict()` so a client that still sends
+* `enabled` gets a validation failure instead of a silently dropped field.
 */
 const globalWorkflowsUpdateRequestSchema = z.object({
 	type: z.literal("dashboard.global-workflows.update"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	enabled: z.boolean().optional(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
+	/** @deprecated Accepted and stored, but never enforced. Removal at v1.0.0. */
 	elevatedRepos: z.array(repoPatternEntrySchema).nullable().optional()
-});
+}).strict();
 const globalWorkflowsGetResponseSchema = z.object({
 	type: z.literal("dashboard.global-workflows.get.response"),
 	requestId: z.string(),
@@ -75,6 +119,6 @@ const globalWorkflowsUpdateResponseSchema = z.object({
 	error: z.string().optional()
 });
 //#endregion
-export { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema };
+export { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, invalidRepoPatternReason, repoPatternEntrySchema };
 
 //# sourceMappingURL=dashboard-global-workflows.js.map

package/dist/protocol/messages/dashboard.d.ts

@@ -299,6 +299,7 @@ export declare const dashboardRunStateResponseSchema: z.ZodObject<{
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;
@@ -380,6 +381,12 @@ export declare const dashboardJobDetailSchema: z.ZodObject<{
     baseJobName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     variantKind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     variantLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    jobKind: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        gate: "gate";
+        proxy: "proxy";
+        standard: "standard";
+    }>>>;
+    summonedRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     startedAt: z.ZodNullable<z.ZodNumber>;
     completedAt: z.ZodNullable<z.ZodNumber>;
     durationMs: z.ZodNullable<z.ZodNumber>;
@@ -391,7 +398,7 @@ export declare const dashboardJobDetailSchema: z.ZodObject<{
     contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     envWarning: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+    outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     initFailure: z.ZodOptional<z.ZodObject<{
         scope: z.ZodEnum<{
@@ -470,6 +477,12 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
         baseJobName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         variantKind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         variantLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobKind: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            gate: "gate";
+            proxy: "proxy";
+            standard: "standard";
+        }>>>;
+        summonedRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         startedAt: z.ZodNullable<z.ZodNumber>;
         completedAt: z.ZodNullable<z.ZodNumber>;
         durationMs: z.ZodNullable<z.ZodNumber>;
@@ -481,7 +494,7 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
         contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         envWarning: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
         secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         initFailure: z.ZodOptional<z.ZodObject<{
             scope: z.ZodEnum<{
@@ -3567,6 +3580,7 @@ export declare const dashboardDiagnosticsResponseSchema: z.ZodObject<{
         type: z.ZodEnum<{
             "bare-metal": "bare-metal";
             container: "container";
+            event: "event";
             firecracker: "firecracker";
             kubernetes: "kubernetes";
         }>;
@@ -6616,7 +6630,6 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -6629,7 +6642,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
     actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -6746,6 +6759,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "source_override.set": "source_override.set";
         "sources.list.read": "sources.list.read";
         "step.logs.read": "step.logs.read";
+        "trust_directory.updated": "trust_directory.updated";
         "trust_policy.updated": "trust_policy.updated";
     }>>;
     source: z.ZodOptional<z.ZodEnum<{
@@ -7001,6 +7015,12 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         baseJobName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         variantKind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         variantLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobKind: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            gate: "gate";
+            proxy: "proxy";
+            standard: "standard";
+        }>>>;
+        summonedRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         startedAt: z.ZodNullable<z.ZodNumber>;
         completedAt: z.ZodNullable<z.ZodNumber>;
         durationMs: z.ZodNullable<z.ZodNumber>;
@@ -7012,7 +7032,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         envWarning: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
         secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         initFailure: z.ZodOptional<z.ZodObject<{
             scope: z.ZodEnum<{
@@ -7296,6 +7316,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;
@@ -7908,6 +7929,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         type: z.ZodEnum<{
             "bare-metal": "bare-metal";
             container: "container";
+            event: "event";
             firecracker: "firecracker";
             kubernetes: "kubernetes";
         }>;
@@ -8466,6 +8488,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "source_override.set": "source_override.set";
             "sources.list.read": "sources.list.read";
             "step.logs.read": "step.logs.read";
+            "trust_directory.updated": "trust_directory.updated";
             "trust_policy.updated": "trust_policy.updated";
         }>;
         targetType: z.ZodNullable<z.ZodEnum<{
@@ -8635,6 +8658,12 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
         baseJobName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         variantKind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         variantLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobKind: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            gate: "gate";
+            proxy: "proxy";
+            standard: "standard";
+        }>>>;
+        summonedRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         startedAt: z.ZodNullable<z.ZodNumber>;
         completedAt: z.ZodNullable<z.ZodNumber>;
         durationMs: z.ZodNullable<z.ZodNumber>;
@@ -8646,7 +8675,7 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
         contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         envWarning: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
         secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         initFailure: z.ZodOptional<z.ZodObject<{
             scope: z.ZodEnum<{
@@ -8821,6 +8850,7 @@ export declare const runListItemSchema: z.ZodObject<{
     workflowName: z.ZodString;
     status: z.ZodString;
     repoIdentifier: z.ZodNullable<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     sha: z.ZodNullable<z.ZodString>;
     ref: z.ZodNullable<z.ZodString>;
     triggerEvent: z.ZodNullable<z.ZodString>;
@@ -8878,6 +8908,7 @@ export declare const runListResponseSchema: z.ZodObject<{
         workflowName: z.ZodString;
         status: z.ZodString;
         repoIdentifier: z.ZodNullable<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         sha: z.ZodNullable<z.ZodString>;
         ref: z.ZodNullable<z.ZodString>;
         triggerEvent: z.ZodNullable<z.ZodString>;
@@ -9203,12 +9234,20 @@ export declare const runEventSchema: z.ZodObject<{
     parentSpanId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type RunEvent = z.infer<typeof runEventSchema>;
-/** Trust policy response (from trust_policies table). */
+/**
+ * Trust policy response (from trust_policies table).
+ *
+ * `approvalExpirySeconds` is the authoritative window and `approvalExpiryHours`
+ * its coarse, rounded-up view, so a client reading only the older field still
+ * gets a usable number. Both are always sent by this build; the seconds field is
+ * optional so a dashboard build reading an older Platform still parses.
+ */
 export declare const trustPolicyResponseSchema: z.ZodObject<{
     forkPolicy: z.ZodString;
     unknownContributorPolicy: z.ZodString;
     workflowChangePolicy: z.ZodString;
     approvalExpiryHours: z.ZodNumber;
+    approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type TrustPolicy = z.infer<typeof trustPolicyResponseSchema>;
 /** Single identity link item. */
@@ -9256,6 +9295,7 @@ export declare const orgMemberSchema: z.ZodObject<{
     suspendedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
     joinedAt: z.ZodCoercedString<unknown>;
     ciTrustLevel: z.ZodString;
+    ciTrustOverride: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     identityLinks: z.ZodArray<z.ZodObject<{
         provider: z.ZodString;
         providerUsername: z.ZodString;
@@ -9276,6 +9316,7 @@ export declare const memberListResponseSchema: z.ZodObject<{
         suspendedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
         joinedAt: z.ZodCoercedString<unknown>;
         ciTrustLevel: z.ZodString;
+        ciTrustOverride: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         identityLinks: z.ZodArray<z.ZodObject<{
             provider: z.ZodString;
             providerUsername: z.ZodString;

package/dist/protocol/messages/dashboard.js

@@ -5,7 +5,7 @@ import { AttestationOrigin } from "../../provenance/attestation-origin.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { HeldRunStatus } from "../../context/held-run-status.js";
 import { dashboardSealedEnvelopeSchema } from "./dashboard-sealed-write.js";
-import { StepConcurrencyKind, initFailureSchema, stateReplayRunSchema } from "./execution-status.js";
+import { JobKind, StepConcurrencyKind, initFailureSchema, stateReplayRunSchema } from "./execution-status.js";
 import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
@@ -126,6 +126,19 @@ const dashboardJobDetailSchema = z.object({
 	variantKind: z.string().nullable().optional(),
 	/** Fan-out label for a child: matrix suffix or hostname; null for non-fanned jobs. */
 	variantLabel: z.string().nullable().optional(),
+	/**
+	* Job kind: `standard` runs steps on an agent, `gate` is an invoke gate, and
+	* `proxy` mirrors a summoned source-repo run. Absent/null for a standard job.
+	*
+	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
+	* protected, so an orchestrator that predates invoke gates omits it.
+	*/
+	jobKind: JobKind.nullable().optional(),
+	/**
+	* For a `proxy` job, the summoned source-repo run this job mirrors; the
+	* dashboard links the proxy node through to it. null/absent otherwise.
+	*/
+	summonedRunId: z.string().nullable().optional(),
 	startedAt: z.number().nullable(),
 	completedAt: z.number().nullable(),
 	durationMs: z.number().nullable(),
@@ -138,7 +151,7 @@ const dashboardJobDetailSchema = z.object({
 	* a matching agent or scaler backend appears.
 	*
 	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
-	* protected, so an orchestrator that predates the unroutable probe simply
+	* protected, so an orchestrator that predates the unroutable probe
 	* omits it.
 	*/
 	routingReason: z.string().nullable().optional(),
@@ -157,8 +170,22 @@ const dashboardJobDetailSchema = z.object({
 	skippedContexts: z.array(z.string()).nullable().optional(),
 	/** User-visible warning naming the skipped test-run contexts. null/absent when none. */
 	envWarning: z.string().nullable().optional(),
-	/** Aggregated step outputs (step-keyed map). Present when job completed successfully with outputs. */
-	outputs: z.record(z.string(), z.record(z.string(), z.unknown())).nullable().optional(),
+	/**
+	* A job's non-secret outputs. Present when the job completed successfully with
+	* outputs.
+	*
+	* The value is intentionally `z.record(z.string(), z.unknown())` — the same
+	* loose shape the wire (`job.status.data.outputs`) and `InvokeResult.outputs`
+	* use — because two job kinds populate it with two different shapes:
+	* - a **standard** job carries the agent's step-keyed map
+	*   (`{ <stepName>: { <outputKey>: value } }`), so each value is itself a map;
+	* - a **proxy** job mirrors a summoned run, and a run's outputs are FLAT
+	*   (`{ <outputKey>: value }`, values scalar), matching `InvokeResult.outputs`.
+	*
+	* A stricter step-keyed record type rejected the flat proxy shape and failed
+	* the whole run-detail response, so the schema accepts either.
+	*/
+	outputs: z.record(z.string(), z.unknown()).nullable().optional(),
 	/** Secret output key names produced by this job (values are NOT included -- display masked). */
 	secretOutputKeys: z.array(z.string()).nullable().optional(),
 	/**
@@ -2203,6 +2230,13 @@ const runListItemSchema = z.object({
 	workflowName: z.string(),
 	status: z.string(),
 	repoIdentifier: z.string().nullable(),
+	/**
+	* The repository that DEFINES this run's workflow. Non-null only when it
+	* differs from `repoIdentifier` — i.e. this is an organization-wide global
+	* run, whose workflow file lives in another repo entirely. Optional so a
+	* client parsing a response from an older Platform still validates.
+	*/
+	workflowRepoIdentifier: z.string().nullable().optional(),
 	sha: z.string().nullable(),
 	ref: z.string().nullable(),
 	triggerEvent: z.string().nullable(),
@@ -2403,12 +2437,20 @@ const runEventSchema = z.object({
 	spanId: z.string().nullable(),
 	parentSpanId: z.string().nullable()
 });
-/** Trust policy response (from trust_policies table). */
+/**
+* Trust policy response (from trust_policies table).
+*
+* `approvalExpirySeconds` is the authoritative window and `approvalExpiryHours`
+* its coarse, rounded-up view, so a client reading only the older field still
+* gets a usable number. Both are always sent by this build; the seconds field is
+* optional so a dashboard build reading an older Platform still parses.
+*/
 const trustPolicyResponseSchema = z.object({
 	forkPolicy: z.string(),
 	unknownContributorPolicy: z.string(),
 	workflowChangePolicy: z.string(),
-	approvalExpiryHours: z.number()
+	approvalExpiryHours: z.number(),
+	approvalExpirySeconds: z.number().optional()
 });
 /** Single identity link item. */
 const identityLinkItemSchema = z.object({
@@ -2441,6 +2483,20 @@ const orgMemberSchema = z.object({
 	suspendedAt: z.coerce.string().nullable(),
 	joinedAt: z.coerce.string(),
 	ciTrustLevel: z.string(),
+	/**
+	* The per-member `ci_trust` override, when one is stored, or `null` when the
+	* member's level is entirely role-derived.
+	*
+	* Carried beside `ciTrustLevel` rather than folded into it, because the two
+	* answer different questions. `ciTrustLevel` is the effective level the CI
+	* trust gate decides with — the role-derived level with any override applied
+	* on top — so it cannot say which half produced it. An override OUTRANKS the
+	* roles, so an org that lowered a member by override has no way to see that,
+	* and no way to undo it, from a payload that reports only the result.
+	*
+	* Optional so an older client keeps parsing the response.
+	*/
+	ciTrustOverride: z.string().nullable().optional(),
 	identityLinks: z.array(memberIdentityLinkSchema)
 });
 /** Response for org members list endpoint. */

package/dist/protocol/messages/execution-status.d.ts

@@ -57,6 +57,18 @@ export declare const ExecutionJobStatus: z.ZodEnum<{
     unroutable: "unroutable";
 }>;
 export type ExecutionJobStatus = z.infer<typeof ExecutionJobStatus>;
+/**
+ * Job kind on the wire. `standard` runs steps on an agent; `gate` is an invoke
+ * gate that summons source-repo runs instead of running steps; `proxy` mirrors
+ * one summoned run's lifecycle. The orchestrator's DB `JobKind` enum mirrors
+ * these members.
+ */
+export declare const JobKind: z.ZodEnum<{
+    gate: "gate";
+    proxy: "proxy";
+    standard: "standard";
+}>;
+export type JobKind = z.infer<typeof JobKind>;
 /**
  * The status values a notification subscription may target at the given level.
  *
@@ -174,6 +186,28 @@ export declare const CacheStepType: z.ZodEnum<{
     "cache:save": "cache:save";
 }>;
 export type CacheStepType = z.infer<typeof CacheStepType>;
+/**
+ * `step_type` values for pseudo-steps that run BEFORE a job's real steps.
+ *
+ * A run's step timeline is ordered by `step_index`, and every pseudo-step index
+ * sits ABOVE the real steps (the wire schema requires a non-negative index, and
+ * the in-sandbox allocators claim a high block). That is fine for the cache
+ * pseudo-steps, which mostly bracket the work — but a job's image build runs
+ * strictly first, and rendering it last reads as though it happened last.
+ *
+ * A reader therefore sorts these types ahead of everything else, by TYPE rather
+ * than by index. Keeping the ordering rule here — rather than as a negative
+ * index — is deliberate: `step.status` rejects a negative index outright, so an
+ * agent that sent one to an older orchestrator would have its connection closed
+ * mid-job, and two consumers (the check-run reporter's array write, the
+ * dashboard's `stepIndex >= 0` log gate) treat a negative index as absent.
+ */
+export declare const SetupStepType: z.ZodEnum<{
+    "container:build": "container:build";
+}>;
+export type SetupStepType = z.infer<typeof SetupStepType>;
+/** True when a `step_type` names a pseudo-step that ran before the real steps. */
+export declare function isSetupStepType(stepType: string | null | undefined): boolean;
 /** `run.event` types emitted for user-facing cache operations. */
 export declare const CacheRunEventType: z.ZodEnum<{
     "cache.restore": "cache.restore";
@@ -264,6 +298,8 @@ export declare const executionStatusSchema: z.ZodObject<{
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
+    isGlobalEvalRound: z.ZodOptional<z.ZodBoolean>;
     repoProvider: z.ZodOptional<z.ZodString>;
     localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
@@ -393,6 +429,12 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
         message: z.ZodString;
         jobName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    jobKind: z.ZodOptional<z.ZodEnum<{
+        gate: "gate";
+        proxy: "proxy";
+        standard: "standard";
+    }>>;
+    summonedRunId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 /**
@@ -417,6 +459,7 @@ export declare const stateReplayRunSchema: z.ZodObject<{
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     sha: z.ZodOptional<z.ZodString>;
     ref: z.ZodOptional<z.ZodString>;
     triggerEvent: z.ZodOptional<z.ZodString>;
@@ -468,6 +511,7 @@ export declare const stateReplaySchema: z.ZodObject<{
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;