@kici-dev/orchestrator 0.1.24 → 0.1.25

package/dist/cluster/cluster-identity.d.ts

@@ -29,6 +29,17 @@ export interface ClusterIdentityDeps {
      */
     skipSentinelValidation?: boolean;
 }
+/**
+ * Default cache-storage S3 prefix (mirrors the orchestrator config
+ * `cacheStorageS3Prefix` default). Empty means the cache blobs and the
+ * cluster-identity sentinel live at the bucket root — the bucket already scopes
+ * the cluster. Every place that resolves a sentinel prefix (the orchestrator
+ * runtime, the `kici-admin cluster reconcile-identity` CLI, and the staging
+ * deploy's self-heal step) MUST fall back to THIS value when no explicit prefix
+ * is set, otherwise they compute divergent sentinel keys and crash-loop the
+ * orchestrator boot on a spurious "Cluster identity mismatch".
+ */
+export declare const DEFAULT_CACHE_STORAGE_S3_PREFIX = "";
 /**
  * Build the S3 key for the cluster identity sentinel under an optional prefix.
  * Strips any trailing slash from the prefix so callers can pass either form.

package/dist/cluster/reconcile-identity.d.ts

@@ -0,0 +1,50 @@
+import type { IdempotentStep } from '@kici-dev/shared/idempotency';
+export type ReconcileDirection = 'db-from-sentinel' | 'sentinel-from-db';
+export interface ReconcileS3Config {
+    bucket: string;
+    /**
+     * Optional storage prefix (mirrors `KICI_STORAGE_PREFIX`). The sentinel lives
+     * at `<prefix>/.kici-cluster-id`; must match the prefix the orchestrator boots
+     * with. When omitted, `clusterSentinelKey` resolves the bucket root — the same
+     * as the orchestrator's `DEFAULT_CACHE_STORAGE_S3_PREFIX` (empty) default.
+     */
+    prefix?: string;
+    region?: string;
+    endpoint?: string;
+    forcePathStyle?: boolean;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export interface IdentityDrift {
+    dbClusterId: string | null;
+    sentinelClusterId: string | null;
+    direction: ReconcileDirection;
+}
+declare function readClusterIdFromDb(databaseUrl: string): Promise<string | null>;
+declare function writeClusterIdToDb(databaseUrl: string, clusterId: string): Promise<void>;
+declare function readSentinel(s3: ReconcileS3Config): Promise<string | null>;
+declare function writeSentinel(s3: ReconcileS3Config, clusterId: string): Promise<void>;
+/**
+ * Indirection object for the DB + S3 reads/writes, so the unit test can stub
+ * the I/O without an ESM partial-mock dance. `buildReconcileStep` calls every
+ * reader/writer through this object; the test overrides its members directly.
+ */
+export declare const reconcileIo: {
+    readClusterIdFromDb: typeof readClusterIdFromDb;
+    writeClusterIdToDb: typeof writeClusterIdToDb;
+    readSentinel: typeof readSentinel;
+    writeSentinel: typeof writeSentinel;
+};
+/**
+ * Build the idempotent step that reconciles the cluster identity in the given
+ * direction. `check()` returns drift when the two sides disagree (or null when
+ * in sync); `apply()` performs the single write that brings them into
+ * agreement. Run it through `runIdempotentStep` (`@kici-dev/core/idempotency`).
+ */
+export declare function buildReconcileStep(deps: {
+    databaseUrl: string;
+    s3: ReconcileS3Config;
+    direction: ReconcileDirection;
+}): IdempotentStep<IdentityDrift>;
+export {};
+//# sourceMappingURL=reconcile-identity.d.ts.map

package/dist/cold-store/load-access-log-range.d.ts

@@ -52,6 +52,10 @@ export interface LoadAccessLogRangeArgs {
          * `009_access_log_trigram.ts`. Min ~3 chars for the index to help.
          */
         q?: string;
+        /** Exact-match filter on the agent provenance label (`agent_label` column). */
+        agentLabel?: string;
+        /** When true, return only agent-attributed rows (`agent_label IS NOT NULL`). */
+        agentOnly?: boolean;
     };
     limit: number;
     cursor?: string;

package/dist/config.d.ts

@@ -100,6 +100,7 @@ declare const configSchema: z.ZodObject<{
     eventRouterRetryScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     testMode: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     testEventFailFirstN: z.ZodOptional<z.ZodString>;
+    testMintDeferAudience: z.ZodOptional<z.ZodString>;
     eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
         error: "error";
@@ -274,6 +275,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     bootstrapAdminToken?: string | undefined;
     orchestratorHostAgentId?: string | undefined;
     testEventFailFirstN?: string | undefined;
+    testMintDeferAudience?: string | undefined;
     otelExporterOtlpEndpoint?: string | undefined;
     clusterName?: string | undefined;
 }>;

package/dist/dashboard/attestation-filters.d.ts

@@ -12,6 +12,7 @@ import type { Database } from '../db/types.js';
  * lists (repository / workflow come back null).
  */
 export declare function baseAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    cluster_meta: import("../db/types.js").ClusterMetaTable;
     environments: import("../db/types.js").EnvironmentsTable;
     host_roster: import("../db/types.js").HostRosterTable;
     dispatch_queue: import("../db/types.js").DispatchQueueTable;
@@ -42,7 +43,6 @@ export declare function baseAttestationsQuery(db: Kysely<Database>): import("kys
     run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
     concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
     sources: import("../db/types.js").SourcesTable;
-    cluster_meta: import("../db/types.js").ClusterMetaTable;
     join_tokens: import("../db/types.js").JoinTokenTable;
     org_settings: import("../db/types.js").OrgSettingsTable;
     execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
@@ -57,9 +57,70 @@ export declare function baseAttestationsQuery(db: Kysely<Database>): import("kys
     scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
     scaler_reservations: import("../db/types.js").ScalerReservationsTable;
     attestations: import("../db/types.js").AttestationsTable;
+    pending_attestations: import("../db/types.js").PendingAttestationsTable;
     remote_sources: import("../db/types.js").RemoteSourcesTable;
 }, "execution_runs" | "execution_jobs" | "attestations", {}>;
 export type AttestationsBaseQuery = ReturnType<typeof baseAttestationsQuery>;
+/**
+ * Base query for the deferred-attestation outbox (`pending_attestations`),
+ * joined to `execution_jobs` (job name) and `execution_runs` (repo / workflow
+ * context) for the org-wide list's pending summaries.
+ *
+ * Same uuid/text mismatch as `baseAttestationsQuery`: `pending_attestations`
+ * `run_id` / `job_id` are TEXT while the `execution_*` keys are `uuid`, and
+ * Postgres won't compare `uuid = text` implicitly — so the joins cast the uuid
+ * side to text. Both joins are LEFT joins so a pending row with no matching
+ * run / job still lists (repository / workflow / job name come back null).
+ */
+export declare function basePendingAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    cluster_meta: import("../db/types.js").ClusterMetaTable;
+    environments: import("../db/types.js").EnvironmentsTable;
+    host_roster: import("../db/types.js").HostRosterTable;
+    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    dedup_cache: import("../db/types.js").DedupCacheTable;
+    ip_allocations: import("../db/types.js").IpAllocationTable;
+    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
+    execution_jobs: import("kysely").Nullable<import("../db/types.js").ExecutionJobTable>;
+    execution_steps: import("../db/types.js").ExecutionStepTable;
+    raft_state: import("../db/types.js").RaftStateTable;
+    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
+    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
+    environment_bindings: import("../db/types.js").EnvironmentBindingsTable;
+    environment_variables: import("../db/types.js").EnvironmentVariablesTable;
+    environment_source_overrides: import("../db/types.js").EnvironmentSourceOverridesTable;
+    held_runs: import("../db/types.js").HeldRunsTable;
+    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
+    admin_tokens: import("../db/types.js").AdminTokenTable;
+    agent_tokens: import("../db/types.js").AgentTokenTable;
+    config_versions: import("../db/types.js").ConfigVersionTable;
+    kici_events: import("../db/types.js").KiciEventTable;
+    generic_webhook_sources: import("../db/types.js").GenericWebhookSourceTable;
+    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
+    test_uploads: import("../db/types.js").TestUploadsTable;
+    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
+    registry_versions: import("../db/types.js").RegistryVersionsTable;
+    cron_last_fired: import("../db/types.js").CronLastFiredTable;
+    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
+    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
+    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
+    sources: import("../db/types.js").SourcesTable;
+    join_tokens: import("../db/types.js").JoinTokenTable;
+    org_settings: import("../db/types.js").OrgSettingsTable;
+    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
+    pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
+    pending_workflow_contexts: import("../db/types.js").PendingWorkflowContextsTable;
+    event_log: import("../db/types.js").EventLogTable;
+    access_log: import("../db/types.js").AccessLogTable;
+    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
+    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
+    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
+    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
+    scaler_reservations: import("../db/types.js").ScalerReservationsTable;
+    attestations: import("../db/types.js").AttestationsTable;
+    pending_attestations: import("../db/types.js").PendingAttestationsTable;
+    remote_sources: import("../db/types.js").RemoteSourcesTable;
+}, "execution_runs" | "execution_jobs" | "pending_attestations", {}>;
 /**
  * Apply org-wide attestation filters to the base query. Digest is exact-match;
  * name is an ILIKE substring; status / repository / workflow / job are equality;

package/dist/dashboard/handler.d.ts

@@ -13,7 +13,7 @@
  */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
-import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest } from '@kici-dev/engine';
+import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest } from '@kici-dev/engine';
 import type { Database } from '../db/types.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { CacheStorage } from '../storage/types.js';
@@ -31,6 +31,17 @@ interface DashboardHandlerDeps {
      * (the same one P1.5 writes bundles to).
      */
     provenanceStorage?: CacheStorage | null;
+    /**
+     * Drain the deferred-attestation outbox on demand (mints in this process,
+     * which owns the Platform WS). Backs `dashboard.attestation.retry`. Optional —
+     * absent on orchestrators without the retrier wired.
+     */
+    retryAttestations?: (opts: {
+        runId?: string;
+    }) => Promise<{
+        minted: number;
+        stillPending: number;
+    }>;
     /** Send a response message back to Platform over the WS connection. */
     send: (msg: unknown) => void;
     /** This orchestrator's instance ID, included in job detail responses. */
@@ -59,7 +70,7 @@ interface DashboardHandlerDeps {
      * compat with mixed deploys; absent means the orchestrator falls
      * back to the legacy "no PG row → throw" path.
      */
-    onRerun: (runId: string, triggeredBy: string | null, routingKey?: string) => Promise<{
+    onRerun: (runId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, routingKey?: string) => Promise<{
         newRunId: string;
     }>;
     /**
@@ -67,14 +78,14 @@ interface DashboardHandlerDeps {
      * Returns { cancelledJobs } on success or throws on failure.
      * The force flag indicates whether to force-cancel (SIGKILL, skip hooks).
      */
-    onCancel: (runId: string, cancelledBy: string | null, force?: boolean) => Promise<{
+    onCancel: (runId: string, cancelledBy: string | null, cancelledByAgentLabel: string | null, force?: boolean) => Promise<{
         cancelledJobs: number;
     }>;
     /**
      * Callback for handling manual schedule trigger requests.
      * Returns { newRunId } on success or throws on failure.
      */
-    onManualSchedule: (registrationId: string, triggeredBy: string | null) => Promise<{
+    onManualSchedule: (registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null) => Promise<{
         newRunId: string;
     }>;
     /**
@@ -99,6 +110,7 @@ export declare class DashboardHandler {
     private readonly onManualSchedule;
     private readonly coldStore;
     private readonly eventStore;
+    private readonly retryAttestations;
     constructor(deps: DashboardHandlerDeps);
     /**
      * Update the bound orgId + routingKey. Called from server.ts after resolving
@@ -295,12 +307,20 @@ export declare class DashboardHandler {
      * the shared filter builder.
      */
     private resolveAttestationsListAll;
+    /** Map the deferred-attestation outbox into pending list summaries (page 1). */
+    private resolvePendingAttestationSummaries;
     /**
      * Handle a dashboard.attestations.list.all request: org-wide, paginated,
      * filtered list of attestation summaries (metadata only). Access-logged
      * against the `attestation` target.
      */
     handleAttestationsListAll(msg: DashboardAttestationsListAllRequest): Promise<void>;
+    /**
+     * Handle a dashboard.attestation.retry request: drain the deferred-attestation
+     * outbox (optionally scoped to one run) and reply with the mint counts. The
+     * mint happens in this orchestrator process, which owns the Platform WS.
+     */
+    handleAttestationRetry(msg: DashboardAttestationRetryRequest): Promise<void>;
     /**
      * Handle a dashboard.attestation.get request: a single attestation by id with
      * its bundle inlined for the detail page. Resolves the run-owning org for the

package/dist/db/migrations/061_execution_runs_environment_id.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=061_execution_runs_environment_id.d.ts.map

package/dist/db/migrations/062_execution_runs_agent_label.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=062_execution_runs_agent_label.d.ts.map

package/dist/db/migrations/063_access_log_agent_label_index.d.ts

@@ -0,0 +1,10 @@
+import { type Kysely } from 'kysely';
+/**
+ * Index `access_log.agent_label` (column added by migration 058) so the
+ * operator-facing agent filter (`kici-admin access-log list --agent-label`,
+ * the dashboard "agent name" filter) does an indexed exact-match lookup
+ * instead of a scan. Idempotent.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=063_access_log_agent_label_index.d.ts.map

package/dist/db/migrations/064_execution_jobs_skipped_environments.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the test-run skipped-environment columns to `execution_jobs`:
+ *
+ * - `execution_jobs.skipped_environments text NULL` — a JSON-encoded `string[]`
+ *   of the bound environment names dropped on a test/local run because they
+ *   disallow local execution (`allowLocalExecution=false`) or are unconfigured.
+ *   NULL = nothing skipped.
+ * - `execution_jobs.env_warning text NULL` — the user-visible warning naming the
+ *   skipped environments, surfaced on the dashboard run view. NULL = no warning.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=064_execution_jobs_skipped_environments.d.ts.map

package/dist/db/migrations/065_pending_attestations.d.ts

@@ -0,0 +1,22 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `pending_attestations` deferred-attestation outbox and an idempotency
+ * unique index on `attestations`.
+ *
+ * When a build's provenance mint fails transiently, the agent freezes and
+ * DSSE-signs the statement at build time; the orchestrator records the frozen
+ * envelope here instead of failing the job. A Raft-leader-only retrier later
+ * mints the deferred token, attaches it, uploads the bundle, and records one
+ * `attestations` row — deleting the pending row. The unique index on
+ * `attestations (run_id, job_id, subject_digest)` makes that fulfilment
+ * idempotent across a cluster (ON CONFLICT DO NOTHING).
+ *
+ * `origin_kind` holds the non-`live` `AttestationOrigin` values
+ * (`deferred` / `offline-backfill`); the `created_at` default anchors the true
+ * build time so temporal honesty survives a later mint.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=065_pending_attestations.d.ts.map

package/dist/db/migrations/066_pending_attestations_rejected.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
+ * a deferred attestation the Platform definitively cannot mint (run/job absent).
+ * NULL while the row is still pending a later mint; set once, the row is skipped
+ * by the retrier and drops out of the pending-attestations gauge. Re-armed via
+ * `kici-admin attestations retry --include-rejected`.
+ *
+ * Idempotent: guarded on column existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=066_pending_attestations_rejected.d.ts.map

package/dist/db/types.d.ts

@@ -49,6 +49,7 @@ export interface Database {
     scaler_agent_jobs: ScalerAgentJobsTable;
     scaler_reservations: ScalerReservationsTable;
     attestations: AttestationsTable;
+    pending_attestations: PendingAttestationsTable;
     remote_sources: RemoteSourcesTable;
     host_roster: HostRosterTable;
 }
@@ -281,10 +282,16 @@ export interface ExecutionRunTable {
     original_run_id: string | null;
     /** User identity that triggered this re-run (null for webhook-triggered). Format: "user:email" or "key:name". */
     triggered_by: string | null;
+    /** Agent provenance label when the run was triggered through an agent credential (null otherwise). */
+    triggered_by_agent_label: string | null;
     /** User identity that cancelled this run (null for non-cancelled). */
     cancelled_by: string | null;
+    /** Agent provenance label when the run was cancelled through an agent credential (null otherwise). */
+    cancelled_by_agent_label: string | null;
     /** Environment name for this run (null if no environment applies) */
     environment: string | null;
+    /** Matched environment id for this run (null if no/unresolved environment). */
+    environment_id: string | null;
     /** Trust tier of the contributor for PR runs (null for non-PR events) */
     trust_tier: string | null;
     /** Lock file source: 'head' or 'base' (null for non-PR events) */
@@ -395,6 +402,13 @@ export interface ExecutionJobTable {
      * overwritten with the agent-resolved list for dynamic environments.
      */
     environments: string | null;
+    /**
+     * Bound environments skipped on a test/local run (non-test or unconfigured),
+     * JSON-encoded `string[]`. NULL = nothing skipped.
+     */
+    skipped_environments: string | null;
+    /** User-visible warning naming the skipped test-run environments. NULL = none. */
+    env_warning: string | null;
     /** Whether all upstream needs edges are satisfied (dispatch gate). */
     needs_satisfied: Generated<boolean>;
     /** Timestamp when needs_satisfied first flipped to true. */
@@ -1643,6 +1657,50 @@ export interface AttestationsTable {
 }
 export type AttestationRow = Selectable<AttestationsTable>;
 export type NewAttestationRow = Insertable<AttestationsTable>;
+/**
+ * Deferred-attestation outbox: a build whose provenance mint failed transiently
+ * freezes its DSSE-signed statement here; a leader-only retrier mints the token
+ * later and records the fulfilled `attestations` row.
+ */
+export interface PendingAttestationsTable {
+    /** Random id (primary key). */
+    id: string;
+    /** KiCI run this deferred attestation belongs to. */
+    run_id: string;
+    /** KiCI job this deferred attestation was produced by. */
+    job_id: string;
+    /** Caller-supplied artifact name. */
+    subject_name: string;
+    /** Primary subject digest (lowercase hex). */
+    subject_digest: string;
+    /** Requested token audience. */
+    audience: string;
+    /** The frozen, agent-signed DSSE envelope (JSONB). */
+    dsse_envelope: unknown;
+    /** The ephemeral public-key JWK (JSONB). */
+    public_key: unknown;
+    /** Bundle media type. */
+    media_type: string;
+    /** SHA-256 of the frozen statement payload — the later-mint binding. */
+    statement_hash: string;
+    /** Non-`live` AttestationOrigin: `deferred` | `offline-backfill`. */
+    origin_kind: string;
+    /** Retry attempts so far. */
+    attempt_count: Generated<number>;
+    /** First-capture time = the true build-time anchor. */
+    created_at: Generated<Date>;
+    /** When fulfilment was last attempted. */
+    last_attempt_at: Date | null;
+    /** Last fulfilment error, or NULL. */
+    last_error: string | null;
+    /**
+     * Terminal-rejection time: the Platform definitively rejected the mint
+     * (run/job absent). NULL while the row is still pending a later mint.
+     */
+    rejected_at: Date | null;
+}
+export type PendingAttestationRow = Selectable<PendingAttestationsTable>;
+export type NewPendingAttestationRow = Insertable<PendingAttestationsTable>;
 /**
  * Remote-source table (remote_sources).
  *

package/dist/environments/protection/satisfiability.d.ts

@@ -11,9 +11,11 @@
  *
  * This module intersects the statically-decidable set rules (branch, trigger
  * type, repository — only when every pattern is a literal, never a glob) plus
- * existence and enabled across the bound environments, and reports the first
- * provably-empty intersection. Any glob in a rule makes that rule undecidable,
- * so it is skipped here and left to the dispatch-time catch-all
+ * the `enabled` gate across the **resolved** bound environments, and reports the
+ * first provably-empty intersection. Bound names that resolve to no environment
+ * record are lenient — skipped, never rejected — matching the dispatch-time
+ * behavior in `dispatch-matched-workflow.ts`. Any glob in a rule makes that rule
+ * undecidable, so it is skipped here and left to the dispatch-time catch-all
  * (`evaluateMultiEnvGates`).
  */
 import { z } from 'zod';
@@ -23,7 +25,6 @@ export declare const UnsatisfiableRule: z.ZodEnum<{
     enabled: "enabled";
     repo: "repo";
     branch: "branch";
-    existence: "existence";
     trigger: "trigger";
 }>;
 export type UnsatisfiableRule = z.infer<typeof UnsatisfiableRule>;
@@ -36,9 +37,12 @@ export interface UnsatisfiableBinding {
 }
 /**
  * Returns a precise problem when the bound environments can NEVER be jointly
- * satisfied (a provably-empty intersection on a decidable rule, a missing
- * environment, or a disabled one), else `null`. Glob / undecidable cases return
- * `null` and are caught at dispatch by `evaluateMultiEnvGates`.
+ * satisfied (a disabled environment, or mutually-exclusive fixed restrictions
+ * among the resolved environments), else `null`. Missing (unresolved) names are
+ * skipped — a bound name with no environment record contributes no protection
+ * rules and is lenient at dispatch, so it is not rejected here. Glob /
+ * undecidable cases also return `null` and are caught at dispatch by
+ * `evaluateMultiEnvGates`.
  *
  * `envs[i]` is the resolved `Environment` for `envNames[i]` (undefined when the
  * name has no environment record). Only the statically-known (non-dynamic) bound
@@ -52,8 +56,9 @@ interface SatisfiabilityLockWorkflow {
 }
 /**
  * Walk every workflow's static jobs and reject the registration when a bound
- * environment list is provably unsatisfiable (missing/disabled environment, or
- * mutually-exclusive fixed branch/trigger/repo restrictions). Dynamic elements
+ * environment list is provably unsatisfiable (a disabled environment, or
+ * mutually-exclusive fixed branch/trigger/repo restrictions among the resolved
+ * environments — missing names are lenient, never rejected). Dynamic elements
  * are skipped (unresolvable at registration); the all-must-pass semantics keep
  * the static subset's exclusivity sound. Throws the first
  * `UnsatisfiableBinding.message` so the registration route / direct helper

package/dist/events/circuit-breaker.d.ts

@@ -1,10 +1,11 @@
 import type { EventRouterConfig } from './types.js';
 /**
- * Circuit breaker for event loop detection and per-workflow rate limiting.
+ * Circuit breaker for event loop detection and user-event rate limiting.
  *
  * Two-layer protection:
  * 1. Chain depth: Rejects events exceeding configurable max chain depth.
- * 2. Rate limiting: Sliding-window per-workflow rate limiter.
+ * 2. Rate limiting: Sliding-window limiter keyed per (source routing key +
+ *    event name). System events (`__`-prefixed) are exempt upstream.
  */
 export declare class EventCircuitBreaker {
     private readonly config;
@@ -18,10 +19,12 @@ export declare class EventCircuitBreaker {
         reason?: string;
     };
     /**
-     * Check if a workflow is within its per-minute rate limit.
-     * Uses a sliding window of 60 seconds.
+     * Check whether a rate-limit key is within its per-minute allowance, using a
+     * sliding 60-second window. Callers key user events by
+     * `<sourceRoutingKey>:<eventName>`; system events (`__`-prefixed) are exempt
+     * upstream and never reach here.
      */
-    checkRateLimit(workflowKey: string): {
+    checkRateLimit(rateKey: string): {
         allowed: boolean;
         retryAfterMs?: number;
     };

package/dist/events/event-router.d.ts

@@ -159,11 +159,19 @@ export declare class EventRouter {
      */
     private buildSimulatedEvent;
     /**
-     * Catch-up: process unprocessed events missed during downtime.
+     * Catch-up: process every unprocessed event missed during downtime.
      *
-     * Uses lease-based dispatch identical to the live path, so a catch-up
-     * dispatch failure schedules a retry via the leader-only scanner instead
-     * of being silently dropped.
+     * Pages through the backlog with a keyset cursor: fetch a batch, dispatch
+     * each event (lease-based, identical failure semantics to the live path),
+     * advance the cursor to the last event of the batch, and repeat until a
+     * batch returns fewer than EVENT_CATCHUP_BATCH_SIZE rows. Without this loop
+     * only the oldest page (100 events) would be dispatched and the remainder
+     * would sit unprocessed — invisible to both the live NOTIFY path and the
+     * retry scanner — until the TTL cleanup deleted them undelivered.
+     *
+     * The store's cursor is strictly monotone over (created_at, id), so a
+     * still-unprocessed retrying event at or before the cursor is never
+     * re-fetched — that strict advance is what guarantees this loop terminates.
      */
     private catchUp;
 }

package/dist/events/event-store.d.ts

@@ -3,6 +3,14 @@ import type { Database } from '../db/types.js';
 import type { DlqReason, EventRouterConfig, StoredEvent } from './types.js';
 /** Either a Kysely DB handle or an active transaction. */
 export type DbExecutor = Kysely<Database> | Transaction<Database>;
+/**
+ * Default page size for unprocessed-event catch-up scans.
+ *
+ * Shared with EventRouter.catchUp so the paginating loop's "a short batch
+ * means we're done" termination check compares against the same value the
+ * store slices by.
+ */
+export declare const EVENT_CATCHUP_BATCH_SIZE = 100;
 /**
  * Input shape for writing a new event. Excludes columns the DB fills in
  * itself (id, processed, created_at, attempts, claimed_*, last_error,
@@ -58,9 +66,19 @@ export declare class EventStore {
      */
     getById(id: string): Promise<StoredEvent | null>;
     /**
-     * Get unprocessed events for catch-up on reconnect.
-     * If sinceId is null, returns all unprocessed events.
-     * Ordered by created_at ASC. Excludes DLQ rows.
+     * Get a page of unprocessed events for catch-up on start.
+     *
+     * Rows are ordered by a deterministic keyset `(created_at ASC, id ASC)` and
+     * exclude processed + DLQ rows. When `sinceId` is null, returns the first
+     * page from the oldest event. When `sinceId` is given, returns the page
+     * strictly after that event's `(created_at, id)` — a composite cursor so
+     * that events sharing the reference event's `created_at` are NOT skipped
+     * (a bare `created_at > ref` predicate drops same-timestamp siblings) and a
+     * still-unprocessed retrying event at or before the cursor is never
+     * re-fetched (which is what makes the caller's pagination loop terminate).
+     *
+     * The caller advances `sinceId` to the last event of each returned page and
+     * re-queries until a page returns fewer than `limit` rows.
      */
     getUnprocessedSince(sinceId: string | null, limit?: number): Promise<StoredEvent[]>;
     /**

package/dist/events/trust-store.d.ts

@@ -17,7 +17,12 @@ interface TrustEntry {
  *
  * Same-repo events (same routing key) are always trusted without a DB lookup.
  * Cross-repo events require an explicit enabled row in the cross_repo_trust table.
- * Glob-based event filtering is supported via the allowed_events column.
+ * Glob-based event filtering is supported via the allowed_events column, whose
+ * value carries a three-way meaning:
+ *   - `null`       — filter unset: every event name is allowed (allow-all).
+ *   - `'[]'`       — an explicit empty allow-list: no event is allowed (deny-all).
+ *   - `'["glob"]'` — only event names matching one of the globs are allowed.
+ * Malformed (unparseable / non-array) allowed_events fails closed (deny).
  */
 export declare class TrustStore {
     private readonly db;

package/dist/events/types.d.ts

@@ -7,7 +7,12 @@
 export interface EventRouterConfig {
     /** Maximum allowed chain depth before circuit breaker trips (default: 10) */
     maxChainDepth: number;
-    /** Maximum event emissions per workflow per minute (default: 100) */
+    /**
+     * Max user-event emissions per (source routing key + event name) per minute
+     * (sliding 60s window). System events (`__`-prefixed, e.g. __workflow_complete)
+     * are EXEMPT -- they are orchestrator-emitted once per completion and cannot
+     * loop, so the storm guard does not apply. Default 100.
+     */
     rateLimitPerWorkflowPerMinute: number;
     /** TTL for persisted events in seconds (default: 604800 = 7 days) */
     eventTtlSeconds: number;