@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/pipeline/manual-schedule.d.ts

@@ -9,28 +9,30 @@
  * eventRouter fire-and-forget. The manual path needs request/response
  * correlation to return the newRunId to the dashboard.
  */
-import type { LockWorkflow, MaterializedJob } from '@kici-dev/engine';
+import type { LockScheduleTrigger, LockWorkflow, MaterializedJob } from '@kici-dev/engine';
 import type { RerunDeps } from './rerun.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 interface ManualScheduleDeps extends RerunDeps {
     registrationIndex: RegistrationIndex;
 }
-export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: ManualScheduleDeps): Promise<{
+export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: ManualScheduleDeps, 
+/**
+ * Platform-minted `requestId`. Stable across an HA relay failover re-send, so
+ * it is the idempotency key: after the read-only validation, the first
+ * coordinator to claim it creates the run and a failover re-send returns that
+ * same run instead of minting a second one.
+ */
+requestId: string): Promise<{
     newRunId: string;
 }>;
+/**
+ * A manual "fire now" targets no specific schedule, so merge the declared
+ * default inputs across ALL of the workflow's schedule triggers (later triggers
+ * win on key collision) rather than arbitrarily taking the first. Returns
+ * undefined when no schedule declares resolvable inputs.
+ */
+export declare function mergeScheduleInputs(scheduleTriggers: LockScheduleTrigger[]): Record<string, unknown> | undefined;
 export declare function buildManualJobConfig(workflow: LockWorkflow, mat: MaterializedJob): {
-    resolvedHashFiles?: string[] | undefined;
-    contentHash?: string | undefined;
-    dispatchInputs?: Record<string, unknown> | undefined;
-    steps: readonly import("@kici-dev/engine").LockStepEntry[];
-    needs: readonly (string | {
-        name: string;
-        runOn: ("success" | "pending" | "failed" | "recovering" | "running" | "queued" | "skipped" | "cancelled" | "cancelling" | "timed_out_stale" | "drift_dropped")[];
-    } | {
-        group: string;
-        runOn: ("success" | "pending" | "failed" | "recovering" | "running" | "queued" | "skipped" | "cancelled" | "cancelling" | "timed_out_stale" | "drift_dropped")[];
-    })[];
-    rules: readonly import("@kici-dev/engine").LockRule[] | undefined;
     name: string;
     baseJobName: string;
     matrixValues?: import("@kici-dev/engine").MatrixValues;
@@ -38,6 +40,18 @@ export declare function buildManualJobConfig(workflow: LockWorkflow, mat: Materi
     fanoutTotal?: number;
     source: import("@kici-dev/engine").LockSource | undefined;
     workflowName: string;
+    steps: readonly import("@kici-dev/engine").LockStepEntry[];
+    needs: readonly (string | {
+        name: string;
+        runOn: ("cancelled" | "cancelling" | "drift_dropped" | "failed" | "pending" | "queued" | "recovering" | "running" | "skipped" | "success" | "timed_out_stale" | "unroutable")[];
+    } | {
+        group: string;
+        runOn: ("cancelled" | "cancelling" | "drift_dropped" | "failed" | "pending" | "queued" | "recovering" | "running" | "skipped" | "success" | "timed_out_stale" | "unroutable")[];
+    })[];
+    rules: readonly import("@kici-dev/engine").LockRule[] | undefined;
+    dispatchInputs?: Record<string, unknown> | undefined;
+    contentHash?: string | undefined;
+    resolvedHashFiles?: string[] | undefined;
 };
 export {};
 //# sourceMappingURL=manual-schedule.d.ts.map

package/dist/pipeline/pending-workflow-context.d.ts

@@ -12,7 +12,7 @@
  * Writes to both an in-memory Map (fast read on the same process) and the DB
  * (crash recovery + cross-orchestrator read), mirroring the pending-job store.
  */
-import type { Kysely } from 'kysely';
+import { type Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { WorkflowDispatchContext } from './dispatch-matched-workflow.js';
 /**

package/dist/pipeline/process-webhook.d.ts

@@ -17,10 +17,13 @@
  * top-level export is `processWebhook`, callable from server.ts / app.ts.
  */
 import { z } from 'zod';
-import type { SimulatedEvent } from '@kici-dev/engine';
+import type { LockFile as FullLockFile, SimulatedEvent } from '@kici-dev/engine';
+import type { OrchestratorMode } from '@kici-dev/engine';
 import type { WebhookInfo } from '../webhook/handler.js';
 import type { ProviderBundle } from '../provider-registry.js';
 import type { TrustResolution } from '../security/trust-resolver.js';
+import { type TrustPolicyOutcome } from '../security/trust-policy-gate.js';
+import { type WorkflowModification } from '../security/workflow-diff.js';
 import { type ProcessingDeps } from './processor.js';
 /**
  * Outcome of a single inbound-webhook ingestion. `duplicate` lets a direct-
@@ -29,9 +32,10 @@ import { type ProcessingDeps } from './processor.js';
  * `processed` means the pipeline matched and dispatched (or recorded a run).
  */
 export declare const WebhookIngestOutcome: z.ZodEnum<{
+    duplicate: "duplicate";
     processed: "processed";
+    shed: "shed";
     skipped: "skipped";
-    duplicate: "duplicate";
 }>;
 export type WebhookIngestOutcome = z.infer<typeof WebhookIngestOutcome>;
 interface TrustOutcome {
@@ -49,6 +53,57 @@ export declare function resolveTrustForPR(args: {
     repoIdentifier: string;
     credentials: Record<string, unknown>;
 }): Promise<TrustOutcome>;
+interface SecurityState {
+    workflowModifications: WorkflowModification[];
+    /**
+     * True when this PR changes `.kici/` workflow definitions. A *signal*, not a
+     * decision — the trust-policy gate turns it into an outcome, which the
+     * dispatch gate then enforces as a held run or a rejected run.
+     */
+    hasWorkflowModifications: boolean;
+}
+/**
+ * Phase G — On PR events evaluated against the base lock file, detect workflow
+ * modifications by diffing base vs. head and post a neutral informational check
+ * (on its own dedicated check name).
+ *
+ * Detection only. Whether a modification gates the run is the org trust policy's
+ * call, evaluated in `evaluateSecurityPolicy` and enforced by the dispatch gate
+ * — which creates the real `held_runs` row and posts the pending
+ * "Held for approval" check, so `/kici approve` / reject / expiry can resolve it.
+ */
+export declare function applyWorkflowModificationsAndSecurityHold(args: {
+    info: WebhookInfo;
+    bundle: ProviderBundle;
+    event: SimulatedEvent;
+    fullLockFile: FullLockFile;
+    headLockFileForDiff: FullLockFile | undefined;
+    isPREvent: boolean;
+    lockFileSource: 'head' | 'base';
+    trustResolution: TrustResolution | undefined;
+    repoIdentifier: string;
+    ref: string;
+    credentials: Record<string, unknown>;
+}): SecurityState;
+/**
+ * Evaluate the org trust policy for a PR event.
+ *
+ * Scoped to providers with a contributor model — the same condition trust
+ * resolution uses. A source without a `ContributorResolver` (generic, local,
+ * universal-git) is trusted by construction, so it passes regardless of policy;
+ * in particular, universal-git computes an `isForkPR` signal that must NOT gate
+ * those sources.
+ */
+export declare function evaluateSecurityPolicy(args: {
+    deps: ProcessingDeps;
+    bundle: ProviderBundle;
+    isPREvent: boolean;
+    resolvedOrgId: string;
+    mode: OrchestratorMode;
+    trustResolution: TrustResolution | undefined;
+    isForkPR: boolean;
+    hasWorkflowModifications: boolean;
+}): Promise<TrustPolicyOutcome>;
 /**
  * Process a webhook through the complete pipeline.
  *

package/dist/pipeline/processor.d.ts

@@ -13,6 +13,7 @@
  */
 import { type Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
+import type { SandboxAllowListReader } from './sandbox-allowlist-reader.js';
 import type { WebhookInfo } from '../webhook/handler.js';
 import type { DedupCache } from '../webhook/dedup.js';
 import type { ProviderRegistry, ProviderBundle } from '../provider-registry.js';
@@ -31,6 +32,7 @@ import type { ExecutionTracker } from '../reporting/execution-tracker.js';
 import type { AgentRegistry } from '../agent/registry.js';
 import type { HostRosterStore } from '../agent/host-roster.js';
 import type { RunCoordinator } from '../cluster/coordinator.js';
+import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
 import type { TeamMembershipLookup } from '../approvals/team-membership-lookup.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { SecretResolverApi } from '../secrets/secret-resolver.js';
@@ -46,11 +48,12 @@ import type { GlobalWorkflowPolicy } from '../security/global-workflow-policy.js
 import type { EventLogWriter } from '../webhook/event-log.js';
 import { EventLogSource } from '@kici-dev/engine';
 import type { LockJob } from '@kici-dev/engine';
-import type { EnvironmentStore } from '../environments/environment-store.js';
-import type { VariableStore } from '../environments/variable-store.js';
+import type { ContextStore } from '../contexts/context-store.js';
+import type { VariableStore } from '../contexts/variable-store.js';
 import type { TrustResolver, IdentityLink, PermissionLevel } from '../security/trust-resolver.js';
-import type { HeldRunStore } from '../environments/held-runs.js';
-import type { WorkflowDecision } from '@kici-dev/engine';
+import { type HeldRunStore } from '../contexts/held-runs.js';
+import type { OrchestratorMode, WorkflowDecision } from '@kici-dev/engine';
+import type { TrustPolicyStore } from '../security/trust-policy-store.js';
 /**
  * Pending dispatch context for jobs gated by the needs scheduler.
  * Keyed by `${runId}:${jobName}`. Populated at processWebhook time for all
@@ -210,13 +213,9 @@ export declare function eventTypeToTriggerType(eventType: string): string;
  * Combines event type with action (e.g. "push", "pull_request:opened").
  */
 export declare function buildTriggerEvent(event: string, action: string | null | undefined): string;
-/**
- * Extract the first line of the commit message from a webhook payload.
- * Handles push (head_commit.message) and PR (pull_request.title) events.
- */
 /**
  * Best-effort extraction of a repository identifier from a generic webhook
- * payload for cross-source dispatch (phase 28.5). Generic webhooks have no
+ * payload for cross-source dispatch. Generic webhooks have no
  * canonical repo shape, so we probe the conventions a sender is most likely
  * to use:
  *
@@ -228,11 +227,25 @@ export declare function buildTriggerEvent(event: string, action: string | null |
  * cross-source repo lookup is skipped (event-name fan-out still runs).
  */
 export declare function extractInboundRepoIdentifier(payload: unknown): string | null;
+/**
+ * Extract the first line of the commit message from a webhook payload.
+ * Handles push (head_commit.message) and PR (pull_request.title) events.
+ */
 export declare function extractCommitMessage(event: string, payload: unknown): string | undefined;
 /**
  * Build a human-readable summary for a security hold check.
  */
 export declare function buildSecurityHoldSummary(reason: string, tier: string, contributorUsername?: string): string;
+/**
+ * Build the failure check-run description for a run the org trust policy
+ * REJECTED.
+ *
+ * Deliberately not `buildSecurityHoldSummary`: a rejected run creates no
+ * `held_runs` row, so telling the contributor to seek "approval from a user
+ * with ci_trust:write or higher" points at a queue the run will never appear
+ * in. Only an org policy change can unblock it.
+ */
+export declare function buildSecurityRejectionSummary(reason: string, message: string, tier: string, contributorUsername?: string): string;
 /**
  * Build the pending check-run description for a job/workflow approval hold,
  * naming the clauses an approver must satisfy. `{team:X}` renders as
@@ -282,6 +295,12 @@ export interface ProcessingDeps {
     coordinator?: RunCoordinator;
     /** Secret resolver for dispatch-time secret resolution. Optional -- if not set, secrets are not resolved. */
     secretResolver?: SecretResolverApi;
+    /**
+     * Cached per-org container-sandbox escape-hatch allow-list reader. Optional --
+     * when absent, dispatch defaults to the safe deny-all allow-list, so no
+     * workflow can escalate capabilities / host networking.
+     */
+    sandboxAllowListReader?: SandboxAllowListReader;
     /** Optional callback when source locations are extracted from a lock file workflow. */
     onSourceLocationsExtracted?: (workflowName: string, jobName: string, sourceLocations: Array<{
         file: string;
@@ -302,14 +321,28 @@ export interface ProcessingDeps {
     secretKey?: string;
     /** Log storage backend for persisting webhook payloads. Optional -- if not set, payload storage is skipped. */
     logStorage?: LogStorage;
-    /** Environment store for looking up deployment environments. Optional -- if not set, environment features are inactive. */
-    environmentStore?: EnvironmentStore;
-    /** Variable store for resolving environment variables. Optional -- if not set, environment vars are not merged. */
+    /** Context store for looking up deployment contexts. Optional -- if not set, context features are inactive. */
+    contextStore?: ContextStore;
+    /** Variable store for resolving context variables. Optional -- if not set, context vars are not merged. */
     variableStore?: VariableStore;
     /** Held run store for persisting protection rule holds. Optional -- if not set, holds are not persisted. */
     heldRunStore?: HeldRunStore;
     /** Trust resolver for determining contributor trust tiers. Optional -- if not set, trust resolution is skipped. */
     trustResolver?: TrustResolver;
+    /**
+     * Cache of the Platform-owned org trust policy. Read per PR event by the
+     * trust-policy gate. Optional so existing tests and independent deployments
+     * that construct deps by hand keep working.
+     */
+    trustPolicyStore?: TrustPolicyStore;
+    /**
+     * This orchestrator's mode. The trust-policy gate needs it to decide what an
+     * absent policy means: Platform-attached modes fail closed (a push is
+     * imminent), independent mode has no upstream authority and keeps legacy
+     * behavior. Defaults to `'platform'` at the read site — the fail-closed side —
+     * so a hand-built deps object never accidentally opens the gate.
+     */
+    orchestratorMode?: OrchestratorMode;
     /** Identity links pushed from Platform for trust resolution. Optional -- defaults to empty. */
     identityLinks?: IdentityLink[];
     /** ci_trust permission levels per user ID from Platform push. Optional -- defaults to empty. */
@@ -343,8 +376,11 @@ export interface ProcessingDeps {
     instanceId?: string;
     /** Static-host grace before a disconnected static host reads unreachable (ms). */
     rosterGraceMs?: number;
-    /** Cap on runsOnAll per-host children (default 1024). */
+    /** Cap on runsOnAll per-host children (default 1024). Cluster default; the
+     * live per-cluster override is read from `cluster_settings.max_fanout_hosts`. */
     maxFanoutHosts?: number;
+    /** Reader for fleet-wide cluster tunables (max_fanout_hosts live override). */
+    clusterSettings?: ClusterSettingsReader;
 }
 /**
  * Check if any trigger in the lock file workflows uses path filters.

package/dist/pipeline/request-idempotency.d.ts

@@ -0,0 +1,28 @@
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+/**
+ * Atomically claim a run-minting request by its Platform `requestId`. Returns
+ * the run id to use. `claimed: false` means a sibling coordinator already owns
+ * this requestId (a relay failover re-sent the same request): the caller MUST
+ * return `{ newRunId }` WITHOUT creating or dispatching a run, so one user
+ * click yields exactly one run.
+ *
+ * Shared by `run.rerun.request` and `run.manual_schedule.request` — both mint a
+ * fresh run and both ride the Platform's timeout-driven failover path. HA
+ * coordinator siblings share one orchestrator DB, so the `INSERT … ON CONFLICT
+ * (request_id) DO NOTHING` is the single point of arbitration: exactly one hop
+ * inserts and wins; the loser reads back the winner's `new_run_id`.
+ */
+export declare function claimRequestId(db: Kysely<Database>, requestId: string): Promise<{
+    newRunId: string;
+    claimed: boolean;
+}>;
+/**
+ * Prune `request_idempotency` rows older than 1h. The request budget is ~10s,
+ * so a claimed requestId is never re-sent after an hour; keeping the table
+ * bounded avoids unbounded growth on a long-lived coordinator.
+ *
+ * @returns the number of rows deleted.
+ */
+export declare function pruneRequestIdempotency(db: Kysely<Database>): Promise<number>;
+//# sourceMappingURL=request-idempotency.d.ts.map

package/dist/pipeline/rerun.d.ts

@@ -28,18 +28,17 @@ import type { BuildCoordinator } from '../cache/index.js';
 import type { DepCache } from '../cache/index.js';
 import type { PendingBuildTracker } from '../cache/index.js';
 /**
- * Thrown when a rerun is attempted on an archived run AND the cold-store
- * replay path failed (chunk missing, contentHash mismatch, S3 outage, or
- * cold-store probe disabled). Phase F replaced the Phase-C "rerun is
- * blocked" semantics with a real replay path; this error now signals
- * a genuine "we tried to bring the row back and could not".
+ * Thrown when a rerun is attempted on a run whose row is absent from PG AND
+ * the cold-store replay path failed or is unavailable (chunk missing,
+ * contentHash mismatch, S3 outage, or cold-store probe disabled). Signals a
+ * genuine "we tried to bring the row back and could not".
  *
  * The WS dashboard handler maps this to a structured response that the
  * Platform proxy surfaces as HTTP 410 (`errorCode: 'runArchivedNotRerunnable'`).
  */
 export declare class RunArchivedNotRerunnableError extends Error {
     readonly runId: string;
-    readonly code: "runArchivedNotRerunnable";
+    readonly code: 'runArchivedNotRerunnable';
     constructor(runId: string);
 }
 export interface RerunDeps {
@@ -60,18 +59,26 @@ export interface RerunDeps {
     buildCoordinator: BuildCoordinator | null;
     pendingBuilds: PendingBuildTracker | null;
     /**
-     * Phase F — when set, a PG miss on `originalRunId` triggers a
-     * cold-store replay of the chunk containing the row, then a re-read.
-     * `null` keeps the legacy "throw RunArchivedNotRerunnableError on PG
-     * miss" path for deployments without cold-store wired up.
+     * When set, a PG miss on `originalRunId` triggers a cold-store replay of
+     * the chunk containing the row, then a re-read. `null` keeps the "throw
+     * RunArchivedNotRerunnableError on PG miss" path for deployments without
+     * cold-store wired up.
      */
     coldStore: ColdStore | null;
 }
 export declare function handleRerun(originalRunId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: RerunDeps, 
 /**
- * Phase F — routing key for the original run, forwarded by Platform
- * via the WS `run.rerun.request` payload. Required to address the
- * cold-store chunk under the right tenant prefix.
+ * Platform-minted `requestId` for this rerun. Stable across an HA relay
+ * failover re-send (the Platform re-sends the same message verbatim to a
+ * sibling coordinator on a timeout), so it is the idempotency key: after the
+ * read-only validation, the first coordinator to claim it creates the run and
+ * a failover re-send returns that same run instead of minting a second one.
+ */
+requestId: string, 
+/**
+ * Routing key for the original run, forwarded by Platform via the WS
+ * `run.rerun.request` payload. Required to address the cold-store chunk
+ * under the right tenant prefix.
  */
 routingKeyHint?: string): Promise<{
     newRunId: string;

package/dist/pipeline/resolve-sandbox-grant.d.ts

@@ -0,0 +1,28 @@
+import type { ResolvedSandboxGrant, SandboxNetworkMode } from '@kici-dev/engine';
+import type { SandboxAllowList } from './sandbox-allowlist-reader.js';
+/** The workflow-declared per-job escape-hatch request carried in the lock. */
+export interface SandboxRequest {
+    capabilities?: string[];
+    network?: SandboxNetworkMode;
+}
+/**
+ * The resolution outcome: either an authorized grant (possibly `undefined` when
+ * the request is a no-op / non-escalating) or a total, loud denial.
+ */
+export type SandboxGrantResolution = {
+    grant?: ResolvedSandboxGrant;
+} | {
+    denied: {
+        reason: string;
+    };
+};
+/**
+ * Resolve a workflow-declared sandbox request against the operator's allow-list
+ * (the single enforcement point). Deny is loud and total — a request for any
+ * capability or host-network the operator did not allow-list fails the run with
+ * a reason naming the offending cap/knob; a disallowed cap is never silently
+ * stripped and run anyway. Pure (no I/O), so the allow-list is injected and the
+ * function is exhaustively unit-testable.
+ */
+export declare function resolveSandboxGrant(request: SandboxRequest | undefined, allowList: SandboxAllowList): SandboxGrantResolution;
+//# sourceMappingURL=resolve-sandbox-grant.d.ts.map

package/dist/pipeline/resume-workflow.d.ts

@@ -1,7 +1,7 @@
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { ProcessingDeps } from './processor.js';
-import type { ReleaseSignal } from '../environments/held-runs.js';
+import type { ReleaseSignal } from '../contexts/held-runs.js';
 import { type WorkflowDispatchContext } from './dispatch-matched-workflow.js';
 import { type SerializableWorkflowDispatchInputs } from './pending-workflow-context.js';
 /**

package/dist/pipeline/route-or-dispatch-jobs.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared coordinator-route / direct-dispatch machinery for the orchestrator
+ * pipeline.
+ *
+ * The re-run path (`rerun.ts`) and the manual-schedule path
+ * (`manual-schedule.ts`) both materialize a workflow's static jobs, try to
+ * route them through the cluster coordinator (local dispatch first, then
+ * reroute to peers), fall back to direct local dispatch in standalone mode or
+ * on a coordinator timeout, and synthesize records for rejected jobs. This
+ * module implements that once so a fix lands in a single place.
+ */
+import { createLogger } from '@kici-dev/shared';
+import type { LockJob, MaterializedJob } from '@kici-dev/engine';
+import type { RunContext, RunCoordinator } from '../cluster/coordinator.js';
+import type { Dispatcher } from '../agent/dispatcher.js';
+import type { ExecutionTracker } from '../reporting/execution-tracker.js';
+export interface DispatchedJobEntry {
+    jobId: string;
+    jobName: string;
+    matrixValues?: Record<string, unknown>;
+    runsOnLabels?: string[];
+}
+export interface RejectedJobEntry {
+    jobId: string;
+    reason: string;
+}
+export interface RouteOrDispatchOptions {
+    newRunId: string;
+    /** Static jobs before materialization — the helper materializes + handles FanoutError. */
+    staticJobs: LockJob[];
+    workflowName: string;
+    repoUrl: string;
+    ref: string;
+    sha: string;
+    deliveryId: string;
+    provider: string;
+    providerContext: Record<string, unknown>;
+    routingKey: string;
+    /** Prebuilt by the caller (event name / payload / installationId differ per path). */
+    runContext: RunContext;
+    /** Per-caller jobConfig shape (schedule dispatchInputs vs. rerun source fallback). */
+    buildJobConfig: (mat: MaterializedJob) => Record<string, unknown>;
+    /** Caller's own logger — keeps the originating prefix ('manual-schedule' / 'rerun'). */
+    logger: ReturnType<typeof createLogger>;
+    /** Human label used in log messages: 'Manual schedule' | 'Re-run'. */
+    label: string;
+    coordinator: RunCoordinator | null;
+    dispatcher: Dispatcher;
+}
+/**
+ * Materialize the static jobs (degrading gracefully on a matrix that can no
+ * longer expand), then route them via the coordinator or, in standalone mode /
+ * on a coordinator timeout, dispatch directly. Returns the jobs to register
+ * with the execution tracker plus any synthetic-rejected IDs to mark failed.
+ */
+export declare function routeOrDispatchJobs(opts: RouteOrDispatchOptions): Promise<{
+    dispatchedJobs: DispatchedJobEntry[];
+    rejectedJobs: RejectedJobEntry[];
+}>;
+export interface RegisterDispatchedJobsOptions {
+    newRunId: string;
+    dispatchedJobs: DispatchedJobEntry[];
+    rejectedJobs: RejectedJobEntry[];
+    executionTracker: ExecutionTracker;
+}
+/**
+ * Register dispatched jobs with the execution tracker, then mark any
+ * synthetic-rejected jobs failed. No-op when nothing was dispatched.
+ */
+export declare function registerDispatchedJobs(opts: RegisterDispatchedJobsOptions): Promise<void>;
+//# sourceMappingURL=route-or-dispatch-jobs.d.ts.map

package/dist/pipeline/sandbox-allowlist-reader.d.ts

@@ -0,0 +1,33 @@
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+/**
+ * The operator-controlled per-org escape-hatch allow-list. `capabilities` are
+ * stored canonicalized (bare uppercase Docker-API form) so the dispatch resolver
+ * compares canonical-to-canonical.
+ */
+export interface SandboxAllowList {
+    capabilities: string[];
+    allowHostNetwork: boolean;
+}
+export interface SandboxAllowListReader {
+    /**
+     * Read the org's escape-hatch allow-list. Never throws; on a DB error (or no
+     * DB handle) it degrades to the safe deny-all default `{ capabilities: [],
+     * allowHostNetwork: false }` so a sick DB denies escalation rather than
+     * blocking dispatch.
+     */
+    read(orgId: string): Promise<SandboxAllowList>;
+}
+/**
+ * Reader for the per-org container-sandbox escape-hatch allow-list. Read once per
+ * matched-workflow dispatch (not per request), against a single indexed row, so
+ * it is intentionally **uncached**: this is a security control, and an operator's
+ * `sandbox-allowlist` change must take effect on the very next dispatch (a cache
+ * would leave the old policy in force for its TTL — a stale-deny or stale-allow
+ * window on a privilege boundary). The trivial per-dispatch query is the right
+ * trade for always-fresh enforcement.
+ */
+export declare function createSandboxAllowListReader(deps: {
+    db?: Kysely<Database>;
+}): SandboxAllowListReader;
+//# sourceMappingURL=sandbox-allowlist-reader.d.ts.map

package/dist/pipeline/test-pipeline.d.ts

@@ -3,7 +3,7 @@
  *
  * Resolves the lock file, matched decisions, and fixture-specific concerns
  * (inline-vs-provider lock, decision selection, fixture-payload storage, the
- * `allow_local_execution` environment gate, CLI-secret overlay, in-memory
+ * `allow_local_execution` context gate, CLI-secret overlay, in-memory
  * test-run marking), then dispatches each matched workflow through the SAME
  * shared core as webhooks (`dispatchMatchedWorkflow`). The test path is a thin
  * adapter — needs-DAG scheduling, `expansionMap` fan-out edges, `runsOnAll`
@@ -94,7 +94,7 @@ interface TestTriggerResult {
     jobIds: string[];
     /**
      * User-visible warnings on an accepted run — today, one per job whose bound
-     * test-run environment(s) were unavailable (non-test or unconfigured) and
+     * test-run context(s) were unavailable (non-test or unconfigured) and
      * skipped. Printed by the CLI on acceptance.
      */
     warnings?: string[];

package/dist/policy/dashboard-write-policy.d.ts

@@ -20,7 +20,7 @@
  */
 import { EventEmitter } from 'node:events';
 import { type Kysely } from 'kysely';
-import { DashboardWriteOperation, type DashboardWritePolicyMap } from '@kici-dev/engine/protocol/dashboard-write-operations';
+import { DashboardWriteOperation, type DashboardWritePolicyMap, type DashboardWritePolicyState } from '@kici-dev/engine/protocol/dashboard-write-operations';
 import type { Database } from '../db/types.js';
 import type { ActorPrincipal } from '@kici-dev/engine';
 /**
@@ -37,7 +37,7 @@ export declare const dashboardWritePolicyEvents: EventEmitter<[never]>;
 export declare class DashboardWritePolicyDisabledError extends Error {
     readonly operation: DashboardWriteOperation;
     readonly cliEquivalent: string;
-    readonly code: "operation_disabled";
+    readonly code: 'operation_disabled';
     constructor(operation: DashboardWriteOperation, cliEquivalent: string);
 }
 /**
@@ -64,6 +64,11 @@ export declare function getDashboardWritePolicy(db: Kysely<Database>, customerId
  * `getDashboardWritePolicy` + the engine-side resolver.
  */
 export declare function isDashboardWriteEnabled(db: Kysely<Database>, customerId: string, op: DashboardWriteOperation): Promise<boolean>;
+/**
+ * Resolve the tri-state posture (`permissive` | `encrypted` | `disabled`) for
+ * an operation. Reads through the same 30 s cache as the enabled check.
+ */
+export declare function getDashboardWritePolicyState(db: Kysely<Database>, customerId: string, op: DashboardWriteOperation): Promise<DashboardWritePolicyState>;
 /**
  * Defense-in-depth gate for orch-side dashboard.* handlers. Throws
  * `DashboardWritePolicyDisabledError` when the operation is disabled.
@@ -100,8 +105,8 @@ export interface PolicyChangeEvent {
     actor: ActorPrincipal;
     customerId: string;
     op: DashboardWriteOperation;
-    prior: boolean;
-    next: boolean;
+    prior: DashboardWritePolicyState;
+    next: DashboardWritePolicyState;
 }
 /**
  * Reset to the permissive defaults (everything enabled). Useful for

package/dist/provenance/backfill-run.d.ts

@@ -4,6 +4,7 @@ export interface BackfillRunRow {
     run_id: string;
     workflow_name: string;
     status: string;
+    routing_key: string | null;
     repo_identifier: string | null;
     provider: string | null;
     local_working_tree: boolean | null;

package/dist/provenance/trust-root.d.ts

@@ -16,9 +16,29 @@ export interface ProvenanceTrustRoot {
     getJwks(kid?: string): Promise<JSONWebKeySet | null>;
     setIssuer(issuer: string | null): void;
 }
+/**
+ * A trust root backed by the orchestrator's OWN signing keys (Phase 1
+ * orchestrator-owned attestations). Verify-at-ingest resolves the key set from
+ * the `orchestrator_signing_keys` table so fresh rotations / revocations are
+ * reflected immediately, and the issuer is the orchestrator's own configured
+ * provenance issuer. The key set is read fresh from the DB each resolve (a cheap
+ * read; ingest verification is not hot), so a rotated-in `kid` is always found.
+ */
+export declare function provenanceTrustRootFromRepo(repo: {
+    listTrusted: () => Promise<{
+        public_jwk: unknown;
+    }[]>;
+}, issuer: string): ProvenanceTrustRoot;
 export declare function createProvenanceTrustRoot(opts?: {
     issuer?: string | null;
     fetchImpl?: typeof fetch;
     ttlMs?: number;
+    /**
+     * In-process JWKS served directly (no HTTP fetch). Set for the offline local
+     * dev plane, whose `kici-local` issuer is not a URL — the plane's own signer
+     * is the key source, so a `kici-local` bundle verifies at ingest without a
+     * `.well-known/jwks.json` endpoint. When set, discovery/fetch is bypassed.
+     */
+    staticJwks?: JSONWebKeySet;
 }): ProvenanceTrustRoot;
 //# sourceMappingURL=trust-root.d.ts.map

package/dist/provider-registry.d.ts

@@ -29,6 +29,14 @@ export interface ProviderBundle {
     repoUrlBuilder?: RepoUrlBuilder;
     contributorResolver?: ContributorResolver;
     checkStatusPoster?: CheckStatusPoster;
+    /**
+     * Local `file://` in-place profile: this bundle's `repoBasePath` is the
+     * operator's real working tree, so a dispatched run against it skips the
+     * source-pack `__build__` job (the tree is used directly by the agent's
+     * `KICI_IN_PLACE` profile). Set only by `createLocalProviderBundle`. Undefined
+     * for every non-local (or non-in-place local) bundle.
+     */
+    localInPlace?: boolean;
 }
 /**
  * Registry mapping routing keys to their implementation bundles.

package/dist/providers/generic/normalizer.d.ts

@@ -17,7 +17,7 @@ import type { GenericSourceManager } from '../../webhook/generic-sources.js';
  */
 export declare class GenericWebhookNormalizer implements WebhookNormalizer {
     private readonly sourceManager;
-    readonly provider: "generic";
+    readonly provider: 'generic';
     constructor(sourceManager: GenericSourceManager);
     /**
      * Extract routing key from the X-KiCI-Source-ID header.