@kici-dev/orchestrator 0.1.23 → 0.1.25

package/dist/db/types.d.ts

@@ -49,6 +49,7 @@ export interface Database {
     scaler_agent_jobs: ScalerAgentJobsTable;
     scaler_reservations: ScalerReservationsTable;
     attestations: AttestationsTable;
+    pending_attestations: PendingAttestationsTable;
     remote_sources: RemoteSourcesTable;
     host_roster: HostRosterTable;
 }
@@ -271,6 +272,8 @@ export interface ExecutionRunTable {
     provider_context: Generated<string>;
     /** Whether this is a CLI-initiated test run */
     is_test_run: Generated<boolean>;
+    /** True when the run executed an uploaded local working tree (`kici run remote`). */
+    local_working_tree: Generated<boolean>;
     /** Fixture ID for test runs (null for real webhook runs) */
     fixture_id: string | null;
     /** Parent run ID for re-run lineage (null for original runs). */
@@ -279,16 +282,38 @@ export interface ExecutionRunTable {
     original_run_id: string | null;
     /** User identity that triggered this re-run (null for webhook-triggered). Format: "user:email" or "key:name". */
     triggered_by: string | null;
+    /** Agent provenance label when the run was triggered through an agent credential (null otherwise). */
+    triggered_by_agent_label: string | null;
     /** User identity that cancelled this run (null for non-cancelled). */
     cancelled_by: string | null;
+    /** Agent provenance label when the run was cancelled through an agent credential (null otherwise). */
+    cancelled_by_agent_label: string | null;
     /** Environment name for this run (null if no environment applies) */
     environment: string | null;
+    /** Matched environment id for this run (null if no/unresolved environment). */
+    environment_id: string | null;
     /** Trust tier of the contributor for PR runs (null for non-PR events) */
     trust_tier: string | null;
     /** Lock file source: 'head' or 'base' (null for non-PR events) */
     lock_file_source: string | null;
     /** Username of the contributor (null for non-PR events) */
     contributor_username: string | null;
+    /**
+     * Origin provider of the triggering actor (`github` today). Provider-generic
+     * so GitLab/Bitbucket extend later. Null when no actor was captured.
+     */
+    trigger_actor_provider: string | null;
+    /**
+     * Provider login of the person who triggered the run (pusher / PR author).
+     * Captured for ALL event types, unlike the PR-only `contributor_username`.
+     */
+    trigger_actor_username: string | null;
+    /**
+     * Immutable provider user id of the triggering actor (mirrors
+     * `identity_links.provider_user_id`). Preferred over the mutable username
+     * when resolving the actor to a KiCI user.
+     */
+    trigger_actor_user_id: string | null;
     /** Human-readable reason why the run failed (null for non-failed runs). */
     failure_reason: string | null;
     /**
@@ -371,6 +396,19 @@ export interface ExecutionJobTable {
     dispatched_contexts: Generated<string>;
     /** Aggregated step outputs JSONB (step-keyed map of outputs). Populated on job success. */
     outputs: string | null;
+    /**
+     * Ordered bound deployment-environment names for this job, JSON-encoded
+     * `string[]` (null when the job binds none). Written at dispatch and
+     * overwritten with the agent-resolved list for dynamic environments.
+     */
+    environments: string | null;
+    /**
+     * Bound environments skipped on a test/local run (non-test or unconfigured),
+     * JSON-encoded `string[]`. NULL = nothing skipped.
+     */
+    skipped_environments: string | null;
+    /** User-visible warning naming the skipped test-run environments. NULL = none. */
+    env_warning: string | null;
     /** Whether all upstream needs edges are satisfied (dispatch gate). */
     needs_satisfied: Generated<boolean>;
     /** Timestamp when needs_satisfied first flipped to true. */
@@ -453,6 +491,13 @@ export interface ExecutionStepTable {
     drift_summary: string | null;
     /** Structured drift value returned by `check()` (JSONB). NULL when no drift. */
     drift: ColumnType<unknown | null, unknown, unknown>;
+    /**
+     * Parallel step-group concurrency role (`sequential` | `parallel-child` |
+     * `parallel-group`). NULL for an ordinary sequential step.
+     */
+    concurrency_kind: string | null;
+    /** Parallel-group correlation id shared by a group's children. NULL for sequential steps. */
+    group_id: string | null;
     /** When this record was created */
     created_at: Generated<Date>;
     /**
@@ -804,6 +849,12 @@ export interface AccessLogTable {
     source: string;
     outcome: string;
     error_message: string | null;
+    /**
+     * Human-set agent name, when the actor authenticated with an agent-kind PAT.
+     * NULL for ordinary human / API-key / system actors. Queryable so the access
+     * log can be filtered by agent.
+     */
+    agent_label: string | null;
     created_at: Generated<Date>;
     /**
      * Set inside the archive transaction before the row is DELETEd.
@@ -857,6 +908,14 @@ export interface AgentTokenTable {
     token_prefix: string;
     /** JSON-encoded string[] of agent labels (null = any) */
     labels: string | null;
+    /**
+     * JSON-encoded string[] of mandatory labels (a Kubernetes-taint-style gate):
+     * a static agent registering with this token only accepts a job when every
+     * label here appears in the job's required labels. null = no taint (the
+     * default; the agent accepts any job its advertised labels match).
+     * Authorized at mint time alongside `labels`.
+     */
+    mandatory_labels: string | null;
     /** Token type: 'ephemeral' (scaler-issued) or 'static' (CLI-created) */
     agent_type: string;
     /** When this token was created */
@@ -1585,9 +1644,63 @@ export interface AttestationsTable {
     media_type: string;
     /** When this row was inserted. */
     created_at: Generated<Date>;
+    /**
+     * Server-side verification verdict computed at ingest. One of
+     * `verified` / `failed` / `unverifiable` / `pending`
+     * (`attestationVerifyStatusSchema.enum.*`). DB default is `pending`.
+     */
+    verify_status: Generated<string>;
+    /** First failure code from `verifyKiciBundle`, or NULL when verified/pending. */
+    verify_reason: string | null;
+    /** When the verdict was recorded (explicitly set, not DB-generated). */
+    verified_at: Date | null;
 }
 export type AttestationRow = Selectable<AttestationsTable>;
 export type NewAttestationRow = Insertable<AttestationsTable>;
+/**
+ * Deferred-attestation outbox: a build whose provenance mint failed transiently
+ * freezes its DSSE-signed statement here; a leader-only retrier mints the token
+ * later and records the fulfilled `attestations` row.
+ */
+export interface PendingAttestationsTable {
+    /** Random id (primary key). */
+    id: string;
+    /** KiCI run this deferred attestation belongs to. */
+    run_id: string;
+    /** KiCI job this deferred attestation was produced by. */
+    job_id: string;
+    /** Caller-supplied artifact name. */
+    subject_name: string;
+    /** Primary subject digest (lowercase hex). */
+    subject_digest: string;
+    /** Requested token audience. */
+    audience: string;
+    /** The frozen, agent-signed DSSE envelope (JSONB). */
+    dsse_envelope: unknown;
+    /** The ephemeral public-key JWK (JSONB). */
+    public_key: unknown;
+    /** Bundle media type. */
+    media_type: string;
+    /** SHA-256 of the frozen statement payload — the later-mint binding. */
+    statement_hash: string;
+    /** Non-`live` AttestationOrigin: `deferred` | `offline-backfill`. */
+    origin_kind: string;
+    /** Retry attempts so far. */
+    attempt_count: Generated<number>;
+    /** First-capture time = the true build-time anchor. */
+    created_at: Generated<Date>;
+    /** When fulfilment was last attempted. */
+    last_attempt_at: Date | null;
+    /** Last fulfilment error, or NULL. */
+    last_error: string | null;
+    /**
+     * Terminal-rejection time: the Platform definitively rejected the mint
+     * (run/job absent). NULL while the row is still pending a later mint.
+     */
+    rejected_at: Date | null;
+}
+export type PendingAttestationRow = Selectable<PendingAttestationsTable>;
+export type NewPendingAttestationRow = Insertable<PendingAttestationsTable>;
 /**
  * Remote-source table (remote_sources).
  *

package/dist/environments/protection/aggregate.d.ts

@@ -0,0 +1,43 @@
+import { EnvGateRejectReason, type Environment } from '@kici-dev/engine';
+import type { JobDispatchContext } from './pipeline.js';
+/** A single environment's rejection under all-must-pass aggregation. */
+export interface EnvGateRejection {
+    environment: string;
+    reason: EnvGateRejectReason;
+    detail: string;
+}
+/** Effective protection parameters after most-restrictive aggregation. */
+export interface EffectiveProtection {
+    minimumTrust?: 'known' | 'trusted';
+    requiredReviewers: string[];
+    waitTimerSeconds: number | null;
+    holdExpirySeconds: number;
+    concurrencyLimit: number | null;
+    concurrencyStrategy: 'queue' | 'cancel-pending';
+}
+/**
+ * Evaluate each environment's hard reject gates against the run context. A name
+ * with no `Environment` record yields an `env_not_found` rejection. Returns all
+ * rejections (empty = every environment passed the reject gates).
+ */
+export declare function evaluateMultiEnvGates(envs: ReadonlyArray<{
+    name: string;
+    env: Environment | undefined;
+}>, ctx: JobDispatchContext): EnvGateRejection[];
+/**
+ * Aggregate hold/wait/queue parameters across all bound environments, most
+ * restrictive wins: trust = max tier, reviewers = sorted dedup union, wait timer
+ * = max, hold expiry = min, concurrency limit = min (tightest). The concurrency
+ * strategy follows the primary (first) environment.
+ */
+export declare function aggregateProtectionParams(envs: ReadonlyArray<Environment>): EffectiveProtection;
+/**
+ * Build a synthetic `Environment` carrying the aggregated protection parameters,
+ * so the existing per-rule gate functions (trust/concurrency/reviewer/wait) can
+ * evaluate the all-must-pass holds in one pass. Branch/trigger/repo/enabled are
+ * already handled by `evaluateMultiEnvGates`, so they are neutralized here.
+ */
+export declare function buildEffectiveEnvironment(primary: Environment, eff: EffectiveProtection): Environment;
+/** Format a human-readable rejection reason naming the env(s) and rule(s). */
+export declare function formatMultiEnvRejection(rejections: ReadonlyArray<EnvGateRejection>): string;
+//# sourceMappingURL=aggregate.d.ts.map

package/dist/environments/protection/satisfiability.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Registration-time satisfiability check for multi-environment job bindings.
+ *
+ * When a job binds several environments (`environments: [...]`), every
+ * environment's protection gates must pass for the job to ever dispatch
+ * (all-must-pass aggregation — see `aggregate.ts`). Some of those gates are
+ * decidable statically: if two bound environments restrict to disjoint fixed
+ * branch sets, no run can ever satisfy both, so the binding is provably
+ * unsatisfiable and should be rejected at registration rather than failing
+ * silently at every future dispatch.
+ *
+ * This module intersects the statically-decidable set rules (branch, trigger
+ * type, repository — only when every pattern is a literal, never a glob) plus
+ * the `enabled` gate across the **resolved** bound environments, and reports the
+ * first provably-empty intersection. Bound names that resolve to no environment
+ * record are lenient — skipped, never rejected — matching the dispatch-time
+ * behavior in `dispatch-matched-workflow.ts`. Any glob in a rule makes that rule
+ * undecidable, so it is skipped here and left to the dispatch-time catch-all
+ * (`evaluateMultiEnvGates`).
+ */
+import { z } from 'zod';
+import type { Environment } from '@kici-dev/engine';
+/** Which decidable rule made a binding unsatisfiable. */
+export declare const UnsatisfiableRule: z.ZodEnum<{
+    enabled: "enabled";
+    repo: "repo";
+    branch: "branch";
+    trigger: "trigger";
+}>;
+export type UnsatisfiableRule = z.infer<typeof UnsatisfiableRule>;
+/** A provably-unsatisfiable multi-environment binding, naming the rule + reason. */
+export interface UnsatisfiableBinding {
+    jobName: string;
+    environments: string[];
+    rule: UnsatisfiableRule;
+    message: string;
+}
+/**
+ * Returns a precise problem when the bound environments can NEVER be jointly
+ * satisfied (a disabled environment, or mutually-exclusive fixed restrictions
+ * among the resolved environments), else `null`. Missing (unresolved) names are
+ * skipped — a bound name with no environment record contributes no protection
+ * rules and is lenient at dispatch, so it is not rejected here. Glob /
+ * undecidable cases also return `null` and are caught at dispatch by
+ * `evaluateMultiEnvGates`.
+ *
+ * `envs[i]` is the resolved `Environment` for `envNames[i]` (undefined when the
+ * name has no environment record). Only the statically-known (non-dynamic) bound
+ * names should be passed — dynamic elements are unknown at registration and the
+ * all-must-pass semantics make the static subset's exclusivity still sound.
+ */
+export declare function checkBindingSatisfiable(jobName: string, envs: ReadonlyArray<Environment | undefined>, envNames: readonly string[]): UnsatisfiableBinding | null;
+/** Minimal lock-workflow shape needed to walk its jobs for satisfiability. */
+interface SatisfiabilityLockWorkflow {
+    jobs?: readonly unknown[];
+}
+/**
+ * Walk every workflow's static jobs and reject the registration when a bound
+ * environment list is provably unsatisfiable (a disabled environment, or
+ * mutually-exclusive fixed branch/trigger/repo restrictions among the resolved
+ * environments — missing names are lenient, never rejected). Dynamic elements
+ * are skipped (unresolvable at registration); the all-must-pass semantics keep
+ * the static subset's exclusivity sound. Throws the first
+ * `UnsatisfiableBinding.message` so the registration route / direct helper
+ * surfaces it to the caller.
+ */
+export declare function assertWorkflowsSatisfiable(workflows: ReadonlyArray<SatisfiabilityLockWorkflow>, resolveEnv: (name: string) => Promise<Environment | null>): Promise<void>;
+export {};
+//# sourceMappingURL=satisfiability.d.ts.map

package/dist/events/circuit-breaker.d.ts

@@ -1,10 +1,11 @@
 import type { EventRouterConfig } from './types.js';
 /**
- * Circuit breaker for event loop detection and per-workflow rate limiting.
+ * Circuit breaker for event loop detection and user-event rate limiting.
  *
  * Two-layer protection:
  * 1. Chain depth: Rejects events exceeding configurable max chain depth.
- * 2. Rate limiting: Sliding-window per-workflow rate limiter.
+ * 2. Rate limiting: Sliding-window limiter keyed per (source routing key +
+ *    event name). System events (`__`-prefixed) are exempt upstream.
  */
 export declare class EventCircuitBreaker {
     private readonly config;
@@ -18,10 +19,12 @@ export declare class EventCircuitBreaker {
         reason?: string;
     };
     /**
-     * Check if a workflow is within its per-minute rate limit.
-     * Uses a sliding window of 60 seconds.
+     * Check whether a rate-limit key is within its per-minute allowance, using a
+     * sliding 60-second window. Callers key user events by
+     * `<sourceRoutingKey>:<eventName>`; system events (`__`-prefixed) are exempt
+     * upstream and never reach here.
      */
-    checkRateLimit(workflowKey: string): {
+    checkRateLimit(rateKey: string): {
         allowed: boolean;
         retryAfterMs?: number;
     };

package/dist/events/event-router.d.ts

@@ -159,11 +159,19 @@ export declare class EventRouter {
      */
     private buildSimulatedEvent;
     /**
-     * Catch-up: process unprocessed events missed during downtime.
+     * Catch-up: process every unprocessed event missed during downtime.
      *
-     * Uses lease-based dispatch identical to the live path, so a catch-up
-     * dispatch failure schedules a retry via the leader-only scanner instead
-     * of being silently dropped.
+     * Pages through the backlog with a keyset cursor: fetch a batch, dispatch
+     * each event (lease-based, identical failure semantics to the live path),
+     * advance the cursor to the last event of the batch, and repeat until a
+     * batch returns fewer than EVENT_CATCHUP_BATCH_SIZE rows. Without this loop
+     * only the oldest page (100 events) would be dispatched and the remainder
+     * would sit unprocessed — invisible to both the live NOTIFY path and the
+     * retry scanner — until the TTL cleanup deleted them undelivered.
+     *
+     * The store's cursor is strictly monotone over (created_at, id), so a
+     * still-unprocessed retrying event at or before the cursor is never
+     * re-fetched — that strict advance is what guarantees this loop terminates.
      */
     private catchUp;
 }

package/dist/events/event-store.d.ts

@@ -3,6 +3,14 @@ import type { Database } from '../db/types.js';
 import type { DlqReason, EventRouterConfig, StoredEvent } from './types.js';
 /** Either a Kysely DB handle or an active transaction. */
 export type DbExecutor = Kysely<Database> | Transaction<Database>;
+/**
+ * Default page size for unprocessed-event catch-up scans.
+ *
+ * Shared with EventRouter.catchUp so the paginating loop's "a short batch
+ * means we're done" termination check compares against the same value the
+ * store slices by.
+ */
+export declare const EVENT_CATCHUP_BATCH_SIZE = 100;
 /**
  * Input shape for writing a new event. Excludes columns the DB fills in
  * itself (id, processed, created_at, attempts, claimed_*, last_error,
@@ -58,9 +66,19 @@ export declare class EventStore {
      */
     getById(id: string): Promise<StoredEvent | null>;
     /**
-     * Get unprocessed events for catch-up on reconnect.
-     * If sinceId is null, returns all unprocessed events.
-     * Ordered by created_at ASC. Excludes DLQ rows.
+     * Get a page of unprocessed events for catch-up on start.
+     *
+     * Rows are ordered by a deterministic keyset `(created_at ASC, id ASC)` and
+     * exclude processed + DLQ rows. When `sinceId` is null, returns the first
+     * page from the oldest event. When `sinceId` is given, returns the page
+     * strictly after that event's `(created_at, id)` — a composite cursor so
+     * that events sharing the reference event's `created_at` are NOT skipped
+     * (a bare `created_at > ref` predicate drops same-timestamp siblings) and a
+     * still-unprocessed retrying event at or before the cursor is never
+     * re-fetched (which is what makes the caller's pagination loop terminate).
+     *
+     * The caller advances `sinceId` to the last event of each returned page and
+     * re-queries until a page returns fewer than `limit` rows.
      */
     getUnprocessedSince(sinceId: string | null, limit?: number): Promise<StoredEvent[]>;
     /**

package/dist/events/trust-store.d.ts

@@ -17,7 +17,12 @@ interface TrustEntry {
  *
  * Same-repo events (same routing key) are always trusted without a DB lookup.
  * Cross-repo events require an explicit enabled row in the cross_repo_trust table.
- * Glob-based event filtering is supported via the allowed_events column.
+ * Glob-based event filtering is supported via the allowed_events column, whose
+ * value carries a three-way meaning:
+ *   - `null`       — filter unset: every event name is allowed (allow-all).
+ *   - `'[]'`       — an explicit empty allow-list: no event is allowed (deny-all).
+ *   - `'["glob"]'` — only event names matching one of the globs are allowed.
+ * Malformed (unparseable / non-array) allowed_events fails closed (deny).
  */
 export declare class TrustStore {
     private readonly db;

package/dist/events/types.d.ts

@@ -7,7 +7,12 @@
 export interface EventRouterConfig {
     /** Maximum allowed chain depth before circuit breaker trips (default: 10) */
     maxChainDepth: number;
-    /** Maximum event emissions per workflow per minute (default: 100) */
+    /**
+     * Max user-event emissions per (source routing key + event name) per minute
+     * (sliding 60s window). System events (`__`-prefixed, e.g. __workflow_complete)
+     * are EXEMPT -- they are orchestrator-emitted once per completion and cannot
+     * loop, so the storm guard does not apply. Default 100.
+     */
     rateLimitPerWorkflowPerMinute: number;
     /** TTL for persisted events in seconds (default: 604800 = 7 days) */
     eventTtlSeconds: number;

package/dist/helpers/rate-limiter.d.ts

@@ -1,13 +1,21 @@
 /**
  * Sliding-window rate limiter.
  *
- * Tracks timestamps of recent events per key and rejects new events
- * once the count within the window exceeds the configured maximum.
+ * Tracks timestamps of recent events per key and rejects new events once the
+ * count within the window exceeds the configured maximum.
+ *
+ * The internal Map stays bounded to the recently-active key set. A checked key
+ * whose window has fully expired is dropped before this call decides whether to
+ * record a new timestamp, so a call that records nothing (for example when the
+ * limit is zero) leaves no residual bucket. Keys that are never checked again
+ * are reclaimed by an amortized sweep that runs at most once per window, so the
+ * per-call hot path stays O(1) amortized even though a single sweep is O(n).
  */
 export declare class SlidingWindowRateLimiter {
     private readonly maxPerWindow;
     private readonly windowMs;
     private state;
+    private lastSweepAt;
     constructor(maxPerWindow: number, windowMs?: number);
     /**
      * Check if a new event is allowed for the given key.
@@ -18,6 +26,13 @@ export declare class SlidingWindowRateLimiter {
         allowed: boolean;
         retryAfterMs?: number;
     };
+    /**
+     * Evict buckets whose newest timestamp is outside the window. Runs at most
+     * once per window so the amortized cost per check() stays O(1).
+     */
+    private maybeSweep;
+    /** Number of tracked keys currently held in the internal map. */
+    get size(): number;
     reset(): void;
 }
 //# sourceMappingURL=rate-limiter.d.ts.map

package/dist/index.js

@@ -16,7 +16,6 @@ import { Octokit } from "@octokit/rest";
 import { createAppAuth } from "@octokit/auth-app";
 import { createServer } from "node:http";
 import { exec } from "node:child_process";
-import.meta.url;
 //#endregion
 //#region src/storage/s3.ts
 /**
@@ -1779,6 +1778,15 @@ var AdminApiClient = class {
 		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/jobs${qs}`);
 	}
 	/**
+	* Fetch the machine-first, provenance-tagged structured run result: typed
+	* job DAG, per-step exit codes / durations / statuses, derived failure
+	* category. Untrusted fields are envelope-tagged; secret values are never
+	* returned (only secret-output key names).
+	*/
+	async getRunStructured(runId) {
+		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/structured`);
+	}
+	/**
 	* Fetch the scrub status of the run's ephemeral key. Never returns the
 	* key material itself — only `{ exists, createdAt }`.
 	*/
@@ -1833,6 +1841,8 @@ var AdminApiClient = class {
 		if (opts?.from) params.set("from", opts.from);
 		if (opts?.to) params.set("to", opts.to);
 		if (opts?.q) params.set("q", opts.q);
+		if (opts?.agentLabel) params.set("agentLabel", opts.agentLabel);
+		if (opts?.agentOnly) params.set("agentOnly", "true");
 		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();

package/dist/metrics/prometheus.d.ts

@@ -6,6 +6,12 @@ export declare function setConfigVersion(value: number): void;
 export declare function setDeclaredHostsUnreachable(value: number): void;
 /** Set the current number of stale runs detected. */
 export declare function setStaleRunsCurrent(value: number): void;
+/** Set the current number of deferred attestations awaiting a later mint. */
+export declare function setPendingAttestations(value: number): void;
+/** Set the age (seconds) of the oldest deferred attestation in the outbox. */
+export declare function setPendingAttestationOldestAgeSeconds(value: number): void;
+/** Set the current number of terminally-rejected deferred attestations. */
+export declare function setRejectedAttestations(value: number): void;
 interface ScalerUsageRow {
     scaler: string;
     /** Backend type for this scaler (rollup dimension). `__global__` for the orchestrator-wide row. */

package/dist/orchestrator-core.d.ts

@@ -27,6 +27,7 @@ import { ExecutionJobStatus, type LabelMatcher, type PeerHeartbeat, type PeerLog
 import { ScalerManager } from './scaler/index.js';
 import type { ScalerConfig } from './scaler/index.js';
 import type { CacheStorage } from './storage/index.js';
+import { type ProvenanceTrustRoot } from './provenance/trust-root.js';
 import { SourceCache, BuildCoordinator, DepCache, UserCache, DispatchCacheRefTracker, PendingBuildTracker, PendingInitTracker, PendingDynamicTracker } from './cache/index.js';
 import { CheckRunReporter } from './reporting/check-run-reporter.js';
 import { StepLogBuffer } from './reporting/step-log-buffer.js';
@@ -70,6 +71,12 @@ export interface OrchestratorSubsystems {
     scalerManager: ScalerManager | null;
     scalerConfig: ScalerConfig | null;
     cacheStorage: CacheStorage | undefined;
+    /**
+     * Provenance trust root used to verify build-provenance bundles at ingest.
+     * The mode-specific hook (server.ts) wires the live issuer onto it from the
+     * Platform `auth.success` message via `onProvenanceIssuer`.
+     */
+    provenanceTrustRoot: ProvenanceTrustRoot;
     sourceCache: SourceCache | undefined;
     depCache: DepCache | undefined;
     userCache: UserCache | undefined;
@@ -315,6 +322,7 @@ export declare function mergeUpstreamOutputs(db: Kysely<Database>, runId: string
     upstreamJobOutputs: Record<string, Record<string, unknown>> | undefined;
     upstreamJobStatuses: Record<string, ExecutionJobStatus> | undefined;
 }>;
+export declare function buildInternalJobConfigForWorkflow(workflow: any, job: any): Record<string, unknown>;
 export declare function bootstrapOrchestrator(config: AppConfig, hooks: OrchestratorHooks, options?: {
     otelSdk?: {
         shutdown(): Promise<void>;

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -71,6 +71,8 @@ export interface WorkflowDispatchContext {
     runId: string;
     trustResolution: TrustResolution | undefined;
     lockFileSource: string | undefined;
+    /** True when this run executes an uploaded local working tree (CLI remote run). */
+    localWorkingTree: boolean;
     /** True only when invoked from the cross-source dispatch shell. */
     crossSource: boolean;
     /** Composite dedup key `${info.deliveryId}:${reg.id}` (cross-source only). */
@@ -136,6 +138,12 @@ export interface DispatchMatchedWorkflowResult {
     dispatchedJobIds: string[];
     /** True when the workflow install gate paused the dispatch (held run). */
     held?: boolean;
+    /**
+     * User-visible warnings aggregated from dispatched jobs — today, one per job
+     * whose bound test-run environment(s) were unavailable and skipped. Surfaced
+     * on the accepted trigger response so the CLI can print them.
+     */
+    envWarnings?: string[];
 }
 /** Options controlling a (re-)dispatch of a matched workflow. */
 export interface DispatchMatchedWorkflowOptions {

package/dist/pipeline/flatten-lock-steps.d.ts

@@ -0,0 +1,11 @@
+import { type LockStep, type LockStepEntry } from '@kici-dev/engine';
+/**
+ * Flatten a lock job's `steps` into the flat sequential list the orchestrator
+ * iterates by `stepIndex`. A `parallel` group's children are inlined in array
+ * order and the group wrapper is dropped (it consumes no flat index). This keeps
+ * the orchestrator's enumeration aligned with the agent's `extractAndNormalizeSteps`
+ * — the flat-stepIndex invariant: `flattenLockSteps(job.steps)[i]` is the step at
+ * agent `stepIndex i`.
+ */
+export declare function flattenLockSteps(steps: readonly LockStepEntry[]): readonly LockStep[];
+//# sourceMappingURL=flatten-lock-steps.d.ts.map

package/dist/pipeline/inline-eval.d.ts

@@ -36,7 +36,8 @@ export declare function evaluateInlineRecord(expression: string, event: object):
  * failures are immediate dispatch failures (no init-job fallback).
  */
 export declare function evaluateInlineFields(lockJob: LockJob, event: object): {
-    inlineEnvironmentName: string | undefined;
+    /** Resolved name per `environments` element, aligned by index; undefined for static or impure-dynamic elements. */
+    inlineEnvironmentNames: Array<string | undefined>;
     inlineEnv: Record<string, string> | undefined;
     inlineConcurrencyGroup: string | undefined;
 };

package/dist/pipeline/job-environments.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Multi-environment resolution helpers for the dispatch path.
+ *
+ * A job binds an ordered list of environments (`LockJob.environments`). This
+ * module resolves that list into concrete environment names (static values
+ * verbatim, pure-inline dynamic elements evaluated against the event) and folds
+ * the per-environment secrets/variables last-wins. It keeps the heavy fold logic
+ * out of `dispatchMatchedWorkflow`, which must stay under the function-length cap.
+ */
+import { type Environment, type HostFacts, type LockJob } from '@kici-dev/engine';
+import type { SecretResolverApi } from '../secrets/secret-resolver.js';
+import type { VariableStore } from '../environments/variable-store.js';
+/**
+ * Placeholder written into the persisted bound-env list for an impure dynamic
+ * element the orchestrator cannot resolve at dispatch. The agent's init eval
+ * later overwrites the list with the resolved name.
+ */
+export declare const DYNAMIC_ENV_PLACEHOLDER = "(dynamic)";
+/** Ordered resolved environment names plus whether any element still needs agent init. */
+export interface ResolvedJobEnvironments {
+    /** Resolved static + pure-inline names, in order. */
+    names: string[];
+    /** True when an impure dynamic element must be resolved by an agent init job. */
+    needsInit: boolean;
+}
+/**
+ * Resolve the ordered bound-environment names from a lock job. Static elements
+ * use their value verbatim; pure-inline dynamic elements use the matching
+ * pre-evaluated inline name (aligned by index); an impure dynamic element cannot
+ * be resolved here and flags `needsInit`.
+ */
+export declare function resolveJobEnvironmentNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): ResolvedJobEnvironments;
+/**
+ * Build the ordered bound-environment display list for persistence at dispatch.
+ * Unlike {@link resolveJobEnvironmentNames}, this never drops an unresolved
+ * element: a static element uses its value, a pure-inline element uses its
+ * resolved name when known, and any element the orchestrator cannot resolve at
+ * dispatch (impure dynamic, or an unresolved pure-inline) becomes the
+ * `(dynamic)` placeholder — so the persisted column reflects every declared
+ * slot in order. Returns an empty array when the job binds no environment.
+ */
+export declare function buildJobEnvironmentDisplayNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): string[];
+/** Merged secrets/variables across an ordered list of resolved environments. */
+export interface MultiEnvMergedData {
+    environmentVars?: Record<string, string>;
+    jobSecrets?: Record<string, string>;
+    jobNamespacedSecrets?: Record<string, Record<string, string>>;
+}
+/**
+ * Resolve and fold variables + secrets across the ordered list of matched
+ * environments, last-wins. Each environment is resolved with the existing
+ * single-env logic (longest-scope-path-wins preserved within each environment),
+ * then folded in array order so a later environment overrides an earlier key.
+ * Secrets are also returned namespaced per environment so qualified
+ * `<env>:<secret>` references still resolve. `entries` carries the matched
+ * `Environment` for each name (in order); variables resolve by environment id.
+ */
+export declare function resolveMultiEnvMergedData(args: {
+    deps: {
+        variableStore?: VariableStore;
+        secretResolver?: SecretResolverApi;
+    };
+    orgId: string;
+    entries: ReadonlyArray<{
+        name: string;
+        env: Environment;
+    }>;
+    hostCtx?: HostFacts;
+    routingKey?: string;
+}): Promise<MultiEnvMergedData>;
+//# sourceMappingURL=job-environments.d.ts.map