@kici-dev/orchestrator 0.1.16 → 0.1.18

package/dist/cluster/coordinator.d.ts

@@ -10,7 +10,7 @@
  * - "Peers report step-by-step progress back to coordinator"
  * - "Cancel mode: graceful -- finish current step, cancel remaining"
  */
-import type { JobReroute, JobProgress, PeerScalerEvent, PeerToPeerMessage, ResourceRequest } from '@kici-dev/engine';
+import type { JobReroute, JobProgress, PeerScalerEvent, PeerToPeerMessage, ResourceRequest, LabelMatcher } from '@kici-dev/engine';
 import type { PeerRegistry } from './peer-registry.js';
 import type { PeerClient } from './peer-client.js';
 import type { Dispatcher } from '../agent/dispatcher.js';
@@ -37,6 +37,10 @@ export interface RunContext {
 export interface JobToRoute {
     jobName: string;
     runsOnLabels: string[][];
+    /** Regex matchers the agent's labels must satisfy (JS post-filter). */
+    runsOnPatterns?: LabelMatcher[];
+    /** Regex matchers that disqualify an agent (JS post-filter). */
+    excludePatterns?: LabelMatcher[];
     jobConfig: Record<string, unknown>;
     repoUrl: string;
     ref: string;

package/dist/config/schema.d.ts

@@ -69,6 +69,8 @@ export declare const sharedConfigSchema: z.ZodObject<{
         none: "none";
     }>>;
     agentTokenTtlMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    rosterGraceMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    rosterTtlMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     queue: z.ZodOptional<z.ZodObject<{
         maxDepth: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
         timeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -156,6 +158,8 @@ export declare const appConfigSchema: z.ZodObject<{
         none: "none";
     }>>;
     agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rosterGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rosterTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     queueMaxDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     queueTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     queueBackpressureThreshold: z.ZodDefault<z.ZodCoercedNumber<unknown>>;

package/dist/config/types.d.ts

@@ -50,6 +50,9 @@ export interface SharedConfig {
     };
     agentAuth?: 'token' | 'none';
     agentTokenTtlMs?: number;
+    rosterGraceMs?: number;
+    rosterTtlMs?: number;
+    maxFanoutHosts?: number;
     queue?: {
         maxDepth?: number;
         timeoutMs?: number;
@@ -135,6 +138,12 @@ export interface AppConfig {
     agentAuth: 'token' | 'none';
     /** Agent token TTL in milliseconds */
     agentTokenTtlMs: number;
+    /** Host roster: static grace before a disconnected static host reads unreachable (ms) */
+    rosterGraceMs: number;
+    /** Host roster: ephemeral GC ttl — past this a disconnected ephemeral host is reaped (ms) */
+    rosterTtlMs: number;
+    /** Cap on per-host children produced by a runsOnAll fan-out */
+    maxFanoutHosts: number;
     /** Queue settings */
     queueMaxDepth: number;
     queueTimeoutMs: number;

package/dist/config.d.ts

@@ -82,6 +82,9 @@ declare const configSchema: z.ZodObject<{
         none: "none";
     }>>;
     agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rosterGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rosterTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    maxFanoutHosts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     eventRouterMaxChainDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     eventRouterRateLimitPerWorkflowPerMinute: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     eventRouterEventTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -105,8 +108,6 @@ declare const configSchema: z.ZodObject<{
         production: "production";
         test: "test";
     }>>;
-    internalProviderRepoPath: z.ZodOptional<z.ZodString>;
-    internalProviderCloneUrl: z.ZodOptional<z.ZodString>;
     autoMigrate: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     agentMaxReconnectDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     skipS3SentinelValidation: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
@@ -199,6 +200,9 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     pgCustomerSecrets: boolean;
     agentAuth: "token" | "none";
     agentTokenTtlMs: number;
+    rosterGraceMs: number;
+    rosterTtlMs: number;
+    maxFanoutHosts: number;
     eventRouterMaxChainDepth: number;
     eventRouterRateLimitPerWorkflowPerMinute: number;
     eventRouterEventTtlSeconds: number;
@@ -262,8 +266,6 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     secretKeyFileOld?: string | undefined;
     bootstrapAdminToken?: string | undefined;
     testEventFailFirstN?: string | undefined;
-    internalProviderRepoPath?: string | undefined;
-    internalProviderCloneUrl?: string | undefined;
     otelExporterOtlpEndpoint?: string | undefined;
     clusterName?: string | undefined;
 }>;

package/dist/dashboard/handler.d.ts

@@ -13,14 +13,24 @@
  */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
-import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest } from '@kici-dev/engine';
+import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest } from '@kici-dev/engine';
 import type { Database } from '../db/types.js';
 import type { LogStorage } from '../reporting/log-storage.js';
+import type { CacheStorage } from '../storage/types.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { EventStore } from '../events/event-store.js';
 interface DashboardHandlerDeps {
     db: Kysely<Database>;
     logStorage: LogStorage;
+    /**
+     * Object-storage backend for provenance bundles. The attestations handler
+     * reads each stored bundle by `storage_key` and inlines it into the response
+     * so the dashboard verifies it client-side without a second fetch. Optional —
+     * when absent (e.g. orchestrators without provenance configured) the handler
+     * replies with an `error` and an empty list. Reuses the cache storage backend
+     * (the same one P1.5 writes bundles to).
+     */
+    provenanceStorage?: CacheStorage | null;
     /** Send a response message back to Platform over the WS connection. */
     send: (msg: unknown) => void;
     /** This orchestrator's instance ID, included in job detail responses. */
@@ -78,6 +88,7 @@ interface DashboardHandlerDeps {
 export declare class DashboardHandler {
     private readonly db;
     private readonly logStorage;
+    private readonly provenanceStorage;
     private readonly send;
     private readonly orchestratorId;
     private readonly accessLog;
@@ -222,7 +233,7 @@ export declare class DashboardHandler {
      *
      * `triggerTypes` is populated from `execution_runs.provider` — the
      * orchestrator has no dedicated trigger-event column, so `provider`
-     * (`github` / `generic` / `internal`) is the closest available
+     * (`github` / `generic` / `local`) is the closest available
      * discriminator the customer filter can offer.
      *
      * Attribution uses the handler-bound `orgId` / `routingKey` directly — the
@@ -251,6 +262,19 @@ export declare class DashboardHandler {
      * Looks up the step's log_path and reads content from LogStorage.
      */
     handleStepLogs(msg: DashboardStepLogsRequest): Promise<void>;
+    /**
+     * Read the attestation rows for a run, joined to `execution_jobs` for the
+     * job name. Ordered oldest-first so the dashboard table is stable.
+     */
+    private resolveAttestationsForRun;
+    /**
+     * Handle a dashboard.attestations.list request: list the run's provenance
+     * attestations, inlining each stored bundle from object storage so the
+     * dashboard verifies it client-side. Mirrors `handleStepLogs` (per-run org
+     * resolution + `recordAccess` + `send`). Rows whose bundle can't be read are
+     * skipped (best-effort) rather than failing the whole list.
+     */
+    handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
     /**
      * Handle a dashboard.payload request.
      * Reads the webhook payload from log storage for the given runId.

package/dist/dashboard/needs-edges.d.ts

@@ -0,0 +1,13 @@
+import { IfFailedPolicy } from '@kici-dev/engine';
+/** A single resolved upstream dependency edge for a job. */
+export interface JobNeedEdge {
+    upstreamName: string;
+    ifFailed: IfFailedPolicy;
+}
+/** Group raw execution_job_needs rows by downstream job_name. */
+export declare function groupNeedsByJobName(rows: ReadonlyArray<{
+    job_name: string;
+    upstream_name: string;
+    if_failed: string;
+}>): Map<string, JobNeedEdge[]>;
+//# sourceMappingURL=needs-edges.d.ts.map

package/dist/db/migrations/035_pending_workflow_contexts.d.ts

@@ -0,0 +1,11 @@
+import { type Kysely } from 'kysely';
+/**
+ * Pending workflow dispatch context — backs resume of a workflow whose install
+ * gate held. One row per held run: the serializable dispatch inputs needed to
+ * rebuild the WorkflowDispatchContext when the hold releases (reviewer approve,
+ * wait-timer expiry, concurrency slot free). The row is deleted once the resume
+ * dispatch has been kicked off.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=035_pending_workflow_contexts.d.ts.map

package/dist/db/migrations/036_attestations.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `attestations` table for build-provenance bundles.
+ *
+ * When a workflow step calls `ctx.attestProvenance`, the agent uploads the
+ * signed KiCI bundle to object storage under
+ * `provenance/{run_id}/{job_id}/{subject_digest}.kici.json` and the
+ * orchestrator records one row here so the dashboard can list and fetch
+ * attestations per run/job.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=036_attestations.d.ts.map

package/dist/db/migrations/037_generic_sources_provider_type_local.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
+ * permits `'local'` instead of `'internal'`, and migrate any carried-over
+ * `'internal'` rows to `'local'`.
+ *
+ * The local filesystem (`file://`) provider is `provider_type='local'`; the
+ * value used to be `'internal'`. The original CHECK constraint
+ * (`generic_webhook_sources_provider_type_check`) allowed only
+ * `{'generic','internal'}`, so writing a `'local'` row fails. Universal-git
+ * sources keep `provider_type='generic'` (discriminated by `git_config`), so
+ * the new allowed set is `{'generic','local'}`.
+ *
+ * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
+ * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=037_generic_sources_provider_type_local.d.ts.map

package/dist/db/migrations/038_remote_sources.d.ts

@@ -0,0 +1,14 @@
+import { type Kysely } from 'kysely';
+/**
+ * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
+ * org. One row per org served by this orchestrator: routing key
+ * `remote:<orgId>` maps to the canonical org id, so `resolveOrgId` resolves
+ * the real tenant through the same local-source path a webhook takes — no
+ * GitHub App, no webhook secret, no manual setup. The row is auto-provisioned
+ * on Platform auth from the canonical org id carried on `auth.success`.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=038_remote_sources.d.ts.map

package/dist/db/migrations/039_host_roster.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * `host_roster` is KiCI's declared inventory: one durable row per agent the
+ * cluster has ever enrolled, reconciled from the in-memory AgentRegistry on
+ * every register/unregister. `lifecycle_class` (snapshot of the auth token's
+ * agent_type) drives reaping — `ephemeral` rows are GC'd past their TTL,
+ * `static` rows persist and read as `unreachable` when their heartbeat goes
+ * stale. `connected_instance_id` records which orchestrator holds the live WS
+ * (cluster liveness + the host-fanout reroute target); NULL = disconnected.
+ *
+ * The roster lives in the shared cluster DB (one table, all instances). Status
+ * is derived at read from the shared `last_seen` + `connected_instance_id`, so
+ * every instance agrees regardless of which one holds the agent's live WS.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=039_host_roster.d.ts.map

package/dist/db/migrations/040_runsonall_pin.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=040_runsonall_pin.d.ts.map

package/dist/db/migrations/041_wave_gated.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=041_wave_gated.d.ts.map

package/dist/db/migrations/042_dispatch_queue_patterns.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=042_dispatch_queue_patterns.d.ts.map

package/dist/db/types.d.ts

@@ -39,6 +39,7 @@ export interface Database {
     org_settings: OrgSettingsTable;
     execution_job_needs: ExecutionJobNeedsTable;
     pending_job_contexts: PendingJobContextsTable;
+    pending_workflow_contexts: PendingWorkflowContextsTable;
     event_log: EventLogTable;
     access_log: AccessLogTable;
     cold_store_chunk_counts: ColdStoreChunkCountsTable;
@@ -47,6 +48,9 @@ export interface Database {
     scaler_spawning_agents: ScalerSpawningAgentsTable;
     scaler_agent_jobs: ScalerAgentJobsTable;
     scaler_reservations: ScalerReservationsTable;
+    attestations: AttestationsTable;
+    remote_sources: RemoteSourcesTable;
+    host_roster: HostRosterTable;
 }
 /**
  * Cluster metadata table
@@ -135,6 +139,10 @@ export interface DispatchQueueTable {
     request_id: string | null;
     /** JSONB array of exclusion labels. Default '[]'. */
     exclude_labels: Generated<string>;
+    /** Regex matchers (LabelMatcher[]) the job requires; JS post-filter on top of runs_on_labels. Default '[]'. */
+    runs_on_patterns: Generated<string>;
+    /** Regex matchers (LabelMatcher[]) that disqualify an agent; JS post-filter. Default '[]'. */
+    exclude_patterns: Generated<string>;
     /** Routing key (e.g. "github:12345") so dispatch can pick the right
      *  per-app provider bundle in multi-app setups. Required (NOT NULL). */
     routing_key: string;
@@ -170,6 +178,12 @@ export interface DispatchQueueTable {
     ack_deadline: ColumnType<Date | null, Date | null | undefined, Date | null>;
     /** Agent the dispatch was sent to (for ack-timeout disconnect + logging). */
     ack_agent_id: ColumnType<string | null, string | null | undefined, string | null>;
+    /**
+     * For a runsOnAll host-fanout child: the agent this job is pinned to. The
+     * dispatcher routes it only to that agent and the queue drain never hands it
+     * to another. NULL for normal label-routed jobs.
+     */
+    pinned_agent_id: ColumnType<string | null, string | null | undefined, string | null>;
 }
 /**
  * Deduplication cache table
@@ -351,6 +365,23 @@ export interface ExecutionJobTable {
     ready_at: Date | null;
     /** Dynamic group membership tag (NULL for static jobs). */
     group_name: string | null;
+    /** Base (logical) job name for a fan-out child. NULL for non-fanned jobs. */
+    base_job_name: string | null;
+    /** Fan-out kind for a child: 'matrix' | 'host'. NULL for non-fanned jobs. */
+    variant_kind: string | null;
+    /** Fan-out label for a child: matrix suffix or hostname. NULL for non-fanned jobs. */
+    variant_label: string | null;
+    /**
+     * Wave gate: a fan-out child beyond the job's `maxParallel` window is held
+     * (`true`) instead of dispatched. Cleared by the wave-scheduler when a sibling
+     * reaches terminal and an in-flight slot frees up. NULL/false for any job not
+     * held by a rolling wave.
+     */
+    wave_gated: Generated<boolean>;
+    /** The fan-out base's `maxParallel` wave width, stamped on every child. NULL = no bounded wave. */
+    wave_max_parallel: number | null;
+    /** The fan-out base's `failFast` policy, stamped on every child. NULL = no bounded wave. */
+    wave_fail_fast: boolean | null;
     /** When this record was created */
     created_at: Generated<Date>;
     /**
@@ -925,15 +956,17 @@ export interface GenericWebhookSourceTable {
     deleted_at: Date | null;
     /** Provider implementation to route this source through.
      *  'generic' (default) → GenericWebhookNormalizer (Stripe-shaped payloads).
-     *  'internal' → InternalWebhookNormalizer (github-shaped push/PR payloads
-     *  for E2E tests and the staging smoke test). */
+     *  'local' → LocalWebhookNormalizer (github-shaped push/PR payloads for a
+     *  git repository present on the agent filesystem, cloned via file://). */
     provider_type: Generated<string>;
-    /** Universal-git config (JSONB) for sources that also know how to build
-     *  clone URLs, fetch lock files, and issue clone credentials against a
-     *  user-supplied git server (Forgejo / Gitea / Gogs / GitLab repo-webhook /
-     *  plain GitHub repo-webhook). null for legacy generic / internal sources
-     *  that don't drive git operations. Shape validated by
-     *  `UniversalGitConfigSchema` at the application layer. */
+    /** Git config (JSONB), dual-purpose discriminated by `provider_type`:
+     *  - universal-git sources ('generic' with git_config) store a
+     *    `UniversalGitConfig` (clone URLs, lock-file fetch, clone credentials
+     *    against Forgejo / Gitea / Gogs / GitLab repo-webhook / GitHub repo).
+     *  - local sources ('local') store a `LocalSourceConfig`
+     *    (`{ repoBasePath, cloneUrlBase? }`).
+     *  null for plain generic sources that don't drive git operations. Shape
+     *  validated by the matching Zod schema at the application layer. */
     git_config: ColumnType<string | Record<string, unknown> | null, string | null, string | null>;
 }
 export type GenericWebhookSource = Selectable<GenericWebhookSourceTable>;
@@ -1271,6 +1304,24 @@ export interface PendingJobContextsTable {
 }
 export type PendingJobContextRow = Selectable<PendingJobContextsTable>;
 export type NewPendingJobContext = Insertable<PendingJobContextsTable>;
+/**
+ * Pending workflow dispatch contexts table.
+ * Persists the serializable WorkflowDispatchContext inputs needed to resume a
+ * workflow whose install gate held. One row per held run (keyed by run_id).
+ * Created at hold time, deleted once the resume dispatch is kicked off.
+ */
+export interface PendingWorkflowContextsTable {
+    /** Run identifier (one pending dispatch per run) */
+    run_id: string;
+    /** Organization id */
+    org_id: string;
+    /** Serializable WorkflowDispatchContext inputs as JSONB */
+    context: ColumnType<Record<string, unknown>, string, string>;
+    /** When this context was stored */
+    created_at: Generated<Date>;
+}
+export type PendingWorkflowContextRow = Selectable<PendingWorkflowContextsTable>;
+export type NewPendingWorkflowContext = Insertable<PendingWorkflowContextsTable>;
 /**
  * Inbound webhook delivery event log table.
  * One row per inbound webhook delivery (relay or direct), regardless of
@@ -1289,7 +1340,7 @@ export interface EventLogTable {
     org_id: string;
     /** Provider delivery ID (unique within org) */
     delivery_id: string;
-    /** Routing key (e.g. "github:42", "generic:<org>:<src>", "internal:...") */
+    /** Routing key (e.g. "github:42", "generic:<org>:<src>") */
     routing_key: string;
     /** Provider event name (X-GitHub-Event / X-Event-Type / 'default') */
     event: string;
@@ -1297,7 +1348,7 @@ export interface EventLogTable {
     action: string | null;
     /** Where the delivery arrived: 'relay' (Platform WS) or 'direct' (HTTP) */
     source: string;
-    /** Provider type ('github' / 'generic' / 'internal') */
+    /** Provider type ('github' / 'generic' / 'local') */
     provider: string;
     /** owner/repo when extractable */
     repo_identifier: string | null;
@@ -1456,6 +1507,89 @@ export interface CheckRunTrackingTable {
 export type CheckRunTrackingRow = Selectable<CheckRunTrackingTable>;
 export type NewCheckRunTrackingRow = Insertable<CheckRunTrackingTable>;
 export type CheckRunTrackingUpdate = Updateable<CheckRunTrackingTable>;
+/**
+ * Build-provenance attestation table.
+ *
+ * One row per `ctx.attestProvenance` bundle uploaded to object storage. The
+ * dashboard lists/fetches attestations by `(run_id, job_id)`.
+ */
+export interface AttestationsTable {
+    /** Random id (primary key). */
+    id: string;
+    /** KiCI run this attestation belongs to. */
+    run_id: string;
+    /** KiCI job this attestation was produced by. */
+    job_id: string;
+    /** Caller-supplied artifact name (e.g. an npm package coordinate). */
+    subject_name: string;
+    /** Primary subject digest (lowercase hex) used in the storage key. */
+    subject_digest: string;
+    /** Object-storage key the bundle was written to. */
+    storage_key: string;
+    /** Signing mode ('kici' for Mode A). */
+    mode: string;
+    /** Bundle media type. */
+    media_type: string;
+    /** When this row was inserted. */
+    created_at: Generated<Date>;
+}
+export type AttestationRow = Selectable<AttestationsTable>;
+export type NewAttestationRow = Insertable<AttestationsTable>;
+/**
+ * Remote-source table (remote_sources).
+ *
+ * Anchors a Platform-relayed `kici run remote` to its real org: routing key
+ * `remote:<orgId>` maps to the canonical org id so `resolveOrgId` resolves the
+ * real tenant through the same local-source path a webhook takes. One row per
+ * org served by this orchestrator, auto-provisioned on Platform auth.
+ */
+export interface RemoteSourcesTable {
+    /** Canonical org id (`org_<…>`) this anchor resolves to. */
+    customer_id: string;
+    /** Deterministic routing key `remote:<orgId>`. */
+    routing_key: string;
+    /** Cluster id this orchestrator deployment reports, or null. */
+    cluster_id: string | null;
+    /** When this row was first provisioned. */
+    created_at: Generated<Date>;
+    /** When this row was last upserted. */
+    updated_at: Generated<Date>;
+}
+export type RemoteSourceRow = Selectable<RemoteSourcesTable>;
+export type NewRemoteSourceRow = Insertable<RemoteSourcesTable>;
+/**
+ * Host roster table (host_roster).
+ *
+ * KiCI's declared inventory: one durable row per agent the cluster has ever
+ * enrolled, reconciled from the in-memory AgentRegistry on register/unregister.
+ * `lifecycle_class` (snapshot of the auth token's `agent_type`) drives reaping;
+ * `connected_instance_id` records which orchestrator holds the live WS (cluster
+ * liveness + the host-fanout reroute target), null when disconnected. Status is
+ * derived at read from the shared `last_seen` + `connected_instance_id`.
+ */
+export interface HostRosterTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** The agent identity the pin targets; unique. */
+    agent_id: string;
+    /** FK to agent_tokens.id (provenance), or null when auth mode is none. */
+    token_id: string | null;
+    /** Snapshot of the token's agent_type: 'static' | 'ephemeral'. */
+    lifecycle_class: string;
+    /** JSON-encoded string[] of the post-Gate-1 validated labels. */
+    labels: string;
+    hostname: string | null;
+    platform: string | null;
+    arch: string | null;
+    /** Which orchestrator instance holds the live WS; null = disconnected. */
+    connected_instance_id: string | null;
+    last_seen: ColumnType<Date, Date | string | undefined, Date | string>;
+    created_at: Generated<Date>;
+    updated_at: ColumnType<Date, Date | string | undefined, Date | string>;
+}
+export type HostRosterRow = Selectable<HostRosterTable>;
+export type NewHostRosterRow = Insertable<HostRosterTable>;
+export type HostRosterUpdate = Updateable<HostRosterTable>;
 /**
  * Scaler spawning-agents table (scaler_spawning_agents).
  *

package/dist/diagnostics/fleet-collector.d.ts

@@ -12,9 +12,9 @@ import { z } from 'zod';
 /** Per-node collection outcome recorded in the fleet manifest. */
 export declare const FleetNodeStatus: z.ZodEnum<{
     error: "error";
+    unreachable: "unreachable";
     ok: "ok";
     timeout: "timeout";
-    unreachable: "unreachable";
 }>;
 export type FleetNodeStatus = z.infer<typeof FleetNodeStatus>;
 export interface FleetCollectorDeps {

package/dist/entry-helpers.d.ts

@@ -5,14 +5,13 @@
  * Both entry points import these helpers instead of maintaining separate copies.
  */
 import { type SourceProvider, SourceSubtype } from '@kici-dev/engine';
-import { ProviderRegistry } from './provider-registry.js';
 /**
  * A provider source for Platform registration.
  *
  * `provider` is the coarse-grained Platform-routing family (`github` /
  * `gitlab` / `bitbucket` / `generic`). `subtype` is the fine-grained
  * source kind that survives all the way to the dashboard so universal-git,
- * generic_webhook, and internal sources stay distinguishable. `name` is
+ * generic_webhook, and local sources stay distinguishable. `name` is
  * the human-readable label shown in the runs view + sources tab.
  */
 export interface ProviderSource {
@@ -50,24 +49,6 @@ export declare function diffProviderSources(oldSources: ProviderSource[], newSou
     added: ProviderSource[];
     removed: ProviderSource[];
 };
-/**
- * Register the internal provider bundle for E2E testing when the
- * `internalProviderRepoPath` config field (KICI_INTERNAL_PROVIDER_REPO_PATH)
- * is set.
- *
- * When the field is present, this overwrites the previously-registered
- * `generic:default` bundle with one that has a lockFileFetcher and
- * repoUrlBuilder (needed for the webhook pipeline to match triggers and
- * dispatch jobs).
- *
- * When the field is not set, does nothing (leaves `generic:default` as-is).
- *
- * @returns true if the internal provider was registered, false otherwise
- */
-export declare function registerInternalProviderIfConfigured(registry: ProviderRegistry, config: {
-    internalProviderRepoPath?: string;
-    internalProviderCloneUrl?: string;
-}): boolean;
 /**
  * Decide whether the local orchestrator can serve a `generic_webhook_sources`
  * row with the given `provider_type`. Used at boot (and any future reload) to
@@ -79,15 +60,12 @@ export declare function registerInternalProviderIfConfigured(registry: ProviderR
  * - `'generic'` / `'universal-git'` → always servable (the bundles register
  *   without filesystem dependencies; per-row failures during universal-git
  *   bundle registration are already isolated in orchestrator-core.ts).
- * - `'internal'` → only servable when `internalProviderRepoPath` is set, the
- *   path exists on disk, and is a directory. This mirrors the fail-fast
- *   guard in `registerInternalProviderIfConfigured`. The check is binary
- *   per peer: a single `KICI_INTERNAL_PROVIDER_REPO_PATH` backs every
- *   internal source on that peer (per-source `repoIdentifier`s nest under
- *   the same base dir).
+ * - `'local'` → only servable when the ROW's own `git_config.repoBasePath`
+ *   exists as a directory on THIS peer. The check is per-source and per-peer:
+ *   a local repo present on one HA peer may be absent on another, so only the
+ *   peer that hosts the repo advertises the routing key. Mirrors the statSync
+ *   gate in `registerProviderBundleForSource`.
  * - Any unknown provider_type returns false to fail closed.
  */
-export declare function canServeGenericProviderType(providerType: string, config: {
-    internalProviderRepoPath?: string;
-}): boolean;
+export declare function canServeGenericProviderType(providerType: string, gitConfig?: string | Record<string, unknown> | null): boolean;
 //# sourceMappingURL=entry-helpers.d.ts.map

package/dist/environments/held-runs.d.ts

@@ -45,6 +45,12 @@ export interface CreateHoldData {
     environmentId?: string | null;
     /** Queue type: 'environment' (default) or 'security'. */
     queueType?: 'environment' | 'security';
+    /**
+     * Held-run `hold_type` discriminator. Defaults to `'approval'` (reviewer
+     * holds). The workflow install gate sets `'wait_timer'` / `'concurrency'` so
+     * the automated release sweeps can find their rows.
+     */
+    holdType?: string;
 }
 /** A single decision to record against a hold. */
 export interface RecordDecisionData {
@@ -65,6 +71,15 @@ export interface ReleaseSignal {
     scope: HoldScope;
     /** Set only for step-scoped holds. */
     stepIndex: number | null;
+    /**
+     * What kind of gate created the hold. `explicit` (SDK `requireApproval`) holds
+     * a real root job and resumes by re-dispatching it; `environment` covers the
+     * workflow install-gate (wait-timer / concurrency / env approval) which resumes
+     * by rebuilding the workflow dispatch context. The resume router keys off this
+     * so a workflow-scoped explicit hold goes through the job re-dispatch path
+     * rather than the install-gate path (which has no pending workflow context).
+     */
+    triggerSource: TriggerSource;
 }
 /** Options for listing held runs. */
 export interface ListHeldRunsOptions {
@@ -121,6 +136,24 @@ export declare class HeldRunStore {
      * holds notify the waiting agent; job/workflow holds fail the run).
      */
     listOverdue(): Promise<HeldRun[]>;
+    /**
+     * Release overdue workflow `wait_timer` holds. The install-gate wait action
+     * pauses the workflow as a held run; on timer expiry it must RESUME (not
+     * fail like a reviewer-hold expiry). Flips each overdue pending
+     * `hold_type='wait_timer'`, `hold_scope='workflow'` row to `released` and
+     * returns a `ReleaseSignal` per row so the caller can resume the workflow.
+     * Runs BEFORE `expireOverdue()` so these rows leave the pending pool before
+     * the expire-and-fail sweep sees them.
+     */
+    releaseDueWaitHolds(): Promise<ReleaseSignal[]>;
+    /**
+     * Release the oldest pending workflow `concurrency` hold for a group. Called
+     * when a concurrency slot frees on run completion. Flips the oldest matching
+     * pending row to `released` and returns its `ReleaseSignal`, or null when no
+     * concurrency hold is queued for the group. `group` matches the held row's
+     * `environment_id` (workflow-level install concurrency keys on the env id).
+     */
+    releaseConcurrencyHold(orgId: string, group: string): Promise<ReleaseSignal | null>;
     /**
      * Expire overdue pending runs. Called by the stale detector.
      * Sets status to 'expired' and resolved_at to now() for all

package/dist/index.js

@@ -991,6 +991,7 @@ const DEFAULT_EXPIRY_DAYS = 90;
 * Used by the coordinator to manage credentials for all cluster members.
 */
 var PeerCredentialStore = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}