@kici-dev/orchestrator 0.1.22 → 0.1.24

package/dist/cli.js

@@ -2,27 +2,32 @@
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import * as path$1 from "node:path";
-import path, { join, resolve } from "node:path";
+import path, { dirname, join, resolve } from "node:path";
 import * as fs$1 from "node:fs";
 import fs, { chmodSync, closeSync, createReadStream, createWriteStream, existsSync, mkdtempSync, openSync, promises, readFileSync, realpathSync, statSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
 import { Command } from "commander";
-import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
-import crypto, { createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import crypto, { createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { createInterface } from "node:readline";
+import { KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, attestationVerifyStatusSchema, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
 import { access, chmod, constants, copyFile, link, mkdir, open, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { parse, stringify } from "yaml";
 import { z } from "zod";
-import os, { platform, tmpdir } from "node:os";
+import os, { hostname, platform, tmpdir } from "node:os";
 import { getDatabaseCollationDrift, refreshDatabaseCollationVersion, reindexDatabaseConcurrently } from "@kici-dev/shared/db-collation";
 import { sql } from "kysely";
 import { Migrator } from "kysely/migration";
 import "jsonpath-plus";
 import { exec, execFile, execFileSync, execSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
 import { Octokit } from "@octokit/rest";
 import { createAppAuth } from "@octokit/auth-app";
 import http, { createServer } from "node:http";
+import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
+import { CopyObjectCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand } from "@aws-sdk/client-s3";
+import { Upload } from "@aws-sdk/lib-storage";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { verifyKiciBundle } from "@kici-dev/engine/provenance/verify";
 import { ZipArchive } from "archiver";
 import { confirm, input, password, select } from "@inquirer/prompts";
 import JSZip from "jszip";
@@ -370,6 +375,15 @@ var AdminApiClient = class {
 		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs${qs}`);
 	}
 	/**
+	* Fetch the machine-first, provenance-tagged structured run result: typed
+	* job DAG, per-step exit codes / durations / statuses, derived failure
+	* category. Untrusted fields are envelope-tagged; secret values are never
+	* returned (only secret-output key names).
+	*/
+	async getRunStructured(runId) {
+		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/structured`);
+	}
+	/**
 	* Fetch the scrub status of the run's ephemeral key. Never returns the
 	* key material itself — only `{ exists, createdAt }`.
 	*/
@@ -797,13 +811,22 @@ function formatAgentTokenTable(tokens) {
 }
 function registerAgentCommands(program, getClient) {
 	const agent = program.command("agent").description("Manage agent authentication tokens");
-	agent.command("register").description("Create a static agent token").option("--labels <labels>", "Comma-separated agent labels (e.g. linux,x64)").action(async (opts) => {
+	agent.command("register").description("Create a static agent token").option("--labels <labels>", "Comma-separated agent labels (e.g. linux,x64)").option("--mandatory-label <label>", "Taint label the agent only accepts jobs demanding (repeatable). Also authorized as an advertised label.", (val, acc) => [...acc, val.trim()], []).option("--privileged-root", `Shorthand for --mandatory-label ${PRIVILEGED_ROOT_LABEL}: mint a confined root agent token (the agent must run as uid 0).`).action(async (opts) => {
 		try {
-			const labels = opts.labels ? opts.labels.split(",").map((l) => l.trim()) : void 0;
-			const result = await getClient().createAgentToken({ labels });
+			const mandatorySet = new Set(opts.mandatoryLabel);
+			if (opts.privilegedRoot) mandatorySet.add(PRIVILEGED_ROOT_LABEL);
+			const mandatoryLabels = mandatorySet.size > 0 ? [...mandatorySet] : void 0;
+			const baseLabels = opts.labels ? opts.labels.split(",").map((l) => l.trim()) : [];
+			const labelSet = new Set([...baseLabels, ...mandatoryLabels ?? []]);
+			const labels = labelSet.size > 0 ? [...labelSet] : void 0;
+			const result = await getClient().createAgentToken({
+				labels,
+				mandatoryLabels
+			});
 			console.log(`Agent token created successfully.`);
 			console.log(`Token ID: ${result.id}`);
 			console.log(`Token:    ${result.token}`);
+			if (mandatoryLabels) console.log(`Taint:    ${mandatoryLabels.join(", ")} (agent only accepts jobs demanding these)`);
 			console.log("");
 			console.log("WARNING: Save this token now -- it cannot be recovered after this point.");
 			console.log("Set KICI_AGENT_TOKEN on the agent to use this token.");
@@ -1556,8 +1579,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2249,7 +2272,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$49(db) {
+async function up$59(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2271,7 +2294,7 @@ async function up$49(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$49(db) {
+async function down$59(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2318,8 +2341,8 @@ async function down$49(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2333,13 +2356,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$48(db) {
+async function up$58(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$48(db) {
+async function down$58(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2348,8 +2371,8 @@ async function down$48(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2373,7 +2396,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$47(db) {
+async function up$57(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2411,28 +2434,28 @@ async function up$47(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$47(db) {
+async function down$57(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$56,
+	up: () => up$56
 });
-async function up$46(db) {
+async function up$56(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$46(db) {
+async function down$56(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Cold-store chunk counter table.
@@ -2449,7 +2472,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$45(db) {
+async function up$55(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2467,14 +2490,14 @@ async function up$45(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$45(db) {
+async function down$55(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2510,7 +2533,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$44(db) {
+async function up$54(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2555,7 +2578,7 @@ async function up$44(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$44(db) {
+async function down$54(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2580,8 +2603,8 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2621,7 +2644,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$43(db) {
+async function up$53(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2642,7 +2665,7 @@ async function up$43(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$43(db) {
+async function down$53(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2670,8 +2693,8 @@ async function down$43(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2709,7 +2732,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$42(db) {
+async function up$52(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2725,7 +2748,7 @@ async function up$42(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$42(db) {
+async function down$52(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2744,8 +2767,8 @@ async function down$42(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2758,7 +2781,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$41(db) {
+async function up$51(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2767,14 +2790,14 @@ async function up$41(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$41(db) {
+async function down$51(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2806,7 +2829,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$40(db) {
+async function up$50(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2833,14 +2856,14 @@ async function up$40(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$40(db) {
+async function down$50(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2859,11 +2882,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$39(db) {
+async function up$49(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$39(db) {
+async function down$49(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2902,8 +2925,8 @@ async function down$39(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2929,7 +2952,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$38(db) {
+async function up$48(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2947,14 +2970,14 @@ async function up$38(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$38(db) {
+async function down$48(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2973,7 +2996,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$37(db) {
+async function up$47(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -2983,15 +3006,15 @@ async function up$37(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$37(db) {
+async function down$47(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3025,7 +3048,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$36(db) {
+async function up$46(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3056,7 +3079,7 @@ async function up$36(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$36(db) {
+async function down$46(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3074,8 +3097,8 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3103,7 +3126,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$35(db) {
+async function up$45(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3228,7 +3251,7 @@ async function up$35(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$35(db) {
+async function down$45(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3253,8 +3276,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3267,7 +3290,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$34(db) {
+async function up$44(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3281,7 +3304,7 @@ async function up$34(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$34(db) {
+async function down$44(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3289,8 +3312,8 @@ async function down$34(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3330,17 +3353,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$33(db) {
+async function up$43(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$33(db) {
+async function down$43(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3385,19 +3408,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$32(db) {
+async function up$42(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$32(db) {
+async function down$42(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3420,7 +3443,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$31(db) {
+async function up$41(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3441,15 +3464,15 @@ async function up$31(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$31(db) {
+async function down$41(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3464,7 +3487,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$30(db) {
+async function up$40(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3478,7 +3501,7 @@ async function up$30(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$30(db) {
+async function down$40(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3486,8 +3509,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3511,7 +3534,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$29(db) {
+async function up$39(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3542,14 +3565,14 @@ async function up$29(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$29(db) {
+async function down$39(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3576,7 +3599,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$28(db) {
+async function up$38(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3626,7 +3649,7 @@ async function up$28(db) {
     `.execute(db);
 	}
 }
-async function down$28(db) {
+async function down$38(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3634,8 +3657,8 @@ async function down$28(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3659,7 +3682,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$27(db) {
+async function up$37(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3684,7 +3707,7 @@ async function up$27(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$27(db) {
+async function down$37(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3696,8 +3719,8 @@ async function down$27(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3713,7 +3736,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$26(db) {
+async function up$36(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3729,7 +3752,7 @@ async function up$26(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$26(db) {
+async function down$36(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3737,8 +3760,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -3752,7 +3775,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$25(db) {
+async function up$35(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3772,7 +3795,7 @@ async function up$25(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$25(db) {
+async function down$35(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3783,8 +3806,8 @@ async function down$25(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3793,7 +3816,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$24(db) {
+async function up$34(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3803,7 +3826,7 @@ async function up$24(db) {
     ])))
   `.execute(db);
 }
-async function down$24(db) {
+async function down$34(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3816,8 +3839,8 @@ async function down$24(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -3835,13 +3858,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$23(db) {
+async function up$33(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$23(db) {
+async function down$33(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3849,8 +3872,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3879,7 +3902,7 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$22(db) {
+async function up$32(db) {
 	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -3889,7 +3912,7 @@ async function up$22(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$22(db) {
+async function down$32(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3900,8 +3923,8 @@ async function down$22(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -3915,7 +3938,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$21(db) {
+async function up$31(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3928,7 +3951,7 @@ async function up$21(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$21(db) {
+async function down$31(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -3936,8 +3959,8 @@ async function down$21(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -3948,14 +3971,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$20(db) {
+async function up$30(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$20(db) {
+async function down$30(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -3965,8 +3988,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -3983,7 +4006,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$19(db) {
+async function up$29(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4008,7 +4031,7 @@ async function up$19(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$19(db) {
+async function down$29(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4016,8 +4039,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4029,7 +4052,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$18(db) {
+async function up$28(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4043,7 +4066,7 @@ async function up$18(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$18(db) {
+async function down$28(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4051,8 +4074,8 @@ async function down$18(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -4069,7 +4092,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$17(db) {
+async function up$27(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4089,7 +4112,7 @@ async function up$17(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$17(db) {
+async function down$27(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4100,8 +4123,8 @@ async function down$17(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -4123,7 +4146,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$16(db) {
+async function up$26(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4156,7 +4179,7 @@ async function up$16(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$16(db) {
+async function down$26(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4166,8 +4189,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -4176,7 +4199,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$15(db) {
+async function up$25(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4186,14 +4209,14 @@ async function up$15(db) {
     )
   `.execute(db);
 }
-async function down$15(db) {
+async function down$25(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4206,7 +4229,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$14(db) {
+async function up$24(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4232,15 +4255,15 @@ async function up$14(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$14(db) {
+async function down$24(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
-});
+	down: () => down$23,
+	up: () => up$23
+});
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
 * permits `'local'` instead of `'internal'`, and migrate any carried-over
@@ -4256,7 +4279,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$13(db) {
+async function up$23(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4272,7 +4295,7 @@ async function up$13(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$13(db) {
+async function down$23(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4291,8 +4314,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -4304,7 +4327,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$12(db) {
+async function up$22(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4323,14 +4346,14 @@ async function up$12(db) {
     )
   `.execute(db);
 }
-async function down$12(db) {
+async function down$22(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4347,7 +4370,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$11(db) {
+async function up$21(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4377,14 +4400,14 @@ async function up$11(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$11(db) {
+async function down$21(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4401,7 +4424,7 @@ var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has any column is a no-op.
 */
-async function colExists$5(db, table, name) {
+async function colExists$9(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4411,18 +4434,18 @@ async function colExists$5(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$10(db) {
-	if (!await colExists$5(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
-	if (!await colExists$5(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
-	if (!await colExists$5(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
-	if (!await colExists$5(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
+async function up$20(db) {
+	if (!await colExists$9(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
+	if (!await colExists$9(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
+	if (!await colExists$9(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
+	if (!await colExists$9(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_pinned_agent
       ON public.dispatch_queue (pinned_agent_id)
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$10(db) {
+async function down$20(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4432,8 +4455,8 @@ async function down$10(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -4453,7 +4476,7 @@ var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$4(db, table, name) {
+async function colExists$8(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4463,16 +4486,16 @@ async function colExists$4(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$9(db) {
-	if (!await colExists$4(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
-	if (!await colExists$4(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
-	if (!await colExists$4(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
+async function up$19(db) {
+	if (!await colExists$8(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
+	if (!await colExists$8(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
+	if (!await colExists$8(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$9(db) {
+async function down$19(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -4481,8 +4504,8 @@ async function down$9(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -4498,7 +4521,7 @@ var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$3(db, table, name) {
+async function colExists$7(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4508,19 +4531,19 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$8(db) {
-	if (!await colExists$3(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
-	if (!await colExists$3(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+async function up$18(db) {
+	if (!await colExists$7(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	if (!await colExists$7(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$8(db) {
+async function down$18(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -4531,7 +4554,7 @@ var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function colExists$2(db, table, name) {
+async function colExists$6(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4541,17 +4564,17 @@ async function colExists$2(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$7(db) {
-	if (!await colExists$2(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
+async function up$17(db) {
+	if (!await colExists$6(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$7(db) {
+async function down$17(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add idempotent check-mode columns:
@@ -4568,7 +4591,7 @@ var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
 * All nullable. Idempotent: re-running on a DB that already has the columns is
 * a no-op.
 */
-async function colExists$1(db, table, name) {
+async function colExists$5(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4578,13 +4601,13 @@ async function colExists$1(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$6(db) {
-	if (!await colExists$1(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
-	if (!await colExists$1(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
-	if (!await colExists$1(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
-	if (!await colExists$1(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
+async function up$16(db) {
+	if (!await colExists$5(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
+	if (!await colExists$5(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
+	if (!await colExists$5(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
+	if (!await colExists$5(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$6(db) {
+async function down$16(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -4593,8 +4616,8 @@ async function down$6(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -4608,18 +4631,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$5(db) {
+async function up$15(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$5(db) {
+async function down$15(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -4634,18 +4657,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up$4(db) {
+async function up$14(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$4(db) {
+async function down$14(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -4670,7 +4693,7 @@ const ALL_TERMINAL_JSON = JSON.stringify([
 	"drift_dropped"
 ]);
 const SUCCESS_ONLY_JSON = JSON.stringify(["success"]);
-async function colExists(db, table, name) {
+async function colExists$4(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4681,12 +4704,12 @@ async function colExists(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$3(db) {
-	if (!await colExists(db, "execution_job_needs", "run_on")) await sql`
+async function up$13(db) {
+	if (!await colExists$4(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
     `.execute(db);
-	if (await colExists(db, "execution_job_needs", "if_failed")) {
+	if (await colExists$4(db, "execution_job_needs", "if_failed")) {
 		await sql`
       UPDATE public.execution_job_needs
          SET run_on = ${ALL_TERMINAL_JSON}
@@ -4700,12 +4723,12 @@ async function up$3(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$3(db) {
-	if (!await colExists(db, "execution_job_needs", "if_failed")) await sql`
+async function down$13(db) {
+	if (!await colExists$4(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
     `.execute(db);
-	if (await colExists(db, "execution_job_needs", "run_on")) {
+	if (await colExists$4(db, "execution_job_needs", "run_on")) {
 		await sql`
       UPDATE public.execution_job_needs
          SET if_failed = CASE WHEN run_on = ${SUCCESS_ONLY_JSON} THEN 'skip' ELSE 'run' END
@@ -4716,8 +4739,8 @@ async function down$3(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -4734,18 +4757,18 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$2(db) {
+async function up$12(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$2(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -4757,18 +4780,18 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$1(db) {
+async function up$11(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$1(db) {
+async function down$11(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -4783,141 +4806,491 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up(db) {
+async function up$10(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down(db) {
+async function down$10(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
-//#region src/db/migration-provider.ts
-function createMigrationProvider() {
-	return { async getMigrations() {
-		return {
-			"001_initial": _001_initial_exports,
-			"002_config_versions_key_version": _002_config_versions_key_version_exports,
-			"003_access_log": _003_access_log_exports,
-			"004_rename_bundle_to_source": _004_rename_bundle_to_source_exports,
-			"005_cold_store_chunk_counter": _005_cold_store_chunk_counter_exports,
-			"006_runs_jobs_steps_archived_at": _006_runs_jobs_steps_archived_at_exports,
-			"007_audit_logs_archived_at": _007_audit_logs_archived_at_exports,
-			"008_event_log_archived_at": _008_event_log_archived_at_exports,
-			"009_access_log_trigram": _009_access_log_trigram_exports,
-			"010_cold_store_chunks": _010_cold_store_chunks_exports,
-			"011_drop_source_secrets_notify": _011_drop_source_secrets_notify_exports,
-			"012_peer_credentials_active_uniq": _012_peer_credentials_active_uniq_exports,
-			"013_execution_log_bytes": _013_execution_log_bytes_exports,
-			"014_kici_events_lease_retry": _014_kici_events_lease_retry_exports,
-			"015_org_settings_customer_scoped": _015_org_settings_customer_scoped_exports,
-			"016_org_settings_allow_http_npm": _016_org_settings_allow_http_npm_exports,
-			"017_org_id_widen": _017_org_id_widen_exports,
-			"018_org_id_prefix_backfill": _018_org_id_prefix_backfill_exports,
-			"019_generic_sources_change_notify": _019_generic_sources_change_notify_exports,
-			"020_org_settings_dashboard_write_policy": _020_org_settings_dashboard_write_policy_exports,
-			"021_check_run_tracking": _021_check_run_tracking_exports,
-			"022_scaler_manager_state": _022_scaler_manager_state_exports,
-			"023_dispatch_queue_recovery_deadline": _023_dispatch_queue_recovery_deadline_exports,
-			"024_dispatch_queue_provisioning_error": _024_dispatch_queue_provisioning_error_exports,
-			"025_init_failure": _025_init_failure_exports,
-			"026_event_log_lockfile_corrupt": _026_event_log_lockfile_corrupt_exports,
-			"027_workflow_timeout": _027_workflow_timeout_exports,
-			"028_org_settings_user_cache": _028_org_settings_user_cache_exports,
-			"029_dispatch_queue_attempts": _029_dispatch_queue_attempts_exports,
-			"030_held_runs_env_set_null": _030_held_runs_env_set_null_exports,
-			"031_dispatch_queue_ack_deadline": _031_dispatch_queue_ack_deadline_exports,
-			"032_org_settings_dispatch_ack_timeout": _032_org_settings_dispatch_ack_timeout_exports,
-			"033_org_settings_approval": _033_org_settings_approval_exports,
-			"034_held_runs_generalize": _034_held_runs_generalize_exports,
-			"035_pending_workflow_contexts": _035_pending_workflow_contexts_exports,
-			"036_attestations": _036_attestations_exports,
-			"037_generic_sources_provider_type_local": _037_generic_sources_provider_type_local_exports,
-			"038_remote_sources": _038_remote_sources_exports,
-			"039_host_roster": _039_host_roster_exports,
-			"040_runsonall_pin": _040_runsonall_pin_exports,
-			"041_wave_gated": _041_wave_gated_exports,
-			"042_dispatch_queue_patterns": _042_dispatch_queue_patterns_exports,
-			"043_rerouted_to_peer": _043_rerouted_to_peer_exports,
-			"044_check_mode": _044_check_mode_exports,
-			"045_host_properties": _045_host_properties_exports,
-			"046_join_token_consumed_by_instance": _046_join_token_consumed_by_instance_exports,
-			"047_needs_run_on": _047_needs_run_on_exports,
-			"048_host_reboot_pending": _048_host_reboot_pending_exports,
-			"049_held_runs_payload": _049_held_runs_payload_exports,
-			"050_sources_slug": _050_sources_slug_exports
-		};
-	} };
+//#region src/db/migrations/051_binding_host_pattern.ts
+var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$9,
+	up: () => up$9
+});
+/**
+* Add a per-host dimension to environment secret bindings:
+*
+* - `environment_bindings.host_pattern text NOT NULL DEFAULT '**'` — the host
+*   selector a binding applies to (exact / glob / regex, matched against a
+*   fan-out child's agentId / hostname / labels). `'**'` matches every host, so
+*   existing rows are backfilled to `'**'` and keep their fleet-wide behaviour.
+* - The binding unique key widens from `(environment_id, scope_pattern)` to
+*   `(environment_id, scope_pattern, host_pattern)` so the same scope can carry
+*   distinct per-host selectors.
+*
+* Idempotent: re-running on a DB that already has the column / index is a no-op.
+* Additive — staging data is preserved.
+*/
+async function up$9(db) {
+	await sql`ALTER TABLE public.environment_bindings
+    ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings
+    DROP CONSTRAINT IF EXISTS environment_bindings_env_id_scope_unique`.execute(db);
+	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
+    ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
+}
+async function down$9(db) {
+	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings
+    DROP COLUMN IF EXISTS host_pattern`.execute(db);
+	await sql`ALTER TABLE public.environment_bindings
+    ADD CONSTRAINT environment_bindings_env_id_scope_unique UNIQUE (environment_id, scope_pattern)`.execute(db);
 }
 //#endregion
-//#region src/db/migrator.ts
+//#region src/db/migrations/052_host_reach_metadata.ts
+var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$8,
+	up: () => up$8
+});
 /**
-* Auto-migrate module with PostgreSQL advisory lock for HA safety.
+* Add pre-agent reach metadata to the host roster so a declared host (no agent
+* yet) can be reached over SSH for bootstrap bring-up:
 *
-* Uses pg_advisory_lock to ensure only one orchestrator instance runs
-* migrations at a time, preventing conflicts in multi-instance deployments.
+* - `host_roster.address text NULL` — IP / hostname to SSH to.
+* - `host_roster.ssh_user text NULL` — SSH login user (defaults to `root` at use site).
+* - `host_roster.ssh_port int NULL` — SSH port (defaults to 22 at use site).
+* - `host_roster.ssh_key_secret text NULL` — scoped-secret ref (`scope/key`)
+*   holding the bring-up private key. The orchestrator resolves it server-side;
+*   the key never lives in the roster.
+*
+* All nullable: a host with no reach metadata simply cannot be bootstrapped and
+* behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
+* so staging data is preserved.
 */
-const logger$10 = createLogger({ prefix: "migrate" });
-const ADVISORY_LOCK_KEY = 543210001;
+async function up$8(db) {
+	await sql`ALTER TABLE public.host_roster
+    ADD COLUMN IF NOT EXISTS address text,
+    ADD COLUMN IF NOT EXISTS ssh_user text,
+    ADD COLUMN IF NOT EXISTS ssh_port integer,
+    ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
+}
+async function down$8(db) {
+	await sql`ALTER TABLE public.host_roster
+    DROP COLUMN IF EXISTS address,
+    DROP COLUMN IF EXISTS ssh_user,
+    DROP COLUMN IF EXISTS ssh_port,
+    DROP COLUMN IF EXISTS ssh_key_secret`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/053_agent_token_single_use.ts
+var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$7,
+	up: () => up$7
+});
 /**
-* Run all pending migrations with an advisory lock for concurrency safety.
+* Add a single-use marker to agent tokens for the bootstrap (init-runner)
+* bring-up flow:
 *
-* Acquires pg_advisory_lock before migrating to prevent concurrent
-* migration attempts from multiple orchestrator instances. The lock
-* is always released in the finally block, even on error.
+* - `agent_tokens.consumed_at timestamptz NULL` — set the first time a
+*   single-use bootstrap token is consumed (at `agent.register`). A second
+*   register with the same token is rejected. NULL = never consumed (the
+*   default for every existing static / ephemeral token, which stay reusable
+*   until expiry).
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
 */
-async function runMigrations(opts) {
-	const client = await opts.pool.connect();
-	try {
-		logger$10.info("Acquiring migration lock...");
-		await client.query("SELECT pg_advisory_lock($1)", [ADVISORY_LOCK_KEY]);
-		logger$10.info("Migration lock acquired");
-		const migrator = new Migrator({
-			db: opts.db,
-			provider: createMigrationProvider()
-		});
-		const start = Date.now();
-		const { results, error } = await migrator.migrateToLatest();
-		for (const result of results ?? []) if (result.status === "Success") logger$10.info(`${result.migrationName} ... OK (${Date.now() - start}ms)`);
-		else if (result.status === "Error") logger$10.error(`${result.migrationName} ... FAILED`);
-		if (error) throw error;
-		const applied = (results ?? []).filter((r) => r.status === "Success");
-		if (applied.length === 0) logger$10.info("Database schema is up to date");
-		else logger$10.info(`Applied ${applied.length} migration(s)`);
-		const hash = await computeMigrationsHash(createMigrationProvider());
-		await storeMigrationContentHash(opts.pool, hash);
-		return results ?? [];
-	} finally {
-		await client.query("SELECT pg_advisory_unlock($1)", [ADVISORY_LOCK_KEY]);
-		client.release();
-	}
+async function up$7(db) {
+	await sql`ALTER TABLE public.agent_tokens
+    ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
+}
+async function down$7(db) {
+	await sql`ALTER TABLE public.agent_tokens
+    DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
 //#endregion
-//#region src/cli/commands/db.ts
+//#region src/db/migrations/054_local_working_tree.ts
+var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
 /**
-* Database management commands for kici-admin.
+* Mark runs that executed an uploaded local working tree (`kici run remote`):
 *
-*   db migrate                    Run pending migrations (HTTP — orchestrator must be up)
-*   db fresh                      DROP + CREATE + migrate + store content hash (direct DB)
-*   db ensure <name>              CREATE DATABASE IF NOT EXISTS (direct DB)
-*   db create-role                CREATE ROLE LOGIN [CREATEDB] (direct DB)
-*   db create-readonly-user       Read-only role + GRANT SELECT (direct DB)
-*   db check-schema               Compare bundled migrations vs live schema (direct DB)
-*   db collation-check            Check pg_database.datcollversion vs running libc (direct DB)
-*   db reindex                    REINDEX DATABASE CONCURRENTLY (direct DB)
-*   db refresh-collation-version  ALTER DATABASE REFRESH COLLATION VERSION (direct DB)
+* - `execution_runs.local_working_tree boolean NOT NULL DEFAULT false` — true
+*   for runs that ran a developer's local working tree from the CLI (inline
+*   lock file). The dashboard renders a "Local machine" badge for these runs
+*   and avoids building an external repository link from the repo identifier.
 *
-* The direct-DB subcommands cannot go through HTTP because the target database
-* may not exist yet or is about to be dropped. They follow the same pattern
-* as `kici-admin peer create-token` — open a pool from KICI_DATABASE_URL /
-* DATABASE_URL / --database-url.
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
+* data is preserved.
 */
-function resolveDatabaseUrl$2(explicit) {
-	const url = explicit ?? process.env.KICI_DATABASE_URL;
-	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
-	return url;
+async function up$6(db) {
+	await sql`ALTER TABLE public.execution_runs
+    ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function confirmInteractive$1(prompt, expected) {
-	if (!process.stdin.isTTY) return false;
+async function down$6(db) {
+	await sql`ALTER TABLE public.execution_runs
+    DROP COLUMN IF EXISTS local_working_tree`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/055_agent_token_mandatory_labels.ts
+var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* Add a token-bound mandatory-label taint to agent tokens:
+*
+* - `agent_tokens.mandatory_labels text NULL` — a JSON-encoded `string[]` of
+*   Kubernetes-taint-style gate labels the token authorizes. When a static
+*   agent registers with this token, the set becomes the agent's registry-entry
+*   `mandatoryLabels`: the agent only accepts a job when every label here
+*   appears in the job's required labels. NULL = no taint (the default; the
+*   agent accepts any job its advertised labels match), so every existing token
+*   stays unconfined until re-minted.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up$5(db) {
+	await sql`ALTER TABLE public.agent_tokens
+    ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
+}
+async function down$5(db) {
+	await sql`ALTER TABLE public.agent_tokens
+    DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/056_execution_jobs_environments.ts
+var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Add a per-job bound deployment-environment list to `execution_jobs`:
+*
+* - `execution_jobs.environments text NULL` — a JSON-encoded `string[]` of the
+*   ordered environment names a job binds (`environments: [...]`), in merge
+*   order. Written at dispatch with the statically-resolved names (impure
+*   dynamic elements as a `(dynamic)` placeholder), then overwritten with the
+*   fully-resolved list when a deferred-init agent eval resolves dynamic
+*   elements. NULL = the job binds no environment.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
+*/
+async function up$4(db) {
+	await sql`ALTER TABLE public.execution_jobs
+    ADD COLUMN IF NOT EXISTS environments text`.execute(db);
+}
+async function down$4(db) {
+	await sql`ALTER TABLE public.execution_jobs
+    DROP COLUMN IF EXISTS environments`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/057_step_concurrency.ts
+var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* Add parallel step-group concurrency columns to `execution_steps`:
+*
+* - `concurrency_kind text` — the step's concurrency role (`sequential` |
+*   `parallel-child` | `parallel-group`). NULL for an ordinary sequential step.
+* - `group_id text` — the parallel-group correlation id shared by a group's
+*   children (e.g. `g0`). NULL for a sequential step.
+*
+* Both nullable, no backfill. Idempotent: re-running on a DB that already has the
+* columns is a no-op.
+*/
+async function colExists$3(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$3(db) {
+	if (!await colExists$3(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
+	if (!await colExists$3(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
+}
+async function down$3(db) {
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/058_access_log_agent_label.ts
+var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* Add `access_log.agent_label text` — the human-set name of the agent that
+* performed the action, when the actor authenticated with an agent-kind PAT.
+*
+* Queryable column (not just baked into `actor_meta`) so an operator can filter
+* the access log by agent. NULL for ordinary human / API-key / system actors.
+* Nullable, no backfill. Idempotent.
+*/
+async function colExists$2(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$2(db) {
+	if (!await colExists$2(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
+}
+async function down$2(db) {
+	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/059_attestation_verdict.ts
+var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add server-side verification verdict columns to `attestations`, plus the
+* lookup indexes the org-wide attestations browser queries against.
+*
+* The orchestrator verifies each provenance bundle at ingest and records the
+* verdict here so the dashboard list shows trustworthy badges with no per-row
+* bundle fetch:
+* - `verify_status` — one of `verified` / `failed` / `unverifiable` / `pending`
+*   (mirrors `attestationVerifyStatusSchema.enum.*` in `@kici-dev/engine`).
+*   `DEFAULT 'pending'` covers rows written before a verdict is computed.
+* - `verify_reason` — first failure code from `verifyKiciBundle` (nullable).
+* - `verified_at` — when the verdict was recorded (nullable).
+*
+* Idempotent: guarded on the `verify_status` column's existence.
+*/
+async function colExists$1(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$1(db) {
+	if (await colExists$1(db, "attestations", "verify_status")) return;
+	await sql`
+    ALTER TABLE public.attestations
+      ADD COLUMN verify_status TEXT NOT NULL DEFAULT 'pending',
+      ADD COLUMN verify_reason TEXT,
+      ADD COLUMN verified_at TIMESTAMPTZ
+  `.execute(db);
+	await sql`CREATE INDEX idx_attestations_subject_digest ON public.attestations (subject_digest)`.execute(db);
+	await sql`CREATE INDEX idx_attestations_subject_name ON public.attestations (subject_name)`.execute(db);
+	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
+	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
+}
+async function down$1(db) {
+	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
+	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
+	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
+	await sql`DROP INDEX IF EXISTS idx_attestations_subject_digest`.execute(db);
+	await sql`
+    ALTER TABLE public.attestations
+      DROP COLUMN IF EXISTS verify_status,
+      DROP COLUMN IF EXISTS verify_reason,
+      DROP COLUMN IF EXISTS verified_at
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/060_run_trigger_actor.ts
+var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add the triggering-actor columns to `execution_runs`:
+*
+*  - `trigger_actor_provider` — the origin provider of the actor identity
+*    (`github` today; provider-generic so GitLab/Bitbucket extend later).
+*  - `trigger_actor_username` — the provider login of the person who triggered
+*    the run (e.g. the GitHub pusher / PR author).
+*  - `trigger_actor_user_id` — the immutable provider user id (mirrors
+*    `identity_links.provider_user_id`), preferred over the mutable username
+*    when resolving the actor to a KiCI user.
+*
+* Captured for ALL event types (push/tag/PR/comment), unlike the PR-only
+* `contributor_username`. Independently useful for a dashboard "triggered by
+* @x" and audit, beyond actor notifications. All nullable, no backfill,
+* idempotent.
+*/
+async function colExists(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up(db) {
+	if (!await colExists(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
+	if (!await colExists(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
+	if (!await colExists(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
+}
+async function down(db) {
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
+}
+//#endregion
+//#region src/db/migration-provider.ts
+function createMigrationProvider() {
+	return { async getMigrations() {
+		return {
+			"001_initial": _001_initial_exports,
+			"002_config_versions_key_version": _002_config_versions_key_version_exports,
+			"003_access_log": _003_access_log_exports,
+			"004_rename_bundle_to_source": _004_rename_bundle_to_source_exports,
+			"005_cold_store_chunk_counter": _005_cold_store_chunk_counter_exports,
+			"006_runs_jobs_steps_archived_at": _006_runs_jobs_steps_archived_at_exports,
+			"007_audit_logs_archived_at": _007_audit_logs_archived_at_exports,
+			"008_event_log_archived_at": _008_event_log_archived_at_exports,
+			"009_access_log_trigram": _009_access_log_trigram_exports,
+			"010_cold_store_chunks": _010_cold_store_chunks_exports,
+			"011_drop_source_secrets_notify": _011_drop_source_secrets_notify_exports,
+			"012_peer_credentials_active_uniq": _012_peer_credentials_active_uniq_exports,
+			"013_execution_log_bytes": _013_execution_log_bytes_exports,
+			"014_kici_events_lease_retry": _014_kici_events_lease_retry_exports,
+			"015_org_settings_customer_scoped": _015_org_settings_customer_scoped_exports,
+			"016_org_settings_allow_http_npm": _016_org_settings_allow_http_npm_exports,
+			"017_org_id_widen": _017_org_id_widen_exports,
+			"018_org_id_prefix_backfill": _018_org_id_prefix_backfill_exports,
+			"019_generic_sources_change_notify": _019_generic_sources_change_notify_exports,
+			"020_org_settings_dashboard_write_policy": _020_org_settings_dashboard_write_policy_exports,
+			"021_check_run_tracking": _021_check_run_tracking_exports,
+			"022_scaler_manager_state": _022_scaler_manager_state_exports,
+			"023_dispatch_queue_recovery_deadline": _023_dispatch_queue_recovery_deadline_exports,
+			"024_dispatch_queue_provisioning_error": _024_dispatch_queue_provisioning_error_exports,
+			"025_init_failure": _025_init_failure_exports,
+			"026_event_log_lockfile_corrupt": _026_event_log_lockfile_corrupt_exports,
+			"027_workflow_timeout": _027_workflow_timeout_exports,
+			"028_org_settings_user_cache": _028_org_settings_user_cache_exports,
+			"029_dispatch_queue_attempts": _029_dispatch_queue_attempts_exports,
+			"030_held_runs_env_set_null": _030_held_runs_env_set_null_exports,
+			"031_dispatch_queue_ack_deadline": _031_dispatch_queue_ack_deadline_exports,
+			"032_org_settings_dispatch_ack_timeout": _032_org_settings_dispatch_ack_timeout_exports,
+			"033_org_settings_approval": _033_org_settings_approval_exports,
+			"034_held_runs_generalize": _034_held_runs_generalize_exports,
+			"035_pending_workflow_contexts": _035_pending_workflow_contexts_exports,
+			"036_attestations": _036_attestations_exports,
+			"037_generic_sources_provider_type_local": _037_generic_sources_provider_type_local_exports,
+			"038_remote_sources": _038_remote_sources_exports,
+			"039_host_roster": _039_host_roster_exports,
+			"040_runsonall_pin": _040_runsonall_pin_exports,
+			"041_wave_gated": _041_wave_gated_exports,
+			"042_dispatch_queue_patterns": _042_dispatch_queue_patterns_exports,
+			"043_rerouted_to_peer": _043_rerouted_to_peer_exports,
+			"044_check_mode": _044_check_mode_exports,
+			"045_host_properties": _045_host_properties_exports,
+			"046_join_token_consumed_by_instance": _046_join_token_consumed_by_instance_exports,
+			"047_needs_run_on": _047_needs_run_on_exports,
+			"048_host_reboot_pending": _048_host_reboot_pending_exports,
+			"049_held_runs_payload": _049_held_runs_payload_exports,
+			"050_sources_slug": _050_sources_slug_exports,
+			"051_binding_host_pattern": _051_binding_host_pattern_exports,
+			"052_host_reach_metadata": _052_host_reach_metadata_exports,
+			"053_agent_token_single_use": _053_agent_token_single_use_exports,
+			"054_local_working_tree": _054_local_working_tree_exports,
+			"055_agent_token_mandatory_labels": _055_agent_token_mandatory_labels_exports,
+			"056_execution_jobs_environments": _056_execution_jobs_environments_exports,
+			"057_step_concurrency": _057_step_concurrency_exports,
+			"058_access_log_agent_label": _058_access_log_agent_label_exports,
+			"059_attestation_verdict": _059_attestation_verdict_exports,
+			"060_run_trigger_actor": _060_run_trigger_actor_exports
+		};
+	} };
+}
+//#endregion
+//#region src/db/migrator.ts
+/**
+* Auto-migrate module with PostgreSQL advisory lock for HA safety.
+*
+* Uses pg_advisory_lock to ensure only one orchestrator instance runs
+* migrations at a time, preventing conflicts in multi-instance deployments.
+*/
+const logger$12 = createLogger({ prefix: "migrate" });
+const ADVISORY_LOCK_KEY = 543210001;
+/**
+* Run all pending migrations with an advisory lock for concurrency safety.
+*
+* Acquires pg_advisory_lock before migrating to prevent concurrent
+* migration attempts from multiple orchestrator instances. The lock
+* is always released in the finally block, even on error.
+*/
+async function runMigrations(opts) {
+	const client = await opts.pool.connect();
+	try {
+		logger$12.info("Acquiring migration lock...");
+		await client.query("SELECT pg_advisory_lock($1)", [ADVISORY_LOCK_KEY]);
+		logger$12.info("Migration lock acquired");
+		const migrator = new Migrator({
+			db: opts.db,
+			provider: createMigrationProvider()
+		});
+		const start = Date.now();
+		const { results, error } = await migrator.migrateToLatest();
+		for (const result of results ?? []) if (result.status === "Success") logger$12.info(`${result.migrationName} ... OK (${Date.now() - start}ms)`);
+		else if (result.status === "Error") logger$12.error(`${result.migrationName} ... FAILED`);
+		if (error) throw error;
+		const applied = (results ?? []).filter((r) => r.status === "Success");
+		if (applied.length === 0) logger$12.info("Database schema is up to date");
+		else logger$12.info(`Applied ${applied.length} migration(s)`);
+		const hash = await computeMigrationsHash(createMigrationProvider());
+		await storeMigrationContentHash(opts.pool, hash);
+		return results ?? [];
+	} finally {
+		await client.query("SELECT pg_advisory_unlock($1)", [ADVISORY_LOCK_KEY]);
+		client.release();
+	}
+}
+//#endregion
+//#region src/cli/commands/db.ts
+/**
+* Database management commands for kici-admin.
+*
+*   db migrate                    Run pending migrations (HTTP — orchestrator must be up)
+*   db fresh                      DROP + CREATE + migrate + store content hash (direct DB)
+*   db ensure <name>              CREATE DATABASE IF NOT EXISTS (direct DB)
+*   db create-role                CREATE ROLE LOGIN [CREATEDB] (direct DB)
+*   db create-readonly-user       Read-only role + GRANT SELECT (direct DB)
+*   db check-schema               Compare bundled migrations vs live schema (direct DB)
+*   db collation-check            Check pg_database.datcollversion vs running libc (direct DB)
+*   db reindex                    REINDEX DATABASE CONCURRENTLY (direct DB)
+*   db refresh-collation-version  ALTER DATABASE REFRESH COLLATION VERSION (direct DB)
+*
+* The direct-DB subcommands cannot go through HTTP because the target database
+* may not exist yet or is about to be dropped. They follow the same pattern
+* as `kici-admin peer create-token` — open a pool from KICI_DATABASE_URL /
+* DATABASE_URL / --database-url.
+*/
+function resolveDatabaseUrl$3(explicit) {
+	const url = explicit ?? process.env.KICI_DATABASE_URL;
+	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
+	return url;
+}
+async function confirmInteractive$2(prompt, expected) {
+	if (!process.stdin.isTTY) return false;
 	process.stderr.write(prompt);
 	const rl = createInterface({
 		input: process.stdin,
@@ -4958,10 +5331,10 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("fresh").description("DROP + CREATE the orchestrator DB, run migrations, record content hash").option("--database-url <url>", "Target database URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--confirm", "Explicit confirmation (destructive)").option("--yes", "Skip interactive confirmation (for scripted use)").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$2(opts.databaseUrl);
+			const url = resolveDatabaseUrl$3(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			if (!opts.yes) {
-				if (!await confirmInteractive$1(`About to DROP + RECREATE database "${dbName}". Type "${dbName}" to confirm: `, dbName)) {
+				if (!await confirmInteractive$2(`About to DROP + RECREATE database "${dbName}". Type "${dbName}" to confirm: `, dbName)) {
 					console.error("Aborted.");
 					process.exit(1);
 				}
@@ -4989,7 +5362,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("ensure <name>").description("CREATE DATABASE IF NOT EXISTS (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--owner <role>", "DB owner role (default: URL user). Pass when the admin connection is privileged but the new DB should be owned by a separate non-privileged role.").option("--revoke-connect-public", "After ensure, REVOKE CONNECT ON DATABASE \"<name>\" FROM PUBLIC (recommended on shared clusters).").option("--grant-connect-role <role>", "After ensure (and any --revoke-connect-public), GRANT CONNECT ON DATABASE \"<name>\" TO \"<role>\". Repeatable.", (val, acc) => acc.concat([val]), []).action(async (name, opts) => {
 		try {
-			const baseUrl = resolveDatabaseUrl$2(opts.databaseUrl);
+			const baseUrl = resolveDatabaseUrl$3(opts.databaseUrl);
 			const url = new URL(baseUrl);
 			url.pathname = `/${name}`;
 			const targetUrl = url.toString();
@@ -5008,7 +5381,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("create-role").description("CREATE / ALTER ROLE with LOGIN [+ CREATEDB] (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--user <name>", "Role name to create or update").requiredOption("--password <password>", "Role password (raw — quote as needed)").option("--createdb", "Grant CREATEDB to the new role", false).action(async (opts) => {
 		try {
-			const { adminUrl } = parseDatabaseUrl(resolveDatabaseUrl$2(opts.databaseUrl));
+			const { adminUrl } = parseDatabaseUrl(resolveDatabaseUrl$3(opts.databaseUrl));
 			logInvocation(`create-role ${opts.user}`, adminUrl);
 			const outcome = await createDbRole(adminUrl, {
 				username: opts.user,
@@ -5023,7 +5396,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("create-readonly-user").description("Create a read-only role with SELECT on all tables + default privileges").option("--database-url <url>", "Target DB URL (must connect as owner)").requiredOption("--user <name>", "Read-only role name").requiredOption("--password <password>", "Role password").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$2(opts.databaseUrl);
+			const url = resolveDatabaseUrl$3(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			logInvocation(`create-readonly-user ${opts.user}`, url);
 			const outcome = await createReadOnlyDbUser(url, {
@@ -5038,7 +5411,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("check-schema").description("Compare bundled migrations vs live schema. Exit 2 on drift.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--json", "Emit JSON instead of a human-readable line", false).action(async (opts) => {
 		try {
-			const pool = createPool(resolveDatabaseUrl$2(opts.databaseUrl));
+			const pool = createPool(resolveDatabaseUrl$3(opts.databaseUrl));
 			try {
 				const status = await isSchemaCurrent(pool, createMigrationProvider());
 				if (opts.json) process.stdout.write(JSON.stringify(status) + "\n");
@@ -5055,7 +5428,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("collation-check").description("Compare pg_database.datcollversion against the running libc collation version. Exit 2 on drift.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--json", "Emit JSON instead of a human-readable line", false).action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$2(opts.databaseUrl);
+			const url = resolveDatabaseUrl$3(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			const pool = createPool(url);
 			try {
@@ -5085,7 +5458,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("reindex").description("REINDEX DATABASE CONCURRENTLY <db>. Rebuilds every index under the running libc collation rules. Non-blocking but takes minutes + ~2× temp disk.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--confirm", "Explicit confirmation (destructive — long-running)").requiredOption("--reason <text>", "Reason (recorded in stderr banner)").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$2(opts.databaseUrl);
+			const url = resolveDatabaseUrl$3(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			logInvocation(`reindex ${dbName} (${opts.reason})`, url);
 			const pool = createPool(url);
@@ -5102,7 +5475,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("refresh-collation-version").description("ALTER DATABASE <db> REFRESH COLLATION VERSION. Metadata-only bump; pair with db reindex after a libc-base image rebuild.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--reason <text>", "Reason (recorded in stderr banner)").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$2(opts.databaseUrl);
+			const url = resolveDatabaseUrl$3(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			logInvocation(`refresh-collation-version ${dbName} (${opts.reason})`, url);
 			const pool = createPool(url);
@@ -6540,7 +6913,7 @@ async function getRemoteSource(db, orgId) {
 //#endregion
 //#region src/cli/commands/remote-source.ts
 init_client();
-function resolveDatabaseUrl$1(explicit) {
+function resolveDatabaseUrl$2(explicit) {
 	const url = explicit ?? process.env.KICI_DATABASE_URL;
 	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
 	return url;
@@ -6549,7 +6922,7 @@ function registerRemoteSourceCommands(program) {
 	program.command("remote-source").description("Inspect the auto-provisioned remote-source org anchor").command("show <orgId>").description("Print the remote_sources anchor row for an org (routing key remote:<orgId>).").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--format <format>", "Output format: json|table", "table").action(async (orgId, opts) => {
 		let url;
 		try {
-			url = resolveDatabaseUrl$1(opts.databaseUrl);
+			url = resolveDatabaseUrl$2(opts.databaseUrl);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -6911,6 +7284,64 @@ function registerRunsCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	runs.command("structured <runId>").description("Show the provenance-tagged structured run result (agent read path; /structured)").option("--json", "Emit the raw AgentRunResult (untrusted envelopes preserved)").action(async (runId, opts) => {
+		try {
+			const result = await getClient().getRunStructured(runId);
+			if (opts.json) {
+				console.log(JSON.stringify(result, null, 2));
+				return;
+			}
+			const uv = (v) => v == null ? "-" : typeof v === "object" ? v.value : String(v);
+			console.log(`Run: ${result.runId}`);
+			console.log(`  Workflow:    ${uv(result.workflowName)}`);
+			console.log(`  Status:      ${result.status}`);
+			console.log(`  Failure:     ${result.failureCategory ?? "-"}`);
+			if (result.failureReason) console.log(`  Reason:      ${uv(result.failureReason)}`);
+			console.log(`  Repo:        ${uv(result.repoIdentifier)}`);
+			console.log(`  Ref:         ${uv(result.ref)}`);
+			console.log(`  SHA:         ${result.sha}`);
+			console.log(`  Duration:    ${formatDuration(result.durationMs)}`);
+			if (result.jobs.length === 0) {
+				console.log("\nNo jobs.");
+				return;
+			}
+			console.log("");
+			const jobHeaders = [
+				"job",
+				"status",
+				"failed_steps"
+			];
+			const jobRows = result.jobs.map((j) => [
+				uv(j.jobName),
+				j.status,
+				String(j.steps.filter((s) => s.exitCode != null && s.exitCode !== 0).length)
+			]);
+			console.log(renderTable$2(jobHeaders, jobRows));
+			for (const job of result.jobs) {
+				if (job.steps.length === 0) continue;
+				console.log("");
+				console.log(`Steps for ${uv(job.jobName)}:`);
+				const stepHeaders = [
+					"#",
+					"name",
+					"status",
+					"exit",
+					"duration"
+				];
+				const stepRows = job.steps.map((s) => [
+					String(s.stepIndex),
+					uv(s.stepName),
+					s.status,
+					s.exitCode != null ? String(s.exitCode) : "-",
+					formatDuration(s.durationMs)
+				]);
+				console.log(renderTable$2(stepHeaders, stepRows));
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 	runs.command("jobs <runId>").description("List jobs for a run (dogfooded via /api/v1/admin/runs/:runId/jobs)").option("--include-steps", "Embed step list inside each job (default false)").option("--json", "Emit raw JSON instead of a table").action(async (runId, opts) => {
 		try {
 			const response = await getClient().getRunJobs(runId, { includeSteps: Boolean(opts.includeSteps) });
@@ -6961,67 +7392,1298 @@ function registerRunsCommands(program, getClient) {
 				console.log(renderTable$2(stepHeaders, stepRows));
 			}
 		} catch (err) {
-			console.error(`Error: ${toErrorMessage(err)}`);
-			process.exit(1);
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	runs.command("ephemeral-key <runId>").description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(async (runId, opts) => {
+		try {
+			const response = await getClient().getRunEphemeralKey(runId);
+			if (opts.json) {
+				console.log(JSON.stringify(response, null, 2));
+				return;
+			}
+			if (response.exists) {
+				console.log(`exists: true`);
+				console.log(`created_at: ${response.createdAt}`);
+			} else {
+				console.log(`exists: false`);
+				console.log(`created_at: -`);
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	runs.command("secret-outputs <runId>").description("List per-job secret outputs (masked by default; --reveal decrypts and audits)").option("--output-key <key>", "Filter to a single output_key").option("--reveal", "Decrypt and print plaintext values. Audited with actor=secret-outputs.reveal; requires secret.reveal permission").option("--json", "Emit raw JSON instead of a table").action(async (runId, opts) => {
+		try {
+			if (opts.reveal) process.stderr.write("⚠  --reveal will decrypt secret values; this call is recorded in secret_audit_log.\n");
+			const response = await getClient().getRunSecretOutputs(runId, {
+				outputKey: opts.outputKey,
+				reveal: Boolean(opts.reveal)
+			});
+			if (opts.json) {
+				console.log(JSON.stringify(response, null, 2));
+				return;
+			}
+			if (response.outputs.length === 0) {
+				console.log("No secret outputs for this run.");
+				return;
+			}
+			const headers = opts.reveal ? [
+				"job_id",
+				"output_key",
+				"value",
+				"created_at"
+			] : [
+				"job_id",
+				"output_key",
+				"masked",
+				"created_at"
+			];
+			const rows = response.outputs.map((o) => opts.reveal ? [
+				o.jobId,
+				o.outputKey,
+				o.value ?? o.revealError ?? "(decrypt failed)",
+				o.createdAt
+			] : [
+				o.jobId,
+				o.outputKey,
+				String(o.masked),
+				o.createdAt
+			]);
+			console.log(renderTable$2(headers, rows));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
+//#endregion
+//#region src/config.ts
+/**
+* Orchestrator configuration.
+*
+* This is a thin backward-compatible wrapper around the new config resolution
+* chain (config/resolver.ts). It preserves the existing synchronous loadConfig()
+* API so that no other files need changing.
+*
+* The new config system lives in config/ and supports:
+* - YAML config files (config/loader.ts)
+* - Shared DB config store (config/shared-store.ts)
+* - 4-layer resolution: env > YAML > DB > defaults (config/resolver.ts)
+* - KICI_ env var mapping (config/env-overlay.ts)
+*
+* Provider configuration (GitHub Apps, etc.) is managed via the `sources` table
+* and PgSecretStore, not through config. See SourceStore and SourceManager.
+*/
+const baseSchema = z.object({
+	mode: z.enum([
+		"platform",
+		"hybrid",
+		"independent"
+	]).default("platform"),
+	port: z.coerce.number().default(4e3),
+	basePath: z.string().default("/"),
+	tlsCertPath: z.string().optional(),
+	platformUrl: z.string().optional(),
+	platformToken: z.string().optional(),
+	/**
+	* Base URL of the user-facing dashboard. Used to build `details_url`
+	* on GitHub Check Runs and similar outbound URLs that reach public
+	* surfaces — the `oal_<12-char>` public alias is appended to this
+	* base. When unset, no `details_url` is emitted (preserving today's
+	* behavior). Trailing slash optional.
+	*/
+	dashboardUrl: z.string().optional(),
+	/**
+	* Provenance trust root (the OIDC issuer) used to verify build-provenance
+	* bundles. The live process learns this over the Platform `auth.success`
+	* connect message; this config/env value is the source for the CLI backfill
+	* (`kici-admin attestations reverify`), which has no live handshake. When
+	* unset, the orchestrator records attestation verdicts as `unverifiable`.
+	*/
+	provenanceIssuer: z.string().optional(),
+	/**
+	* Public base URL at which this orchestrator's own webhook ingress is
+	* reachable (independent/hybrid self-serve generic webhooks:
+	* `<base>/webhook/<customerId>/generic/<sourceId>`). Used by
+	* `kici-admin source add` to print a generic source's webhook URL. GitHub-App
+	* ingress is Platform-relayed, so GitHub URLs come from the Platform's
+	* `source.register.ack`, not this value. Trailing slash optional.
+	*/
+	webhookPublicUrl: z.string().optional(),
+	databaseUrl: z.string().default(""),
+	lockfileCacheMax: z.coerce.number().default(500),
+	lockfileCacheTtlMs: z.coerce.number().default(36e5),
+	queueMaxDepth: z.coerce.number().default(1e3),
+	queueTimeoutMs: z.coerce.number().default(36e5),
+	/**
+	* Operator-facing backpressure warning threshold for the dispatch queue.
+	* When pending-queue depth stays at or above this value for at least two
+	* consecutive refresher ticks (~10s), the orchestrator emits a
+	* `logger.warn` pointing operators at the per-label Grafana panel so
+	* they can identify which label pool is starved. `0` disables the
+	* warner entirely — metrics are still exported, but the periodic warn
+	* is silenced. See docs/operator/monitoring.md for tuning guidance.
+	*/
+	queueBackpressureThreshold: z.coerce.number().default(100),
+	workerConcurrency: z.coerce.number().default(5),
+	concurrencyWaitTimeoutMs: z.coerce.number().int().min(1e3).default(36e5),
+	dispatchAckTimeoutMs: z.coerce.number().int().min(1e3).default(1e4),
+	cacheStorageType: z.enum(["s3", "filesystem"]).optional(),
+	cacheStoragePath: z.string().optional(),
+	cacheStorageS3Bucket: z.string().optional(),
+	cacheStorageS3Prefix: z.string().default(""),
+	cacheStorageS3Region: z.string().optional(),
+	cacheStorageS3Endpoint: z.string().optional(),
+	cacheStorageS3ExternalEndpoint: z.string().optional(),
+	cacheStorageS3UploadEndpoint: z.string().optional(),
+	cacheStorageS3ForcePathStyle: z.enum(["true", "false"]).transform((v) => v === "true").optional(),
+	cacheStorageFsPath: z.string().optional(),
+	cacheStorageFsBaseUrl: z.string().optional(),
+	logStorageS3Bucket: z.string().optional(),
+	cacheTtlDays: z.coerce.number().default(30),
+	cacheBuildTimeoutMs: z.coerce.number().default(6e5),
+	cacheMaxTarballBytes: z.coerce.number().default(524288e3),
+	userCacheQuotaBytes: z.coerce.number().int().positive().default(5 * 1024 * 1024 * 1024).describe("Cluster-wide default per-org byte quota for the user-facing cache (ctx.cache). A per-org override in org_settings.user_cache_quota_bytes (set via `kici-admin org-settings user-cache set-quota`) takes precedence when present."),
+	userCacheTtlMs: z.coerce.number().int().positive().default(10080 * 60 * 1e3).describe("Cluster-wide default per-entry TTL (ms) for the user-facing cache. A per-org override in org_settings.user_cache_ttl_ms (set via `kici-admin org-settings user-cache set-ttl`) takes precedence when present."),
+	webhookPayloadDir: z.string().optional(),
+	dataDir: z.string().optional(),
+	scalerConfigPath: z.string().optional(),
+	scalerConfigDir: z.string().optional(),
+	machineLedgerDir: z.string().optional(),
+	staleDetectorScanIntervalMs: z.coerce.number().default(6e4),
+	staleDetectorThresholdMultiplier: z.coerce.number().default(2),
+	jobHeartbeatIntervalMs: z.coerce.number().default(6e4),
+	githubAppNameRefreshIntervalMs: z.coerce.number().default(864e5),
+	secretKey: z.string().optional(),
+	secretKeyFile: z.string().optional(),
+	secretKeyOld: z.string().optional(),
+	secretKeyFileOld: z.string().optional(),
+	bootstrapAdminToken: z.string().optional(),
+	pgCustomerSecrets: z.enum(["true", "false"]).default("true").transform((v) => v === "true"),
+	agentAuth: z.enum(["token", "none"]).default("token"),
+	agentTokenTtlMs: z.coerce.number().default(36e5),
+	rosterGraceMs: z.coerce.number().int().min(1e3).default(3e5),
+	rosterTtlMs: z.coerce.number().int().min(1e3).default(18e5),
+	hostRebootDeadlineMs: z.coerce.number().int().min(1e3).default(9e5),
+	orchestratorHostAgentId: z.string().optional(),
+	maxFanoutHosts: z.coerce.number().int().min(1).default(1024),
+	eventRouterMaxChainDepth: z.coerce.number().default(10),
+	eventRouterRateLimitPerWorkflowPerMinute: z.coerce.number().default(100),
+	eventRouterEventTtlSeconds: z.coerce.number().default(604800),
+	eventRouterCleanupIntervalMs: z.coerce.number().default(36e5),
+	eventRouterMaxDispatchAttempts: z.coerce.number().default(5),
+	eventRouterLeaseDurationMs: z.coerce.number().default(6e4),
+	eventRouterRetryBaseBackoffMs: z.coerce.number().default(5e3),
+	eventRouterRetryMaxBackoffMs: z.coerce.number().default(3e5),
+	eventRouterRetryScanIntervalMs: z.coerce.number().default(1e4),
+	/**
+	* **Test-only.** Master switch for fault-injection knobs in the event
+	* dispatch pipeline. When `false` (default) the orchestrator ignores
+	* every test-only knob below, even if its env var is set. Pair with
+	* `KICI_TEST_EVENT_FAIL_FIRST_N` to drive the E2E retry / DLQ
+	* scenarios. Production deployments leave this at its default.
+	*/
+	testMode: z.string().default("0").transform((v) => v === "1" || v.toLowerCase() === "true"),
+	/**
+	* **Test-only.** JSON map of `{ "<eventName>": <N> }` instructing the
+	* EventRouter to throw a synthetic dispatch error while
+	* `event.attempts <= N`. Ignored unless `KICI_TEST_MODE=1`.
+	*/
+	testEventFailFirstN: z.string().optional(),
+	eventLogMaxPayloadBytes: z.coerce.number().default(5 * 1024 * 1024),
+	logLevel: z.enum([
+		"debug",
+		"info",
+		"warn",
+		"error"
+	]).default("info"),
+	nodeEnv: z.enum([
+		"development",
+		"production",
+		"test"
+	]).default("development"),
+	autoMigrate: z.string().default("true").transform((v) => v !== "false"),
+	agentMaxReconnectDelayMs: z.coerce.number().default(6e4),
+	skipS3SentinelValidation: z.string().default("false").transform((v) => v === "true"),
+	otelExporterOtlpEndpoint: z.string().optional(),
+	clusterName: z.string().optional(),
+	cluster: z.object({
+		/** This orchestrator's unique instance ID. Default: random UUID. */
+		instanceId: z.string().optional().default(() => randomUUID()),
+		/** This orchestrator's address for peers to connect to. Required when peers are configured. */
+		address: z.string().optional(),
+		/** Join token for cluster bootstrap. */
+		joinToken: z.string().optional(),
+		/** Path to peer credential file. */
+		credentialFile: z.string().default("~/.kici/peer-credential"),
+		/** Auto-rotate credentials. */
+		autoRotateCredentials: z.boolean().default(false),
+		/** Static peer addresses for independent mode. Comma-separated URLs. */
+		peers: z.string().optional().transform((v) => v ? v.split(",").map((s) => s.trim()) : []),
+		/** Raft election timeout minimum in ms. Default: 5000. */
+		raftElectionTimeoutMinMs: z.coerce.number().default(5e3),
+		/** Raft election timeout maximum in ms. Default: 10000. */
+		raftElectionTimeoutMaxMs: z.coerce.number().default(1e4),
+		/** Raft leader heartbeat interval in ms. Default: 2000. */
+		raftHeartbeatMs: z.coerce.number().default(2e3),
+		/** Peer heartbeat interval in ms (inventory broadcast). Default: 30000. */
+		peerHeartbeatIntervalMs: z.coerce.number().default(3e4),
+		/** Maximum peer reconnect delay in ms. Default: 60000. */
+		peerMaxReconnectDelayMs: z.coerce.number().default(6e4),
+		/** Cluster role: coordinator (full orchestrator) or worker (delegated execution). Default: coordinator. */
+		role: z.enum(["coordinator", "worker"]).default("coordinator"),
+		/** URL of the coordinator to connect to when role=worker. Single-coord mode. */
+		coordinatorUrl: z.string().optional(),
+		/**
+		* URLs of all coordinators to connect to when role=worker (comma-separated).
+		* Worker maintains one outbound PeerClient per coord so every coord can
+		* route work to it. Takes precedence over coordinatorUrl when both are set.
+		*/
+		coordinatorUrls: z.string().optional().transform((v) => v ? v.split(",").map((s) => s.trim()).filter(Boolean) : []),
+		/** Stale peer timeout in ms (2 missed heartbeats at 30s = 60s default). */
+		peerStaleTimeoutMs: z.coerce.number().default(6e4),
+		/** Grace period before dormant-mode self-election (0 peers). Default: 60000ms.
+		*  Prevents false self-election during the peer discovery window. */
+		electionGracePeriodMs: z.coerce.number().default(6e4),
+		/** Single-node deployment mode. When true, election grace period is bypassed
+		*  for immediate self-election. Default: false. */
+		singleNode: z.union([z.boolean(), z.string()]).default(false).transform((v) => typeof v === "boolean" ? v : v === "true"),
+		/** Trusted proxy IPs/CIDRs for X-Forwarded-For/X-Real-IP extraction. Comma-separated. */
+		trustedProxies: z.string().default("").transform((v) => v ? v.split(",").map((s) => s.trim()) : [])
+	}).prefault({})
+});
+/**
+* Env-var definition for the orchestrator. Exported so the docs generator and
+* the deploy-stg pre-validator can re-parse without going through process.env.
+*
+* Note: passes the inner `baseSchema` (a ZodObject) so describe() can walk
+* `.shape`, but uses the outer `configSchema` (with .superRefine) as the parser
+* so cross-field rules still fire.
+*/
+const envDef = defineEnv({
+	service: "orchestrator",
+	schema: baseSchema,
+	parser: baseSchema.superRefine((data, ctx) => {
+		const isWorker = data.cluster.role === "worker";
+		if (isWorker && !data.cluster.coordinatorUrl && (!data.cluster.coordinatorUrls || data.cluster.coordinatorUrls.length === 0)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "KICI_CLUSTER_COORDINATOR_URL or KICI_CLUSTER_COORDINATOR_URLS is required when KICI_CLUSTER_ROLE=worker",
+			path: ["cluster", "coordinatorUrls"]
+		});
+		if (!isWorker && !data.databaseUrl) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "KICI_DATABASE_URL is required for coordinator mode",
+			path: ["databaseUrl"]
+		});
+		if (!isWorker && (data.mode === "platform" || data.mode === "hybrid")) {
+			if (!data.platformUrl) ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "KICI_PLATFORM_URL is required when KICI_MODE is platform or hybrid",
+				path: ["platformUrl"]
+			});
+			if (!data.platformToken) ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "KICI_PLATFORM_TOKEN is required when KICI_MODE is platform or hybrid",
+				path: ["platformToken"]
+			});
+		}
+		if (data.cacheStorageType === "s3" && !data.cacheStorageS3Bucket) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "KICI_STORAGE_BUCKET is required when KICI_STORAGE_TYPE is s3",
+			path: ["cacheStorageS3Bucket"]
+		});
+		if (data.cacheStorageType === "filesystem") {
+			if (!data.cacheStorageFsPath) ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "KICI_STORAGE_FS_PATH is required when KICI_STORAGE_TYPE is filesystem",
+				path: ["cacheStorageFsPath"]
+			});
+			else if (!data.cacheStorageFsPath.startsWith("/")) ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "KICI_STORAGE_FS_PATH must be an absolute path",
+				path: ["cacheStorageFsPath"]
+			});
+		}
+		if (data.cluster.peers.length > 0 && !data.cluster.address) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "KICI_CLUSTER_ADDRESS is required when KICI_CLUSTER_PEERS is set (peers need to know where to connect back)",
+			path: ["cluster", "address"]
+		});
+	}),
+	envMap: {
+		mode: "KICI_MODE",
+		port: "KICI_PORT",
+		basePath: "KICI_BASE_PATH",
+		tlsCertPath: "KICI_SERVER_TLS_CERT_PATH",
+		platformUrl: "KICI_PLATFORM_URL",
+		platformToken: "KICI_PLATFORM_TOKEN",
+		dashboardUrl: "KICI_DASHBOARD_URL",
+		provenanceIssuer: "KICI_PROVENANCE_ISSUER",
+		webhookPublicUrl: "KICI_WEBHOOK_PUBLIC_URL",
+		databaseUrl: "KICI_DATABASE_URL",
+		cacheStorageType: "KICI_STORAGE_TYPE",
+		cacheStoragePath: "KICI_STORAGE_PATH",
+		cacheStorageS3Bucket: "KICI_STORAGE_BUCKET",
+		cacheStorageS3Prefix: "KICI_STORAGE_PREFIX",
+		cacheStorageS3Region: "KICI_STORAGE_REGION",
+		cacheStorageS3Endpoint: "KICI_STORAGE_ENDPOINT",
+		cacheStorageS3ExternalEndpoint: "KICI_STORAGE_EXTERNAL_ENDPOINT",
+		cacheStorageS3UploadEndpoint: "KICI_STORAGE_UPLOAD_ENDPOINT",
+		cacheStorageS3ForcePathStyle: "KICI_STORAGE_FORCE_PATH_STYLE",
+		cacheStorageFsPath: "KICI_STORAGE_FS_PATH",
+		cacheStorageFsBaseUrl: "KICI_STORAGE_FS_BASE_URL",
+		logStorageS3Bucket: "KICI_STORAGE_LOG_BUCKET",
+		cacheTtlDays: "KICI_CACHE_TTL_DAYS",
+		cacheBuildTimeoutMs: "KICI_CACHE_BUILD_TIMEOUT_MS",
+		cacheMaxTarballBytes: "KICI_CACHE_MAX_TARBALL_BYTES",
+		userCacheQuotaBytes: "KICI_USER_CACHE_QUOTA_BYTES",
+		userCacheTtlMs: "KICI_USER_CACHE_TTL_MS",
+		lockfileCacheMax: "KICI_LOCKFILE_CACHE_MAX",
+		lockfileCacheTtlMs: "KICI_LOCKFILE_CACHE_TTL_MS",
+		queueMaxDepth: "KICI_QUEUE_MAX_DEPTH",
+		queueTimeoutMs: "KICI_QUEUE_TIMEOUT_MS",
+		queueBackpressureThreshold: "KICI_QUEUE_BACKPRESSURE_THRESHOLD",
+		workerConcurrency: "KICI_WORKER_CONCURRENCY",
+		concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS",
+		dispatchAckTimeoutMs: "KICI_DISPATCH_ACK_TIMEOUT_MS",
+		webhookPayloadDir: "KICI_WEBHOOK_PAYLOAD_DIR",
+		dataDir: "KICI_DATA_DIR",
+		scalerConfigPath: "KICI_SCALER_CONFIG_PATH",
+		scalerConfigDir: "KICI_SCALER_CONFIG_DIR",
+		machineLedgerDir: "KICI_MACHINE_LEDGER_DIR",
+		staleDetectorScanIntervalMs: "KICI_STALE_DETECTOR_SCAN_INTERVAL_MS",
+		staleDetectorThresholdMultiplier: "KICI_STALE_DETECTOR_THRESHOLD_MULTIPLIER",
+		jobHeartbeatIntervalMs: "KICI_JOB_HEARTBEAT_INTERVAL_MS",
+		githubAppNameRefreshIntervalMs: "KICI_GITHUB_APP_NAME_REFRESH_INTERVAL_MS",
+		secretKey: "KICI_SECRET_KEY",
+		secretKeyFile: "KICI_SECRET_KEY_FILE",
+		secretKeyOld: "KICI_SECRET_KEY_OLD",
+		secretKeyFileOld: "KICI_SECRET_KEY_FILE_OLD",
+		bootstrapAdminToken: "KICI_BOOTSTRAP_ADMIN_TOKEN",
+		pgCustomerSecrets: "KICI_PG_CUSTOMER_SECRETS",
+		agentAuth: "KICI_AGENT_AUTH",
+		agentTokenTtlMs: "KICI_AGENT_TOKEN_TTL_MS",
+		rosterGraceMs: "KICI_ROSTER_GRACE_MS",
+		rosterTtlMs: "KICI_ROSTER_TTL_MS",
+		hostRebootDeadlineMs: "KICI_HOST_REBOOT_DEADLINE_MS",
+		orchestratorHostAgentId: "KICI_ORCHESTRATOR_HOST_AGENT_ID",
+		maxFanoutHosts: "KICI_MAX_FANOUT_HOSTS",
+		eventRouterMaxChainDepth: "KICI_EVENT_ROUTER_MAX_CHAIN_DEPTH",
+		eventRouterRateLimitPerWorkflowPerMinute: "KICI_EVENT_ROUTER_RATE_LIMIT_PER_WORKFLOW_PER_MINUTE",
+		eventRouterEventTtlSeconds: "KICI_EVENT_ROUTER_EVENT_TTL_SECONDS",
+		eventRouterCleanupIntervalMs: "KICI_EVENT_ROUTER_CLEANUP_INTERVAL_MS",
+		eventRouterMaxDispatchAttempts: "KICI_EVENT_ROUTER_MAX_DISPATCH_ATTEMPTS",
+		eventRouterLeaseDurationMs: "KICI_EVENT_ROUTER_LEASE_DURATION_MS",
+		eventRouterRetryBaseBackoffMs: "KICI_EVENT_ROUTER_RETRY_BASE_BACKOFF_MS",
+		eventRouterRetryMaxBackoffMs: "KICI_EVENT_ROUTER_RETRY_MAX_BACKOFF_MS",
+		eventRouterRetryScanIntervalMs: "KICI_EVENT_ROUTER_RETRY_SCAN_INTERVAL_MS",
+		testMode: "KICI_TEST_MODE",
+		testEventFailFirstN: "KICI_TEST_EVENT_FAIL_FIRST_N",
+		eventLogMaxPayloadBytes: "KICI_EVENT_LOG_MAX_PAYLOAD_BYTES",
+		logLevel: "KICI_LOG_LEVEL",
+		nodeEnv: "NODE_ENV",
+		autoMigrate: "KICI_AUTO_MIGRATE",
+		agentMaxReconnectDelayMs: "KICI_AGENT_MAX_RECONNECT_DELAY_MS",
+		skipS3SentinelValidation: "KICI_SKIP_S3_SENTINEL_VALIDATION",
+		otelExporterOtlpEndpoint: "OTEL_EXPORTER_OTLP_ENDPOINT",
+		clusterName: "KICI_CLUSTER_NAME",
+		cluster: {
+			instanceId: "KICI_CLUSTER_INSTANCE_ID",
+			address: "KICI_CLUSTER_ADDRESS",
+			joinToken: "KICI_CLUSTER_JOIN_TOKEN",
+			credentialFile: "KICI_CLUSTER_CREDENTIAL_FILE",
+			peers: "KICI_CLUSTER_PEERS",
+			raftElectionTimeoutMinMs: "KICI_CLUSTER_RAFT_ELECTION_TIMEOUT_MIN_MS",
+			raftElectionTimeoutMaxMs: "KICI_CLUSTER_RAFT_ELECTION_TIMEOUT_MAX_MS",
+			raftHeartbeatMs: "KICI_CLUSTER_RAFT_HEARTBEAT_MS",
+			peerHeartbeatIntervalMs: "KICI_CLUSTER_PEER_HEARTBEAT_INTERVAL_MS",
+			peerMaxReconnectDelayMs: "KICI_CLUSTER_PEER_MAX_RECONNECT_DELAY_MS",
+			role: "KICI_CLUSTER_ROLE",
+			coordinatorUrl: "KICI_CLUSTER_COORDINATOR_URL",
+			coordinatorUrls: "KICI_CLUSTER_COORDINATOR_URLS",
+			peerStaleTimeoutMs: "KICI_CLUSTER_PEER_STALE_TIMEOUT_MS",
+			electionGracePeriodMs: "KICI_CLUSTER_ELECTION_GRACE_PERIOD_MS",
+			singleNode: "KICI_CLUSTER_SINGLE_NODE",
+			trustedProxies: "KICI_CLUSTER_TRUSTED_PROXIES"
+		}
+	}
+});
+/**
+* Load orchestrator configuration from environment variables.
+*
+* This is the LEGACY synchronous config loader. It reads directly from process.env
+* using the env var names declared in `envDef` (KICI_DATABASE_URL, KICI_PORT, etc.).
+*
+* Provider configuration (GitHub Apps) is no longer loaded from env vars.
+* Use the sources table and SourceManager instead.
+*
+* For new deployments, use resolveLocalConfig() + resolveFullConfig() from
+* config/resolver.ts which support YAML files, KICI_ env var prefixes, and
+* the shared DB config store.
+*/
+/**
+* Cold-store env vars consumed by `OrchestratorColdStore` directly via
+* `process.env` (not threaded through the AppConfig schema). Registered
+* here so the unknown-KICI_* validator at boot doesn't reject them.
+* Per-table tuning mirrors `knownTables` in `orchestrator-cold-store.ts`.
+*/
+const COLD_STORE_ENV_VARS = [
+	"KICI_COLD_STORE_ENABLED",
+	"KICI_COLD_STORE_BUCKET",
+	"KICI_COLD_STORE_PREFIX",
+	"KICI_COLD_STORE_REGION",
+	"KICI_COLD_STORE_ENDPOINT",
+	"KICI_COLD_STORE_EXTERNAL_ENDPOINT",
+	"KICI_COLD_STORE_FORCE_PATH_STYLE",
+	"KICI_COLD_STORE_S3_CONCURRENCY",
+	"KICI_COLD_STORE_EXECUTION_RUNS_WARM_TTL_DAYS",
+	"KICI_COLD_STORE_EXECUTION_RUNS_MIN_WARM_TENANT_BYTES",
+	"KICI_COLD_STORE_EXECUTION_RUNS_MIN_CHUNK_BYTES",
+	"KICI_COLD_STORE_EXECUTION_RUNS_MAX_CHUNK_BYTES",
+	"KICI_COLD_STORE_EXECUTION_RUNS_MAX_ROWS_PER_CYCLE",
+	"KICI_COLD_STORE_EXECUTION_RUNS_ENABLED",
+	"KICI_COLD_STORE_EXECUTION_JOBS_WARM_TTL_DAYS",
+	"KICI_COLD_STORE_EXECUTION_JOBS_MIN_WARM_TENANT_BYTES",
+	"KICI_COLD_STORE_EXECUTION_JOBS_MIN_CHUNK_BYTES",
+	"KICI_COLD_STORE_EXECUTION_JOBS_MAX_CHUNK_BYTES",
+	"KICI_COLD_STORE_EXECUTION_JOBS_MAX_ROWS_PER_CYCLE",
+	"KICI_COLD_STORE_EXECUTION_JOBS_ENABLED",
+	"KICI_COLD_STORE_EXECUTION_STEPS_WARM_TTL_DAYS",
+	"KICI_COLD_STORE_EXECUTION_STEPS_MIN_WARM_TENANT_BYTES",
+	"KICI_COLD_STORE_EXECUTION_STEPS_MIN_CHUNK_BYTES",
+	"KICI_COLD_STORE_EXECUTION_STEPS_MAX_CHUNK_BYTES",
+	"KICI_COLD_STORE_EXECUTION_STEPS_MAX_ROWS_PER_CYCLE",
+	"KICI_COLD_STORE_EXECUTION_STEPS_ENABLED",
+	"KICI_COLD_STORE_SECRET_AUDIT_LOG_WARM_TTL_DAYS",
+	"KICI_COLD_STORE_SECRET_AUDIT_LOG_MIN_WARM_TENANT_BYTES",
+	"KICI_COLD_STORE_SECRET_AUDIT_LOG_MIN_CHUNK_BYTES",
+	"KICI_COLD_STORE_SECRET_AUDIT_LOG_MAX_CHUNK_BYTES",
+	"KICI_COLD_STORE_SECRET_AUDIT_LOG_MAX_ROWS_PER_CYCLE",
+	"KICI_COLD_STORE_SECRET_AUDIT_LOG_ENABLED",
+	"KICI_COLD_STORE_ACCESS_LOG_WARM_TTL_DAYS",
+	"KICI_COLD_STORE_ACCESS_LOG_MIN_WARM_TENANT_BYTES",
+	"KICI_COLD_STORE_ACCESS_LOG_MIN_CHUNK_BYTES",
+	"KICI_COLD_STORE_ACCESS_LOG_MAX_CHUNK_BYTES",
+	"KICI_COLD_STORE_ACCESS_LOG_MAX_ROWS_PER_CYCLE",
+	"KICI_COLD_STORE_ACCESS_LOG_ENABLED",
+	"KICI_COLD_STORE_EVENT_LOG_WARM_TTL_DAYS",
+	"KICI_COLD_STORE_EVENT_LOG_MIN_WARM_TENANT_BYTES",
+	"KICI_COLD_STORE_EVENT_LOG_MIN_CHUNK_BYTES",
+	"KICI_COLD_STORE_EVENT_LOG_MAX_CHUNK_BYTES",
+	"KICI_COLD_STORE_EVENT_LOG_MAX_ROWS_PER_CYCLE",
+	"KICI_COLD_STORE_EVENT_LOG_ENABLED"
+];
+/**
+* Deployment-identity env vars injected by the installer (and the staging
+* deploy) so the orchestrator can report its own deployment shape in
+* `source.register`. Read directly from `process.env` by the deployment reader,
+* not threaded through the AppConfig schema — registered here so the
+* unknown-KICI_* validator at boot doesn't reject them.
+*/
+const DEPLOY_IDENTITY_ENV_VARS = [
+	"KICI_DEPLOY_MODE",
+	"KICI_DEPLOY_CONTAINER",
+	"KICI_DEPLOY_CONTAINER_RUNTIME"
+];
+function loadConfig() {
+	const data = envDef.parse();
+	validateUnknownKiciVars([
+		...envDef.listKnownEnvVars(),
+		...LOGGER_ENV_VARS,
+		...COLD_STORE_ENV_VARS,
+		...DEPLOY_IDENTITY_ENV_VARS
+	]);
+	const instanceId = data.cluster.instanceId || `${hostname()}-${randomUUID().slice(0, 8)}`;
+	const userCacheStorage = {
+		userCacheQuotaBytes: data.userCacheQuotaBytes,
+		userCacheTtlMs: data.userCacheTtlMs
+	};
+	let storage;
+	if (data.cacheStorageType === "s3") storage = {
+		type: "s3",
+		bucket: data.cacheStorageS3Bucket,
+		prefix: data.cacheStorageS3Prefix,
+		region: data.cacheStorageS3Region,
+		endpoint: data.cacheStorageS3Endpoint,
+		externalEndpoint: data.cacheStorageS3ExternalEndpoint,
+		uploadEndpoint: data.cacheStorageS3UploadEndpoint,
+		forcePathStyle: data.cacheStorageS3ForcePathStyle,
+		logBucket: data.logStorageS3Bucket,
+		...userCacheStorage
+	};
+	else if (data.cacheStorageType === "filesystem") storage = {
+		type: "filesystem",
+		fsBasePath: data.cacheStorageFsPath,
+		fsBaseUrl: data.cacheStorageFsBaseUrl,
+		...userCacheStorage
+	};
+	else storage = { ...userCacheStorage };
+	return {
+		...data,
+		instanceId,
+		storage
+	};
+}
+//#endregion
+//#region src/storage/s3.ts
+/**
+* S3-backed cache storage.
+*
+* Stores cached items in S3 with custom metadata headers for TTL tracking.
+* Uses AWS SDK v3 modular imports -- only loaded when S3 storage is configured.
+*
+* Metadata storage:
+*   x-amz-meta-created-at      -- ISO timestamp of creation
+*   x-amz-meta-last-accessed-at -- ISO timestamp of last access
+*
+* TTL is enforced lazily: expired items are deleted on access.
+* Pre-signed URLs are generated for getUrl() with 15-minute expiry.
+*/
+/** Pre-signed download URL expiry in seconds (15 minutes) */
+const PRESIGNED_URL_EXPIRY_SECONDS = 900;
+/** Pre-signed upload URL expiry in seconds (30 minutes -- uploads take longer) */
+const UPLOAD_URL_EXPIRY_SECONDS = 1800;
+var S3CacheStorage = class {
+	client;
+	/** Separate client for pre-signed URL generation (uses externalEndpoint if configured). */
+	presignClient;
+	/** Separate client for the host CLI's pre-signed upload URL (uses uploadEndpoint if configured). */
+	uploadPresignClient;
+	bucket;
+	prefix;
+	ttlMs;
+	constructor(options) {
+		this.bucket = options.bucket;
+		this.prefix = options.prefix;
+		this.ttlMs = options.ttlMs;
+		this.client = createS3Client(options);
+		if (options.externalEndpoint) this.presignClient = createS3Client({
+			...options,
+			endpoint: options.externalEndpoint
+		});
+		else this.presignClient = this.client;
+		if (options.uploadEndpoint) this.uploadPresignClient = createS3Client({
+			...options,
+			endpoint: options.uploadEndpoint
+		});
+		else this.uploadPresignClient = this.client;
+	}
+	/** Build the full S3 object key from a cache key. */
+	objectKey(key) {
+		return `${this.prefix}${key}`;
+	}
+	/** Check if metadata indicates an expired item, honoring a per-op TTL override. */
+	isExpired(meta, ttlMsOverride) {
+		const ttl = ttlMsOverride ?? this.ttlMs;
+		const lastAccessed = new Date(meta.lastAccessedAt).getTime();
+		return Date.now() - lastAccessed > ttl;
+	}
+	/**
+	* Read metadata from an S3 object's custom headers.
+	* Returns null if the object doesn't exist (NoSuchKey/NotFound).
+	*/
+	async readMeta(key) {
+		try {
+			const head = await this.client.send(new HeadObjectCommand({
+				Bucket: this.bucket,
+				Key: this.objectKey(key)
+			}));
+			const createdAt = head.Metadata?.["created-at"] ?? "";
+			const lastAccessedAt = head.Metadata?.["last-accessed-at"] ?? "";
+			if (!createdAt || !lastAccessedAt) return null;
+			return {
+				createdAt,
+				lastAccessedAt
+			};
+		} catch (err) {
+			if (this.isNotFoundError(err)) return null;
+			throw err;
+		}
+	}
+	/**
+	* Update metadata on an S3 object by copying it to itself.
+	* This is the standard S3 pattern for updating metadata without re-uploading data.
+	*/
+	async updateMeta(key, meta) {
+		const objectKey = this.objectKey(key);
+		await this.client.send(new CopyObjectCommand({
+			Bucket: this.bucket,
+			Key: objectKey,
+			CopySource: `${this.bucket}/${objectKey}`,
+			MetadataDirective: "REPLACE",
+			Metadata: {
+				"created-at": meta.createdAt,
+				"last-accessed-at": meta.lastAccessedAt
+			}
+		}));
+	}
+	/** Check if an error is a "not found" error (NoSuchKey, NotFound, 404). */
+	isNotFoundError(err) {
+		if (typeof err !== "object" || err === null) return false;
+		const name = err.name;
+		if (name === "NoSuchKey" || name === "NotFound") return true;
+		return err.$metadata?.httpStatusCode === 404;
+	}
+	async put(key, data) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const body = typeof data === "string" ? Buffer.from(data) : data;
+		await new Upload({
+			client: this.client,
+			params: {
+				Bucket: this.bucket,
+				Key: this.objectKey(key),
+				Body: body,
+				Metadata: {
+					"created-at": now,
+					"last-accessed-at": now
+				}
+			}
+		}).done();
+	}
+	async get(key, ttlMsOverride) {
+		const meta = await this.readMeta(key);
+		if (!meta) return null;
+		if (this.isExpired(meta, ttlMsOverride)) {
+			await this.deleteObject(key);
+			return null;
+		}
+		let data;
+		try {
+			const response = await this.client.send(new GetObjectCommand({
+				Bucket: this.bucket,
+				Key: this.objectKey(key)
+			}));
+			if (!response.Body) return null;
+			data = Buffer.from(await response.Body.transformToByteArray());
+		} catch (err) {
+			if (this.isNotFoundError(err)) return null;
+			throw err;
+		}
+		try {
+			meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
+			await this.updateMeta(key, meta);
+		} catch {}
+		return data;
+	}
+	async has(key, ttlMsOverride) {
+		const meta = await this.readMeta(key);
+		if (!meta) return false;
+		if (this.isExpired(meta, ttlMsOverride)) {
+			await this.deleteObject(key);
+			return false;
+		}
+		return true;
+	}
+	async delete(key) {
+		const existed = await this.readMeta(key) !== null;
+		await this.deleteObject(key);
+		return existed;
+	}
+	async touch(key) {
+		const meta = await this.readMeta(key);
+		if (!meta) return;
+		meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await this.updateMeta(key, meta);
+	}
+	async getUrl(key, ttlMsOverride) {
+		const meta = await this.readMeta(key);
+		if (!meta) return null;
+		if (this.isExpired(meta, ttlMsOverride)) {
+			await this.deleteObject(key);
+			return null;
+		}
+		return await getSignedUrl(this.presignClient, new GetObjectCommand({
+			Bucket: this.bucket,
+			Key: this.objectKey(key)
+		}), { expiresIn: PRESIGNED_URL_EXPIRY_SECONDS });
+	}
+	async getUploadUrl(key) {
+		const objectKey = this.objectKey(key);
+		return getSignedUrl(this.presignClient, new PutObjectCommand({
+			Bucket: this.bucket,
+			Key: objectKey
+		}), { expiresIn: UPLOAD_URL_EXPIRY_SECONDS });
+	}
+	async getInternalUploadUrl(key) {
+		const objectKey = this.objectKey(key);
+		return getSignedUrl(this.uploadPresignClient, new PutObjectCommand({
+			Bucket: this.bucket,
+			Key: objectKey
+		}), { expiresIn: UPLOAD_URL_EXPIRY_SECONDS });
+	}
+	async initMeta(key) {
+		const objectKey = this.objectKey(key);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.client.send(new CopyObjectCommand({
+			Bucket: this.bucket,
+			Key: objectKey,
+			CopySource: `${this.bucket}/${objectKey}`,
+			MetadataDirective: "REPLACE",
+			Metadata: {
+				"created-at": now,
+				"last-accessed-at": now
+			}
+		}));
+	}
+	async list(subPrefix) {
+		const fullPrefix = this.objectKey(subPrefix);
+		const items = [];
+		let token;
+		do {
+			const resp = await this.client.send(new ListObjectsV2Command({
+				Bucket: this.bucket,
+				Prefix: fullPrefix,
+				ContinuationToken: token
+			}));
+			for (const obj of resp.Contents ?? []) {
+				if (!obj.Key) continue;
+				items.push({
+					key: obj.Key.slice(this.prefix.length),
+					created: obj.LastModified ? obj.LastModified.getTime() : 0
+				});
+			}
+			token = resp.IsTruncated ? resp.NextContinuationToken : void 0;
+		} while (token);
+		items.sort((a, b) => b.created - a.created);
+		return items.map((i) => i.key);
+	}
+	async getMetadata(key) {
+		return this.readMeta(key);
+	}
+	async copy(srcKey, destKey) {
+		const srcObj = this.objectKey(srcKey);
+		const destObj = this.objectKey(destKey);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.client.send(new CopyObjectCommand({
+			Bucket: this.bucket,
+			Key: destObj,
+			CopySource: `${this.bucket}/${srcObj}`,
+			MetadataDirective: "REPLACE",
+			Metadata: {
+				"created-at": now,
+				"last-accessed-at": now
+			}
+		}));
+	}
+	/** Delete an S3 object. Idempotent (doesn't error if missing). */
+	async deleteObject(key) {
+		try {
+			await this.client.send(new DeleteObjectCommand({
+				Bucket: this.bucket,
+				Key: this.objectKey(key)
+			}));
+		} catch (err) {
+			if (!this.isNotFoundError(err)) throw err;
+		}
+	}
+};
+//#endregion
+//#region src/storage/sign-url.ts
+/**
+* HMAC-signed URL tokens for the filesystem cache backend.
+*
+* Pre-signed S3 URLs are not available for filesystem storage, so the
+* filesystem backend mints HMAC-SHA256 tokens that the orchestrator's HTTP
+* blob route verifies before serving / writing a file. Token shape:
+*
+*   `${expiresUnixMs}.${hexSig}`
+*
+* Signature input: `${method}:${key}:${expiresUnixMs}` with HMAC-SHA256 keyed
+* by a per-orchestrator-process secret (random 32-byte hex at boot, persists
+* for the lifetime of the process). Tokens become invalid on orchestrator
+* restart — fine for the filesystem backend's E2E / single-host use case.
+*/
+/** Default URL lifetime: 1 hour (matches S3 backend's PUT-URL lifetime). */
+const DEFAULT_SIGN_URL_TTL_MS = 3600 * 1e3;
+function computeSig(secret, method, key, expiresMs) {
+	const hmac = createHmac("sha256", secret);
+	hmac.update(`${method}:${key}:${expiresMs}`);
+	return hmac.digest("hex");
+}
+/**
+* Mint a signed token for the given (method, key, expiry) triple.
+*/
+function signToken(secret, method, key, ttlMs = DEFAULT_SIGN_URL_TTL_MS) {
+	const expiresMs = Date.now() + ttlMs;
+	return {
+		token: `${expiresMs}.${computeSig(secret, method, key, expiresMs)}`,
+		expiresMs
+	};
+}
+//#endregion
+//#region src/storage/filesystem.ts
+/**
+* Filesystem-backed cache storage.
+*
+* Mirrors the `CacheStorage` interface that `S3CacheStorage` provides, but
+* stores blobs as files under a configured base directory. Pre-signed URLs
+* are replaced by HMAC-signed `http://<orchUrl>/api/v1/cache/blob/...` URLs
+* — see `sign-url.ts` for the token mechanics and `app.ts` for the route.
+*
+* Intended for single-host deployments and E2E sandboxes where standing up
+* an S3-compatible service is overkill. Production should still use S3.
+*
+* Metadata is co-located as a sibling JSON file (`<key>.meta.json`) so the
+* data file is byte-identical to what the agent receives over HTTP. TTL is
+* enforced lazily on access — same model as the S3 backend.
+*/
+const DEFAULT_ROUTE_PREFIX = "/api/v1/cache/blob/";
+var FilesystemCacheStorage = class {
+	basePath;
+	ttlMs;
+	baseUrl;
+	signingSecret;
+	routePrefix;
+	constructor(options) {
+		this.basePath = options.basePath;
+		this.ttlMs = options.ttlMs;
+		this.baseUrl = options.baseUrl.replace(/\/$/, "");
+		this.signingSecret = options.signingSecret;
+		this.routePrefix = (options.routePrefix ?? DEFAULT_ROUTE_PREFIX).replace(/\/?$/, "/");
+	}
+	/**
+	* Map a cache key to its on-disk path. Keys may contain `/`, which becomes a
+	* directory separator. Reject keys containing `..` segments or NUL bytes to
+	* prevent path traversal — the same defence the route layer enforces too.
+	*/
+	resolvePath(key) {
+		if (key.includes("\0") || key.split("/").some((seg) => seg === ".." || seg === "")) throw new Error(`Invalid cache key: ${JSON.stringify(key)}`);
+		return join(this.basePath, key);
+	}
+	/** Public for the HTTP route. The route validates the key before calling. */
+	pathFor(key) {
+		return this.resolvePath(key);
+	}
+	metaPath(key) {
+		return `${this.resolvePath(key)}.meta.json`;
+	}
+	isExpired(meta, ttlMsOverride) {
+		const ttl = ttlMsOverride ?? this.ttlMs;
+		const lastAccessed = new Date(meta.lastAccessedAt).getTime();
+		return Date.now() - lastAccessed > ttl;
+	}
+	async readMeta(key) {
+		try {
+			const raw = await promises.readFile(this.metaPath(key), "utf-8");
+			const parsed = JSON.parse(raw);
+			if (typeof parsed.createdAt !== "string" || typeof parsed.lastAccessedAt !== "string") return null;
+			return parsed;
+		} catch (err) {
+			if (isNotFoundFsError(err)) return null;
+			throw err;
+		}
+	}
+	async writeMeta(key, meta) {
+		const path = this.metaPath(key);
+		await promises.mkdir(dirname(path), { recursive: true });
+		await writeFileAtomic(path, JSON.stringify(meta));
+	}
+	async put(key, data) {
+		const path = this.resolvePath(key);
+		await promises.mkdir(dirname(path), { recursive: true });
+		await writeFileAtomic(path, typeof data === "string" ? Buffer.from(data) : data);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.writeMeta(key, {
+			createdAt: now,
+			lastAccessedAt: now
+		});
+	}
+	async get(key, ttlMsOverride) {
+		const meta = await this.readMeta(key);
+		if (!meta) return null;
+		if (this.isExpired(meta, ttlMsOverride)) {
+			await this.deleteFiles(key);
+			return null;
+		}
+		let data;
+		try {
+			data = await promises.readFile(this.resolvePath(key));
+		} catch (err) {
+			if (isNotFoundFsError(err)) return null;
+			throw err;
 		}
-	});
-	runs.command("ephemeral-key <runId>").description("Show whether the run-ephemeral key has been scrubbed yet").option("--json", "Emit raw JSON instead of plain text").action(async (runId, opts) => {
 		try {
-			const response = await getClient().getRunEphemeralKey(runId);
-			if (opts.json) {
-				console.log(JSON.stringify(response, null, 2));
-				return;
-			}
-			if (response.exists) {
-				console.log(`exists: true`);
-				console.log(`created_at: ${response.createdAt}`);
-			} else {
-				console.log(`exists: false`);
-				console.log(`created_at: -`);
-			}
+			meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
+			await this.writeMeta(key, meta);
+		} catch {}
+		return data;
+	}
+	async has(key, ttlMsOverride) {
+		const meta = await this.readMeta(key);
+		if (!meta) return false;
+		if (this.isExpired(meta, ttlMsOverride)) {
+			await this.deleteFiles(key);
+			return false;
+		}
+		return true;
+	}
+	async delete(key) {
+		const existed = await this.readMeta(key) !== null;
+		await this.deleteFiles(key);
+		return existed;
+	}
+	async touch(key) {
+		const meta = await this.readMeta(key);
+		if (!meta) return;
+		meta.lastAccessedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await this.writeMeta(key, meta);
+	}
+	async getUrl(key, ttlMsOverride) {
+		const meta = await this.readMeta(key);
+		if (!meta) return null;
+		if (this.isExpired(meta, ttlMsOverride)) {
+			await this.deleteFiles(key);
+			return null;
+		}
+		return this.signedUrl("GET", key);
+	}
+	async getUploadUrl(key) {
+		return this.signedUrl("PUT", key);
+	}
+	async getInternalUploadUrl(key) {
+		return this.signedUrl("PUT", key);
+	}
+	async initMeta(key) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.writeMeta(key, {
+			createdAt: now,
+			lastAccessedAt: now
+		});
+	}
+	async list(subPrefix) {
+		const root = this.resolvePath(subPrefix.replace(/\/$/, ""));
+		let entries;
+		try {
+			entries = await this.walkDataFiles(root, subPrefix.replace(/\/$/, ""));
 		} catch (err) {
-			console.error(`Error: ${toErrorMessage(err)}`);
-			process.exit(1);
+			if (isNotFoundFsError(err)) return [];
+			throw err;
+		}
+		entries.sort((a, b) => b.mtime - a.mtime);
+		return entries.map((e) => e.key);
+	}
+	async getMetadata(key) {
+		return this.readMeta(key);
+	}
+	async copy(srcKey, destKey) {
+		const srcPath = this.resolvePath(srcKey);
+		const destPath = this.resolvePath(destKey);
+		await promises.mkdir(dirname(destPath), { recursive: true });
+		await promises.copyFile(srcPath, destPath);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.writeMeta(destKey, {
+			createdAt: now,
+			lastAccessedAt: now
+		});
+	}
+	/**
+	* Recursively collect data files under `dir`, returning each as a cache key
+	* relative to `basePath` paired with its mtime. Metadata sidecars
+	* (`*.meta.json`) and the atomic-write temp files (`*.tmp-*`) are skipped so
+	* `list()` only surfaces real cache objects.
+	*/
+	async walkDataFiles(dir, keyPrefix) {
+		const out = [];
+		const dirents = await promises.readdir(dir, { withFileTypes: true });
+		for (const dirent of dirents) {
+			const childPath = join(dir, dirent.name);
+			const childKey = keyPrefix ? `${keyPrefix}/${dirent.name}` : dirent.name;
+			if (dirent.isDirectory()) {
+				out.push(...await this.walkDataFiles(childPath, childKey));
+				continue;
+			}
+			if (dirent.name.endsWith(".meta.json") || /\.tmp-[0-9a-f]+$/.test(dirent.name)) continue;
+			const stat = await promises.stat(childPath);
+			out.push({
+				key: childKey,
+				mtime: stat.mtimeMs
+			});
 		}
+		return out;
+	}
+	signedUrl(method, key) {
+		const { token } = signToken(this.signingSecret, method, key);
+		const encodedKey = key.split("/").map((seg) => encodeURIComponent(seg)).join("/");
+		return `${this.baseUrl}${this.routePrefix}${encodedKey}?sig=${encodeURIComponent(token)}`;
+	}
+	async deleteFiles(key) {
+		await promises.rm(this.resolvePath(key), { force: true });
+		await promises.rm(this.metaPath(key), { force: true });
+	}
+};
+function isNotFoundFsError(err) {
+	return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+/**
+* Write a file atomically: write to a temp sibling, fsync, rename. Avoids
+* partial reads if the orchestrator crashes mid-write. The temp suffix is
+* randomised so concurrent writers don't collide on the same temp name.
+*/
+async function writeFileAtomic(path, data) {
+	const tmp = `${path}.tmp-${randomBytes(6).toString("hex")}`;
+	const handle = await promises.open(tmp, "w");
+	try {
+		await handle.writeFile(data);
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+	await promises.rename(tmp, path);
+}
+//#endregion
+//#region src/storage/index.ts
+/**
+* Create a cache storage backend from configuration.
+*/
+function createCacheStorage(config) {
+	if (config.type === "s3") return new S3CacheStorage({
+		bucket: config.bucket,
+		prefix: config.prefix,
+		ttlMs: config.ttlMs,
+		region: config.region,
+		endpoint: config.endpoint,
+		externalEndpoint: config.externalEndpoint,
+		uploadEndpoint: config.uploadEndpoint,
+		forcePathStyle: config.forcePathStyle
 	});
-	runs.command("secret-outputs <runId>").description("List per-job secret outputs (masked by default; --reveal decrypts and audits)").option("--output-key <key>", "Filter to a single output_key").option("--reveal", "Decrypt and print plaintext values. Audited with actor=secret-outputs.reveal; requires secret.reveal permission").option("--json", "Emit raw JSON instead of a table").action(async (runId, opts) => {
+	if (config.type === "filesystem") return new FilesystemCacheStorage({
+		basePath: config.basePath,
+		ttlMs: config.ttlMs,
+		baseUrl: config.baseUrl,
+		signingSecret: config.signingSecret
+	});
+	throw new Error(`Unknown cache storage type: ${config.type}`);
+}
+//#endregion
+//#region src/provenance/trust-root.ts
+/**
+* Derive the JWKS URI for a provenance OIDC issuer. Identical to the Platform's
+* own derivation (`packages/platform/src/dashboard/routes/runs.ts`) so a bundle
+* verified client-side and at ingest resolve the same key set.
+*/
+function deriveJwksUri(issuer) {
+	return `${issuer.replace(/\/+$/, "")}/.well-known/jwks.json`;
+}
+function createProvenanceTrustRoot(opts = {}) {
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const ttlMs = opts.ttlMs ?? 5 * 6e4;
+	let issuer = opts.issuer ?? null;
+	let cache = null;
+	async function fetchJwks() {
+		if (!issuer) return null;
 		try {
-			if (opts.reveal) process.stderr.write("⚠  --reveal will decrypt secret values; this call is recorded in secret_audit_log.\n");
-			const response = await getClient().getRunSecretOutputs(runId, {
-				outputKey: opts.outputKey,
-				reveal: Boolean(opts.reveal)
-			});
-			if (opts.json) {
-				console.log(JSON.stringify(response, null, 2));
-				return;
+			const res = await fetchImpl(deriveJwksUri(issuer));
+			if (!res.ok) return null;
+			const jwks = await res.json();
+			cache = {
+				jwks,
+				at: Date.now()
+			};
+			return jwks;
+		} catch {
+			return null;
+		}
+	}
+	function hasKid(jwks, kid) {
+		if (!kid || !jwks) return true;
+		return jwks.keys.some((k) => k.kid === kid);
+	}
+	return {
+		getIssuer: () => issuer,
+		getJwks: async (kid) => {
+			if (cache && Date.now() - cache.at < ttlMs && hasKid(cache.jwks, kid)) return cache.jwks;
+			return await fetchJwks();
+		},
+		setIssuer: (next) => {
+			if (next !== issuer) cache = null;
+			issuer = next;
+		}
+	};
+}
+//#endregion
+//#region src/provenance/verify-at-ingest.ts
+/**
+* Compute the verification verdict for a stored provenance bundle at ingest.
+*
+* Fail-closed: a missing trust root, unfetchable JWKS, missing storage, or an
+* unreadable bundle all yield `unverifiable` (never silently `verified`). A
+* bundle that verifies false yields `failed` with the first failure code. Any
+* thrown error is caught and recorded as `unverifiable` — verification never
+* fails the upload.
+*/
+async function computeAttestationVerdict(opts) {
+	const { trustRoot, storage, storageKey } = opts;
+	const status = attestationVerifyStatusSchema.enum;
+	try {
+		const issuer = trustRoot?.getIssuer() ?? null;
+		if (!issuer) return {
+			verifyStatus: status.unverifiable,
+			verifyReason: "no_issuer_configured",
+			verifiedAt: null
+		};
+		if (!storage) return {
+			verifyStatus: status.unverifiable,
+			verifyReason: "no_storage",
+			verifiedAt: null
+		};
+		const jwks = await trustRoot.getJwks();
+		if (!jwks) return {
+			verifyStatus: status.unverifiable,
+			verifyReason: "jwks_fetch_failed",
+			verifiedAt: null
+		};
+		const raw = await storage.get(storageKey);
+		if (!raw) return {
+			verifyStatus: status.unverifiable,
+			verifyReason: "bundle_unreadable",
+			verifiedAt: null
+		};
+		const result = await verifyKiciBundle({
+			bundle: JSON.parse(raw.toString("utf8")),
+			jwks,
+			expectedIssuer: issuer
+		});
+		return {
+			verifyStatus: result.verified ? status.verified : status.failed,
+			verifyReason: result.verified ? null : result.failures[0] ?? "verification_failed",
+			verifiedAt: /* @__PURE__ */ new Date()
+		};
+	} catch (err) {
+		opts.logWarn?.(toErrorMessage(err));
+		return {
+			verifyStatus: status.unverifiable,
+			verifyReason: "verify_error",
+			verifiedAt: null
+		};
+	}
+}
+//#endregion
+//#region src/cli/commands/attestations-reverify.ts
+const logger$9 = createLogger({ prefix: "kici-admin-attestations" });
+/**
+* Backfill / refresh attestation verdicts. By default it re-evaluates only rows
+* that have no usable verdict yet (`pending` / `unverifiable`) — the rollout
+* path for rows recorded before verify-at-ingest, or before an org configured
+* provenance. With `--all` it re-evaluates every row. Idempotent: re-running
+* over already-verified rows (when `--all`) recomputes the same verdict.
+*/
+async function reverifyAttestations(db, trustRoot, storage, opts) {
+	let query = db.selectFrom("attestations").select([
+		"id",
+		"storage_key",
+		"verify_status"
+	]);
+	if (!opts.all) query = query.where("verify_status", "in", ["pending", "unverifiable"]);
+	const rows = await query.execute();
+	let updated = 0;
+	for (const row of rows) {
+		const verdict = await computeAttestationVerdict({
+			trustRoot,
+			storage,
+			storageKey: row.storage_key,
+			logWarn: (reason) => logger$9.warn("reverify: verification error", {
+				attestationId: row.id,
+				reason
+			})
+		});
+		await db.updateTable("attestations").set({
+			verify_status: verdict.verifyStatus,
+			verify_reason: verdict.verifyReason,
+			verified_at: verdict.verifiedAt
+		}).where("id", "=", row.id).execute();
+		updated += 1;
+		logger$9.info("reverify: updated attestation verdict", {
+			attestationId: row.id,
+			from: row.verify_status,
+			to: verdict.verifyStatus
+		});
+	}
+	return {
+		updated,
+		scanned: rows.length
+	};
+}
+//#endregion
+//#region src/cli/commands/attestations.ts
+/**
+* `kici-admin attestations` — orchestrator-DB-direct provenance maintenance.
+*
+*   attestations reverify [--all]   Recompute stored verdicts (verify-at-ingest
+*                                   backfill). Default scope: pending /
+*                                   unverifiable rows; `--all` re-evaluates
+*                                   every row. Direct DB + object storage.
+*
+* Classified `kici-admin` (orchestrator DB plane) per .claude/rules/platform-admin.md.
+*/
+init_client();
+const logger$8 = createLogger({ prefix: "kici-admin-attestations" });
+function resolveDatabaseUrl$1(explicit) {
+	const url = explicit ?? process.env.KICI_DATABASE_URL;
+	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
+	return url;
+}
+/** Build the provenance object-storage handle from config (s3 / filesystem). */
+function buildStorage(config) {
+	if (config.storage?.type === "s3") return createCacheStorage({
+		type: "s3",
+		bucket: config.storage.bucket,
+		prefix: config.storage.prefix ?? "",
+		ttlMs: config.cacheTtlDays * 864e5,
+		region: config.storage.region,
+		endpoint: config.storage.endpoint,
+		externalEndpoint: config.storage.externalEndpoint,
+		uploadEndpoint: config.storage.uploadEndpoint,
+		forcePathStyle: config.storage.forcePathStyle
+	});
+	if (config.storage?.type === "filesystem") return createCacheStorage({
+		type: "filesystem",
+		basePath: config.storage.fsBasePath,
+		ttlMs: config.cacheTtlDays * 864e5,
+		baseUrl: config.storage.fsBaseUrl ?? `http://127.0.0.1:${config.port}`,
+		signingSecret: "kici-admin-reverify"
+	});
+}
+async function confirmInteractive$1(prompt) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	try {
+		const answer = await new Promise((resolve) => rl.question(prompt, resolve));
+		return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+	} finally {
+		rl.close();
+	}
+}
+function registerAttestationsCommands(program) {
+	program.command("attestations").description("Provenance-attestation maintenance (orchestrator DB)").command("reverify").description("Recompute stored attestation verdicts (verify-at-ingest backfill)").option("--all", "Re-evaluate every attestation (default: only pending/unverifiable)").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--yes", "Skip the --all confirmation prompt").action(async (opts) => {
+		try {
+			const config = loadConfig();
+			const url = resolveDatabaseUrl$1(opts.databaseUrl ?? (config.databaseUrl || void 0));
+			if (opts.all && !opts.yes) {
+				if (!await confirmInteractive$1("Re-evaluate the verdict of EVERY attestation (including already-verified)? [y/N] ")) {
+					console.error("Aborted.");
+					process.exit(1);
+				}
 			}
-			if (response.outputs.length === 0) {
-				console.log("No secret outputs for this run.");
-				return;
+			const pool = createPool(url);
+			const db = createDb$1(pool);
+			const storage = buildStorage(config);
+			const trustRoot = createProvenanceTrustRoot({ issuer: config.provenanceIssuer ?? null });
+			try {
+				const { updated, scanned } = await reverifyAttestations(db, trustRoot, storage, { all: !!opts.all });
+				logger$8.info("attestations reverify complete", {
+					updated,
+					scanned
+				});
+				process.stderr.write(`Reverified ${updated} of ${scanned} attestation(s).\n`);
+			} finally {
+				await db.destroy();
+				await pool.end().catch(() => {});
 			}
-			const headers = opts.reveal ? [
-				"job_id",
-				"output_key",
-				"value",
-				"created_at"
-			] : [
-				"job_id",
-				"output_key",
-				"masked",
-				"created_at"
-			];
-			const rows = response.outputs.map((o) => opts.reveal ? [
-				o.jobId,
-				o.outputKey,
-				o.value ?? o.revealError ?? "(decrypt failed)",
-				o.createdAt
-			] : [
-				o.jobId,
-				o.outputKey,
-				String(o.masked),
-				o.createdAt
-			]);
-			console.log(renderTable$2(headers, rows));
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -9744,6 +11406,44 @@ function getInstallBase(platform, name) {
 		case "windows": return `C:\\Program Files\\KiCI\\${name}${sep}`;
 	}
 }
+/**
+* Build the interactive `--pick` choices, newest-first (lexicographic, matching
+* the rest of the versioned-directory handling). The currently-active version is
+* labeled `(current)` and disabled so it cannot be selected — picking it would be
+* a no-op restart.
+*/
+function buildPickChoices(versions, current) {
+	return [...versions].sort().reverse().map((v) => ({
+		value: v,
+		name: v === current ? `${v} (current)` : v,
+		disabled: v === current ? "current version" : false
+	}));
+}
+/**
+* The versions a `--pick` switch may target: every installed version except the
+* currently-active one. Empty when only the current version (or nothing) is
+* installed — the caller turns that into a "nothing to pick" error.
+*/
+function selectablePickTargets(versions, current) {
+	return versions.filter((v) => v !== current);
+}
+/**
+* Validate that `--pick` is not combined with a source/mode flag it conflicts
+* with. `--pick` activates an already-installed version, so it never downloads
+* (`--from`/`--url`), never takes an explicit `--version`, and is its own mode
+* (not `--rollback`/`--cleanup`). Returns an error message, or null when OK.
+*/
+function checkPickFlagConflicts(opts) {
+	if (!opts.pick) return null;
+	const conflicts = [];
+	if (opts.from) conflicts.push("--from");
+	if (opts.url) conflicts.push("--url");
+	if (opts.version) conflicts.push("--version");
+	if (opts.rollback) conflicts.push("--rollback");
+	if (opts.cleanup) conflicts.push("--cleanup");
+	if (conflicts.length === 0) return null;
+	return `--pick cannot be combined with ${conflicts.join(", ")}. --pick activates an already-installed version; it never downloads or takes an explicit version.`;
+}
 /** Check if the platform is Windows. */
 function isWindows(platform) {
 	return platform === "windows";
@@ -9901,8 +11601,17 @@ async function performVersionedUpgrade(component, opts) {
 			console.error("Error: root privileges required to upgrade system-level services");
 			process.exit(1);
 		}
+		const pickConflict = checkPickFlagConflicts(opts);
+		if (pickConflict) {
+			console.error(`Error: ${pickConflict}`);
+			process.exit(1);
+		}
+		if (opts.pick) {
+			await handlePick(component, platform, installBase, config, manager, resolvedInstance, opts);
+			return;
+		}
 		if (opts.rollback) {
-			await handleRollback(component, platform, installBase, config, manager, opts);
+			await handleRollback(component, platform, installBase, config, manager, resolvedInstance, opts);
 			return;
 		}
 		if (opts.cleanup) {
@@ -10061,9 +11770,89 @@ async function performNpmSourceUpgrade(component, config, resolvedInstance, mana
 	console.log(`Upgrade complete: service "${config.name}" is now running version ${verdict.version}.`);
 }
 /**
+* Handle `--pick`: interactively choose an already-installed version and switch
+* the active version pointer to it. Lists every installed version (the active
+* one shown disabled), confirms the change, then delegates to
+* {@link switchToInstalledVersion}.
+*/
+async function handlePick(component, platform, installBase, config, manager, resolvedInstance, opts) {
+	if (!process.stdin.isTTY) {
+		console.error("Error: --pick requires an interactive terminal; pass an explicit archive (--from/--url) or use --rollback for non-interactive switching.");
+		process.exit(1);
+	}
+	const versions = listInstalledVersions(installBase, component);
+	const current = getCurrentVersion(installBase, component, platform);
+	if (selectablePickTargets(versions, current).length === 0) {
+		const only = current ?? versions[0];
+		console.error(only ? `Error: only one version installed (${only}), nothing to pick.` : `Error: no installed versions found for ${component}.`);
+		process.exit(1);
+	}
+	const target = await select({
+		message: `Select a ${component} version to activate:`,
+		choices: buildPickChoices(versions, current)
+	});
+	if (!opts.yes) {
+		console.log(`This will switch "${config.name}":`);
+		if (current) console.log(`  Current version: ${current}`);
+		console.log(`  Pick target: ${target}`);
+		console.log(`  Install path: ${path.join(installBase, `${component}-${target}`)}`);
+		console.log("  The service will be stopped during the switch.");
+		console.log("");
+		if (!await confirm$2("Proceed with switch?")) {
+			console.log("Pick cancelled.");
+			return;
+		}
+	}
+	await switchToInstalledVersion({
+		component,
+		platform,
+		installBase,
+		config,
+		manager,
+		resolvedInstance,
+		targetVersion: target
+	});
+	console.log("");
+	console.log(`Switched: ${current ?? "(unknown)"} -> ${target}`);
+}
+/**
+* Stop the service, switch the active version pointer to an already-installed
+* versioned directory (atomic symlink on Unix; uninstall→install + version file
+* on Windows), restart, and persist the new `kiciVersion` into the manifest.
+*
+* Shared by `--rollback` (switch to the previous version) and `--pick` (switch
+* to any chosen installed version).
+*/
+async function switchToInstalledVersion(args) {
+	const { component, platform, installBase, config, manager, resolvedInstance, targetVersion } = args;
+	console.log("Stopping service...");
+	if ((await manager.status(config)).state === "running") {
+		await manager.stop(config);
+		console.log("Service stopped.");
+	}
+	if (isWindows(platform)) {
+		const launcherPath = path.join(installBase, `${component}-${targetVersion}`, getLauncherName(component, platform));
+		config.executablePath = launcherPath;
+		await manager.uninstall(config);
+		await manager.install(config);
+		writeCurrentVersion(installBase, component, targetVersion);
+		console.log(`Service registration updated to ${launcherPath}`);
+	} else {
+		updateSymlinkAtomic(installBase, component, targetVersion);
+		console.log(`Symlink updated: ${path.join(installBase, component)} -> ${component}-${targetVersion}`);
+	}
+	console.log("Starting service...");
+	await manager.start(config);
+	console.log("Service started.");
+	writeManifest(resolvedInstance.instanceDir, {
+		...resolvedInstance.manifest,
+		kiciVersion: targetVersion
+	});
+}
+/**
 * Handle --rollback: switch symlink to the previous version and restart.
 */
-async function handleRollback(component, platform, installBase, config, manager, opts) {
+async function handleRollback(component, platform, installBase, config, manager, resolvedInstance, opts) {
 	const versions = listInstalledVersions(installBase, component);
 	if (versions.length < 2) {
 		console.error("Error: no previous version available for rollback");
@@ -10096,25 +11885,15 @@ async function handleRollback(component, platform, installBase, config, manager,
 			return;
 		}
 	}
-	console.log("Stopping service...");
-	if ((await manager.status(config)).state === "running") {
-		await manager.stop(config);
-		console.log("Service stopped.");
-	}
-	if (isWindows(platform)) {
-		const launcherPath = path.join(installBase, `${component}-${previousVersion}`, getLauncherName(component, platform));
-		config.executablePath = launcherPath;
-		await manager.uninstall(config);
-		await manager.install(config);
-		writeCurrentVersion(installBase, component, previousVersion);
-		console.log(`Service registration updated to ${launcherPath}`);
-	} else {
-		updateSymlinkAtomic(installBase, component, previousVersion);
-		console.log(`Symlink updated: ${path.join(installBase, component)} -> ${component}-${previousVersion}`);
-	}
-	console.log("Starting service...");
-	await manager.start(config);
-	console.log("Service started.");
+	await switchToInstalledVersion({
+		component,
+		platform,
+		installBase,
+		config,
+		manager,
+		resolvedInstance,
+		targetVersion: previousVersion
+	});
 	console.log("");
 	console.log(`Rollback complete: ${currentVersion} -> ${previousVersion}`);
 }
@@ -10864,7 +12643,7 @@ function registerLogsCommand(parent) {
 //#endregion
 //#region src/cli/commands/orchestrator-service/upgrade.ts
 function registerUpgradeCommand(parent) {
-	parent.command("upgrade").description("Upgrade orchestrator to a new version using versioned directory layout").option("--platform <type>", "Service platform (systemd|launchd|windows|compose)").option("--instance-dir <path>", "Deploy folder of the instance to upgrade").option("--name <name>", "Service name (no default — must resolve via flag/CWD)").option("--from <path>", "Path to package archive (.tar.gz or .zip)").option("--url <url>", "URL to download package archive from").option("--version <version>", "Target version string (e.g., 0.3.0)").option("--yes", "Skip confirmation prompt").option("--force", "Overwrite existing versioned directory").option("--cleanup", "Remove old versions (keeps current and previous)").option("--rollback", "Roll back to the previous version").action(async (opts) => {
+	parent.command("upgrade").description("Upgrade orchestrator to a new version using versioned directory layout").option("--platform <type>", "Service platform (systemd|launchd|windows|compose)").option("--instance-dir <path>", "Deploy folder of the instance to upgrade").option("--name <name>", "Service name (no default — must resolve via flag/CWD)").option("--from <path>", "Path to package archive (.tar.gz or .zip)").option("--url <url>", "URL to download package archive from").option("--version <version>", "Target version string (e.g., 0.3.0)").option("--yes", "Skip confirmation prompt").option("--force", "Overwrite existing versioned directory").option("--cleanup", "Remove old versions (keeps current and previous)").option("--rollback", "Roll back to the previous version").option("--pick", "Interactively pick an installed version to activate").action(async (opts) => {
 		await performVersionedUpgrade("orchestrator", opts);
 	});
 }
@@ -11364,7 +13143,7 @@ function registerAgentLogsCommand(parent) {
 //#endregion
 //#region src/cli/commands/agent-service/upgrade.ts
 function registerAgentUpgradeCommand(parent) {
-	parent.command("upgrade").description("Upgrade agent to a new version using versioned directory layout").option("--platform <type>", "Service platform (systemd|launchd|windows|compose)").option("--instance-dir <path>", "Deploy folder of the instance to upgrade").option("--name <name>", "Service name (no default — must resolve via flag/CWD)").option("--from <path>", "Path to package archive (.tar.gz or .zip)").option("--url <url>", "URL to download package archive from").option("--version <version>", "Target version string (e.g., 0.3.0)").option("--yes", "Skip confirmation prompt").option("--force", "Overwrite existing versioned directory").option("--cleanup", "Remove old versions (keeps current and previous)").option("--rollback", "Roll back to the previous version").action(async (opts) => {
+	parent.command("upgrade").description("Upgrade agent to a new version using versioned directory layout").option("--platform <type>", "Service platform (systemd|launchd|windows|compose)").option("--instance-dir <path>", "Deploy folder of the instance to upgrade").option("--name <name>", "Service name (no default — must resolve via flag/CWD)").option("--from <path>", "Path to package archive (.tar.gz or .zip)").option("--url <url>", "URL to download package archive from").option("--version <version>", "Target version string (e.g., 0.3.0)").option("--yes", "Skip confirmation prompt").option("--force", "Overwrite existing versioned directory").option("--cleanup", "Remove old versions (keeps current and previous)").option("--rollback", "Roll back to the previous version").option("--pick", "Interactively pick an installed version to activate").action(async (opts) => {
 		await performVersionedUpgrade("agent", opts);
 	});
 }
@@ -11911,19 +13690,67 @@ var HostRosterStore = class {
 	async stampLastSeen(agentId, instanceId) {
 		await this.db.updateTable("host_roster").set({ last_seen: sql`now()` }).where("agent_id", "=", agentId).where("connected_instance_id", "=", instanceId).execute();
 	}
-	/** Operator pre-declare of a static host before its agent dials in. */
+	/**
+	* Operator pre-declare of a static host. A re-declare of an existing agent_id
+	* converges the operator-owned columns (labels, hostname, reach,
+	* host_properties) to the newly-declared values while preserving the
+	* agent-reported liveness/identity columns (connected_instance_id, last_seen,
+	* platform, arch, lifecycle_class, token_id, reboot_pending_until). The
+	* optional reach fields (`address`/`sshUser`/`sshPort`/`sshKeySecret`) carry
+	* how to SSH to the host for bootstrap bring-up. Each operator field is
+	* preserve-on-omit: an omitted field keeps the existing column value.
+	*
+	* Returns `{ created: true }` when the declare inserted a new row,
+	* `{ created: false }` when it converged an existing one.
+	*/
 	async declareStatic(input) {
-		await this.db.insertInto("host_roster").values({
+		const labelsBind = input.labels === void 0 ? null : JSON.stringify(input.labels);
+		const propsBind = input.properties === void 0 ? null : JSON.stringify(input.properties);
+		return { created: !!(await this.db.insertInto("host_roster").values({
 			agent_id: input.agentId,
 			token_id: null,
 			lifecycle_class: "static",
-			labels: JSON.stringify(input.labels),
+			labels: JSON.stringify(input.labels ?? []),
 			hostname: input.hostname ?? null,
 			connected_instance_id: null,
 			host_properties: JSON.stringify(input.properties ?? {}),
+			address: input.address ?? null,
+			ssh_user: input.sshUser ?? null,
+			ssh_port: input.sshPort ?? null,
+			ssh_key_secret: input.sshKeySecret ?? null,
 			last_seen: sql`now()`,
 			updated_at: sql`now()`
-		}).onConflict((oc) => oc.column("agent_id").doNothing()).execute();
+		}).onConflict((oc) => oc.column("agent_id").doUpdateSet({
+			labels: sql`COALESCE(${labelsBind}, host_roster.labels)`,
+			hostname: sql`COALESCE(${input.hostname ?? null}, host_roster.hostname)`,
+			host_properties: sql`COALESCE(host_roster.host_properties, '{}'::jsonb) || COALESCE(${propsBind}::jsonb, '{}'::jsonb)`,
+			address: sql`COALESCE(${input.address ?? null}, host_roster.address)`,
+			ssh_user: sql`COALESCE(${input.sshUser ?? null}, host_roster.ssh_user)`,
+			ssh_port: sql`COALESCE(${input.sshPort ?? null}, host_roster.ssh_port)`,
+			ssh_key_secret: sql`COALESCE(${input.sshKeySecret ?? null}, host_roster.ssh_key_secret)`,
+			updated_at: sql`now()`
+		})).returning(sql`(xmax = 0)`.as("created")).executeTakeFirstOrThrow()).created };
+	}
+	/**
+	* Read a host's pre-agent reach metadata. Returns null when the host is not
+	* in the roster; a host declared without reach fields reads back with nulls.
+	*/
+	async getReach(agentId) {
+		const row = await this.db.selectFrom("host_roster").select([
+			"agent_id",
+			"address",
+			"ssh_user",
+			"ssh_port",
+			"ssh_key_secret"
+		]).where("agent_id", "=", agentId).executeTakeFirst();
+		if (!row) return null;
+		return {
+			agentId: row.agent_id,
+			address: row.address,
+			sshUser: row.ssh_user,
+			sshPort: row.ssh_port,
+			sshKeySecret: row.ssh_key_secret
+		};
 	}
 	async get(agentId) {
 		return await this.db.selectFrom("host_roster").selectAll().where("agent_id", "=", agentId).executeTakeFirst() ?? null;
@@ -12113,15 +13940,24 @@ function registerHostCommands(program) {
 			process.exit(1);
 		}
 	});
-	host.command("declare").description("Pre-declare a static host before it connects").requiredOption("--agent-id <id>", "Agent id the host will register as").option("--labels <labels>", "Comma-separated labels", "").option("--hostname <name>", "Hostname").option("--prop <key=value>", "Typed host property (repeatable; true/false ⇒ boolean, numeric ⇒ number)", collectProp, []).action(async (opts) => {
+	host.command("declare").description("Pre-declare a static host before it connects").requiredOption("--agent-id <id>", "Agent id the host will register as").option("--labels <labels>", "Comma-separated labels", "").option("--hostname <name>", "Hostname").option("--prop <key=value>", "Typed host property (repeatable; true/false ⇒ boolean, numeric ⇒ number)", collectProp, []).option("--address <host>", "Pre-agent SSH reach address (IP / hostname) for bootstrap").option("--ssh-user <user>", "SSH login user for bootstrap bring-up").option("--ssh-port <port>", "SSH port for bootstrap bring-up").option("--ssh-key-secret <ref>", "Scoped-secret ref (scope/key) holding the bring-up private key").action(async (opts) => {
 		try {
 			const labels = opts.labels ? String(opts.labels).split(",").map((s) => s.trim()).filter(Boolean) : [];
 			const properties = parseHostPropertyAssignments(opts.prop);
+			let sshPort;
+			if (opts.sshPort !== void 0) {
+				sshPort = Number(opts.sshPort);
+				if (!Number.isInteger(sshPort) || sshPort <= 0) throw new Error(`--ssh-port must be a positive integer (got "${opts.sshPort}")`);
+			}
 			await withDb((db) => new HostRosterStore(db).declareStatic({
 				agentId: opts.agentId,
 				labels,
 				hostname: opts.hostname,
-				properties
+				properties,
+				address: opts.address,
+				sshUser: opts.sshUser,
+				sshPort,
+				sshKeySecret: opts.sshKeySecret
 			}));
 			console.log(`Declared static host: ${opts.agentId}`);
 		} catch (err) {
@@ -12817,7 +14653,10 @@ function printShowEnvironment(res) {
 	} else console.log("variables: none");
 	if (res.bindings.length > 0) {
 		console.log(`bindings (${res.bindings.length}):`);
-		for (const b of res.bindings) console.log(`  ${b.scope_pattern}`);
+		for (const b of res.bindings) {
+			const host = b.host_pattern && b.host_pattern !== "**" ? `  (host: ${b.host_pattern})` : "";
+			console.log(`  ${b.scope_pattern}${host}`);
+		}
 	} else console.log("bindings: none");
 }
 function registerEnvironmentCommands(program, getClient) {
@@ -12852,17 +14691,19 @@ function registerEnvironmentCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
-	env.command("bind").description("Upsert an environment_bindings row (scope_pattern → environment)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").requiredOption("--scope <pattern>", "Scope pattern (e.g. \"staging\" or \"aws/prod/**\")").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
+	env.command("bind").description("Upsert an environment_bindings row (scope_pattern → environment)").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Environment name").requiredOption("--scope <pattern>", "Scope pattern (e.g. \"staging\" or \"aws/prod/**\")").option("--host <pattern>", "Host selector (exact/glob/regex over agentId/host/labels); \"**\" = all hosts", "**").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
 			const payload = {
 				orgId: opts.org,
 				envName: opts.env,
-				scopePattern: opts.scope
+				scopePattern: opts.scope,
+				hostPattern: opts.host
 			};
 			const result = dbUrl ? await seedEnvironmentBindingDirect(dbUrl, payload) : await getClient().post(`/api/v1/admin/environments/${encodeURIComponent(opts.env)}/bind`, {
 				orgId: opts.org,
-				scopePattern: opts.scope
+				scopePattern: opts.scope,
+				hostPattern: opts.host
 			});
 			if (opts.json) console.log(JSON.stringify(result));
 			else console.log(`environment bind: created=${result.created}${dbUrl ? " (direct)" : ""}`);
@@ -18822,6 +20663,7 @@ function buildProgram() {
 	registerRemoteSourceCommands(program);
 	registerWorkflowCommands(program, getClient);
 	registerRunsCommands(program, getClient);
+	registerAttestationsCommands(program);
 	registerEventLogCommands(program, getClient);
 	registerAccessLogCommands(program, getClient);
 	registerBackendCommands(program, getClient);