@kici-dev/orchestrator 0.1.23 → 0.1.24

package/dist/config.d.ts

@@ -27,6 +27,7 @@ declare const configSchema: z.ZodObject<{
     platformUrl: z.ZodOptional<z.ZodString>;
     platformToken: z.ZodOptional<z.ZodString>;
     dashboardUrl: z.ZodOptional<z.ZodString>;
+    provenanceIssuer: z.ZodOptional<z.ZodString>;
     webhookPublicUrl: z.ZodOptional<z.ZodString>;
     databaseUrl: z.ZodDefault<z.ZodString>;
     lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -248,6 +249,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     platformUrl?: string | undefined;
     platformToken?: string | undefined;
     dashboardUrl?: string | undefined;
+    provenanceIssuer?: string | undefined;
     webhookPublicUrl?: string | undefined;
     cacheStorageType?: "s3" | "filesystem" | undefined;
     cacheStoragePath?: string | undefined;

package/dist/dashboard/attestation-filters.d.ts

@@ -0,0 +1,70 @@
+import { type Kysely } from 'kysely';
+import type { AttestationListFilters } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+/**
+ * The org-wide attestations base query: joins `attestations` to `execution_jobs`
+ * (for the job name) and `execution_runs` (for repository / workflow context).
+ *
+ * `attestations.run_id` / `job_id` are TEXT (P1.5 schema) while the
+ * `execution_*` keys are `uuid`; Postgres won't compare `uuid = text` implicitly,
+ * so the join casts the uuid side to text — mirroring `resolveAttestationsForRun`.
+ * The `execution_runs` join is a LEFT join so a row with no matching run still
+ * lists (repository / workflow come back null).
+ */
+export declare function baseAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    environments: import("../db/types.js").EnvironmentsTable;
+    host_roster: import("../db/types.js").HostRosterTable;
+    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    dedup_cache: import("../db/types.js").DedupCacheTable;
+    ip_allocations: import("../db/types.js").IpAllocationTable;
+    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
+    execution_jobs: import("../db/types.js").ExecutionJobTable;
+    execution_steps: import("../db/types.js").ExecutionStepTable;
+    raft_state: import("../db/types.js").RaftStateTable;
+    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
+    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
+    environment_bindings: import("../db/types.js").EnvironmentBindingsTable;
+    environment_variables: import("../db/types.js").EnvironmentVariablesTable;
+    environment_source_overrides: import("../db/types.js").EnvironmentSourceOverridesTable;
+    held_runs: import("../db/types.js").HeldRunsTable;
+    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
+    admin_tokens: import("../db/types.js").AdminTokenTable;
+    agent_tokens: import("../db/types.js").AgentTokenTable;
+    config_versions: import("../db/types.js").ConfigVersionTable;
+    kici_events: import("../db/types.js").KiciEventTable;
+    generic_webhook_sources: import("../db/types.js").GenericWebhookSourceTable;
+    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
+    test_uploads: import("../db/types.js").TestUploadsTable;
+    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
+    registry_versions: import("../db/types.js").RegistryVersionsTable;
+    cron_last_fired: import("../db/types.js").CronLastFiredTable;
+    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
+    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
+    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
+    sources: import("../db/types.js").SourcesTable;
+    cluster_meta: import("../db/types.js").ClusterMetaTable;
+    join_tokens: import("../db/types.js").JoinTokenTable;
+    org_settings: import("../db/types.js").OrgSettingsTable;
+    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
+    pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
+    pending_workflow_contexts: import("../db/types.js").PendingWorkflowContextsTable;
+    event_log: import("../db/types.js").EventLogTable;
+    access_log: import("../db/types.js").AccessLogTable;
+    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
+    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
+    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
+    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
+    scaler_reservations: import("../db/types.js").ScalerReservationsTable;
+    attestations: import("../db/types.js").AttestationsTable;
+    remote_sources: import("../db/types.js").RemoteSourcesTable;
+}, "execution_runs" | "execution_jobs" | "attestations", {}>;
+export type AttestationsBaseQuery = ReturnType<typeof baseAttestationsQuery>;
+/**
+ * Apply org-wide attestation filters to the base query. Digest is exact-match;
+ * name is an ILIKE substring; status / repository / workflow / job are equality;
+ * created_at gets `>=` / `<=` bounds for the date range. Absent filters are
+ * skipped.
+ */
+export declare function applyAttestationFilters(qb: AttestationsBaseQuery, filters: AttestationListFilters): AttestationsBaseQuery;
+//# sourceMappingURL=attestation-filters.d.ts.map

package/dist/dashboard/handler.d.ts

@@ -13,7 +13,7 @@
  */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
-import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest } from '@kici-dev/engine';
+import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest } from '@kici-dev/engine';
 import type { Database } from '../db/types.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { CacheStorage } from '../storage/types.js';
@@ -166,6 +166,14 @@ export declare class DashboardHandler {
      * builds a nested job/step tree, and sends the response.
      */
     handleRunDetail(msg: DashboardRunDetailRequest): Promise<void>;
+    /**
+     * Handle a dashboard.run.structured request — the user-plane equivalent of
+     * the orchestrator-admin `/runs/:id/structured` endpoint. Reuses the Phase-1
+     * aggregator + provenance mapper so the result is byte-identical to the admin
+     * surface; emits an `access_log` `run.structured.read` row (carrying the
+     * agent label when the actor came through an agent PAT).
+     */
+    handleRunStructured(msg: DashboardRunStructuredRequest): Promise<void>;
     /**
      * Resolve every routing key owned by an org by unioning both source
      * tables. The orchestrator is single-org but multi-routing-key: one org
@@ -275,6 +283,30 @@ export declare class DashboardHandler {
      * skipped (best-effort) rather than failing the whole list.
      */
     handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
+    /**
+     * Fetch + parse one attestation bundle from object storage. Returns the full
+     * detail item, or null when the bundle is missing or not valid JSON (logged).
+     * Shared by `handleAttestationsList` (per-run) and `handleAttestationGet`.
+     */
+    private inlineBundle;
+    /**
+     * Org-wide attestations query: one page of metadata-only summaries (no bundle
+     * fetch) plus the total matching count. Filters/pagination/sort applied via
+     * the shared filter builder.
+     */
+    private resolveAttestationsListAll;
+    /**
+     * Handle a dashboard.attestations.list.all request: org-wide, paginated,
+     * filtered list of attestation summaries (metadata only). Access-logged
+     * against the `attestation` target.
+     */
+    handleAttestationsListAll(msg: DashboardAttestationsListAllRequest): Promise<void>;
+    /**
+     * Handle a dashboard.attestation.get request: a single attestation by id with
+     * its bundle inlined for the detail page. Resolves the run-owning org for the
+     * access-log row, then logs against the `attestation` target.
+     */
+    handleAttestationGet(msg: DashboardAttestationGetRequest): Promise<void>;
     /**
      * Handle a dashboard.payload request.
      * Reads the webhook payload from log storage for the given runId.

package/dist/db/migrations/054_local_working_tree.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Mark runs that executed an uploaded local working tree (`kici run remote`):
+ *
+ * - `execution_runs.local_working_tree boolean NOT NULL DEFAULT false` — true
+ *   for runs that ran a developer's local working tree from the CLI (inline
+ *   lock file). The dashboard renders a "Local machine" badge for these runs
+ *   and avoids building an external repository link from the repo identifier.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
+ * data is preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=054_local_working_tree.d.ts.map

package/dist/db/migrations/055_agent_token_mandatory_labels.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add a token-bound mandatory-label taint to agent tokens:
+ *
+ * - `agent_tokens.mandatory_labels text NULL` — a JSON-encoded `string[]` of
+ *   Kubernetes-taint-style gate labels the token authorizes. When a static
+ *   agent registers with this token, the set becomes the agent's registry-entry
+ *   `mandatoryLabels`: the agent only accepts a job when every label here
+ *   appears in the job's required labels. NULL = no taint (the default; the
+ *   agent accepts any job its advertised labels match), so every existing token
+ *   stays unconfined until re-minted.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=055_agent_token_mandatory_labels.d.ts.map

package/dist/db/migrations/056_execution_jobs_environments.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add a per-job bound deployment-environment list to `execution_jobs`:
+ *
+ * - `execution_jobs.environments text NULL` — a JSON-encoded `string[]` of the
+ *   ordered environment names a job binds (`environments: [...]`), in merge
+ *   order. Written at dispatch with the statically-resolved names (impure
+ *   dynamic elements as a `(dynamic)` placeholder), then overwritten with the
+ *   fully-resolved list when a deferred-init agent eval resolves dynamic
+ *   elements. NULL = the job binds no environment.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=056_execution_jobs_environments.d.ts.map

package/dist/db/migrations/057_step_concurrency.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=057_step_concurrency.d.ts.map

package/dist/db/migrations/058_access_log_agent_label.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=058_access_log_agent_label.d.ts.map

package/dist/db/migrations/059_attestation_verdict.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=059_attestation_verdict.d.ts.map

package/dist/db/migrations/060_run_trigger_actor.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=060_run_trigger_actor.d.ts.map

package/dist/db/types.d.ts

@@ -271,6 +271,8 @@ export interface ExecutionRunTable {
     provider_context: Generated<string>;
     /** Whether this is a CLI-initiated test run */
     is_test_run: Generated<boolean>;
+    /** True when the run executed an uploaded local working tree (`kici run remote`). */
+    local_working_tree: Generated<boolean>;
     /** Fixture ID for test runs (null for real webhook runs) */
     fixture_id: string | null;
     /** Parent run ID for re-run lineage (null for original runs). */
@@ -289,6 +291,22 @@ export interface ExecutionRunTable {
     lock_file_source: string | null;
     /** Username of the contributor (null for non-PR events) */
     contributor_username: string | null;
+    /**
+     * Origin provider of the triggering actor (`github` today). Provider-generic
+     * so GitLab/Bitbucket extend later. Null when no actor was captured.
+     */
+    trigger_actor_provider: string | null;
+    /**
+     * Provider login of the person who triggered the run (pusher / PR author).
+     * Captured for ALL event types, unlike the PR-only `contributor_username`.
+     */
+    trigger_actor_username: string | null;
+    /**
+     * Immutable provider user id of the triggering actor (mirrors
+     * `identity_links.provider_user_id`). Preferred over the mutable username
+     * when resolving the actor to a KiCI user.
+     */
+    trigger_actor_user_id: string | null;
     /** Human-readable reason why the run failed (null for non-failed runs). */
     failure_reason: string | null;
     /**
@@ -371,6 +389,12 @@ export interface ExecutionJobTable {
     dispatched_contexts: Generated<string>;
     /** Aggregated step outputs JSONB (step-keyed map of outputs). Populated on job success. */
     outputs: string | null;
+    /**
+     * Ordered bound deployment-environment names for this job, JSON-encoded
+     * `string[]` (null when the job binds none). Written at dispatch and
+     * overwritten with the agent-resolved list for dynamic environments.
+     */
+    environments: string | null;
     /** Whether all upstream needs edges are satisfied (dispatch gate). */
     needs_satisfied: Generated<boolean>;
     /** Timestamp when needs_satisfied first flipped to true. */
@@ -453,6 +477,13 @@ export interface ExecutionStepTable {
     drift_summary: string | null;
     /** Structured drift value returned by `check()` (JSONB). NULL when no drift. */
     drift: ColumnType<unknown | null, unknown, unknown>;
+    /**
+     * Parallel step-group concurrency role (`sequential` | `parallel-child` |
+     * `parallel-group`). NULL for an ordinary sequential step.
+     */
+    concurrency_kind: string | null;
+    /** Parallel-group correlation id shared by a group's children. NULL for sequential steps. */
+    group_id: string | null;
     /** When this record was created */
     created_at: Generated<Date>;
     /**
@@ -804,6 +835,12 @@ export interface AccessLogTable {
     source: string;
     outcome: string;
     error_message: string | null;
+    /**
+     * Human-set agent name, when the actor authenticated with an agent-kind PAT.
+     * NULL for ordinary human / API-key / system actors. Queryable so the access
+     * log can be filtered by agent.
+     */
+    agent_label: string | null;
     created_at: Generated<Date>;
     /**
      * Set inside the archive transaction before the row is DELETEd.
@@ -857,6 +894,14 @@ export interface AgentTokenTable {
     token_prefix: string;
     /** JSON-encoded string[] of agent labels (null = any) */
     labels: string | null;
+    /**
+     * JSON-encoded string[] of mandatory labels (a Kubernetes-taint-style gate):
+     * a static agent registering with this token only accepts a job when every
+     * label here appears in the job's required labels. null = no taint (the
+     * default; the agent accepts any job its advertised labels match).
+     * Authorized at mint time alongside `labels`.
+     */
+    mandatory_labels: string | null;
     /** Token type: 'ephemeral' (scaler-issued) or 'static' (CLI-created) */
     agent_type: string;
     /** When this token was created */
@@ -1585,6 +1630,16 @@ export interface AttestationsTable {
     media_type: string;
     /** When this row was inserted. */
     created_at: Generated<Date>;
+    /**
+     * Server-side verification verdict computed at ingest. One of
+     * `verified` / `failed` / `unverifiable` / `pending`
+     * (`attestationVerifyStatusSchema.enum.*`). DB default is `pending`.
+     */
+    verify_status: Generated<string>;
+    /** First failure code from `verifyKiciBundle`, or NULL when verified/pending. */
+    verify_reason: string | null;
+    /** When the verdict was recorded (explicitly set, not DB-generated). */
+    verified_at: Date | null;
 }
 export type AttestationRow = Selectable<AttestationsTable>;
 export type NewAttestationRow = Insertable<AttestationsTable>;

package/dist/environments/protection/aggregate.d.ts

@@ -0,0 +1,43 @@
+import { EnvGateRejectReason, type Environment } from '@kici-dev/engine';
+import type { JobDispatchContext } from './pipeline.js';
+/** A single environment's rejection under all-must-pass aggregation. */
+export interface EnvGateRejection {
+    environment: string;
+    reason: EnvGateRejectReason;
+    detail: string;
+}
+/** Effective protection parameters after most-restrictive aggregation. */
+export interface EffectiveProtection {
+    minimumTrust?: 'known' | 'trusted';
+    requiredReviewers: string[];
+    waitTimerSeconds: number | null;
+    holdExpirySeconds: number;
+    concurrencyLimit: number | null;
+    concurrencyStrategy: 'queue' | 'cancel-pending';
+}
+/**
+ * Evaluate each environment's hard reject gates against the run context. A name
+ * with no `Environment` record yields an `env_not_found` rejection. Returns all
+ * rejections (empty = every environment passed the reject gates).
+ */
+export declare function evaluateMultiEnvGates(envs: ReadonlyArray<{
+    name: string;
+    env: Environment | undefined;
+}>, ctx: JobDispatchContext): EnvGateRejection[];
+/**
+ * Aggregate hold/wait/queue parameters across all bound environments, most
+ * restrictive wins: trust = max tier, reviewers = sorted dedup union, wait timer
+ * = max, hold expiry = min, concurrency limit = min (tightest). The concurrency
+ * strategy follows the primary (first) environment.
+ */
+export declare function aggregateProtectionParams(envs: ReadonlyArray<Environment>): EffectiveProtection;
+/**
+ * Build a synthetic `Environment` carrying the aggregated protection parameters,
+ * so the existing per-rule gate functions (trust/concurrency/reviewer/wait) can
+ * evaluate the all-must-pass holds in one pass. Branch/trigger/repo/enabled are
+ * already handled by `evaluateMultiEnvGates`, so they are neutralized here.
+ */
+export declare function buildEffectiveEnvironment(primary: Environment, eff: EffectiveProtection): Environment;
+/** Format a human-readable rejection reason naming the env(s) and rule(s). */
+export declare function formatMultiEnvRejection(rejections: ReadonlyArray<EnvGateRejection>): string;
+//# sourceMappingURL=aggregate.d.ts.map

package/dist/environments/protection/satisfiability.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Registration-time satisfiability check for multi-environment job bindings.
+ *
+ * When a job binds several environments (`environments: [...]`), every
+ * environment's protection gates must pass for the job to ever dispatch
+ * (all-must-pass aggregation — see `aggregate.ts`). Some of those gates are
+ * decidable statically: if two bound environments restrict to disjoint fixed
+ * branch sets, no run can ever satisfy both, so the binding is provably
+ * unsatisfiable and should be rejected at registration rather than failing
+ * silently at every future dispatch.
+ *
+ * This module intersects the statically-decidable set rules (branch, trigger
+ * type, repository — only when every pattern is a literal, never a glob) plus
+ * existence and enabled across the bound environments, and reports the first
+ * provably-empty intersection. Any glob in a rule makes that rule undecidable,
+ * so it is skipped here and left to the dispatch-time catch-all
+ * (`evaluateMultiEnvGates`).
+ */
+import { z } from 'zod';
+import type { Environment } from '@kici-dev/engine';
+/** Which decidable rule made a binding unsatisfiable. */
+export declare const UnsatisfiableRule: z.ZodEnum<{
+    enabled: "enabled";
+    repo: "repo";
+    branch: "branch";
+    existence: "existence";
+    trigger: "trigger";
+}>;
+export type UnsatisfiableRule = z.infer<typeof UnsatisfiableRule>;
+/** A provably-unsatisfiable multi-environment binding, naming the rule + reason. */
+export interface UnsatisfiableBinding {
+    jobName: string;
+    environments: string[];
+    rule: UnsatisfiableRule;
+    message: string;
+}
+/**
+ * Returns a precise problem when the bound environments can NEVER be jointly
+ * satisfied (a provably-empty intersection on a decidable rule, a missing
+ * environment, or a disabled one), else `null`. Glob / undecidable cases return
+ * `null` and are caught at dispatch by `evaluateMultiEnvGates`.
+ *
+ * `envs[i]` is the resolved `Environment` for `envNames[i]` (undefined when the
+ * name has no environment record). Only the statically-known (non-dynamic) bound
+ * names should be passed — dynamic elements are unknown at registration and the
+ * all-must-pass semantics make the static subset's exclusivity still sound.
+ */
+export declare function checkBindingSatisfiable(jobName: string, envs: ReadonlyArray<Environment | undefined>, envNames: readonly string[]): UnsatisfiableBinding | null;
+/** Minimal lock-workflow shape needed to walk its jobs for satisfiability. */
+interface SatisfiabilityLockWorkflow {
+    jobs?: readonly unknown[];
+}
+/**
+ * Walk every workflow's static jobs and reject the registration when a bound
+ * environment list is provably unsatisfiable (missing/disabled environment, or
+ * mutually-exclusive fixed branch/trigger/repo restrictions). Dynamic elements
+ * are skipped (unresolvable at registration); the all-must-pass semantics keep
+ * the static subset's exclusivity sound. Throws the first
+ * `UnsatisfiableBinding.message` so the registration route / direct helper
+ * surfaces it to the caller.
+ */
+export declare function assertWorkflowsSatisfiable(workflows: ReadonlyArray<SatisfiabilityLockWorkflow>, resolveEnv: (name: string) => Promise<Environment | null>): Promise<void>;
+export {};
+//# sourceMappingURL=satisfiability.d.ts.map

package/dist/index.js

@@ -1779,6 +1779,15 @@ var AdminApiClient = class {
 		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs${qs}`);
 	}
 	/**
+	* Fetch the machine-first, provenance-tagged structured run result: typed
+	* job DAG, per-step exit codes / durations / statuses, derived failure
+	* category. Untrusted fields are envelope-tagged; secret values are never
+	* returned (only secret-output key names).
+	*/
+	async getRunStructured(runId) {
+		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/structured`);
+	}
+	/**
 	* Fetch the scrub status of the run's ephemeral key. Never returns the
 	* key material itself — only `{ exists, createdAt }`.
 	*/

package/dist/orchestrator-core.d.ts

@@ -27,6 +27,7 @@ import { ExecutionJobStatus, type LabelMatcher, type PeerHeartbeat, type PeerLog
 import { ScalerManager } from './scaler/index.js';
 import type { ScalerConfig } from './scaler/index.js';
 import type { CacheStorage } from './storage/index.js';
+import { type ProvenanceTrustRoot } from './provenance/trust-root.js';
 import { SourceCache, BuildCoordinator, DepCache, UserCache, DispatchCacheRefTracker, PendingBuildTracker, PendingInitTracker, PendingDynamicTracker } from './cache/index.js';
 import { CheckRunReporter } from './reporting/check-run-reporter.js';
 import { StepLogBuffer } from './reporting/step-log-buffer.js';
@@ -70,6 +71,12 @@ export interface OrchestratorSubsystems {
     scalerManager: ScalerManager | null;
     scalerConfig: ScalerConfig | null;
     cacheStorage: CacheStorage | undefined;
+    /**
+     * Provenance trust root used to verify build-provenance bundles at ingest.
+     * The mode-specific hook (server.ts) wires the live issuer onto it from the
+     * Platform `auth.success` message via `onProvenanceIssuer`.
+     */
+    provenanceTrustRoot: ProvenanceTrustRoot;
     sourceCache: SourceCache | undefined;
     depCache: DepCache | undefined;
     userCache: UserCache | undefined;
@@ -315,6 +322,7 @@ export declare function mergeUpstreamOutputs(db: Kysely<Database>, runId: string
     upstreamJobOutputs: Record<string, Record<string, unknown>> | undefined;
     upstreamJobStatuses: Record<string, ExecutionJobStatus> | undefined;
 }>;
+export declare function buildInternalJobConfigForWorkflow(workflow: any, job: any): Record<string, unknown>;
 export declare function bootstrapOrchestrator(config: AppConfig, hooks: OrchestratorHooks, options?: {
     otelSdk?: {
         shutdown(): Promise<void>;

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -71,6 +71,8 @@ export interface WorkflowDispatchContext {
     runId: string;
     trustResolution: TrustResolution | undefined;
     lockFileSource: string | undefined;
+    /** True when this run executes an uploaded local working tree (CLI remote run). */
+    localWorkingTree: boolean;
     /** True only when invoked from the cross-source dispatch shell. */
     crossSource: boolean;
     /** Composite dedup key `${info.deliveryId}:${reg.id}` (cross-source only). */

package/dist/pipeline/flatten-lock-steps.d.ts

@@ -0,0 +1,11 @@
+import { type LockStep, type LockStepEntry } from '@kici-dev/engine';
+/**
+ * Flatten a lock job's `steps` into the flat sequential list the orchestrator
+ * iterates by `stepIndex`. A `parallel` group's children are inlined in array
+ * order and the group wrapper is dropped (it consumes no flat index). This keeps
+ * the orchestrator's enumeration aligned with the agent's `extractAndNormalizeSteps`
+ * — the flat-stepIndex invariant: `flattenLockSteps(job.steps)[i]` is the step at
+ * agent `stepIndex i`.
+ */
+export declare function flattenLockSteps(steps: readonly LockStepEntry[]): readonly LockStep[];
+//# sourceMappingURL=flatten-lock-steps.d.ts.map

package/dist/pipeline/inline-eval.d.ts

@@ -36,7 +36,8 @@ export declare function evaluateInlineRecord(expression: string, event: object):
  * failures are immediate dispatch failures (no init-job fallback).
  */
 export declare function evaluateInlineFields(lockJob: LockJob, event: object): {
-    inlineEnvironmentName: string | undefined;
+    /** Resolved name per `environments` element, aligned by index; undefined for static or impure-dynamic elements. */
+    inlineEnvironmentNames: Array<string | undefined>;
     inlineEnv: Record<string, string> | undefined;
     inlineConcurrencyGroup: string | undefined;
 };

package/dist/pipeline/job-environments.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Multi-environment resolution helpers for the dispatch path.
+ *
+ * A job binds an ordered list of environments (`LockJob.environments`). This
+ * module resolves that list into concrete environment names (static values
+ * verbatim, pure-inline dynamic elements evaluated against the event) and folds
+ * the per-environment secrets/variables last-wins. It keeps the heavy fold logic
+ * out of `dispatchMatchedWorkflow`, which must stay under the function-length cap.
+ */
+import { type Environment, type HostFacts, type LockJob } from '@kici-dev/engine';
+import type { SecretResolverApi } from '../secrets/secret-resolver.js';
+import type { VariableStore } from '../environments/variable-store.js';
+/**
+ * Placeholder written into the persisted bound-env list for an impure dynamic
+ * element the orchestrator cannot resolve at dispatch. The agent's init eval
+ * later overwrites the list with the resolved name.
+ */
+export declare const DYNAMIC_ENV_PLACEHOLDER = "(dynamic)";
+/** Ordered resolved environment names plus whether any element still needs agent init. */
+export interface ResolvedJobEnvironments {
+    /** Resolved static + pure-inline names, in order. */
+    names: string[];
+    /** True when an impure dynamic element must be resolved by an agent init job. */
+    needsInit: boolean;
+}
+/**
+ * Resolve the ordered bound-environment names from a lock job. Static elements
+ * use their value verbatim; pure-inline dynamic elements use the matching
+ * pre-evaluated inline name (aligned by index); an impure dynamic element cannot
+ * be resolved here and flags `needsInit`.
+ */
+export declare function resolveJobEnvironmentNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): ResolvedJobEnvironments;
+/**
+ * Build the ordered bound-environment display list for persistence at dispatch.
+ * Unlike {@link resolveJobEnvironmentNames}, this never drops an unresolved
+ * element: a static element uses its value, a pure-inline element uses its
+ * resolved name when known, and any element the orchestrator cannot resolve at
+ * dispatch (impure dynamic, or an unresolved pure-inline) becomes the
+ * `(dynamic)` placeholder — so the persisted column reflects every declared
+ * slot in order. Returns an empty array when the job binds no environment.
+ */
+export declare function buildJobEnvironmentDisplayNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): string[];
+/** Merged secrets/variables across an ordered list of resolved environments. */
+export interface MultiEnvMergedData {
+    environmentVars?: Record<string, string>;
+    jobSecrets?: Record<string, string>;
+    jobNamespacedSecrets?: Record<string, Record<string, string>>;
+}
+/**
+ * Resolve and fold variables + secrets across the ordered list of matched
+ * environments, last-wins. Each environment is resolved with the existing
+ * single-env logic (longest-scope-path-wins preserved within each environment),
+ * then folded in array order so a later environment overrides an earlier key.
+ * Secrets are also returned namespaced per environment so qualified
+ * `<env>:<secret>` references still resolve. `entries` carries the matched
+ * `Environment` for each name (in order); variables resolve by environment id.
+ */
+export declare function resolveMultiEnvMergedData(args: {
+    deps: {
+        variableStore?: VariableStore;
+        secretResolver?: SecretResolverApi;
+    };
+    orgId: string;
+    entries: ReadonlyArray<{
+        name: string;
+        env: Environment;
+    }>;
+    hostCtx?: HostFacts;
+    routingKey?: string;
+}): Promise<MultiEnvMergedData>;
+//# sourceMappingURL=job-environments.d.ts.map

package/dist/pipeline/manual-schedule.d.ts

@@ -9,6 +9,7 @@
  * eventRouter fire-and-forget. The manual path needs request/response
  * correlation to return the newRunId to the dashboard.
  */
+import type { LockWorkflow, MaterializedJob } from '@kici-dev/engine';
 import type { RerunDeps } from './rerun.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 interface ManualScheduleDeps extends RerunDeps {
@@ -17,5 +18,26 @@ interface ManualScheduleDeps extends RerunDeps {
 export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, deps: ManualScheduleDeps): Promise<{
     newRunId: string;
 }>;
+export declare function buildManualJobConfig(workflow: LockWorkflow, mat: MaterializedJob): {
+    resolvedHashFiles?: string[] | undefined;
+    contentHash?: string | undefined;
+    dispatchInputs?: Record<string, unknown> | undefined;
+    steps: readonly import("@kici-dev/engine").LockStepEntry[];
+    needs: readonly (string | {
+        name: string;
+        runOn: ("success" | "pending" | "failed" | "recovering" | "running" | "queued" | "skipped" | "cancelled" | "cancelling" | "timed_out_stale" | "drift_dropped")[];
+    } | {
+        group: string;
+        runOn: ("success" | "pending" | "failed" | "recovering" | "running" | "queued" | "skipped" | "cancelled" | "cancelling" | "timed_out_stale" | "drift_dropped")[];
+    })[];
+    rules: readonly import("@kici-dev/engine").LockRule[] | undefined;
+    name: string;
+    baseJobName: string;
+    matrixValues?: import("@kici-dev/engine").MatrixValues;
+    fanoutIndex?: number;
+    fanoutTotal?: number;
+    source: import("@kici-dev/engine").LockSource | undefined;
+    workflowName: string;
+};
 export {};
 //# sourceMappingURL=manual-schedule.d.ts.map

package/dist/pipeline/test-pipeline.d.ts

@@ -93,6 +93,15 @@ interface TestTriggerResult {
     /** Dispatched job IDs. */
     jobIds: string[];
 }
+/**
+ * Repo identity for an inline-lock (local working tree) run. Derived from the
+ * event payload the CLI stamps -- NOT the relay routing key, which is the
+ * Platform-internal `remote:<orgId>` anchor and is meaningless as a repo.
+ */
+export declare function repoIdentityFromInlineInput(input: TestTriggerInput): {
+    repoIdentifier: string;
+    provider: string;
+};
 /**
  * Process a test trigger through the shared dispatch core.
  *