@kici-dev/orchestrator 0.1.13 → 0.1.14

package/dist/server.js

@@ -3,7 +3,7 @@ import { dirname as __cjs_dirname } from "node:path";
 __cjs_dirname(__cjs_fileURLToPath(import.meta.url));
 import "node:module";
 import { BaseColdStore, RingBuffer, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, encodeKeySegment, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
-import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, ORCH_CAPABILITIES, OrchRole, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOrchestratorMessageSchema, resolveRoleLabels, resolveSecretsForEnvironment, scalerAgentLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stringifyActor, stripScopePrefix, testEventSchema } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, ORCH_CAPABILITIES, OrchRole, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOrchestratorMessageSchema, resolveRoleLabels, resolveSecretsForEnvironment, scalerAgentLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stringifyActor, stripScopePrefix, testEventSchema } from "@kici-dev/engine";
 import { verifySignature } from "@kici-dev/engine/webhook/signature";
 import { X509Certificate, createCipheriv, createDecipheriv, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import os, { cpus, freemem, homedir, hostname, release, tmpdir, totalmem, uptime, userInfo, version } from "node:os";
@@ -49,6 +49,7 @@ import { CopyObjectCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCom
 import { Upload } from "@aws-sdk/lib-storage";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import stripAnsi from "strip-ansi";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { ORCH_PUSHED_METRIC_NAMES } from "@kici-dev/engine/metrics/catalog-policy";
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -3850,7 +3851,11 @@ async function runBuildJob(args) {
 						jobName: buildJobName,
 						runsOnLabels: buildJobInput.runsOnLabels
 					}], setup.info.routingKey, void 0, buildTriggerEvent(event.type, event.action), extractCommitMessage$1(setup.info.event, setup.info.payload), void 0, void 0, void 0, setup.workflowConcurrency);
-					await deps.executionTracker.failRun(runId, reason);
+					await deps.executionTracker.failRun(runId, reason, {
+						scope: "run",
+						category: InitFailureCategory.enum.build_coordination,
+						message: reason
+					});
 				}
 				return;
 			}
@@ -3903,8 +3908,14 @@ async function recordBuildFailure(args) {
 		});
 	}
 	if (deps.executionTracker) try {
-		if (buildJobTrackedEarly) await deps.executionTracker.onBuildFailed(runId);
-		else await deps.executionTracker.onBuildFailedBeforeTracking(runId, workflow.name, setup.info.provider, repoIdentifier, event.targetBranch, ref, setup.effectiveDeliveryId, credentials, setup.info.routingKey, buildTriggerEvent(event.type, event.action), extractCommitMessage$1(setup.info.event, setup.info.payload), toErrorMessage(err));
+		const buildFailureReason = toErrorMessage(err);
+		const buildInitFailure = {
+			scope: "run",
+			category: InitFailureCategory.enum.build_coordination,
+			message: buildFailureReason
+		};
+		if (buildJobTrackedEarly) await deps.executionTracker.onBuildFailed(runId, buildInitFailure);
+		else await deps.executionTracker.onBuildFailedBeforeTracking(runId, workflow.name, setup.info.provider, repoIdentifier, event.targetBranch, ref, setup.effectiveDeliveryId, credentials, setup.info.routingKey, buildTriggerEvent(event.type, event.action), extractCommitMessage$1(setup.info.event, setup.info.payload), buildFailureReason, buildInitFailure);
 	} catch (cleanupErr) {
 		logger$92.warn("Failed to mark run as failed after build error", {
 			runId,
@@ -4114,11 +4125,15 @@ async function resolveWorkflowSecretsAndKey(ctx) {
 	const declaredContexts = workflow.contexts ?? [];
 	if (declaredContexts.length > 0) {
 		if (!deps.secretResolver) {
-			logger$92.error("Workflow declares secret contexts but secrets subsystem is not configured (KICI_SECRET_KEY missing)", {
+			const reason = "Workflow declares secret contexts but secrets subsystem is not configured (KICI_SECRET_KEY missing)";
+			logger$92.error(reason, {
 				workflow: workflow.name,
 				contexts: declaredContexts
 			});
-			return { skipDispatch: true };
+			return {
+				skipDispatch: true,
+				reason
+			};
 		}
 		try {
 			const mergedSecrets = {};
@@ -4133,11 +4148,15 @@ async function resolveWorkflowSecretsAndKey(ctx) {
 				resolvedNamespacedSecrets = mergedNamespaced;
 			}
 		} catch (err) {
+			const errMessage = toErrorMessage(err);
 			logger$92.error("Secret resolution failed, skipping workflow", {
 				workflow: workflow.name,
-				error: toErrorMessage(err)
+				error: errMessage
 			});
-			return { skipDispatch: true };
+			return {
+				skipDispatch: true,
+				reason: `Secret resolution failed: ${errMessage}`
+			};
 		}
 	}
 	let runPublicKeyBase64;
@@ -4215,7 +4234,10 @@ async function resolveWorkflowInstallSecrets(ctx, secrets) {
 			workflow: workflow.name,
 			reason: result.reason
 		});
-		return { skipDispatch: true };
+		return {
+			skipDispatch: true,
+			reason: `Workflow install-secrets resolution rejected dispatch: ${result.reason}`
+		};
 	}
 	if (result.contributorStripped) logger$92.warn("Skipping registries:/installEnv: resolution for untrusted contributor — install will fail naturally if private deps are required", {
 		runId,
@@ -4668,6 +4690,7 @@ async function clusterRouteRootJobs(args) {
 				});
 				rejectedJobs.push({
 					jobId: syntheticId,
+					jobName: jtr.jobName,
 					reason: result.reason
 				});
 			} else if (result.status === "queued-no-backend") logger$92.warn("Job has no matching backend (cluster fallback), skipping", {
@@ -4773,6 +4796,7 @@ async function dispatchSingleOrchPath(args) {
 			});
 			rejectedJobs.push({
 				jobId: syntheticId,
+				jobName: jobOrFactory.name,
 				reason: result.reason
 			});
 		} else if (result.status === "queued-no-backend") logger$92.warn("Job has no matching backend, skipping execution tracking", {
@@ -4877,6 +4901,11 @@ async function recordRunStart(args) {
 		});
 	});
 }
+function categorizeRejectReason(reason) {
+	const lower = reason.toLowerCase();
+	if (/no\s+agent|no\s+matching\s+backend/.test(lower)) return InitFailureCategory.enum.no_agent;
+	return InitFailureCategory.enum.environment_rules;
+}
 async function insertEdgesAndMarkRejected(args) {
 	const { ctx, staticJobs, dispatchedJobs, rejectedJobs } = args;
 	const { deps, runId } = ctx;
@@ -4890,7 +4919,15 @@ async function insertEdgesAndMarkRejected(args) {
 	}
 	if (deps.executionTracker && rejectedJobs.length > 0) {
 		const now = Date.now();
-		for (const { jobId, reason } of rejectedJobs) deps.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, now, void 0, { error: reason }).catch((err) => {
+		for (const { jobId, jobName, reason } of rejectedJobs) deps.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, now, void 0, {
+			error: reason,
+			initFailure: {
+				scope: "job",
+				category: categorizeRejectReason(reason),
+				message: reason,
+				jobName
+			}
+		}).catch((err) => {
 			logger$92.error("Failed to mark rejected job as failed", {
 				runId,
 				jobId,
@@ -5071,17 +5108,30 @@ function startDeferredInitDispatch(args) {
 				lockJob
 			});
 		} catch (err) {
+			const errMsg = toErrorMessage(err);
 			logger$92.error("Deferred init job failed", {
 				runId,
 				workflow: workflow.name,
 				job: lockJob.name,
-				error: toErrorMessage(err)
+				error: errMsg
 			});
-			if (deps.executionTracker) deps.executionTracker.addJobsToRun(runId, [{
-				jobId: `init-failed-${lockJob.name}`,
-				jobName: lockJob.name,
-				runsOnLabels: Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn]
-			}]).catch(() => {});
+			if (deps.executionTracker) {
+				const jobId = `init-failed-${lockJob.name}`;
+				await deps.executionTracker.addJobsToRun(runId, [{
+					jobId,
+					jobName: lockJob.name,
+					runsOnLabels: Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn]
+				}]).catch(() => {});
+				await deps.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, {
+					error: errMsg,
+					initFailure: {
+						scope: "job",
+						category: InitFailureCategory.enum.dynamic_eval,
+						message: errMsg,
+						jobName: lockJob.name
+					}
+				}).catch(() => {});
+			}
 		}
 	})();
 }
@@ -5623,6 +5673,39 @@ async function ensureExecutionRunForDeferred(args) {
 	await deps.executionTracker.onExecutionStarted(runId, workflow.name, setup.info.provider, repoIdentifier, event.targetBranch, ref, setup.effectiveDeliveryId, credentials, summarizeDecision(decision), [], setup.info.routingKey, declaredContexts.length > 0 ? [...declaredContexts] : void 0, buildTriggerEvent(event.type, event.action), extractCommitMessage$1(setup.info.event, setup.info.payload), void 0, void 0, void 0, setup.workflowConcurrency);
 }
 /**
+* Persist a failed `execution_runs` row for a pre-dispatch early-exit so the
+* dashboard's Runs view surfaces secret_resolution / install_secrets /
+* environment_rules rejections instead of leaving the run with zero trace.
+*
+* Called from each of the three early-exit sites in `dispatchMatchedWorkflow`
+* (workflow secrets, install secrets, all-jobs-rejected). The helper is a
+* no-op when no `executionTracker` is wired into deps (test / minimal
+* deployments).
+*/
+async function recordInitFailureFromSkip(args) {
+	const { ctx, setup, category, reason } = args;
+	const { deps, workflow, repoIdentifier, credentials, event, ref, runId } = ctx;
+	if (!deps.executionTracker) return;
+	await deps.executionTracker.recordInitFailureRun({
+		runId,
+		workflowName: workflow.name,
+		provider: setup.info.provider,
+		repoIdentifier,
+		ref: event.sourceBranch ?? event.targetBranch,
+		sha: ref,
+		deliveryId: setup.effectiveDeliveryId,
+		providerContext: credentials ?? {},
+		routingKey: setup.info.routingKey,
+		initFailure: {
+			scope: "run",
+			category,
+			message: reason
+		},
+		triggerEvent: buildTriggerEvent(event.type, event.action),
+		commitMessage: extractCommitMessage$1(setup.info.event, setup.info.payload)
+	});
+}
+/**
 * Dispatch a single matched workflow.
 *
 * Narrative orchestrator: each phase is a typed helper that returns a typed
@@ -5642,9 +5725,26 @@ async function dispatchMatchedWorkflow(ctx) {
 	const buildPrep = await prepareCacheAndBuild(ctx, setup);
 	if (buildPrep.abort) return { dispatchedJobCount: 0 };
 	const secretsResult = await resolveWorkflowSecretsAndKey(ctx);
-	if ("skipDispatch" in secretsResult) return { dispatchedJobCount: 0 };
+	if ("skipDispatch" in secretsResult) {
+		await recordInitFailureFromSkip({
+			ctx,
+			setup,
+			category: InitFailureCategory.enum.secret_resolution,
+			reason: secretsResult.reason
+		});
+		return { dispatchedJobCount: 0 };
+	}
 	const secrets = secretsResult;
-	if ((await resolveWorkflowInstallSecrets(ctx, secrets)).skipDispatch) return { dispatchedJobCount: 0 };
+	const installResult = await resolveWorkflowInstallSecrets(ctx, secrets);
+	if (installResult.skipDispatch) {
+		await recordInitFailureFromSkip({
+			ctx,
+			setup,
+			category: InitFailureCategory.enum.install_secrets,
+			reason: installResult.reason
+		});
+		return { dispatchedJobCount: 0 };
+	}
 	const evalResult = await evaluateJobEnvironments({
 		ctx,
 		setup,
@@ -5691,6 +5791,12 @@ async function dispatchMatchedWorkflow(ctx) {
 		dispatchedJobs,
 		rejectedJobs
 	});
+	if (dispatchedJobs.length === 0 && evalResult.deferredInitJobs.length === 0 && buildPrep.dynamicEntries.length === 0 && rejectedJobs.length > 0) await recordInitFailureFromSkip({
+		ctx,
+		setup,
+		category: InitFailureCategory.enum.environment_rules,
+		reason: rejectedJobs[0].reason
+	});
 	if (evalResult.deferredInitJobs.length > 0) await ensureExecutionRunForDeferred({
 		ctx,
 		setup,
@@ -8078,7 +8184,8 @@ var init_handler = __esmMin((() => {
 				let runRow = await this.db.selectFrom("execution_runs").select([
 					"trust_tier",
 					"lock_file_source",
-					"contributor_username"
+					"contributor_username",
+					"init_failure"
 				]).where("run_id", "=", msg.runId).executeTakeFirst();
 				let jobs = await this.db.selectFrom("execution_jobs").select([
 					"job_id",
@@ -8091,7 +8198,8 @@ var init_handler = __esmMin((() => {
 					"duration_ms",
 					"error_message",
 					"runs_on_labels",
-					"outputs"
+					"outputs",
+					"init_failure"
 				]).where("run_id", "=", msg.runId).orderBy("created_at", "asc").execute();
 				let steps = await this.db.selectFrom("execution_steps").select([
 					"job_id",
@@ -8133,6 +8241,7 @@ var init_handler = __esmMin((() => {
 				}
 				const responseJobs = jobs.map((job) => {
 					const jobSteps = stepsByJob.get(job.job_id) ?? [];
+					const jobInitFailure = job.init_failure ?? void 0;
 					return {
 						jobId: job.job_id,
 						jobName: job.job_name,
@@ -8147,6 +8256,7 @@ var init_handler = __esmMin((() => {
 						runsOnLabels: job.runs_on_labels ?? null,
 						outputs: job.outputs ? typeof job.outputs === "string" ? JSON.parse(job.outputs) : job.outputs : null,
 						secretOutputKeys: secretKeysByJob.get(job.job_id) ?? null,
+						...jobInitFailure && { initFailure: jobInitFailure },
 						steps: jobSteps.map((step) => ({
 							stepIndex: step.step_index,
 							stepName: step.step_name,
@@ -8166,9 +8276,11 @@ var init_handler = __esmMin((() => {
 					lockFileSource: runRow.lock_file_source ?? null,
 					contributorUsername: runRow.contributor_username ?? null
 				} : void 0;
+				const runInitFailure = runRow?.init_failure ?? void 0;
 				const validated = dashboardRunDetailApiResponseSchema.safeParse({
 					jobs: responseJobs,
-					...trustContext && { trustContext }
+					...trustContext && { trustContext },
+					...runInitFailure && { initFailure: runInitFailure }
 				});
 				if (!validated.success) {
 					logger$86.error("Outgoing dashboard.run.detail response validation failed", {
@@ -8195,7 +8307,8 @@ var init_handler = __esmMin((() => {
 					type: "dashboard.run.detail.response",
 					requestId: msg.requestId,
 					jobs: validated.data.jobs,
-					...validated.data.trustContext && { trustContext: validated.data.trustContext }
+					...validated.data.trustContext && { trustContext: validated.data.trustContext },
+					...validated.data.initFailure && { initFailure: validated.data.initFailure }
 				});
 			} catch (err) {
 				logger$86.error("Error handling dashboard.run.detail", {
@@ -9195,7 +9308,8 @@ var init_handler = __esmMin((() => {
 				out.run = {
 					trust_tier: typeof r.trust_tier === "string" ? r.trust_tier : null,
 					lock_file_source: typeof r.lock_file_source === "string" ? r.lock_file_source : null,
-					contributor_username: typeof r.contributor_username === "string" ? r.contributor_username : null
+					contributor_username: typeof r.contributor_username === "string" ? r.contributor_username : null,
+					init_failure: r.init_failure ?? null
 				};
 			}
 			out.jobs = jobRows.map((r) => ({
@@ -9209,7 +9323,8 @@ var init_handler = __esmMin((() => {
 				duration_ms: typeof r.duration_ms === "number" ? r.duration_ms : null,
 				error_message: typeof r.error_message === "string" ? r.error_message : null,
 				runs_on_labels: typeof r.runs_on_labels === "string" ? r.runs_on_labels : null,
-				outputs: typeof r.outputs === "string" ? r.outputs : null
+				outputs: typeof r.outputs === "string" ? r.outputs : null,
+				init_failure: r.init_failure ?? null
 			}));
 			stepRows.sort((a, b) => Number(a.step_index ?? 0) - Number(b.step_index ?? 0));
 			out.steps = stepRows.map((r) => ({
@@ -15175,7 +15290,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$74 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.13";
+	SOFTWARE_VERSION$1 = "0.1.14";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -16641,7 +16756,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$73 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.13";
+	SOFTWARE_VERSION = "0.1.14";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -17904,15 +18019,15 @@ var init_cluster = __esmMin((() => {
 * Uses a 15-minute TTL and 10,000 max entries.
 */
 var contributor_cache_exports = /* @__PURE__ */ __exportAll({ ContributorCache: () => ContributorCache$1 });
-var DEFAULT_TTL_MS$1, DEFAULT_MAX_ENTRIES, ContributorCache$1;
+var DEFAULT_TTL_MS$1, DEFAULT_MAX_ENTRIES$1, ContributorCache$1;
 var init_contributor_cache = __esmMin((() => {
 	DEFAULT_TTL_MS$1 = 900 * 1e3;
-	DEFAULT_MAX_ENTRIES = 1e4;
+	DEFAULT_MAX_ENTRIES$1 = 1e4;
 	ContributorCache$1 = class {
 		cache;
 		constructor(options) {
 			this.cache = new LRUCache({
-				max: options?.maxEntries ?? DEFAULT_MAX_ENTRIES,
+				max: options?.maxEntries ?? DEFAULT_MAX_ENTRIES$1,
 				ttl: options?.ttlMs ?? DEFAULT_TTL_MS$1
 			});
 		}
@@ -27326,10 +27441,10 @@ var init_admin_sources = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/001_initial.ts
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$24,
+	up: () => up$24
 });
-async function up$23(db) {
+async function up$24(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -27351,7 +27466,7 @@ async function up$23(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$23(db) {
+async function down$24(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -28071,8 +28186,8 @@ var init__001_initial = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -28086,13 +28201,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$22(db) {
+async function up$23(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$22(db) {
+async function down$23(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -28102,8 +28217,8 @@ var init__002_config_versions_key_version = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -28127,7 +28242,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$21(db) {
+async function up$22(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -28165,21 +28280,21 @@ async function up$21(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$21(db) {
+async function down$22(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 var init__003_access_log = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$21,
+	up: () => up$21
 });
-async function up$20(db) {
+async function up$21(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$20(db) {
+async function down$21(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
@@ -28187,8 +28302,8 @@ var init__004_rename_bundle_to_source = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Cold-store chunk counter table.
@@ -28205,7 +28320,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$19(db) {
+async function up$20(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -28223,15 +28338,15 @@ async function up$19(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$19(db) {
+async function down$20(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 var init__005_cold_store_chunk_counter = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -28267,7 +28382,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$18(db) {
+async function up$19(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -28312,7 +28427,7 @@ async function up$18(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$18(db) {
+async function down$19(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -28338,8 +28453,8 @@ var init__006_runs_jobs_steps_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -28379,7 +28494,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$17(db) {
+async function up$18(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -28400,7 +28515,7 @@ async function up$17(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$17(db) {
+async function down$18(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -28429,8 +28544,8 @@ var init__007_audit_logs_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -28468,7 +28583,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$16(db) {
+async function up$17(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -28484,7 +28599,7 @@ async function up$16(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$16(db) {
+async function down$17(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -28504,8 +28619,8 @@ var init__008_event_log_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -28518,7 +28633,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$15(db) {
+async function up$16(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -28527,15 +28642,15 @@ async function up$15(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$15(db) {
+async function down$16(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 var init__009_access_log_trigram = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -28567,7 +28682,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$14(db) {
+async function up$15(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -28594,15 +28709,15 @@ async function up$14(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$14(db) {
+async function down$15(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 var init__010_cold_store_chunks = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -28621,11 +28736,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$13(db) {
+async function up$14(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$13(db) {
+async function down$14(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -28665,8 +28780,8 @@ var init__011_drop_source_secrets_notify = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -28692,7 +28807,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$12(db) {
+async function up$13(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -28710,15 +28825,15 @@ async function up$12(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$12(db) {
+async function down$13(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 var init__012_peer_credentials_active_uniq = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -28737,7 +28852,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$11(db) {
+async function up$12(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -28747,7 +28862,7 @@ async function up$11(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$11(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
@@ -28755,8 +28870,8 @@ var init__013_execution_log_bytes = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -28790,7 +28905,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$10(db) {
+async function up$11(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -28821,7 +28936,7 @@ async function up$10(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$10(db) {
+async function down$11(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -28840,8 +28955,8 @@ var init__014_kici_events_lease_retry = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -28869,7 +28984,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$9(db) {
+async function up$10(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -28994,7 +29109,7 @@ async function up$9(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$9(db) {
+async function down$10(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -29020,8 +29135,8 @@ var init__015_org_settings_customer_scoped = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -29034,7 +29149,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$8(db) {
+async function up$9(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -29048,7 +29163,7 @@ async function up$8(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$8(db) {
+async function down$9(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -29057,13 +29172,13 @@ var init__016_org_settings_allow_http_npm = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$8,
+	up: () => up$8
 });
-async function up$7(db) {
+async function up$8(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$7(db) {
+async function down$8(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 var ORG_ID_TABLES$1;
@@ -29082,14 +29197,14 @@ var init__017_org_id_widen = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$7,
+	up: () => up$7
 });
-async function up$6(db) {
+async function up$7(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$6(db) {
+async function down$7(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
@@ -29115,8 +29230,8 @@ var init__018_org_id_prefix_backfill = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -29139,7 +29254,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$5(db) {
+async function up$6(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -29160,7 +29275,7 @@ async function up$5(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$5(db) {
+async function down$6(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
@@ -29168,8 +29283,8 @@ var init__019_generic_sources_change_notify = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -29184,7 +29299,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$4(db) {
+async function up$5(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -29198,7 +29313,7 @@ async function up$4(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$4(db) {
+async function down$5(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -29207,8 +29322,8 @@ var init__020_org_settings_dashboard_write_policy = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -29232,7 +29347,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$3(db) {
+async function up$4(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -29263,15 +29378,15 @@ async function up$3(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$3(db) {
+async function down$4(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 var init__021_check_run_tracking = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -29298,7 +29413,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$2(db) {
+async function up$3(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -29348,7 +29463,7 @@ async function up$2(db) {
     `.execute(db);
 	}
 }
-async function down$2(db) {
+async function down$3(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -29357,8 +29472,8 @@ var init__022_scaler_manager_state = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -29382,7 +29497,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$1(db) {
+async function up$2(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -29407,7 +29522,7 @@ async function up$1(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$1(db) {
+async function down$2(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -29420,8 +29535,8 @@ var init__023_dispatch_queue_recovery_deadline = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -29437,7 +29552,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up(db) {
+async function up$1(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -29453,13 +29568,60 @@ async function up(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down(db) {
+async function down$1(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
 }
 var init__024_dispatch_queue_provisioning_error = __esmMin((() => {}));
 //#endregion
+//#region src/db/migrations/025_init_failure.ts
+var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
+*
+* Presence of this column on a row means the run/job never executed a step
+* because of an init-phase failure; absence (NULL) means a normal run.
+* Shape on the wire is `InitFailure` from `@kici-dev/engine`. The dashboard
+* reads this column directly so it can render the right banner without
+* round-tripping to the orchestrator (which may be offline).
+*
+* Idempotent: re-running on a DB that already has either column is a no-op
+* for that column.
+*/
+async function up(db) {
+	const colExists = async (table, name) => {
+		return (await sql`
+      SELECT EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_schema = 'public'
+           AND table_name = ${table}
+           AND column_name = ${name}
+      ) AS exists
+    `.execute(db)).rows[0]?.exists ?? false;
+	};
+	if (!await colExists("execution_runs", "init_failure")) await sql`
+      ALTER TABLE public.execution_runs
+        ADD COLUMN init_failure JSONB DEFAULT NULL
+    `.execute(db);
+	if (!await colExists("execution_jobs", "init_failure")) await sql`
+      ALTER TABLE public.execution_jobs
+        ADD COLUMN init_failure JSONB DEFAULT NULL
+    `.execute(db);
+}
+async function down(db) {
+	await sql`
+    ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
+  `.execute(db);
+	await sql`
+    ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS init_failure
+  `.execute(db);
+}
+var init__025_init_failure = __esmMin((() => {}));
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -29487,7 +29649,8 @@ function createMigrationProvider() {
 			"021_check_run_tracking": _021_check_run_tracking_exports,
 			"022_scaler_manager_state": _022_scaler_manager_state_exports,
 			"023_dispatch_queue_recovery_deadline": _023_dispatch_queue_recovery_deadline_exports,
-			"024_dispatch_queue_provisioning_error": _024_dispatch_queue_provisioning_error_exports
+			"024_dispatch_queue_provisioning_error": _024_dispatch_queue_provisioning_error_exports,
+			"025_init_failure": _025_init_failure_exports
 		};
 	} };
 }
@@ -29516,6 +29679,7 @@ var init_migration_provider = __esmMin((() => {
 	init__022_scaler_manager_state();
 	init__023_dispatch_queue_recovery_deadline();
 	init__024_dispatch_queue_provisioning_error();
+	init__025_init_failure();
 }));
 //#endregion
 //#region src/db/migrator.ts
@@ -34217,15 +34381,15 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.13",
-			buildDate: "2026-05-28T10:29:07.719Z",
-			buildCommit: "b3ee727cb",
-			sdkVersion: "0.1.13",
+			version: "0.1.14",
+			buildDate: "2026-05-30T03:04:39.672Z",
+			buildCommit: "0fc7a43c9",
+			sdkVersion: "0.1.14",
 			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.13",
-			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
-			engineVersion: "0.1.13",
-			engineBundleHash: "4ab08e63bcb8558b1191c5d3ab8d58b71950b77d911af56c9955ae1d787c4302"
+			sharedVersion: "0.1.14",
+			sharedBundleHash: "5a44862f00d382dbac676c0bdbf9e3fb3016d1c4667b60ea4ae6cbf8ac8deaf4",
+			engineVersion: "0.1.14",
+			engineBundleHash: "8eef210908744b12e19a2b915520298c5dde5abd4a064fa75e87123e237bf932"
 		}),
 		readinessCheck: deps.db ? async () => {
 			const checks = {};
@@ -34259,7 +34423,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.13",
+			orchestratorVersion: "0.1.14",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -34561,6 +34725,61 @@ var init_certs = __esmMin((() => {
 	WARN_DAYS = 30;
 }));
 //#endregion
+//#region src/diagnostics/checks/scaler.ts
+function truncate(s) {
+	return s.length > MAX_DETAIL_LEN ? `${s.slice(0, MAX_DETAIL_LEN - 1)}…` : s;
+}
+async function checkScalerProvisioning(deps) {
+	const start = Date.now();
+	const mgr = deps.scalerManager;
+	const backends = mgr?.getStatus().backends ?? [];
+	if (!mgr || backends.length === 0) return [{
+		name: "scaler",
+		status: "pass",
+		message: "No scaler backends configured",
+		durationMs: Date.now() - start
+	}];
+	const recent = mgr.recentSpawnFailures(SCALER_FAILURE_WINDOW_MS, Date.now());
+	return backends.map((backend) => {
+		const summary = recent.get(backend.name);
+		const durationMs = Date.now() - start;
+		if (!summary || summary.boundCount + summary.unboundCount === 0) return {
+			name: `scaler:${backend.name}`,
+			status: "pass",
+			message: "0 spawn failures in last 5m",
+			details: {
+				windowMs: SCALER_FAILURE_WINDOW_MS,
+				backendType: backend.type,
+				boundCount: 0,
+				unboundCount: 0
+			},
+			durationMs
+		};
+		const total = summary.boundCount + summary.unboundCount;
+		const status = summary.boundCount > 0 ? "fail" : "warn";
+		const message = `${total} spawn failures in last 5m (${summary.boundCount} bound, ${summary.unboundCount} warm-pool; last: ${truncate(summary.lastError)})`;
+		return {
+			name: `scaler:${backend.name}`,
+			status,
+			message,
+			details: {
+				windowMs: SCALER_FAILURE_WINDOW_MS,
+				backendType: summary.backendType,
+				boundCount: summary.boundCount,
+				unboundCount: summary.unboundCount,
+				lastError: summary.lastError,
+				lastAtMs: summary.lastAtMs
+			},
+			durationMs
+		};
+	});
+}
+var SCALER_FAILURE_WINDOW_MS, MAX_DETAIL_LEN;
+var init_scaler$1 = __esmMin((() => {
+	SCALER_FAILURE_WINDOW_MS = 300 * 1e3;
+	MAX_DETAIL_LEN = 120;
+}));
+//#endregion
 //#region src/diagnostics/checks/index.ts
 var defaultChecks;
 var init_checks = __esmMin((() => {
@@ -34570,13 +34789,15 @@ var init_checks = __esmMin((() => {
 	init_disk();
 	init_config$1();
 	init_certs();
+	init_scaler$1();
 	defaultChecks = [
 		checkDbConnectivity,
 		checkWsToPlatform,
 		checkAgentConnectivity,
 		checkDiskSpace,
 		checkConfigValidity,
-		checkCertificateExpiry
+		checkCertificateExpiry,
+		checkScalerProvisioning
 	];
 }));
 //#endregion
@@ -34592,14 +34813,14 @@ var init_checks = __esmMin((() => {
 async function runDiagnostics(deps, checks, options) {
 	const checksToRun = checks ?? defaultChecks;
 	const timeoutMs = options?.timeoutMs ?? 5e3;
-	return (await Promise.allSettled(checksToRun.map((check) => runWithTimeout(check, deps, timeoutMs)))).map((result, index) => {
-		if (result.status === "fulfilled") return result.value;
-		return {
+	return (await Promise.allSettled(checksToRun.map((check) => runWithTimeout(check, deps, timeoutMs)))).flatMap((result, index) => {
+		if (result.status === "fulfilled") return Array.isArray(result.value) ? result.value : [result.value];
+		return [{
 			name: `Check ${index + 1}`,
 			status: "fail",
 			message: `Unexpected error: ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`,
 			durationMs: 0
-		};
+		}];
 	});
 }
 /**
@@ -35696,7 +35917,8 @@ function createApp(deps) {
 		platformUrl: deps.config.platformUrl,
 		agentRegistry: deps.registry,
 		config: deps.config,
-		tlsCertPath: deps.config.tlsCertPath
+		tlsCertPath: deps.config.tlsCertPath,
+		scalerManager: deps.scalerManager
 	}));
 	{
 		const peerHandlerRef = deps.peerHandler;
@@ -38856,6 +39078,55 @@ var init_machine_ledger = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/scaler/failure-tracker.ts
+var DEFAULT_MAX_ENTRIES, ScalerFailureTracker;
+var init_failure_tracker = __esmMin((() => {
+	DEFAULT_MAX_ENTRIES = 256;
+	ScalerFailureTracker = class {
+		records = [];
+		maxEntries;
+		constructor(maxEntries = DEFAULT_MAX_ENTRIES) {
+			this.maxEntries = maxEntries;
+		}
+		/** Record a failure, evicting the oldest entry when over capacity. */
+		record(rec) {
+			this.records.push(rec);
+			if (this.records.length > this.maxEntries) this.records.shift();
+		}
+		/**
+		* Group failures newer than `nowMs - windowMs` by backend instance name.
+		* `nowMs` is injected so callers control the clock (and tests are
+		* deterministic).
+		*/
+		recentByBackend(windowMs, nowMs) {
+			const cutoff = nowMs - windowMs;
+			const out = /* @__PURE__ */ new Map();
+			for (const rec of this.records) {
+				if (rec.timestampMs < cutoff) continue;
+				const existing = out.get(rec.backendName);
+				if (!existing) {
+					out.set(rec.backendName, {
+						backendType: rec.backendType,
+						boundCount: rec.bound ? 1 : 0,
+						unboundCount: rec.bound ? 0 : 1,
+						lastError: rec.detail,
+						lastAtMs: rec.timestampMs
+					});
+					continue;
+				}
+				if (rec.bound) existing.boundCount += 1;
+				else existing.unboundCount += 1;
+				if (rec.timestampMs >= existing.lastAtMs) {
+					existing.lastError = rec.detail;
+					existing.lastAtMs = rec.timestampMs;
+					existing.backendType = rec.backendType;
+				}
+			}
+			return out;
+		}
+	};
+}));
+//#endregion
 //#region src/scaler/manager.ts
 /**
 * ScalerManager: central coordinator for all scaler backends.
@@ -38919,10 +39190,13 @@ var init_manager = __esmMin((() => {
 	init_machine_ledger();
 	init_prometheus();
 	init_types$1();
+	init_failure_tracker();
 	logger$25 = createLogger({ prefix: "scaler" });
 	ScalerManager = class {
 		backends = /* @__PURE__ */ new Map();
 		backendRoles = /* @__PURE__ */ new Map();
+		/** Recent scaler spawn failures, surfaced by `kici-admin diagnose`. */
+		failureTracker = new ScalerFailureTracker();
 		globalMaxAgents;
 		/** Per-scaler resource caps (`{ maxCpu, maxMemoryBytes }`), keyed by scaler name. */
 		resourceCaps = /* @__PURE__ */ new Map();
@@ -39564,6 +39838,13 @@ var init_manager = __esmMin((() => {
 		/**
 		* Return status summary for metrics and health endpoints.
 		*/
+		/**
+		* Recent scaler spawn failures grouped per backend instance, for the
+		* diagnose scaler check. `nowMs` is injected by the caller.
+		*/
+		recentSpawnFailures(windowMs, nowMs) {
+			return this.failureTracker.recentByBackend(windowMs, nowMs);
+		}
 		getStatus() {
 			const backendStatuses = [];
 			const enrichedEntries = this.getEnrichedScalerEntries();
@@ -39850,6 +40131,13 @@ var init_manager = __esmMin((() => {
 					jobId: jobId ?? null,
 					detail: event.detail
 				});
+				this.failureTracker.record({
+					backendName: backendName ?? "unknown",
+					backendType: backend,
+					bound: Boolean(jobId),
+					detail: event.detail ?? "",
+					timestampMs: event.timestampMs
+				});
 			}
 			if (runId && jobId && this.onScalerEvent) this.onScalerEvent(runId, jobId, event);
 			else if (this.onScalerEvent) {
@@ -41605,6 +41893,22 @@ var init_execution_tracker = __esmMin((() => {
 		orgId;
 		jobQueue;
 		runs = /* @__PURE__ */ new Map();
+		/**
+		* Per-run async-mutex chain. `onJobStatus` and `addJobsToRun` mutate the same
+		* `run.jobs` Map / `execution_jobs` row; without serialization a job-status
+		* reply that lands mid synthetic→real swap (`addJobsToRun`) clobbers the swap
+		* and the run hangs in `running` forever (see `withRunLock`). The map value is
+		* the tail of the chain for that runId; entries are GC'd when the last holder
+		* releases.
+		*/
+		runLockTails = /* @__PURE__ */ new Map();
+		/**
+		* Tracks which runIds the current async context already holds in
+		* `withRunLock`, so reentrant calls (e.g. onJobStatus → scheduler hook →
+		* dispatchReadyJob → addJobsToRun, all the same runId) bypass re-acquisition
+		* instead of deadlocking. Propagates across awaits via AsyncLocalStorage.
+		*/
+		heldRunLocks = new AsyncLocalStorage();
 		/** Tracks which runs are test runs for observer broadcasting. */
 		testRunIds = /* @__PURE__ */ new Set();
 		/**
@@ -41759,7 +42063,44 @@ var init_execution_tracker = __esmMin((() => {
 			}
 			return (await this.db.selectFrom("execution_jobs").select("job_id").where("run_id", "=", runId).where("job_name", "=", jobName).where("job_id", "like", `${prefix}%`).executeTakeFirst())?.job_id;
 		}
+		/**
+		* Run `fn` while holding a per-run lock, serializing the run-mutating methods
+		* (`onJobStatus`, `addJobsToRun`) so a status reply cannot interleave with the
+		* synthetic→real job swap and wedge the run in `running`.
+		*
+		* The lock is **reentrant**: three paths re-enter a locked method within the
+		* same async context for the same runId — onJobStatus → scheduler hook →
+		* dispatchReadyJob → addJobsToRun; onJobStatus → enforceSchedulerInvariant →
+		* onJobStatus; runSchedulerHook → onJobStatus (skip). A non-reentrant mutex
+		* would deadlock on these, so a context that already holds the runId's lock
+		* (tracked via `heldRunLocks`) runs `fn` inline. A genuinely concurrent caller
+		* for the same runId (a separate WS message) is a different async context and
+		* correctly waits. All reentrant paths are same-runId, so there is no
+		* cross-run lock-ordering deadlock.
+		*/
+		async withRunLock(runId, fn) {
+			if (this.heldRunLocks.getStore()?.has(runId)) return fn();
+			const prev = this.runLockTails.get(runId) ?? Promise.resolve();
+			let release;
+			const mine = new Promise((resolve) => {
+				release = resolve;
+			});
+			const chained = prev.then(() => mine);
+			this.runLockTails.set(runId, chained);
+			await prev.catch(() => {});
+			const nextHeld = new Set(this.heldRunLocks.getStore() ?? []);
+			nextHeld.add(runId);
+			try {
+				return await this.heldRunLocks.run(nextHeld, fn);
+			} finally {
+				release();
+				if (this.runLockTails.get(runId) === chained) this.runLockTails.delete(runId);
+			}
+		}
 		async addJobsToRun(runId, jobs, dispatchedContexts, replaceSyntheticId) {
+			return this.withRunLock(runId, () => this.addJobsToRunImpl(runId, jobs, dispatchedContexts, replaceSyntheticId));
+		}
+		async addJobsToRunImpl(runId, jobs, dispatchedContexts, replaceSyntheticId) {
 			const run = this.runs.get(runId);
 			if (!run) {
 				logger$21.warn("addJobsToRun: run not found in memory", { runId });
@@ -41854,6 +42195,9 @@ var init_execution_tracker = __esmMin((() => {
 		* fires the onExecutionComplete callback.
 		*/
 		async onJobStatus(runId, jobId, state, timestamp, agentId, data) {
+			return this.withRunLock(runId, () => this.onJobStatusImpl(runId, jobId, state, timestamp, agentId, data));
+		}
+		async onJobStatusImpl(runId, jobId, state, timestamp, agentId, data) {
 			let run = this.runs.get(runId);
 			let job = run?.jobs.get(jobId);
 			if (!run) {
@@ -41974,6 +42318,8 @@ var init_execution_tracker = __esmMin((() => {
 		* run's in-memory map. Returns the freshly-inserted job entry.
 		*/
 		async recoverJobFromDispatchQueue(run, runId, jobId) {
+			const existing = run.jobs.get(jobId);
+			if (existing) return existing;
 			const jobName = (await this.db.selectFrom("dispatch_queue").select(["job_name"]).where("id", "=", jobId).executeTakeFirst())?.job_name ?? jobId;
 			run.jobs.set(jobId, {
 				name: jobName,
@@ -42008,6 +42354,7 @@ var init_execution_tracker = __esmMin((() => {
 					updateValues.duration_ms = timestamp - job.startedAt;
 				}
 				if (data?.error) updateValues.error_message = String(data.error);
+				if (data?.initFailure) updateValues.init_failure = JSON.stringify(data.initFailure);
 				if (data?.outputs) updateValues.outputs = JSON.stringify(data.outputs);
 				jobLogBytesTotal = this.jobLogBytes.get(runId)?.get(jobId) ?? 0;
 				updateValues.log_bytes = jobLogBytesTotal;
@@ -42126,7 +42473,8 @@ var init_execution_tracker = __esmMin((() => {
 			const completedAtMs = isTerminal ? timestamp : void 0;
 			const duration = isTerminal && job.startedAt ? timestamp - job.startedAt : void 0;
 			const errorMsg = isTerminal && data?.error ? String(data.error) : void 0;
-			this.onJobStatusChange?.(runId, jobId, job.name, state, timestamp, startedAtMs, completedAtMs, duration, errorMsg, job.agentId, job.runsOnLabels, jobLogBytesTotal);
+			const initFailure = isTerminal && data?.initFailure ? data.initFailure : void 0;
+			this.onJobStatusChange?.(runId, jobId, job.name, state, timestamp, startedAtMs, completedAtMs, duration, errorMsg, job.agentId, job.runsOnLabels, jobLogBytesTotal, initFailure);
 		}
 		/**
 		* Phase 6: reconcile orphaned steps. If a job reaches terminal state but
@@ -42323,13 +42671,14 @@ var init_execution_tracker = __esmMin((() => {
 		* onExecutionStarted but the build subsequently fails. Without this,
 		* the execution_runs row would stay in a non-terminal state.
 		*/
-		async onBuildFailed(runId) {
+		async onBuildFailed(runId, initFailure) {
 			const now = /* @__PURE__ */ new Date();
-			const failureReason = "Build job failed";
+			const failureReason = initFailure?.message ?? "Build job failed";
 			await this.db.updateTable("execution_runs").set({
 				status: ExecutionRunStatus.enum.failed,
 				completed_at: now,
-				failure_reason: failureReason
+				failure_reason: failureReason,
+				...initFailure && { init_failure: JSON.stringify(initFailure) }
 			}).where("run_id", "=", runId).execute();
 			await this.db.updateTable("execution_jobs").set({
 				status: ExecutionJobStatus.enum.failed,
@@ -42352,7 +42701,7 @@ var init_execution_tracker = __esmMin((() => {
 					parentRunId: run.parentRunId,
 					originalRunId: run.originalRunId,
 					triggeredBy: run.triggeredBy
-				}, run.jobs.size, run.startedAt, completedAt, completedAt - run.startedAt, failureReason);
+				}, run.jobs.size, run.startedAt, completedAt, completedAt - run.startedAt, failureReason, void 0, initFailure);
 				this.runs.delete(runId);
 				this.jobLogBytes.delete(runId);
 			}
@@ -42365,7 +42714,7 @@ var init_execution_tracker = __esmMin((() => {
 		* Inserts a minimal execution_runs row with status='failed' directly so the E2E
 		* test (and dashboard) can observe the failure instead of a missing run.
 		*/
-		async onBuildFailedBeforeTracking(runId, workflowName, provider, repoIdentifier, ref, sha, deliveryId, providerContext, routingKey, triggerEvent, commitMessage, failureReason) {
+		async onBuildFailedBeforeTracking(runId, workflowName, provider, repoIdentifier, ref, sha, deliveryId, providerContext, routingKey, triggerEvent, commitMessage, failureReason, initFailure) {
 			const now = /* @__PURE__ */ new Date();
 			const reason = failureReason ?? "Build job timed out before execution tracking started";
 			await this.db.insertInto("execution_runs").values({
@@ -42382,7 +42731,8 @@ var init_execution_tracker = __esmMin((() => {
 				started_at: now,
 				completed_at: now,
 				status: ExecutionRunStatus.enum.failed,
-				failure_reason: reason
+				failure_reason: reason,
+				...initFailure && { init_failure: JSON.stringify(initFailure) }
 			}).execute();
 			logger$21.info("Created failed execution run (build failed before tracking)", {
 				runId,
@@ -42391,6 +42741,55 @@ var init_execution_tracker = __esmMin((() => {
 			});
 		}
 		/**
+		* Insert a `failed` execution_runs row directly for an init failure that
+		* occurred BEFORE onExecutionStarted ran (so no in-memory state exists
+		* and no jobs were dispatched). Also writes the structured init_failure
+		* signal and fires onExecutionStatusChange so Platform's projection picks
+		* it up via the normal forward path. Idempotent: if a row already exists
+		* for this runId, the insert is a no-op (ON CONFLICT DO NOTHING).
+		*
+		* Closes the silent pre-run-failure gap — without this helper, secret /
+		* install-secret / all-jobs-rejected early-exits in dispatch-matched-workflow
+		* leave no trace on the dashboard.
+		*/
+		async recordInitFailureRun(args) {
+			const now = /* @__PURE__ */ new Date();
+			await this.db.insertInto("execution_runs").values({
+				run_id: args.runId,
+				routing_key: args.routingKey,
+				workflow_name: args.workflowName,
+				provider: args.provider,
+				repo_identifier: args.repoIdentifier,
+				ref: args.ref,
+				sha: args.sha,
+				delivery_id: args.deliveryId,
+				trigger_decision: null,
+				provider_context: JSON.stringify(args.providerContext),
+				started_at: now,
+				completed_at: now,
+				status: ExecutionRunStatus.enum.failed,
+				failure_reason: args.initFailure.message,
+				init_failure: JSON.stringify(args.initFailure)
+			}).onConflict((oc) => oc.column("run_id").doNothing()).execute();
+			executionsTotal.add(1, { status: ExecutionRunStatus.enum.failed });
+			this.onExecutionStatusChange?.(args.runId, ExecutionRunStatus.enum.failed, {
+				workflowName: args.workflowName,
+				provider: args.provider,
+				repoIdentifier: args.repoIdentifier,
+				sha: args.sha,
+				routingKey: args.routingKey,
+				ref: args.ref,
+				triggerEvent: args.triggerEvent,
+				commitMessage: args.commitMessage
+			}, 0, now.getTime(), now.getTime(), 0, args.initFailure.message, 0, args.initFailure);
+			logger$21.info("Recorded init-failure execution run", {
+				runId: args.runId,
+				workflowName: args.workflowName,
+				category: args.initFailure.category,
+				scope: args.initFailure.scope
+			});
+		}
+		/**
 		* Mark a run as failed immediately with a reason message.
 		*
 		* Used when no agents are available to dispatch any jobs (e.g. cron-triggered
@@ -42398,7 +42797,7 @@ var init_execution_tracker = __esmMin((() => {
 		* Instead of leaving the run in 'running' for OrphanRecovery to catch after 5 min,
 		* this fails it right away.
 		*/
-		async failRun(runId, reason) {
+		async failRun(runId, reason, initFailure) {
 			const now = /* @__PURE__ */ new Date();
 			const run = this.runs.get(runId);
 			const durationMs = run ? now.getTime() - run.startedAt : 0;
@@ -42406,7 +42805,8 @@ var init_execution_tracker = __esmMin((() => {
 				status: ExecutionRunStatus.enum.failed,
 				completed_at: now,
 				duration_ms: durationMs,
-				failure_reason: reason
+				failure_reason: reason,
+				...initFailure && { init_failure: JSON.stringify(initFailure) }
 			}).where("run_id", "=", runId).execute();
 			await this.db.updateTable("execution_jobs").set({
 				status: ExecutionJobStatus.enum.failed,
@@ -42430,7 +42830,7 @@ var init_execution_tracker = __esmMin((() => {
 					parentRunId: run.parentRunId,
 					originalRunId: run.originalRunId,
 					triggeredBy: run.triggeredBy
-				}, run.jobs.size, run.startedAt, completedAt, completedAt - run.startedAt, reason);
+				}, run.jobs.size, run.startedAt, completedAt, completedAt - run.startedAt, reason, void 0, initFailure);
 				this.runs.delete(runId);
 				this.jobLogBytes.delete(runId);
 			}
@@ -50549,14 +50949,14 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.13";
-	WORKER_BUILD_COMMIT = "b3ee727cb";
-	WORKER_SDK_VERSION = "0.1.13";
+	ORCHESTRATOR_VERSION$1 = "0.1.14";
+	WORKER_BUILD_COMMIT = "0fc7a43c9";
+	WORKER_SDK_VERSION = "0.1.14";
 	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.13";
-	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-	WORKER_ENGINE_VERSION = "0.1.13";
-	WORKER_ENGINE_BUNDLE_HASH = "4ab08e63bcb8558b1191c5d3ab8d58b71950b77d911af56c9955ae1d787c4302";
+	WORKER_SHARED_VERSION = "0.1.14";
+	WORKER_SHARED_BUNDLE_HASH = "5a44862f00d382dbac676c0bdbf9e3fb3016d1c4667b60ea4ae6cbf8ac8deaf4";
+	WORKER_ENGINE_VERSION = "0.1.14";
+	WORKER_ENGINE_BUNDLE_HASH = "8eef210908744b12e19a2b915520298c5dde5abd4a064fa75e87123e237bf932";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -50577,14 +50977,14 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown in reverse order:
 * Platform client -> agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.13";
-const BUILD_COMMIT = "b3ee727cb";
-const SDK_VERSION = "0.1.13";
+const ORCHESTRATOR_VERSION = "0.1.14";
+const BUILD_COMMIT = "0fc7a43c9";
+const SDK_VERSION = "0.1.14";
 const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.13";
-const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-const ENGINE_VERSION = "0.1.13";
-const ENGINE_BUNDLE_HASH = "4ab08e63bcb8558b1191c5d3ab8d58b71950b77d911af56c9955ae1d787c4302";
+const SHARED_VERSION = "0.1.14";
+const SHARED_BUNDLE_HASH = "5a44862f00d382dbac676c0bdbf9e3fb3016d1c4667b60ea4ae6cbf8ac8deaf4";
+const ENGINE_VERSION = "0.1.14";
+const ENGINE_BUNDLE_HASH = "8eef210908744b12e19a2b915520298c5dde5abd4a064fa75e87123e237bf932";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
@@ -50662,7 +51062,7 @@ await guardStartup(logger$1, async () => {
 	await bootstrapOrchestrator(config, {
 		logPrefix: "server",
 		executionTrackerExtras: () => ({
-			onExecutionStatusChange: (runId, status, context, jobCount, startedAt, completedAt, durationMs, failureReason, logBytes) => {
+			onExecutionStatusChange: (runId, status, context, jobCount, startedAt, completedAt, durationMs, failureReason, logBytes, initFailure) => {
 				try {
 					platformClient.send({
 						type: "execution.status",
@@ -50684,7 +51084,8 @@ await guardStartup(logger$1, async () => {
 						...completedAt !== void 0 && { completedAt },
 						...durationMs !== void 0 && { durationMs },
 						...failureReason !== void 0 && { failureReason },
-						...logBytes !== void 0 && { logBytes }
+						...logBytes !== void 0 && { logBytes },
+						...initFailure && { initFailure }
 					});
 				} catch (err) {
 					logger$1.warn("Failed to forward execution status to Platform", {
@@ -50694,7 +51095,7 @@ await guardStartup(logger$1, async () => {
 					});
 				}
 			},
-			onJobStatusChange: (runId, jobId, jobName, status, timestamp, startedAt, completedAt, durationMs, errorMessage, agentId, runsOnLabels, logBytes) => {
+			onJobStatusChange: (runId, jobId, jobName, status, timestamp, startedAt, completedAt, durationMs, errorMessage, agentId, runsOnLabels, logBytes, initFailure) => {
 				try {
 					platformClient.send({
 						type: "job.status.forward",
@@ -50711,6 +51112,7 @@ await guardStartup(logger$1, async () => {
 						...logBytes !== void 0 && { logBytes },
 						...agentId && { agentId },
 						...runsOnLabels?.length && { runsOnLabels },
+						...initFailure && { initFailure },
 						orchestratorId: config.instanceId
 					});
 				} catch (err) {