@kici-dev/orchestrator 0.1.24 → 0.1.26

package/dist/cli.js

@@ -6,7 +6,7 @@ import path, { dirname, join, resolve } from "node:path";
 import * as fs$1 from "node:fs";
 import fs, { chmodSync, closeSync, createReadStream, createWriteStream, existsSync, mkdtempSync, openSync, promises, readFileSync, realpathSync, statSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
 import { Command } from "commander";
-import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
+import { BaseColdStore, ChunkLru, addLogsToArchive, chunkObjectKey, clearDispatchQueueDirect, computeChunkId, computeMigrationsHash, createDb, createDbRole, createEnvironmentTemplateDirect, createLogger, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteEnvironmentDirect, dropAndCreateDatabase, emitKiciEventDirect, encodeKeySegment, ensureDatabase, formatBytes, formatUptime, isSchemaCurrent, listEnvironmentsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, registerWorkflowManualDirect, resetRaftStateDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, sha256, showEnvironmentDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, tablePrefix, toErrorMessage } from "@kici-dev/shared";
 import crypto, { createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { createInterface } from "node:readline";
 import { KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, ScalerBackendType, ScalerEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_MAX_PAYLOAD_BYTES, accessLogWarmSqlCase, attestationVerifyStatusSchema, getAccessLogColdDays, getSecretAuditLogColdDays, matcherSatisfiedBy, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseHostPropertyAssignments, scalerAgentLabels, secretAuditLogWarmSqlCase } from "@kici-dev/engine";
@@ -28,6 +28,7 @@ import { CopyObjectCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCom
 import { Upload } from "@aws-sdk/lib-storage";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { verifyKiciBundle } from "@kici-dev/engine/provenance/verify";
+import { decodeProtectedHeader } from "jose";
 import { ZipArchive } from "archiver";
 import { confirm, input, password, select } from "@inquirer/prompts";
 import JSZip from "jszip";
@@ -35,10 +36,18 @@ import { pipeline } from "node:stream/promises";
 import "pg";
 import { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DashboardWriteCategory, DashboardWriteSensitivity } from "@kici-dev/engine/protocol/dashboard-write-operations";
 import { CLUSTER_NAME_FORMAT_MESSAGE } from "@kici-dev/engine/protocol/cluster-name";
+import { runIdempotentStep } from "@kici-dev/shared/idempotency";
 import { PassThrough } from "node:stream";
 import Docker from "dockerode";
 var __defProp = Object.defineProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
 var __exportAll = (all, no_symbols) => {
 	let target = {};
 	for (var name in all) __defProp(target, name, {
@@ -48,7 +57,7 @@ var __exportAll = (all, no_symbols) => {
 	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
 	return target;
 };
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 //#region src/cli/api-client.ts
 /**
@@ -438,6 +447,8 @@ var AdminApiClient = class {
 		if (opts?.from) params.set("from", opts.from);
 		if (opts?.to) params.set("to", opts.to);
 		if (opts?.q) params.set("q", opts.q);
+		if (opts?.agentLabel) params.set("agentLabel", opts.agentLabel);
+		if (opts?.agentOnly) params.set("agentOnly", "true");
 		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();
@@ -817,7 +828,7 @@ function registerAgentCommands(program, getClient) {
 			if (opts.privilegedRoot) mandatorySet.add(PRIVILEGED_ROOT_LABEL);
 			const mandatoryLabels = mandatorySet.size > 0 ? [...mandatorySet] : void 0;
 			const baseLabels = opts.labels ? opts.labels.split(",").map((l) => l.trim()) : [];
-			const labelSet = new Set([...baseLabels, ...mandatoryLabels ?? []]);
+			const labelSet = /* @__PURE__ */ new Set([...baseLabels, ...mandatoryLabels ?? []]);
 			const labels = labelSet.size > 0 ? [...labelSet] : void 0;
 			const result = await getClient().createAgentToken({
 				labels,
@@ -1579,8 +1590,8 @@ var init_client = __esmMin((() => {
 //#region src/db/migrations/001_initial.ts
 init_client();
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$59,
-	up: () => up$59
+	down: () => down$65,
+	up: () => up$65
 });
 /**
 * Squashed initial migration -- creates the complete Orchestrator database schema.
@@ -2272,7 +2283,7 @@ const DDL_STATEMENTS = [
 	`ALTER TABLE ONLY public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey FOREIGN KEY (environment_id) REFERENCES public.environments(id);`
 ];
-async function up$59(db) {
+async function up$65(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -2294,7 +2305,7 @@ async function up$59(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$59(db) {
+async function down$65(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -2341,8 +2352,8 @@ async function down$59(db) {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$58,
-	up: () => up$58
+	down: () => down$64,
+	up: () => up$64
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -2356,13 +2367,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$58(db) {
+async function up$64(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$58(db) {
+async function down$64(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -2371,8 +2382,8 @@ async function down$58(db) {
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$57,
-	up: () => up$57
+	down: () => down$63,
+	up: () => up$63
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -2396,7 +2407,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$57(db) {
+async function up$63(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -2434,28 +2445,28 @@ async function up$57(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$57(db) {
+async function down$63(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$56,
-	up: () => up$56
+	down: () => down$62,
+	up: () => up$62
 });
-async function up$56(db) {
+async function up$62(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$56(db) {
+async function down$62(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$55,
-	up: () => up$55
+	down: () => down$61,
+	up: () => up$61
 });
 /**
 * Cold-store chunk counter table.
@@ -2472,7 +2483,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$55(db) {
+async function up$61(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -2490,14 +2501,14 @@ async function up$55(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$55(db) {
+async function down$61(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$54,
-	up: () => up$54
+	down: () => down$60,
+	up: () => up$60
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -2533,7 +2544,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$54(db) {
+async function up$60(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2578,7 +2589,7 @@ async function up$54(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$54(db) {
+async function down$60(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -2603,8 +2614,8 @@ async function down$54(db) {
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$53,
-	up: () => up$53
+	down: () => down$59,
+	up: () => up$59
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -2644,7 +2655,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$53(db) {
+async function up$59(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2665,7 +2676,7 @@ async function up$53(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$53(db) {
+async function down$59(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -2693,8 +2704,8 @@ async function down$53(db) {
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$52,
-	up: () => up$52
+	down: () => down$58,
+	up: () => up$58
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -2732,7 +2743,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$52(db) {
+async function up$58(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -2748,7 +2759,7 @@ async function up$52(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$52(db) {
+async function down$58(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -2767,8 +2778,8 @@ async function down$52(db) {
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$51,
-	up: () => up$51
+	down: () => down$57,
+	up: () => up$57
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -2781,7 +2792,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$51(db) {
+async function up$57(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -2790,14 +2801,14 @@ async function up$51(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$51(db) {
+async function down$57(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$50,
-	up: () => up$50
+	down: () => down$56,
+	up: () => up$56
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -2829,7 +2840,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$50(db) {
+async function up$56(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -2856,14 +2867,14 @@ async function up$50(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$50(db) {
+async function down$56(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$49,
-	up: () => up$49
+	down: () => down$55,
+	up: () => up$55
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -2882,11 +2893,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$49(db) {
+async function up$55(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$49(db) {
+async function down$55(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -2925,8 +2936,8 @@ async function down$49(db) {
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$48,
-	up: () => up$48
+	down: () => down$54,
+	up: () => up$54
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -2952,7 +2963,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$48(db) {
+async function up$54(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -2970,14 +2981,14 @@ async function up$48(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$48(db) {
+async function down$54(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$47,
-	up: () => up$47
+	down: () => down$53,
+	up: () => up$53
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -2996,7 +3007,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$47(db) {
+async function up$53(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -3006,15 +3017,15 @@ async function up$47(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$47(db) {
+async function down$53(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$46,
-	up: () => up$46
+	down: () => down$52,
+	up: () => up$52
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -3048,7 +3059,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$46(db) {
+async function up$52(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -3079,7 +3090,7 @@ async function up$46(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$46(db) {
+async function down$52(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -3097,8 +3108,8 @@ async function down$46(db) {
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$45,
-	up: () => up$45
+	down: () => down$51,
+	up: () => up$51
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -3126,7 +3137,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$45(db) {
+async function up$51(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3251,7 +3262,7 @@ async function up$45(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$45(db) {
+async function down$51(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3276,8 +3287,8 @@ async function down$45(db) {
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$44,
-	up: () => up$44
+	down: () => down$50,
+	up: () => up$50
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -3290,7 +3301,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$44(db) {
+async function up$50(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3304,7 +3315,7 @@ async function up$44(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$44(db) {
+async function down$50(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -3312,8 +3323,8 @@ async function down$44(db) {
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$43,
-	up: () => up$43
+	down: () => down$49,
+	up: () => up$49
 });
 /**
 * Widen every orchestrator-side `org_id varchar(12)` column to
@@ -3353,17 +3364,17 @@ const ORG_ID_TABLES$1 = [
 	"held_runs",
 	"scoped_secrets"
 ];
-async function up$43(db) {
+async function up$49(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$43(db) {
+async function down$49(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$42,
-	up: () => up$42
+	down: () => down$48,
+	up: () => up$48
 });
 /**
 * Prefix every orchestrator-side tenant string with `org_` to align
@@ -3408,19 +3419,19 @@ const CUSTOMER_ID_TABLES = [
 	"workflow_registrations",
 	"org_settings"
 ];
-async function up$42(db) {
+async function up$48(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$42(db) {
+async function down$48(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$41,
-	up: () => up$41
+	down: () => down$47,
+	up: () => up$47
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -3443,7 +3454,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$41(db) {
+async function up$47(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -3464,15 +3475,15 @@ async function up$41(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$41(db) {
+async function down$47(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$40,
-	up: () => up$40
+	down: () => down$46,
+	up: () => up$46
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -3487,7 +3498,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$40(db) {
+async function up$46(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3501,7 +3512,7 @@ async function up$40(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$40(db) {
+async function down$46(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -3509,8 +3520,8 @@ async function down$40(db) {
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$39,
-	up: () => up$39
+	down: () => down$45,
+	up: () => up$45
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -3534,7 +3545,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$39(db) {
+async function up$45(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -3565,14 +3576,14 @@ async function up$39(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$39(db) {
+async function down$45(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$38,
-	up: () => up$38
+	down: () => down$44,
+	up: () => up$44
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -3599,7 +3610,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$38(db) {
+async function up$44(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3649,7 +3660,7 @@ async function up$38(db) {
     `.execute(db);
 	}
 }
-async function down$38(db) {
+async function down$44(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -3657,8 +3668,8 @@ async function down$38(db) {
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$43,
+	up: () => up$43
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -3682,7 +3693,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$37(db) {
+async function up$43(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3707,7 +3718,7 @@ async function up$37(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$37(db) {
+async function down$43(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -3719,8 +3730,8 @@ async function down$37(db) {
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$42,
+	up: () => up$42
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -3736,7 +3747,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$36(db) {
+async function up$42(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3752,7 +3763,7 @@ async function up$36(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$36(db) {
+async function down$42(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -3760,8 +3771,8 @@ async function down$36(db) {
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$41,
+	up: () => up$41
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -3775,7 +3786,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$35(db) {
+async function up$41(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -3795,7 +3806,7 @@ async function up$35(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$35(db) {
+async function down$41(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -3806,8 +3817,8 @@ async function down$35(db) {
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -3816,7 +3827,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$34(db) {
+async function up$40(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3826,7 +3837,7 @@ async function up$34(db) {
     ])))
   `.execute(db);
 }
-async function down$34(db) {
+async function down$40(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -3839,8 +3850,8 @@ async function down$34(db) {
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -3858,13 +3869,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$33(db) {
+async function up$39(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$33(db) {
+async function down$39(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -3872,8 +3883,8 @@ async function down$33(db) {
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$38,
+	up: () => up$38
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -3892,7 +3903,7 @@ var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has either column skips it.
 */
-async function columnExists(db, column) {
+async function columnExists$1(db, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3902,17 +3913,17 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$32(db) {
-	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
+async function up$38(db) {
+	if (!await columnExists$1(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
     `.execute(db);
-	if (!await columnExists(db, "user_cache_ttl_ms")) await sql`
+	if (!await columnExists$1(db, "user_cache_ttl_ms")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$32(db) {
+async function down$38(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -3923,8 +3934,8 @@ async function down$32(db) {
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -3938,7 +3949,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$31(db) {
+async function up$37(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -3951,7 +3962,7 @@ async function up$31(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$31(db) {
+async function down$37(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -3959,8 +3970,8 @@ async function down$31(db) {
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -3971,14 +3982,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$30(db) {
+async function up$36(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$30(db) {
+async function down$36(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -3988,8 +3999,8 @@ async function down$30(db) {
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -4006,7 +4017,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$29(db) {
+async function up$35(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4031,7 +4042,7 @@ async function up$29(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$29(db) {
+async function down$35(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -4039,8 +4050,8 @@ async function down$29(db) {
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -4052,7 +4063,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$28(db) {
+async function up$34(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4066,7 +4077,7 @@ async function up$28(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$28(db) {
+async function down$34(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -4074,8 +4085,8 @@ async function down$28(db) {
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -4092,7 +4103,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$27(db) {
+async function up$33(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4112,7 +4123,7 @@ async function up$27(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$27(db) {
+async function down$33(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -4123,8 +4134,8 @@ async function down$27(db) {
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -4146,7 +4157,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$26(db) {
+async function up$32(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -4179,7 +4190,7 @@ async function up$26(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$26(db) {
+async function down$32(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -4189,8 +4200,8 @@ async function down$26(db) {
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -4199,7 +4210,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$25(db) {
+async function up$31(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -4209,14 +4220,14 @@ async function up$25(db) {
     )
   `.execute(db);
 }
-async function down$25(db) {
+async function down$31(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -4229,7 +4240,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$24(db) {
+async function up$30(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4255,14 +4266,14 @@ async function up$24(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$24(db) {
+async function down$30(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -4279,7 +4290,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$23(db) {
+async function up$29(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4295,7 +4306,7 @@ async function up$23(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$23(db) {
+async function down$29(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -4314,8 +4325,8 @@ async function down$23(db) {
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -4327,7 +4338,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$22(db) {
+async function up$28(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4346,14 +4357,14 @@ async function up$22(db) {
     )
   `.execute(db);
 }
-async function down$22(db) {
+async function down$28(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/039_host_roster.ts
 var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * `host_roster` is KiCI's declared inventory: one durable row per agent the
@@ -4370,7 +4381,7 @@ var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$21(db) {
+async function up$27(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -4400,14 +4411,14 @@ async function up$21(db) {
 	await sql`CREATE INDEX idx_host_roster_reap
               ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
 }
-async function down$21(db) {
+async function down$27(db) {
 	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/040_runsonall_pin.ts
 var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add the `runsOnAll` host fan-out columns:
@@ -4424,7 +4435,7 @@ var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has any column is a no-op.
 */
-async function colExists$9(db, table, name) {
+async function colExists$11(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4434,18 +4445,18 @@ async function colExists$9(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$20(db) {
-	if (!await colExists$9(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
-	if (!await colExists$9(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
-	if (!await colExists$9(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
-	if (!await colExists$9(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
+async function up$26(db) {
+	if (!await colExists$11(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
+	if (!await colExists$11(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
+	if (!await colExists$11(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
+	if (!await colExists$11(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_dispatch_queue_pinned_agent
       ON public.dispatch_queue (pinned_agent_id)
       WHERE pinned_agent_id IS NOT NULL
   `.execute(db);
 }
-async function down$20(db) {
+async function down$26(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
@@ -4455,8 +4466,8 @@ async function down$20(db) {
 //#endregion
 //#region src/db/migrations/041_wave_gated.ts
 var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$25,
+	up: () => up$25
 });
 /**
 * Add the rolling fan-out wave-gate columns:
@@ -4476,7 +4487,7 @@ var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$8(db, table, name) {
+async function colExists$10(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4486,16 +4497,16 @@ async function colExists$8(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$19(db) {
-	if (!await colExists$8(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
-	if (!await colExists$8(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
-	if (!await colExists$8(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
+async function up$25(db) {
+	if (!await colExists$10(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
+	if (!await colExists$10(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
+	if (!await colExists$10(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
       ON public.execution_jobs (run_id, base_job_name, wave_gated)
   `.execute(db);
 }
-async function down$19(db) {
+async function down$25(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
@@ -4504,8 +4515,8 @@ async function down$19(db) {
 //#endregion
 //#region src/db/migrations/042_dispatch_queue_patterns.ts
 var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$24,
+	up: () => up$24
 });
 /**
 * Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
@@ -4521,7 +4532,7 @@ var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the columns is a no-op.
 */
-async function colExists$7(db, table, name) {
+async function colExists$9(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4531,19 +4542,19 @@ async function colExists$7(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$18(db) {
-	if (!await colExists$7(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
-	if (!await colExists$7(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+async function up$24(db) {
+	if (!await colExists$9(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	if (!await colExists$9(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
 }
-async function down$18(db) {
+async function down$24(db) {
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/043_rerouted_to_peer.ts
 var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add a nullable `rerouted_to_peer text` marker to execution_jobs. Non-null
@@ -4554,7 +4565,7 @@ var _043_rerouted_to_peer_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function colExists$6(db, table, name) {
+async function colExists$8(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4564,17 +4575,17 @@ async function colExists$6(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$17(db) {
-	if (!await colExists$6(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
+async function up$23(db) {
+	if (!await colExists$8(db, "execution_jobs", "rerouted_to_peer")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN rerouted_to_peer text`.execute(db);
 }
-async function down$17(db) {
+async function down$23(db) {
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS rerouted_to_peer`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/044_check_mode.ts
 var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add idempotent check-mode columns:
@@ -4591,7 +4602,7 @@ var _044_check_mode_exports = /* @__PURE__ */ __exportAll({
 * All nullable. Idempotent: re-running on a DB that already has the columns is
 * a no-op.
 */
-async function colExists$5(db, table, name) {
+async function colExists$7(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4601,13 +4612,13 @@ async function colExists$5(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$16(db) {
-	if (!await colExists$5(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
-	if (!await colExists$5(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
-	if (!await colExists$5(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
-	if (!await colExists$5(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
+async function up$22(db) {
+	if (!await colExists$7(db, "execution_runs", "check_mode")) await sql`ALTER TABLE public.execution_runs ADD COLUMN check_mode text`.execute(db);
+	if (!await colExists$7(db, "execution_steps", "check_outcome")) await sql`ALTER TABLE public.execution_steps ADD COLUMN check_outcome text`.execute(db);
+	if (!await colExists$7(db, "execution_steps", "drift_summary")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift_summary text`.execute(db);
+	if (!await colExists$7(db, "execution_steps", "drift")) await sql`ALTER TABLE public.execution_steps ADD COLUMN drift jsonb`.execute(db);
 }
-async function down$16(db) {
+async function down$22(db) {
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS drift_summary`.execute(db);
 	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS check_outcome`.execute(db);
@@ -4616,8 +4627,8 @@ async function down$16(db) {
 //#endregion
 //#region src/db/migrations/045_host_properties.ts
 var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add the typed host-vars dimension to the host roster:
@@ -4631,18 +4642,18 @@ var _045_host_properties_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive column).
 */
-async function up$15(db) {
+async function up$21(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS host_properties jsonb NOT NULL DEFAULT '{}'::jsonb`.execute(db);
 }
-async function down$15(db) {
+async function down$21(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS host_properties`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/046_join_token_consumed_by_instance.ts
 var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Record the joining peer's instanceId at first consumption of a join token:
@@ -4657,18 +4668,18 @@ var _046_join_token_consumed_by_instance_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
 * the column is a no-op. Staging data is preserved (additive nullable column).
 */
-async function up$14(db) {
+async function up$20(db) {
 	await sql`ALTER TABLE public.join_tokens
     ADD COLUMN IF NOT EXISTS consumed_by_instance text`.execute(db);
 }
-async function down$14(db) {
+async function down$20(db) {
 	await sql`ALTER TABLE public.join_tokens DROP COLUMN IF EXISTS consumed_by_instance`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/047_needs_run_on.ts
 var _047_needs_run_on_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Migrate `execution_job_needs` from the binary `if_failed` policy to a
@@ -4693,7 +4704,7 @@ const ALL_TERMINAL_JSON = JSON.stringify([
 	"drift_dropped"
 ]);
 const SUCCESS_ONLY_JSON = JSON.stringify(["success"]);
-async function colExists$4(db, table, name) {
+async function colExists$6(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -4704,12 +4715,12 @@ async function colExists$4(db, table, name) {
   `.execute(db)).rows[0]?.exists ?? false;
 }
 const SUCCESS_ONLY_DEFAULT = `'${SUCCESS_ONLY_JSON}'`;
-async function up$13(db) {
-	if (!await colExists$4(db, "execution_job_needs", "run_on")) await sql`
+async function up$19(db) {
+	if (!await colExists$6(db, "execution_job_needs", "run_on")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN run_on text NOT NULL DEFAULT ${sql.raw(SUCCESS_ONLY_DEFAULT)}
     `.execute(db);
-	if (await colExists$4(db, "execution_job_needs", "if_failed")) {
+	if (await colExists$6(db, "execution_job_needs", "if_failed")) {
 		await sql`
       UPDATE public.execution_job_needs
          SET run_on = ${ALL_TERMINAL_JSON}
@@ -4723,12 +4734,12 @@ async function up$13(db) {
 		await sql`ALTER TABLE public.execution_job_needs DROP COLUMN if_failed`.execute(db);
 	}
 }
-async function down$13(db) {
-	if (!await colExists$4(db, "execution_job_needs", "if_failed")) await sql`
+async function down$19(db) {
+	if (!await colExists$6(db, "execution_job_needs", "if_failed")) await sql`
       ALTER TABLE public.execution_job_needs
         ADD COLUMN if_failed text NOT NULL DEFAULT 'skip'
     `.execute(db);
-	if (await colExists$4(db, "execution_job_needs", "run_on")) {
+	if (await colExists$6(db, "execution_job_needs", "run_on")) {
 		await sql`
       UPDATE public.execution_job_needs
          SET if_failed = CASE WHEN run_on = ${SUCCESS_ONLY_JSON} THEN 'skip' ELSE 'run' END
@@ -4739,8 +4750,8 @@ async function down$13(db) {
 //#endregion
 //#region src/db/migrations/048_host_reboot_pending.ts
 var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
@@ -4757,18 +4768,18 @@ var _048_host_reboot_pending_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$12(db) {
+async function up$18(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS reboot_pending_until timestamptz`.execute(db);
 }
-async function down$12(db) {
+async function down$18(db) {
 	await sql`ALTER TABLE public.host_roster DROP COLUMN IF EXISTS reboot_pending_until`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/049_held_runs_payload.ts
 var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
@@ -4780,18 +4791,18 @@ var _049_held_runs_payload_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$11(db) {
+async function up$17(db) {
 	await sql`ALTER TABLE public.held_runs
     ADD COLUMN IF NOT EXISTS payload jsonb`.execute(db);
 }
-async function down$11(db) {
+async function down$17(db) {
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS payload`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/050_sources_slug.ts
 var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
@@ -4806,18 +4817,18 @@ var _050_sources_slug_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$10(db) {
+async function up$16(db) {
 	await sql`ALTER TABLE public.sources
     ADD COLUMN IF NOT EXISTS slug text`.execute(db);
 }
-async function down$10(db) {
+async function down$16(db) {
 	await sql`ALTER TABLE public.sources DROP COLUMN IF EXISTS slug`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/051_binding_host_pattern.ts
 var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Add a per-host dimension to environment secret bindings:
@@ -4833,7 +4844,7 @@ var _051_binding_host_pattern_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has the column / index is a no-op.
 * Additive — staging data is preserved.
 */
-async function up$9(db) {
+async function up$15(db) {
 	await sql`ALTER TABLE public.environment_bindings
     ADD COLUMN IF NOT EXISTS host_pattern text NOT NULL DEFAULT '**'`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
@@ -4841,7 +4852,7 @@ async function up$9(db) {
 	await sql`CREATE UNIQUE INDEX IF NOT EXISTS environment_bindings_env_scope_host_uniq
     ON public.environment_bindings (environment_id, scope_pattern, host_pattern)`.execute(db);
 }
-async function down$9(db) {
+async function down$15(db) {
 	await sql`DROP INDEX IF EXISTS public.environment_bindings_env_scope_host_uniq`.execute(db);
 	await sql`ALTER TABLE public.environment_bindings
     DROP COLUMN IF EXISTS host_pattern`.execute(db);
@@ -4851,8 +4862,8 @@ async function down$9(db) {
 //#endregion
 //#region src/db/migrations/052_host_reach_metadata.ts
 var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Add pre-agent reach metadata to the host roster so a declared host (no agent
@@ -4869,14 +4880,14 @@ var _052_host_reach_metadata_exports = /* @__PURE__ */ __exportAll({
 * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
 * so staging data is preserved.
 */
-async function up$8(db) {
+async function up$14(db) {
 	await sql`ALTER TABLE public.host_roster
     ADD COLUMN IF NOT EXISTS address text,
     ADD COLUMN IF NOT EXISTS ssh_user text,
     ADD COLUMN IF NOT EXISTS ssh_port integer,
     ADD COLUMN IF NOT EXISTS ssh_key_secret text`.execute(db);
 }
-async function down$8(db) {
+async function down$14(db) {
 	await sql`ALTER TABLE public.host_roster
     DROP COLUMN IF EXISTS address,
     DROP COLUMN IF EXISTS ssh_user,
@@ -4886,8 +4897,8 @@ async function down$8(db) {
 //#endregion
 //#region src/db/migrations/053_agent_token_single_use.ts
 var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add a single-use marker to agent tokens for the bootstrap (init-runner)
@@ -4902,19 +4913,19 @@ var _053_agent_token_single_use_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$7(db) {
+async function up$13(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS consumed_at timestamptz`.execute(db);
 }
-async function down$7(db) {
+async function down$13(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS consumed_at`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/054_local_working_tree.ts
 var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * Mark runs that executed an uploaded local working tree (`kici run remote`):
@@ -4927,19 +4938,19 @@ var _054_local_working_tree_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
 * data is preserved.
 */
-async function up$6(db) {
+async function up$12(db) {
 	await sql`ALTER TABLE public.execution_runs
     ADD COLUMN IF NOT EXISTS local_working_tree boolean NOT NULL DEFAULT false`.execute(db);
 }
-async function down$6(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.execution_runs
     DROP COLUMN IF EXISTS local_working_tree`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/055_agent_token_mandatory_labels.ts
 var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add a token-bound mandatory-label taint to agent tokens:
@@ -4955,19 +4966,19 @@ var _055_agent_token_mandatory_labels_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$5(db) {
+async function up$11(db) {
 	await sql`ALTER TABLE public.agent_tokens
     ADD COLUMN IF NOT EXISTS mandatory_labels text`.execute(db);
 }
-async function down$5(db) {
+async function down$11(db) {
 	await sql`ALTER TABLE public.agent_tokens
     DROP COLUMN IF EXISTS mandatory_labels`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/056_execution_jobs_environments.ts
 var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add a per-job bound deployment-environment list to `execution_jobs`:
@@ -4982,19 +4993,19 @@ var _056_execution_jobs_environments_exports = /* @__PURE__ */ __exportAll({
 * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
 * preserved.
 */
-async function up$4(db) {
+async function up$10(db) {
 	await sql`ALTER TABLE public.execution_jobs
     ADD COLUMN IF NOT EXISTS environments text`.execute(db);
 }
-async function down$4(db) {
+async function down$10(db) {
 	await sql`ALTER TABLE public.execution_jobs
     DROP COLUMN IF EXISTS environments`.execute(db);
 }
 //#endregion
 //#region src/db/migrations/057_step_concurrency.ts
 var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add parallel step-group concurrency columns to `execution_steps`:
@@ -5007,6 +5018,75 @@ var _057_step_concurrency_exports = /* @__PURE__ */ __exportAll({
 * Both nullable, no backfill. Idempotent: re-running on a DB that already has the
 * columns is a no-op.
 */
+async function colExists$5(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$9(db) {
+	if (!await colExists$5(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
+	if (!await colExists$5(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
+}
+async function down$9(db) {
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
+	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/058_access_log_agent_label.ts
+var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$8,
+	up: () => up$8
+});
+/**
+* Add `access_log.agent_label text` — the human-set name of the agent that
+* performed the action, when the actor authenticated with an agent-kind PAT.
+*
+* Queryable column (not just baked into `actor_meta`) so an operator can filter
+* the access log by agent. NULL for ordinary human / API-key / system actors.
+* Nullable, no backfill. Idempotent.
+*/
+async function colExists$4(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$8(db) {
+	if (!await colExists$4(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
+}
+async function down$8(db) {
+	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/059_attestation_verdict.ts
+var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$7,
+	up: () => up$7
+});
+/**
+* Add server-side verification verdict columns to `attestations`, plus the
+* lookup indexes the org-wide attestations browser queries against.
+*
+* The orchestrator verifies each provenance bundle at ingest and records the
+* verdict here so the dashboard list shows trustworthy badges with no per-row
+* bundle fetch:
+* - `verify_status` — one of `verified` / `failed` / `unverifiable` / `pending`
+*   (mirrors `attestationVerifyStatusSchema.enum.*` in `@kici-dev/engine`).
+*   `DEFAULT 'pending'` covers rows written before a verdict is computed.
+* - `verify_reason` — first failure code from `verifyKiciBundle` (nullable).
+* - `verified_at` — when the verdict was recorded (nullable).
+*
+* Idempotent: guarded on the `verify_status` column's existence.
+*/
 async function colExists$3(db, table, name) {
 	return (await sql`
     SELECT EXISTS (
@@ -5017,142 +5097,329 @@ async function colExists$3(db, table, name) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
+async function up$7(db) {
+	if (await colExists$3(db, "attestations", "verify_status")) return;
+	await sql`
+    ALTER TABLE public.attestations
+      ADD COLUMN verify_status TEXT NOT NULL DEFAULT 'pending',
+      ADD COLUMN verify_reason TEXT,
+      ADD COLUMN verified_at TIMESTAMPTZ
+  `.execute(db);
+	await sql`CREATE INDEX idx_attestations_subject_digest ON public.attestations (subject_digest)`.execute(db);
+	await sql`CREATE INDEX idx_attestations_subject_name ON public.attestations (subject_name)`.execute(db);
+	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
+	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
+}
+async function down$7(db) {
+	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
+	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
+	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
+	await sql`DROP INDEX IF EXISTS idx_attestations_subject_digest`.execute(db);
+	await sql`
+    ALTER TABLE public.attestations
+      DROP COLUMN IF EXISTS verify_status,
+      DROP COLUMN IF EXISTS verify_reason,
+      DROP COLUMN IF EXISTS verified_at
+  `.execute(db);
+}
+//#endregion
+//#region src/db/migrations/060_run_trigger_actor.ts
+var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/**
+* Add the triggering-actor columns to `execution_runs`:
+*
+*  - `trigger_actor_provider` — the origin provider of the actor identity
+*    (`github` today; provider-generic so GitLab/Bitbucket extend later).
+*  - `trigger_actor_username` — the provider login of the person who triggered
+*    the run (e.g. the GitHub pusher / PR author).
+*  - `trigger_actor_user_id` — the immutable provider user id (mirrors
+*    `identity_links.provider_user_id`), preferred over the mutable username
+*    when resolving the actor to a KiCI user.
+*
+* Captured for ALL event types (push/tag/PR/comment), unlike the PR-only
+* `contributor_username`. Independently useful for a dashboard "triggered by
+* @x" and audit, beyond actor notifications. All nullable, no backfill,
+* idempotent.
+*/
+async function colExists$2(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$6(db) {
+	if (!await colExists$2(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
+	if (!await colExists$2(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
+	if (!await colExists$2(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
+}
+async function down$6(db) {
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/061_execution_runs_environment_id.ts
+var _061_execution_runs_environment_id_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/**
+* Add `environment_id` to `execution_runs` so environment run-history can be
+* queried by the matched environment's id.
+*
+* The `environment` column stores the job-declared environment name. For a
+* glob environment that is the concrete instance string (e.g. `review/PR-123`),
+* which never equals the environment row's label, so a name-keyed history query
+* always misses. Recording the matched environment id lets the History tab key
+* off a stable id instead. The `environment` name column is untouched (it
+* doubles as the concurrency-group key and the concrete-instance label).
+*
+* `ON DELETE SET NULL`: deleting an environment must not delete its run rows.
+*
+* Backfill: `execution_runs` has no `org_id`, so a name match is only safe when
+* exactly one fixed environment carries that name across the whole table. That
+* backfills 100% of fixed-env history on a single-tenant orchestrator and the
+* unambiguous majority on a shared one, never mis-attributing across tenants.
+* Glob-named rows stay null (they never appeared in history before — that is
+* the bug being fixed — so nothing regresses).
+*
+* Idempotent: guarded on the `environment_id` column's existence; the index and
+* backfill use `IF NOT EXISTS` / `WHERE environment_id IS NULL` so re-running is
+* a no-op.
+*/
+async function colExists$1(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$5(db) {
+	if (!await colExists$1(db, "execution_runs", "environment_id")) await sql`
+      ALTER TABLE public.execution_runs
+        ADD COLUMN environment_id uuid
+        REFERENCES public.environments(id) ON DELETE SET NULL
+    `.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_execution_runs_environment_id
+      ON public.execution_runs (environment_id)
+  `.execute(db);
+	await sql`
+    UPDATE public.execution_runs er
+       SET environment_id = e.id
+      FROM public.environments e
+     WHERE er.environment_id IS NULL
+       AND er.environment IS NOT NULL
+       AND e.type = 'fixed'
+       AND e.name = er.environment
+       AND (SELECT count(*) FROM public.environments e2
+             WHERE e2.type = 'fixed' AND e2.name = er.environment) = 1
+  `.execute(db);
+}
+async function down$5(db) {
+	await sql`DROP INDEX IF EXISTS idx_execution_runs_environment_id`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS environment_id`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/062_execution_runs_agent_label.ts
+var _062_execution_runs_agent_label_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* Add the agent-provenance columns to `execution_runs`:
+*
+*  - `triggered_by_agent_label` — the human-set agent name when the run was
+*    triggered through an agent-kind credential (user agent PAT or org agent
+*    API key) via the developer MCP server.
+*  - `cancelled_by_agent_label` — likewise for a cancellation driven through an
+*    agent credential.
+*
+* The label is provenance only (the credential still inherits its principal's
+* permissions). NULL for ordinary human / webhook / system-driven runs.
+* Nullable, no backfill, idempotent.
+*/
+async function colExists(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$4(db) {
+	if (!await colExists(db, "execution_runs", "triggered_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN triggered_by_agent_label text`.execute(db);
+	if (!await colExists(db, "execution_runs", "cancelled_by_agent_label")) await sql`ALTER TABLE public.execution_runs ADD COLUMN cancelled_by_agent_label text`.execute(db);
+}
+async function down$4(db) {
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS triggered_by_agent_label`.execute(db);
+	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS cancelled_by_agent_label`.execute(db);
+}
+//#endregion
+//#region src/db/migrations/063_access_log_agent_label_index.ts
+var _063_access_log_agent_label_index_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* Index `access_log.agent_label` (column added by migration 058) so the
+* operator-facing agent filter (`kici-admin access-log list --agent-label`,
+* the dashboard "agent name" filter) does an indexed exact-match lookup
+* instead of a scan. Idempotent.
+*/
 async function up$3(db) {
-	if (!await colExists$3(db, "execution_steps", "concurrency_kind")) await sql`ALTER TABLE public.execution_steps ADD COLUMN concurrency_kind text`.execute(db);
-	if (!await colExists$3(db, "execution_steps", "group_id")) await sql`ALTER TABLE public.execution_steps ADD COLUMN group_id text`.execute(db);
+	await sql`CREATE INDEX IF NOT EXISTS access_log_agent_label_idx ON public.access_log (agent_label)`.execute(db);
 }
 async function down$3(db) {
-	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS group_id`.execute(db);
-	await sql`ALTER TABLE public.execution_steps DROP COLUMN IF EXISTS concurrency_kind`.execute(db);
+	await sql`DROP INDEX IF EXISTS access_log_agent_label_idx`.execute(db);
 }
 //#endregion
-//#region src/db/migrations/058_access_log_agent_label.ts
-var _058_access_log_agent_label_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/064_execution_jobs_skipped_environments.ts
+var _064_execution_jobs_skipped_environments_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$2,
 	up: () => up$2
 });
 /**
-* Add `access_log.agent_label text` — the human-set name of the agent that
-* performed the action, when the actor authenticated with an agent-kind PAT.
+* Add the test-run skipped-environment columns to `execution_jobs`:
 *
-* Queryable column (not just baked into `actor_meta`) so an operator can filter
-* the access log by agent. NULL for ordinary human / API-key / system actors.
-* Nullable, no backfill. Idempotent.
+* - `execution_jobs.skipped_environments text NULL` — a JSON-encoded `string[]`
+*   of the bound environment names dropped on a test/local run because they
+*   disallow local execution (`allowLocalExecution=false`) or are unconfigured.
+*   NULL = nothing skipped.
+* - `execution_jobs.env_warning text NULL` — the user-visible warning naming the
+*   skipped environments, surfaced on the dashboard run view. NULL = no warning.
+*
+* Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+* preserved.
 */
-async function colExists$2(db, table, name) {
-	return (await sql`
-    SELECT EXISTS (
-      SELECT 1 FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = ${table}
-         AND column_name = ${name}
-    ) AS exists
-  `.execute(db)).rows[0]?.exists ?? false;
-}
 async function up$2(db) {
-	if (!await colExists$2(db, "access_log", "agent_label")) await sql`ALTER TABLE public.access_log ADD COLUMN agent_label text`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs
+    ADD COLUMN IF NOT EXISTS skipped_environments text`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs
+    ADD COLUMN IF NOT EXISTS env_warning text`.execute(db);
 }
 async function down$2(db) {
-	await sql`ALTER TABLE public.access_log DROP COLUMN IF EXISTS agent_label`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs
+    DROP COLUMN IF EXISTS skipped_environments`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs
+    DROP COLUMN IF EXISTS env_warning`.execute(db);
 }
 //#endregion
-//#region src/db/migrations/059_attestation_verdict.ts
-var _059_attestation_verdict_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/065_pending_attestations.ts
+var _065_pending_attestations_exports = /* @__PURE__ */ __exportAll({
 	down: () => down$1,
 	up: () => up$1
 });
 /**
-* Add server-side verification verdict columns to `attestations`, plus the
-* lookup indexes the org-wide attestations browser queries against.
+* Add the `pending_attestations` deferred-attestation outbox and an idempotency
+* unique index on `attestations`.
 *
-* The orchestrator verifies each provenance bundle at ingest and records the
-* verdict here so the dashboard list shows trustworthy badges with no per-row
-* bundle fetch:
-* - `verify_status` — one of `verified` / `failed` / `unverifiable` / `pending`
-*   (mirrors `attestationVerifyStatusSchema.enum.*` in `@kici-dev/engine`).
-*   `DEFAULT 'pending'` covers rows written before a verdict is computed.
-* - `verify_reason` — first failure code from `verifyKiciBundle` (nullable).
-* - `verified_at` — when the verdict was recorded (nullable).
+* When a build's provenance mint fails transiently, the agent freezes and
+* DSSE-signs the statement at build time; the orchestrator records the frozen
+* envelope here instead of failing the job. A Raft-leader-only retrier later
+* mints the deferred token, attaches it, uploads the bundle, and records one
+* `attestations` row — deleting the pending row. The unique index on
+* `attestations (run_id, job_id, subject_digest)` makes that fulfilment
+* idempotent across a cluster (ON CONFLICT DO NOTHING).
 *
-* Idempotent: guarded on the `verify_status` column's existence.
+* `origin_kind` holds the non-`live` `AttestationOrigin` values
+* (`deferred` / `offline-backfill`); the `created_at` default anchors the true
+* build time so temporal honesty survives a later mint.
+*
+* Idempotent: guarded on table existence.
 */
-async function colExists$1(db, table, name) {
-	return (await sql`
+async function up$1(db) {
+	if ((await sql`
     SELECT EXISTS (
-      SELECT 1 FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = ${table}
-         AND column_name = ${name}
+      SELECT 1 FROM information_schema.tables
+       WHERE table_schema = 'public' AND table_name = 'pending_attestations'
     ) AS exists
-  `.execute(db)).rows[0]?.exists ?? false;
-}
-async function up$1(db) {
-	if (await colExists$1(db, "attestations", "verify_status")) return;
+  `.execute(db)).rows[0]?.exists) return;
 	await sql`
-    ALTER TABLE public.attestations
-      ADD COLUMN verify_status TEXT NOT NULL DEFAULT 'pending',
-      ADD COLUMN verify_reason TEXT,
-      ADD COLUMN verified_at TIMESTAMPTZ
+    CREATE TABLE public.pending_attestations (
+      id              TEXT PRIMARY KEY,
+      run_id          TEXT NOT NULL,
+      job_id          TEXT NOT NULL,
+      subject_name    TEXT NOT NULL,
+      subject_digest  TEXT NOT NULL,
+      audience        TEXT NOT NULL,
+      dsse_envelope   JSONB NOT NULL,
+      public_key      JSONB NOT NULL,
+      media_type      TEXT NOT NULL,
+      statement_hash  TEXT NOT NULL,
+      origin_kind     TEXT NOT NULL,
+      attempt_count   INTEGER NOT NULL DEFAULT 0,
+      created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      last_attempt_at TIMESTAMPTZ,
+      last_error      TEXT
+    )
   `.execute(db);
-	await sql`CREATE INDEX idx_attestations_subject_digest ON public.attestations (subject_digest)`.execute(db);
-	await sql`CREATE INDEX idx_attestations_subject_name ON public.attestations (subject_name)`.execute(db);
-	await sql`CREATE INDEX idx_attestations_verify_status ON public.attestations (verify_status)`.execute(db);
-	await sql`CREATE INDEX idx_attestations_created_at ON public.attestations (created_at)`.execute(db);
-}
-async function down$1(db) {
-	await sql`DROP INDEX IF EXISTS idx_attestations_created_at`.execute(db);
-	await sql`DROP INDEX IF EXISTS idx_attestations_verify_status`.execute(db);
-	await sql`DROP INDEX IF EXISTS idx_attestations_subject_name`.execute(db);
-	await sql`DROP INDEX IF EXISTS idx_attestations_subject_digest`.execute(db);
 	await sql`
-    ALTER TABLE public.attestations
-      DROP COLUMN IF EXISTS verify_status,
-      DROP COLUMN IF EXISTS verify_reason,
-      DROP COLUMN IF EXISTS verified_at
+    CREATE UNIQUE INDEX uq_pending_attestations_run_job_subject
+      ON public.pending_attestations (run_id, job_id, subject_digest)
+  `.execute(db);
+	await sql`
+    CREATE INDEX idx_pending_attestations_created_at
+      ON public.pending_attestations (created_at)
+  `.execute(db);
+	await sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS uq_attestations_run_job_subject
+      ON public.attestations (run_id, job_id, subject_digest)
   `.execute(db);
 }
+async function down$1(db) {
+	await sql`DROP INDEX IF EXISTS uq_attestations_run_job_subject`.execute(db);
+	await sql`DROP TABLE IF EXISTS public.pending_attestations`.execute(db);
+}
 //#endregion
-//#region src/db/migrations/060_run_trigger_actor.ts
-var _060_run_trigger_actor_exports = /* @__PURE__ */ __exportAll({
+//#region src/db/migrations/066_pending_attestations_rejected.ts
+var _066_pending_attestations_rejected_exports = /* @__PURE__ */ __exportAll({
 	down: () => down,
 	up: () => up
 });
 /**
-* Add the triggering-actor columns to `execution_runs`:
-*
-*  - `trigger_actor_provider` — the origin provider of the actor identity
-*    (`github` today; provider-generic so GitLab/Bitbucket extend later).
-*  - `trigger_actor_username` — the provider login of the person who triggered
-*    the run (e.g. the GitHub pusher / PR author).
-*  - `trigger_actor_user_id` — the immutable provider user id (mirrors
-*    `identity_links.provider_user_id`), preferred over the mutable username
-*    when resolving the actor to a KiCI user.
+* Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
+* a deferred attestation the Platform definitively cannot mint (run/job absent).
+* NULL while the row is still pending a later mint; set once, the row is skipped
+* by the retrier and drops out of the pending-attestations gauge. Re-armed via
+* `kici-admin attestations retry --include-rejected`.
 *
-* Captured for ALL event types (push/tag/PR/comment), unlike the PR-only
-* `contributor_username`. Independently useful for a dashboard "triggered by
-* @x" and audit, beyond actor notifications. All nullable, no backfill,
-* idempotent.
+* Idempotent: guarded on column existence.
 */
-async function colExists(db, table, name) {
+async function up(db) {
+	if (await columnExists(db, "pending_attestations", "rejected_at")) return;
+	await sql`
+    ALTER TABLE public.pending_attestations
+      ADD COLUMN rejected_at TIMESTAMPTZ
+  `.execute(db);
+}
+async function down(db) {
+	if (!await columnExists(db, "pending_attestations", "rejected_at")) return;
+	await sql`
+    ALTER TABLE public.pending_attestations
+      DROP COLUMN rejected_at
+  `.execute(db);
+}
+async function columnExists(db, table, column) {
 	return (await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
-       WHERE table_schema = 'public'
-         AND table_name = ${table}
-         AND column_name = ${name}
+       WHERE table_schema = 'public' AND table_name = ${table} AND column_name = ${column}
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up(db) {
-	if (!await colExists(db, "execution_runs", "trigger_actor_provider")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_provider text`.execute(db);
-	if (!await colExists(db, "execution_runs", "trigger_actor_username")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_username text`.execute(db);
-	if (!await colExists(db, "execution_runs", "trigger_actor_user_id")) await sql`ALTER TABLE public.execution_runs ADD COLUMN trigger_actor_user_id text`.execute(db);
-}
-async function down(db) {
-	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_provider`.execute(db);
-	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_username`.execute(db);
-	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS trigger_actor_user_id`.execute(db);
-}
 //#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
@@ -5217,7 +5484,13 @@ function createMigrationProvider() {
 			"057_step_concurrency": _057_step_concurrency_exports,
 			"058_access_log_agent_label": _058_access_log_agent_label_exports,
 			"059_attestation_verdict": _059_attestation_verdict_exports,
-			"060_run_trigger_actor": _060_run_trigger_actor_exports
+			"060_run_trigger_actor": _060_run_trigger_actor_exports,
+			"061_execution_runs_environment_id": _061_execution_runs_environment_id_exports,
+			"062_execution_runs_agent_label": _062_execution_runs_agent_label_exports,
+			"063_access_log_agent_label_index": _063_access_log_agent_label_index_exports,
+			"064_execution_jobs_skipped_environments": _064_execution_jobs_skipped_environments_exports,
+			"065_pending_attestations": _065_pending_attestations_exports,
+			"066_pending_attestations_rejected": _066_pending_attestations_rejected_exports
 		};
 	} };
 }
@@ -5229,7 +5502,7 @@ function createMigrationProvider() {
 * Uses pg_advisory_lock to ensure only one orchestrator instance runs
 * migrations at a time, preventing conflicts in multi-instance deployments.
 */
-const logger$12 = createLogger({ prefix: "migrate" });
+const logger$13 = createLogger({ prefix: "migrate" });
 const ADVISORY_LOCK_KEY = 543210001;
 /**
 * Run all pending migrations with an advisory lock for concurrency safety.
@@ -5241,21 +5514,21 @@ const ADVISORY_LOCK_KEY = 543210001;
 async function runMigrations(opts) {
 	const client = await opts.pool.connect();
 	try {
-		logger$12.info("Acquiring migration lock...");
+		logger$13.info("Acquiring migration lock...");
 		await client.query("SELECT pg_advisory_lock($1)", [ADVISORY_LOCK_KEY]);
-		logger$12.info("Migration lock acquired");
+		logger$13.info("Migration lock acquired");
 		const migrator = new Migrator({
 			db: opts.db,
 			provider: createMigrationProvider()
 		});
 		const start = Date.now();
 		const { results, error } = await migrator.migrateToLatest();
-		for (const result of results ?? []) if (result.status === "Success") logger$12.info(`${result.migrationName} ... OK (${Date.now() - start}ms)`);
-		else if (result.status === "Error") logger$12.error(`${result.migrationName} ... FAILED`);
+		for (const result of results ?? []) if (result.status === "Success") logger$13.info(`${result.migrationName} ... OK (${Date.now() - start}ms)`);
+		else if (result.status === "Error") logger$13.error(`${result.migrationName} ... FAILED`);
 		if (error) throw error;
 		const applied = (results ?? []).filter((r) => r.status === "Success");
-		if (applied.length === 0) logger$12.info("Database schema is up to date");
-		else logger$12.info(`Applied ${applied.length} migration(s)`);
+		if (applied.length === 0) logger$13.info("Database schema is up to date");
+		else logger$13.info(`Applied ${applied.length} migration(s)`);
 		const hash = await computeMigrationsHash(createMigrationProvider());
 		await storeMigrationContentHash(opts.pool, hash);
 		return results ?? [];
@@ -5284,7 +5557,7 @@ async function runMigrations(opts) {
 * as `kici-admin peer create-token` — open a pool from KICI_DATABASE_URL /
 * DATABASE_URL / --database-url.
 */
-function resolveDatabaseUrl$3(explicit) {
+function resolveDatabaseUrl$4(explicit) {
 	const url = explicit ?? process.env.KICI_DATABASE_URL;
 	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
 	return url;
@@ -5331,7 +5604,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("fresh").description("DROP + CREATE the orchestrator DB, run migrations, record content hash").option("--database-url <url>", "Target database URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--confirm", "Explicit confirmation (destructive)").option("--yes", "Skip interactive confirmation (for scripted use)").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$3(opts.databaseUrl);
+			const url = resolveDatabaseUrl$4(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			if (!opts.yes) {
 				if (!await confirmInteractive$2(`About to DROP + RECREATE database "${dbName}". Type "${dbName}" to confirm: `, dbName)) {
@@ -5362,7 +5635,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("ensure <name>").description("CREATE DATABASE IF NOT EXISTS (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--owner <role>", "DB owner role (default: URL user). Pass when the admin connection is privileged but the new DB should be owned by a separate non-privileged role.").option("--revoke-connect-public", "After ensure, REVOKE CONNECT ON DATABASE \"<name>\" FROM PUBLIC (recommended on shared clusters).").option("--grant-connect-role <role>", "After ensure (and any --revoke-connect-public), GRANT CONNECT ON DATABASE \"<name>\" TO \"<role>\". Repeatable.", (val, acc) => acc.concat([val]), []).action(async (name, opts) => {
 		try {
-			const baseUrl = resolveDatabaseUrl$3(opts.databaseUrl);
+			const baseUrl = resolveDatabaseUrl$4(opts.databaseUrl);
 			const url = new URL(baseUrl);
 			url.pathname = `/${name}`;
 			const targetUrl = url.toString();
@@ -5381,7 +5654,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("create-role").description("CREATE / ALTER ROLE with LOGIN [+ CREATEDB] (idempotent)").option("--database-url <url>", "Admin DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--user <name>", "Role name to create or update").requiredOption("--password <password>", "Role password (raw — quote as needed)").option("--createdb", "Grant CREATEDB to the new role", false).action(async (opts) => {
 		try {
-			const { adminUrl } = parseDatabaseUrl(resolveDatabaseUrl$3(opts.databaseUrl));
+			const { adminUrl } = parseDatabaseUrl(resolveDatabaseUrl$4(opts.databaseUrl));
 			logInvocation(`create-role ${opts.user}`, adminUrl);
 			const outcome = await createDbRole(adminUrl, {
 				username: opts.user,
@@ -5396,7 +5669,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("create-readonly-user").description("Create a read-only role with SELECT on all tables + default privileges").option("--database-url <url>", "Target DB URL (must connect as owner)").requiredOption("--user <name>", "Read-only role name").requiredOption("--password <password>", "Role password").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$3(opts.databaseUrl);
+			const url = resolveDatabaseUrl$4(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			logInvocation(`create-readonly-user ${opts.user}`, url);
 			const outcome = await createReadOnlyDbUser(url, {
@@ -5411,7 +5684,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("check-schema").description("Compare bundled migrations vs live schema. Exit 2 on drift.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--json", "Emit JSON instead of a human-readable line", false).action(async (opts) => {
 		try {
-			const pool = createPool(resolveDatabaseUrl$3(opts.databaseUrl));
+			const pool = createPool(resolveDatabaseUrl$4(opts.databaseUrl));
 			try {
 				const status = await isSchemaCurrent(pool, createMigrationProvider());
 				if (opts.json) process.stdout.write(JSON.stringify(status) + "\n");
@@ -5428,7 +5701,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("collation-check").description("Compare pg_database.datcollversion against the running libc collation version. Exit 2 on drift.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").option("--json", "Emit JSON instead of a human-readable line", false).action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$3(opts.databaseUrl);
+			const url = resolveDatabaseUrl$4(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			const pool = createPool(url);
 			try {
@@ -5458,7 +5731,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("reindex").description("REINDEX DATABASE CONCURRENTLY <db>. Rebuilds every index under the running libc collation rules. Non-blocking but takes minutes + ~2× temp disk.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--confirm", "Explicit confirmation (destructive — long-running)").requiredOption("--reason <text>", "Reason (recorded in stderr banner)").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$3(opts.databaseUrl);
+			const url = resolveDatabaseUrl$4(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			logInvocation(`reindex ${dbName} (${opts.reason})`, url);
 			const pool = createPool(url);
@@ -5475,7 +5748,7 @@ function registerDbCommands(program, getClient) {
 	});
 	db.command("refresh-collation-version").description("ALTER DATABASE <db> REFRESH COLLATION VERSION. Metadata-only bump; pair with db reindex after a libc-base image rebuild.").option("--database-url <url>", "Target DB URL (else KICI_DATABASE_URL / DATABASE_URL)").requiredOption("--reason <text>", "Reason (recorded in stderr banner)").action(async (opts) => {
 		try {
-			const url = resolveDatabaseUrl$3(opts.databaseUrl);
+			const url = resolveDatabaseUrl$4(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			logInvocation(`refresh-collation-version ${dbName} (${opts.reason})`, url);
 			const pool = createPool(url);
@@ -6302,7 +6575,7 @@ function safeParse(value) {
 */
 function webhookNoteReason(note) {
 	switch (note) {
-		case "github-ingress-platform-only": return "this orchestrator runs in independent mode";
+		case "no-public-url": return "KICI_WEBHOOK_PUBLIC_URL is not set on the orchestrator";
 		case "platform-no-public-url": return "the Platform has no public webhook URL configured";
 		case "platform-unavailable": return "could not reach the Platform";
 		default: return "webhook URL could not be determined";
@@ -6311,7 +6584,7 @@ function webhookNoteReason(note) {
 /** Actionable next-step hint paired with {@link webhookNoteReason}. */
 function webhookNoteHint(note) {
 	switch (note) {
-		case "github-ingress-platform-only": return "GitHub App ingress is served by the KiCI Platform; find the URL in the dashboard under Sources.";
+		case "no-public-url": return "Set KICI_WEBHOOK_PUBLIC_URL to the orchestrator's public base, then re-run; paste the printed URL into your GitHub App or repo webhook.";
 		case "platform-unavailable": return "Retry once the orchestrator reconnects, or find the URL in the dashboard under Sources.";
 		default: return "Find the webhook URL in the dashboard under Sources.";
 	}
@@ -6913,7 +7186,7 @@ async function getRemoteSource(db, orgId) {
 //#endregion
 //#region src/cli/commands/remote-source.ts
 init_client();
-function resolveDatabaseUrl$2(explicit) {
+function resolveDatabaseUrl$3(explicit) {
 	const url = explicit ?? process.env.KICI_DATABASE_URL;
 	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
 	return url;
@@ -6922,7 +7195,7 @@ function registerRemoteSourceCommands(program) {
 	program.command("remote-source").description("Inspect the auto-provisioned remote-source org anchor").command("show <orgId>").description("Print the remote_sources anchor row for an org (routing key remote:<orgId>).").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--format <format>", "Output format: json|table", "table").action(async (orgId, opts) => {
 		let url;
 		try {
-			url = resolveDatabaseUrl$2(opts.databaseUrl);
+			url = resolveDatabaseUrl$3(opts.databaseUrl);
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);
@@ -7459,6 +7732,16 @@ function registerRunsCommands(program, getClient) {
 		}
 	});
 }
+createLogger({ prefix: "cluster-identity" });
+/**
+* Build the S3 key for the cluster identity sentinel under an optional prefix.
+* Strips any trailing slash from the prefix so callers can pass either form.
+*/
+function clusterSentinelKey(prefix) {
+	if (!prefix) return ".kici-cluster-id";
+	const trimmed = prefix.replace(/\/+$/, "");
+	return trimmed.length === 0 ? ".kici-cluster-id" : `${trimmed}/.kici-cluster-id`;
+}
 //#endregion
 //#region src/config.ts
 /**
@@ -7593,6 +7876,15 @@ const baseSchema = z.object({
 	* `event.attempts <= N`. Ignored unless `KICI_TEST_MODE=1`.
 	*/
 	testEventFailFirstN: z.string().optional(),
+	/**
+	* **Test-only.** When set (and `KICI_TEST_MODE=1`), the orchestrator forces
+	* the *initial* agent provenance mint to fail transiently (defer) for any job
+	* whose requested OIDC `audience` equals this value, so an E2E can exercise
+	* the deferred-attestation retry + per-run serve path with a REAL run. The
+	* retrier's re-mint uses a different call site and is unaffected. Ignored
+	* unless `KICI_TEST_MODE=1`. Production deployments leave this unset.
+	*/
+	testMintDeferAudience: z.string().optional(),
 	eventLogMaxPayloadBytes: z.coerce.number().default(5 * 1024 * 1024),
 	logLevel: z.enum([
 		"debug",
@@ -7782,6 +8074,7 @@ const envDef = defineEnv({
 		eventRouterRetryScanIntervalMs: "KICI_EVENT_ROUTER_RETRY_SCAN_INTERVAL_MS",
 		testMode: "KICI_TEST_MODE",
 		testEventFailFirstN: "KICI_TEST_EVENT_FAIL_FIRST_N",
+		testMintDeferAudience: "KICI_TEST_MINT_DEFER_AUDIENCE",
 		eventLogMaxPayloadBytes: "KICI_EVENT_LOG_MAX_PAYLOAD_BYTES",
 		logLevel: "KICI_LOG_LEVEL",
 		nodeEnv: "NODE_ENV",
@@ -8508,11 +8801,18 @@ function createProvenanceTrustRoot(opts = {}) {
 /**
 * Compute the verification verdict for a stored provenance bundle at ingest.
 *
+* Reads the bundle, selects the signing-key set by the identity token's own
+* `kid` (so a kid-miss triggers the trust root's single refetch — a token
+* minted with a freshly-rotated key still verifies against a briefly-stale
+* cached JWKS), then verifies offline.
+*
 * Fail-closed: a missing trust root, unfetchable JWKS, missing storage, or an
 * unreadable bundle all yield `unverifiable` (never silently `verified`). A
-* bundle that verifies false yields `failed` with the first failure code. Any
-* thrown error is caught and recorded as `unverifiable` — verification never
-* fails the upload.
+* signing key that is absent from the published JWKS even after the refetch
+* yields `unverifiable` (`signing_key_not_published`) — "couldn't verify", not
+* "proved bad". A bundle that verifies false yields `failed` with the first
+* failure code. Any thrown error is caught and recorded as `unverifiable` —
+* verification never fails the upload.
 */
 async function computeAttestationVerdict(opts) {
 	const { trustRoot, storage, storageKey } = opts;
@@ -8529,20 +8829,33 @@ async function computeAttestationVerdict(opts) {
 			verifyReason: "no_storage",
 			verifiedAt: null
 		};
-		const jwks = await trustRoot.getJwks();
+		const raw = await storage.get(storageKey);
+		if (!raw) return {
+			verifyStatus: status.unverifiable,
+			verifyReason: "bundle_unreadable",
+			verifiedAt: null
+		};
+		const bundle = JSON.parse(raw.toString("utf8"));
+		const idToken = bundle?.verificationMaterial?.identityToken;
+		let kid;
+		if (typeof idToken === "string") try {
+			kid = decodeProtectedHeader(idToken).kid;
+		} catch {
+			kid = void 0;
+		}
+		const jwks = await trustRoot.getJwks(kid);
 		if (!jwks) return {
 			verifyStatus: status.unverifiable,
 			verifyReason: "jwks_fetch_failed",
 			verifiedAt: null
 		};
-		const raw = await storage.get(storageKey);
-		if (!raw) return {
+		if (kid && !jwks.keys.some((k) => k.kid === kid)) return {
 			verifyStatus: status.unverifiable,
-			verifyReason: "bundle_unreadable",
+			verifyReason: "signing_key_not_published",
 			verifiedAt: null
 		};
 		const result = await verifyKiciBundle({
-			bundle: JSON.parse(raw.toString("utf8")),
+			bundle,
 			jwks,
 			expectedIssuer: issuer
 		});
@@ -8607,6 +8920,58 @@ async function reverifyAttestations(db, trustRoot, storage, opts) {
 	};
 }
 //#endregion
+//#region src/cli/commands/attestations-retry.ts
+/**
+* Post the retry request through the injected transport (the admin API POST)
+* and return the counts. Validates that the scope is unambiguous. When
+* `includeRejected` is set, previously terminally-rejected rows are re-armed
+* and re-attempted in the same drain.
+*/
+async function runAttestationRetry(post, opts) {
+	const base = opts.includeRejected ? { includeRejected: true } : {};
+	if (!opts.runId && !opts.allPending) return post(base);
+	return post(opts.runId ? {
+		...base,
+		runId: opts.runId
+	} : base);
+}
+//#endregion
+//#region src/cli/commands/attestations-list.ts
+/**
+* Map the injected DB read into the CLI envelope. `limit` / `runId` / `jobId`
+* are honored by the injected `read` fn (the real one is a Kysely query); this
+* runner owns only the row→envelope projection, so it stays pure and testable.
+*/
+async function runAttestationList(read, opts) {
+	return { attestations: (await read(opts)).map((r) => ({
+		id: r.id,
+		runId: r.run_id,
+		jobId: r.job_id,
+		subjectName: r.subject_name,
+		verifyStatus: r.verify_status,
+		createdAt: r.created_at.toISOString()
+	})) };
+}
+/**
+* Build the real DB read: a Kysely query over `attestations`, newest first,
+* with optional run/job filters and a row cap.
+*/
+function readAttestations(db) {
+	return async ({ limit, runId, jobId }) => {
+		let query = db.selectFrom("attestations").select([
+			"id",
+			"run_id",
+			"job_id",
+			"subject_name",
+			"verify_status",
+			"created_at"
+		]).orderBy("created_at", "desc").limit(limit);
+		if (runId) query = query.where("run_id", "=", runId);
+		if (jobId) query = query.where("job_id", "=", jobId);
+		return query.execute();
+	};
+}
+//#endregion
 //#region src/cli/commands/attestations.ts
 /**
 * `kici-admin attestations` — orchestrator-DB-direct provenance maintenance.
@@ -8620,7 +8985,7 @@ async function reverifyAttestations(db, trustRoot, storage, opts) {
 */
 init_client();
 const logger$8 = createLogger({ prefix: "kici-admin-attestations" });
-function resolveDatabaseUrl$1(explicit) {
+function resolveDatabaseUrl$2(explicit) {
 	const url = explicit ?? process.env.KICI_DATABASE_URL;
 	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
 	return url;
@@ -8658,11 +9023,34 @@ async function confirmInteractive$1(prompt) {
 		rl.close();
 	}
 }
-function registerAttestationsCommands(program) {
-	program.command("attestations").description("Provenance-attestation maintenance (orchestrator DB)").command("reverify").description("Recompute stored attestation verdicts (verify-at-ingest backfill)").option("--all", "Re-evaluate every attestation (default: only pending/unverifiable)").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--yes", "Skip the --all confirmation prompt").action(async (opts) => {
+/** Render attestation rows as a compact human table (stderr note when empty). */
+function printAttestationTable(rows) {
+	if (rows.length === 0) {
+		process.stderr.write("No attestations found.\n");
+		return;
+	}
+	for (const r of rows) console.log(`${r.id}  ${r.verifyStatus.padEnd(12)}  run=${r.runId}  job=${r.jobId}  ${r.subjectName}  ${r.createdAt}`);
+}
+function registerAttestationsCommands(program, getClient) {
+	const attestations = program.command("attestations").description("Provenance-attestation maintenance (orchestrator DB)");
+	attestations.command("retry").description("Mint deferred attestations now (drains the pending-attestations outbox)").option("--run-id <id>", "Scope to a single run (else drains every pending attestation)").option("--all-pending", "Drain every pending attestation (default when --run-id is absent)").option("--include-rejected", "Also re-attempt rows previously marked terminally rejected (re-arm)").action(async (opts) => {
+		try {
+			const result = await runAttestationRetry((body) => getClient().post("/api/v1/admin/attestations/retry", body), {
+				runId: opts.runId,
+				allPending: opts.allPending,
+				includeRejected: opts.includeRejected
+			});
+			logger$8.info("attestations retry complete", result);
+			process.stderr.write(`Minted ${result.minted} deferred attestation(s); ${result.stillPending} still pending; ${result.rejected} rejected.\n`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	attestations.command("reverify").description("Recompute stored attestation verdicts (verify-at-ingest backfill)").option("--all", "Re-evaluate every attestation (default: only pending/unverifiable)").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--yes", "Skip the --all confirmation prompt").action(async (opts) => {
 		try {
 			const config = loadConfig();
-			const url = resolveDatabaseUrl$1(opts.databaseUrl ?? (config.databaseUrl || void 0));
+			const url = resolveDatabaseUrl$2(opts.databaseUrl ?? (config.databaseUrl || void 0));
 			if (opts.all && !opts.yes) {
 				if (!await confirmInteractive$1("Re-evaluate the verdict of EVERY attestation (including already-verified)? [y/N] ")) {
 					console.error("Aborted.");
@@ -8689,6 +9077,29 @@ function registerAttestationsCommands(program) {
 			process.exit(1);
 		}
 	});
+	attestations.command("list").description("List provenance attestations from the orchestrator DB (newest first)").option("--run-id <id>", "Filter to a single run").option("--job-id <id>", "Filter to a single job").option("--limit <n>", "Max results (default 20, max 100)", "20").option("--json", "Emit the raw JSON envelope instead of a table").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").action(async (opts) => {
+		try {
+			const url = resolveDatabaseUrl$2(opts.databaseUrl);
+			const limit = Math.min(Math.max(Number.parseInt(opts.limit, 10) || 20, 1), 100);
+			const pool = createPool(url);
+			const db = createDb$1(pool);
+			try {
+				const result = await runAttestationList(readAttestations(db), {
+					limit,
+					runId: opts.runId,
+					jobId: opts.jobId
+				});
+				if (opts.json) console.log(JSON.stringify(result, null, 2));
+				else printAttestationTable(result.attestations);
+			} finally {
+				await db.destroy();
+				await pool.end().catch(() => {});
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 //#endregion
 //#region src/cli/commands/event-log.ts
@@ -8817,7 +9228,7 @@ function renderTable(headers, rows) {
 }
 function registerAccessLogCommands(program, getClient) {
 	const accessLog = program.command("access-log").description("Inspect the read / admin-mutation access log");
-	accessLog.command("list").description("List access-log rows (dogfooded via /api/v1/admin/access-log)").option("--org-id <orgId>", "Filter by org/tenant ID").option("--actor-type <t>", "Filter by actor type (user|api_key|service_account|platform_operator|system)").option("--actor-id <id>", "Filter by actor id (zsub, keyId, service_account id, ...)").option("--action <action>", "Filter by dotted action (e.g. run.detail.read, run.cancel)").option("--source <s>", "Filter by source (platform_proxy|admin_http|admin_cli)").option("--outcome <o>", "Filter by outcome (allowed|denied|error)").option("--target-type <t>", "Filter by target type (run|step|event_log|secret_scope|...)").option("--target-id <id>", "Filter by target id").option("--from <ts>", "ISO timestamp lower bound (inclusive)").option("--to <ts>", "ISO timestamp upper bound (exclusive)").option("--q <text>", "Filter by substring of error_message (trigram-indexed full-text search)").option("--limit <n>", "Max results (default 50, max 200)", "50").option("--cursor <c>", "Opaque cursor from a previous nextCursor").option("--json", "Emit raw JSON instead of a table").action(async (opts) => {
+	accessLog.command("list").description("List access-log rows (dogfooded via /api/v1/admin/access-log)").option("--org-id <orgId>", "Filter by org/tenant ID").option("--actor-type <t>", "Filter by actor type (user|api_key|service_account|platform_operator|system)").option("--actor-id <id>", "Filter by actor id (zsub, keyId, service_account id, ...)").option("--action <action>", "Filter by dotted action (e.g. run.detail.read, run.cancel)").option("--source <s>", "Filter by source (platform_proxy|admin_http|admin_cli)").option("--outcome <o>", "Filter by outcome (allowed|denied|error)").option("--target-type <t>", "Filter by target type (run|step|event_log|secret_scope|...)").option("--target-id <id>", "Filter by target id").option("--from <ts>", "ISO timestamp lower bound (inclusive)").option("--to <ts>", "ISO timestamp upper bound (exclusive)").option("--q <text>", "Filter by substring of error_message (trigram-indexed full-text search)").option("--agent-label <label>", "Filter by exact agent label").option("--agent-only", "Only agent-attributed rows").option("--limit <n>", "Max results (default 50, max 200)", "50").option("--cursor <c>", "Opaque cursor from a previous nextCursor").option("--json", "Emit raw JSON instead of a table").action(async (opts) => {
 		try {
 			const response = await getClient().listAccessLog({
 				orgId: opts.orgId,
@@ -8831,6 +9242,8 @@ function registerAccessLogCommands(program, getClient) {
 				from: opts.from,
 				to: opts.to,
 				q: opts.q,
+				agentLabel: opts.agentLabel,
+				agentOnly: opts.agentOnly,
 				limit: parseInt(opts.limit, 10),
 				cursor: opts.cursor
 			});
@@ -8845,6 +9258,7 @@ function registerAccessLogCommands(program, getClient) {
 			const headers = [
 				"created_at",
 				"actor",
+				"agent",
 				"action",
 				"source",
 				"outcome",
@@ -8854,6 +9268,7 @@ function registerAccessLogCommands(program, getClient) {
 			const rows = response.items.map((r) => [
 				r.createdAt,
 				`${r.actorType}:${r.actorId}`,
+				r.agentLabel ?? "",
 				r.action,
 				r.source,
 				r.outcome,
@@ -8880,6 +9295,7 @@ function registerAccessLogCommands(program, getClient) {
 			console.log(`  Org:           ${response.orgId ?? "(none)"}`);
 			if (response.routingKey) console.log(`  Routing key:   ${response.routingKey}`);
 			console.log(`  Actor:         ${response.actorType}:${response.actorId}`);
+			console.log(`  Agent label:   ${response.agentLabel ?? "-"}`);
 			if (response.actorMeta) console.log(`  Actor meta:    ${JSON.stringify(response.actorMeta)}`);
 			console.log(`  Action:        ${response.action}`);
 			console.log(`  Source:        ${response.source}`);
@@ -10642,61 +11058,61 @@ var init_registry = __esmMin((() => {
 		rolldown: {
 			"linux-x64": {
 				name: "rolldown",
-				version: "1.1.1",
+				version: "1.1.3",
 				platform: "linux",
 				arch: "x64",
-				url: "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.1.tgz",
-				sha256: "55bf455e4d6c5df19636c40b434718891a574214bbf09a50e2e7b21b9f640d56",
+				url: "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.3.tgz",
+				sha256: "7759bc6da0140899e447345cb2467f5a4fb2c73d9cbac94a341b7a69e67f5cff",
 				extractPath: "package/",
 				archiveType: "tar.gz"
 			},
 			"linux-arm64": {
 				name: "rolldown",
-				version: "1.1.1",
+				version: "1.1.3",
 				platform: "linux",
 				arch: "arm64",
-				url: "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.1.tgz",
-				sha256: "af458cfd2ce237a5161bdfdcef960e710c394b966537e1d1374840fb7fc78308",
+				url: "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.3.tgz",
+				sha256: "a1ab47becdde8e8d8f9176a0bdc938e6e76bf52c668ffb5287ea8b515048bb99",
 				extractPath: "package/",
 				archiveType: "tar.gz"
 			},
 			"darwin-x64": {
 				name: "rolldown",
-				version: "1.1.1",
+				version: "1.1.3",
 				platform: "darwin",
 				arch: "x64",
-				url: "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.1.tgz",
-				sha256: "31bd12457aa41646dcee674d7fa73ec2c4625ef5d34d0ef6c6823cad811de3e2",
+				url: "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.3.tgz",
+				sha256: "eabb0140217ba45fc0d1de1a7cd59ba475a9c0cd2c207c9364fb58328478b878",
 				extractPath: "package/",
 				archiveType: "tar.gz"
 			},
 			"darwin-arm64": {
 				name: "rolldown",
-				version: "1.1.1",
+				version: "1.1.3",
 				platform: "darwin",
 				arch: "arm64",
-				url: "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.1.tgz",
-				sha256: "8399e7a87640ffe485ba16289f6c3a7ab69b25d09b43e5896441372bcf6a02f9",
+				url: "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.3.tgz",
+				sha256: "ddc152faf8328a44ee846c99cf945dbac45541ce2a6785f6b0707ad1c0ffe1f3",
 				extractPath: "package/",
 				archiveType: "tar.gz"
 			},
 			"win32-x64": {
 				name: "rolldown",
-				version: "1.1.1",
+				version: "1.1.3",
 				platform: "win32",
 				arch: "x64",
-				url: "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.1.tgz",
-				sha256: "2b2c34d530db0e2cf15cdbe328822d5d385b19ee3b5aba55771587027b9afa17",
+				url: "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.3.tgz",
+				sha256: "adc567f5a423c6e0db071272f7021b1a6d118368b7608eff22b8e61c4c7a6745",
 				extractPath: "package/",
 				archiveType: "tar.gz"
 			},
 			"win32-arm64": {
 				name: "rolldown",
-				version: "1.1.1",
+				version: "1.1.3",
 				platform: "win32",
 				arch: "arm64",
-				url: "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.1.tgz",
-				sha256: "d7431cb75d0bed42dd8794b89c3d73ac7129a36465ac020519726f2a9dca1d7c",
+				url: "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.3.tgz",
+				sha256: "9d055f11eb04e60821013b30ce7d011491bcddf0169f59c7254499bb537b7da8",
 				extractPath: "package/",
 				archiveType: "tar.gz"
 			}
@@ -14472,6 +14888,191 @@ function registerClusterNameCommands(program, getClient) {
 	});
 }
 //#endregion
+//#region src/cluster/reconcile-identity.ts
+/**
+* Reconcile the orchestrator's cluster identity between the DB
+* (`cluster_meta.cluster_id`) and the durable S3 sentinel
+* (`<prefix>/.kici-cluster-id`).
+*
+* Used by `kici-admin cluster reconcile-identity` and the staging deploy's
+* pre-orchestrator-start self-heal step. Talks DB + S3 directly (never the
+* orchestrator HTTP admin API) so it works while the orchestrator process is
+* down — which is exactly when a "Cluster identity mismatch" boot failure needs
+* fixing. Default direction restores the DB FROM the durable sentinel (the
+* cross-restart / peer anchor); `sentinel-from-db` reverses it.
+*/
+async function makeS3Client(s3) {
+	const { S3Client } = await import("@aws-sdk/client-s3");
+	return new S3Client({
+		region: s3.region ?? "us-east-1",
+		credentials: {
+			accessKeyId: s3.accessKeyId,
+			secretAccessKey: s3.secretAccessKey
+		},
+		...s3.endpoint ? { endpoint: s3.endpoint } : {},
+		...s3.forcePathStyle ? { forcePathStyle: true } : {}
+	});
+}
+async function readClusterIdFromDb(databaseUrl) {
+	const pool = createPool(databaseUrl);
+	try {
+		return (await pool.query(`SELECT value FROM cluster_meta WHERE key = 'cluster_id'`)).rows[0]?.value ?? null;
+	} finally {
+		await pool.end();
+	}
+}
+async function writeClusterIdToDb(databaseUrl, clusterId) {
+	const pool = createPool(databaseUrl);
+	try {
+		await pool.query(`UPDATE cluster_meta SET value = $1 WHERE key = 'cluster_id'`, [clusterId]);
+	} finally {
+		await pool.end();
+	}
+}
+async function readSentinel(s3) {
+	const { GetObjectCommand } = await import("@aws-sdk/client-s3");
+	const client = await makeS3Client(s3);
+	const key = clusterSentinelKey(s3.prefix);
+	try {
+		return (await (await client.send(new GetObjectCommand({
+			Bucket: s3.bucket,
+			Key: key
+		}))).Body?.transformToString())?.trim() ?? null;
+	} catch (err) {
+		const e = err;
+		if (e?.name === "NoSuchKey" || e?.$metadata?.httpStatusCode === 404) return null;
+		throw err;
+	}
+}
+async function writeSentinel(s3, clusterId) {
+	const { PutObjectCommand } = await import("@aws-sdk/client-s3");
+	await (await makeS3Client(s3)).send(new PutObjectCommand({
+		Bucket: s3.bucket,
+		Key: clusterSentinelKey(s3.prefix),
+		Body: clusterId,
+		ContentType: "text/plain"
+	}));
+}
+/**
+* Indirection object for the DB + S3 reads/writes, so the unit test can stub
+* the I/O without an ESM partial-mock dance. `buildReconcileStep` calls every
+* reader/writer through this object; the test overrides its members directly.
+*/
+const reconcileIo = {
+	readClusterIdFromDb,
+	writeClusterIdToDb,
+	readSentinel,
+	writeSentinel
+};
+/**
+* Build the idempotent step that reconciles the cluster identity in the given
+* direction. `check()` returns drift when the two sides disagree (or null when
+* in sync); `apply()` performs the single write that brings them into
+* agreement. Run it through `runIdempotentStep` (`@kici-dev/core/idempotency`).
+*/
+function buildReconcileStep(deps) {
+	const { databaseUrl, s3, direction } = deps;
+	return {
+		name: `cluster reconcile-identity (${direction})`,
+		check: async () => {
+			const dbClusterId = await reconcileIo.readClusterIdFromDb(databaseUrl);
+			const sentinelClusterId = await reconcileIo.readSentinel(s3);
+			if (dbClusterId === null) throw new Error("cluster_meta.cluster_id is missing — run orchestrator migrations first.");
+			if (direction === "db-from-sentinel") {
+				if (sentinelClusterId === null) throw new Error("No S3 sentinel to restore the DB from. Use --adopt-db to write the sentinel from the DB instead.");
+				if (dbClusterId === sentinelClusterId) return null;
+			} else if (sentinelClusterId === dbClusterId) return null;
+			return {
+				dbClusterId,
+				sentinelClusterId,
+				direction
+			};
+		},
+		summarize: (drift) => drift.direction === "db-from-sentinel" ? `Rewrite DB cluster_id ${drift.dbClusterId} -> ${drift.sentinelClusterId} (from S3 sentinel s3://${s3.bucket}/${clusterSentinelKey(s3.prefix)}).` : `Rewrite S3 sentinel ${drift.sentinelClusterId ?? "(absent)"} -> ${drift.dbClusterId} (from DB cluster_meta.cluster_id).`,
+		apply: async (drift) => {
+			if (drift.direction === "db-from-sentinel") await reconcileIo.writeClusterIdToDb(databaseUrl, drift.sentinelClusterId);
+			else await reconcileIo.writeSentinel(s3, drift.dbClusterId);
+		}
+	};
+}
+//#endregion
+//#region src/cli/commands/cluster.ts
+/**
+* Cluster recovery commands for kici-admin.
+*
+* Subcommand namespace: `kici-admin cluster reconcile-identity`.
+*
+* Reconciles the orchestrator's cluster identity between the DB
+* (`cluster_meta.cluster_id`) and the durable S3 sentinel
+* (`<prefix>/.kici-cluster-id`) when they diverge and the orchestrator refuses
+* to start with a "Cluster identity mismatch" error.
+*
+* DB + S3 direct (NOT the orchestrator HTTP admin API), so it works while the
+* orchestrator process is crash-looping — which is exactly when it is needed.
+* Default direction restores the DB FROM the durable sentinel (the
+* cross-restart / peer anchor); --adopt-db reverses it.
+*/
+function resolveDatabaseUrl$1(explicit) {
+	const url = explicit ?? process.env.KICI_DATABASE_URL;
+	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
+	return url;
+}
+function resolveS3(opts) {
+	const bucket = opts.bucket ?? process.env.KICI_STORAGE_BUCKET;
+	const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+	if (!bucket) throw new Error("S3 bucket required. Pass --bucket or set KICI_STORAGE_BUCKET.");
+	if (!accessKeyId || !secretAccessKey) throw new Error("AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be set for the S3 sentinel.");
+	return {
+		bucket,
+		prefix: opts.prefix ?? process.env.KICI_STORAGE_PREFIX ?? "",
+		region: opts.region ?? process.env.KICI_STORAGE_REGION,
+		endpoint: opts.endpoint ?? process.env.KICI_STORAGE_ENDPOINT,
+		forcePathStyle: opts.forcePathStyle ?? process.env.KICI_STORAGE_FORCE_PATH_STYLE === "true",
+		accessKeyId,
+		secretAccessKey
+	};
+}
+async function cliConfirm(message) {
+	if (!process.stdin.isTTY) return false;
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	try {
+		const answer = await new Promise((resolve) => {
+			rl.question(`${message}\nProceed? [y/N] `, resolve);
+		});
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		rl.close();
+	}
+}
+function registerClusterCommands(program) {
+	program.command("cluster").description("Cluster identity recovery (DB <-> S3 sentinel reconcile).").command("reconcile-identity").description("Reconcile cluster_meta.cluster_id with the S3 sentinel. Default restores the DB from the sentinel.").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--bucket <bucket>", "S3 bucket (else KICI_STORAGE_BUCKET)").option("--prefix <prefix>", "Storage prefix (else KICI_STORAGE_PREFIX, default empty = bucket root)").option("--region <region>", "S3 region (else KICI_STORAGE_REGION)").option("--endpoint <url>", "S3 endpoint (else KICI_STORAGE_ENDPOINT)").option("--force-path-style", "Use S3 path-style addressing").option("--adopt-db", "Reverse direction: rewrite the sentinel from the DB cluster_id").option("--dry-run", "Report drift and exit without changing anything").option("--yes", "Skip confirmation and apply on drift").action(async (opts) => {
+		try {
+			const result = await runIdempotentStep(buildReconcileStep({
+				databaseUrl: resolveDatabaseUrl$1(opts.databaseUrl),
+				s3: resolveS3(opts),
+				direction: opts.adoptDb ? "sentinel-from-db" : "db-from-sentinel"
+			}), {
+				confirm: cliConfirm,
+				yes: opts.yes,
+				dryRun: opts.dryRun,
+				log: (line) => console.log(line)
+			});
+			if (result.outcome === "applied") console.log("Cluster identity reconciled. Restart the orchestrator to verify it boots clean.");
+			else if (result.outcome === "declined") {
+				console.log("No changes made (declined).");
+				process.exit(1);
+			}
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+}
+//#endregion
 //#region src/cli/commands/maintenance.ts
 /**
 * Maintenance CLI commands for kici-admin.
@@ -14777,6 +15378,21 @@ function registerEnvironmentCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	env.command("purge").description("Delete all environments (and held runs) for an org — direct-DB break-glass / warm-start reset").option("--database-url <url>", "Use direct DB access (or KICI_DATABASE_URL)").option("--org <id>", "Restrict purge to a single org (omit to purge all orgs)").option("--json", "Emit JSON output").action(async (opts) => {
+		try {
+			const dbUrl = resolveDirectDbUrl$4(opts.databaseUrl);
+			if (!dbUrl) {
+				console.error("Error: --database-url or KICI_DATABASE_URL is required (direct-DB only)");
+				process.exit(1);
+			}
+			const result = await purgeEnvironmentsDirect(dbUrl, opts.org);
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`environment purge: environmentsDeleted=${result.environmentsDeleted} heldRunsDeleted=${result.heldRunsDeleted}` + (opts.org ? ` (org ${opts.org})` : " (all orgs)"));
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 	env.command("create-template").description("Create or update an environment template + its seed variables").requiredOption("--org <id>", "Org ID").requiredOption("--template <name>", "Template name").option("--type <t>", "Environment type (defaults to \"template\")", "template").option("--branch-restrictions <json>", "JSON array of allowed branches").option("--required-reviewers <csv>", "CSV of required reviewer user IDs").option("--wait-timer <seconds>", "Wait timer (seconds)").option("--hold-expiry <seconds>", "Hold expiry TTL (seconds)").option("--minimum-trust <level>", "Minimum trust (known|trusted)").option("--variables <json>", "JSON object of env variables to seed (e.g. '{\"K\":\"V\"}')").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const branchRestrictions = parseJsonOption(opts.branchRestrictions, "--branch-restrictions");
@@ -17598,7 +18214,7 @@ function parseRuleHandles(nftOutput, identifier) {
 const execFileP$1 = promisify(execFile);
 const logger$4 = createLogger({ prefix: "fc-host-network" });
 /** Privileged binaries that need `sudo -n` on a non-root orchestrator host. */
-const PRIVILEGED_BINS = new Set([
+const PRIVILEGED_BINS = /* @__PURE__ */ new Set([
 	"ip",
 	"nft",
 	"sysctl"
@@ -20663,7 +21279,7 @@ function buildProgram() {
 	registerRemoteSourceCommands(program);
 	registerWorkflowCommands(program, getClient);
 	registerRunsCommands(program, getClient);
-	registerAttestationsCommands(program);
+	registerAttestationsCommands(program, getClient);
 	registerEventLogCommands(program, getClient);
 	registerAccessLogCommands(program, getClient);
 	registerBackendCommands(program, getClient);
@@ -20678,6 +21294,7 @@ function buildProgram() {
 	registerHostCommands(program);
 	registerOrgSettingsCommands(program, getClient);
 	registerClusterNameCommands(program, getClient);
+	registerClusterCommands(program);
 	registerMaintenanceCommands(program, getClient);
 	registerEnvironmentCommands(program, getClient);
 	registerVariableCommands(program, getClient);