@kici-dev/orchestrator 0.1.27 → 0.2.0

package/dist/reporting/run-aggregator.d.ts

@@ -34,12 +34,6 @@ export interface RunDetailStepRow {
 }
 /** Map a step row to the dashboard run-detail step shape (epoch-ms timestamps). */
 export declare function mapRunDetailStep(step: RunDetailStepRow): {
-    groupId?: string | undefined;
-    concurrencyKind?: string | undefined;
-    driftSummary?: string | undefined;
-    checkOutcome?: string | undefined;
-    secretsAccessed: string | null;
-    stepType?: string | undefined;
     stepIndex: number;
     stepName: string;
     status: string;
@@ -48,6 +42,12 @@ export declare function mapRunDetailStep(step: RunDetailStepRow): {
     durationMs: number | null;
     exitCode: number | null;
     errorMessage: string | null;
+    stepType?: string | undefined;
+    secretsAccessed: string | null;
+    checkOutcome?: string | undefined;
+    driftSummary?: string | undefined;
+    concurrencyKind?: string | undefined;
+    groupId?: string | undefined;
 };
 /** A run-detail job row as queried from execution_jobs (warm + cold paths). */
 export interface RunDetailJobRow {
@@ -81,32 +81,6 @@ export interface RunDetailJobLookups {
 }
 /** Map queried job + step rows into the dashboard run-detail job DTO shape. */
 export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: RunDetailJobLookups): {
-    needs: {
-        upstreamName: string;
-        runOn: ExecutionJobStatus[];
-    }[] | null;
-    steps: {
-        groupId?: string | undefined;
-        concurrencyKind?: string | undefined;
-        driftSummary?: string | undefined;
-        checkOutcome?: string | undefined;
-        secretsAccessed: string | null;
-        stepType?: string | undefined;
-        stepIndex: number;
-        stepName: string;
-        status: string;
-        startedAt: number | null;
-        completedAt: number | null;
-        durationMs: number | null;
-        exitCode: number | null;
-        errorMessage: string | null;
-    }[];
-    initFailure?: {
-        scope: "job" | "run";
-        category: "secret_resolution" | "install_secrets" | "lock_resolution" | "build_coordination" | "context_rules" | "dynamic_eval" | "no_agent" | "matrix_expansion";
-        message: string;
-        jobName?: string | undefined;
-    } | undefined;
     jobId: string;
     jobName: string;
     status: string;
@@ -126,6 +100,32 @@ export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: Run
     envWarning: string | null;
     outputs: any;
     secretOutputKeys: string[] | null;
+    initFailure?: {
+        scope: "job" | "run";
+        category: "approval_misconfig" | "build_coordination" | "context_rules" | "dynamic_eval" | "install_secrets" | "lock_resolution" | "matrix_expansion" | "no_agent" | "sandbox_denied" | "secret_resolution" | "trust_policy";
+        message: string;
+        jobName?: string | undefined;
+    } | undefined;
+    needs: {
+        upstreamName: string;
+        runOn: ExecutionJobStatus[];
+    }[] | null;
+    steps: {
+        stepIndex: number;
+        stepName: string;
+        status: string;
+        startedAt: number | null;
+        completedAt: number | null;
+        durationMs: number | null;
+        exitCode: number | null;
+        errorMessage: string | null;
+        stepType?: string | undefined;
+        secretsAccessed: string | null;
+        checkOutcome?: string | undefined;
+        driftSummary?: string | undefined;
+        concurrencyKind?: string | undefined;
+        groupId?: string | undefined;
+    }[];
 }[];
 /** A dashboard-shaped run-detail job (epoch-ms timestamps). */
 export type CanonicalRunDetailJob = ReturnType<typeof buildRunDetailJobs>[number];

package/dist/reporting/s3-log-storage.d.ts

@@ -1,14 +1,37 @@
 /**
  * S3-backed log storage.
  *
- * Stores execution logs in S3. No TTL -- logs persist indefinitely.
+ * Stores execution logs in S3. Retention is bounded by the orchestrator cleanup
+ * sweep, which bulk-deletes objects older than `KICI_STEP_LOG_TTL_DAYS` (default
+ * 90; 0 disables the sweep for operators running their own bucket lifecycle).
  *
- * Implementation notes:
- * - append() reads existing content + concatenates + puts back (acceptable
- *   for the sequential step model where max ~10MB per step)
- * - read() uses Range header for cursor-based pagination
- * - exists() uses HeadObject
- * - list() uses ListObjectsV2 with prefix
+ * Two write verbs with different durability contracts:
+ *
+ * - append() is an immediately-durable read-modify-write: GetObject the whole
+ *   object, concatenate, PutObject it back. Correct for single-shot writers
+ *   (webhook delivery payloads, rerun payloads, orchestration logs) that write
+ *   once and read back without any finalize — N=1 means no amplification and no
+ *   race. Its content is a plain single object at objectKey(path).
+ * - appendStreaming() is the high-frequency step-log verb. S3 has no native
+ *   append primitive, so it buffers chunks per step key in memory and seals an
+ *   immutable `{objectKey(path)}/seg-NNNNNN` object (one PutObject, unique key)
+ *   once the buffer reaches segmentFlushBytes OR its oldest byte reaches
+ *   segmentFlushMs. Each byte is written exactly once (no O(N^2) amplification)
+ *   and the unique seal key means concurrent appends to the same step can never
+ *   overwrite one another. Durability of the final tail is guaranteed by
+ *   finalize(path) at run completion.
+ *
+ * - finalize() seals the remaining tail buffer for a step key.
+ * - read() lists sealed segments (plus any legacy/single object written by
+ *   append()) and streams them via the byte-offset cursor.
+ * - exists()/list() are segment-aware: `exists` is true when a single object or
+ *   any segment is present; `list` collapses segment keys to their logical step
+ *   path.
+ *
+ * All appendStreaming/finalize operations for one step key run through a
+ * sequential execution chain so the in-memory buffer and seq counter are the
+ * authoritative single writer even when the caller fires appends without
+ * awaiting.
  *
  * Uses AWS SDK v3 modular imports -- only loaded when S3 storage is configured.
  */
@@ -21,22 +44,93 @@ interface S3LogStorageOptions {
     endpoint?: string;
     /** Use path-style access instead of virtual-hosted-style (required for most S3-compatible services) */
     forcePathStyle?: boolean;
+    /** Seal a step-log segment once the in-memory buffer reaches this many bytes. */
+    segmentFlushBytes: number;
+    /** Seal a step-log segment once the oldest buffered byte reaches this age (ms). */
+    segmentFlushMs: number;
 }
 export declare class S3LogStorage implements LogStorage {
     private readonly client;
     private readonly bucket;
     private readonly prefix;
+    private readonly segmentFlushBytes;
+    private readonly segmentFlushMs;
+    /** Per-key in-memory tail buffers awaiting seal (appendStreaming path). */
+    private readonly buffers;
+    /** Per-key sequential execution chain (serializes appendStreaming/finalize). */
+    private readonly locks;
     constructor(options: S3LogStorageOptions);
-    /** Build the full S3 object key from a log path. */
+    /**
+     * Build the full S3 object key from a log path.
+     *
+     * The assert is not traversal protection — S3 keys are opaque byte strings,
+     * so `..` is a literal segment and this concatenation cannot escape the
+     * prefix. It refuses to mint a malformed key at all: `list()` and
+     * `listWithMetadata()` rebuild storage-relative paths by slicing the prefix
+     * off, so a key carrying `..` or a leading `/` would be handed back to the
+     * caller as an odd relative path — and on a filesystem-backed peer that path
+     * reaches a resolve. Keep it; it is deliberate.
+     *
+     * Removals do NOT go through here: see {@link S3LogStorage.deleteKey}.
+     */
     private objectKey;
+    /**
+     * Object key for a removal, built without the minting assert.
+     *
+     * `deleteMany` consumes this store's own `listWithMetadata()` output, which
+     * reports whatever keys the bucket actually holds — including a legacy
+     * malformed one written before `objectKey()` began refusing them. Routing a
+     * removal through the minting assert would throw while building the batch,
+     * so one such object would abort the whole retention sweep and leave every
+     * expired object in place forever. There is no protection to lose: an S3 key
+     * is an opaque byte string, so a `..` segment is literal and this
+     * concatenation addresses an object inside the prefix or nothing at all.
+     */
+    private deleteKey;
+    /** Segment object key for a given sequence number (zero-padded to 6 digits). */
+    private segKey;
     /** Check if an error is a "not found" error (NoSuchKey, NotFound, 404). */
     private isNotFoundError;
     /** Read the full content of an S3 object as a string. Returns null if not found. */
     private getContent;
+    /**
+     * Run `fn` after every previously-queued operation for `key` has settled, so
+     * all appendStreaming/finalize calls for one step key execute strictly in
+     * order. The chain swallows prior errors (they are surfaced to their own
+     * caller) so one failed op does not wedge the key.
+     */
+    private runExclusive;
     append(path: string, data: string): Promise<void>;
+    /**
+     * Highest existing segment number under a key (for mid-run redeploy
+     * continuity), + 1. Returns 0 when no segments exist yet.
+     */
+    private nextSeq;
+    /** Seal the buffer as the next immutable segment object. */
+    private seal;
+    appendStreaming(path: string, data: string): Promise<void>;
+    finalize(path: string): Promise<void>;
+    /**
+     * Single-object size (or null) + sealed segments in ascending seq order for a
+     * key. The single object is the content written by append() (single-shot
+     * writers) or any legacy step log written before the append-only change.
+     */
+    private layout;
+    /** Fetch an inclusive byte range from one object. */
+    private getRange;
+    /**
+     * Map a global byte cursor + limit onto per-object range reads across an
+     * ordered entry list. Returns the reads to perform and the total byte size.
+     */
+    private planReads;
     read(path: string, options?: LogReadOptions): Promise<LogReadResult>;
     exists(path: string): Promise<boolean>;
     list(prefix: string): Promise<string[]>;
+    listWithMetadata(prefix: string): Promise<Array<{
+        path: string;
+        lastModified: Date;
+    }>>;
+    deleteMany(paths: string[]): Promise<number>;
 }
 export {};
 //# sourceMappingURL=s3-log-storage.d.ts.map

package/dist/routes/admin-auth.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Shared Bearer-token auth middleware for the orchestrator's admin routes.
+ *
+ * One factory serves every DB-backed admin router, which is what makes the
+ * error boundary universal: a router that forgets to wrap `validate()` cannot
+ * exist, because no router writes that call itself.
+ *
+ * Three outcomes, deliberately distinct:
+ *   - header absent / not `Bearer <token>`   -> 401 AUTH_ERROR.missing
+ *   - token unknown / revoked / expired      -> 401 AUTH_ERROR.invalid
+ *   - validation could not be completed      -> 503 AUTH_ERROR.unavailable
+ *
+ * The third is the reason this file exists. `validate()` returns `null` for a
+ * bad credential, so it only throws when the lookup itself fails (unreachable
+ * DB, exhausted pool, failover). That is not the caller's fault and is not a
+ * bug in this request: the server cannot authenticate anyone right now, which
+ * is what 503 means. It also keeps a DB blip out of the 5xx error-rate signal
+ * that alerting reads as an application outage.
+ *
+ * The boundary fails closed: an unresolvable auth decision is a rejection with
+ * a 5xx, never a fall-through to the protected handler.
+ */
+import type { Context, MiddlewareHandler } from 'hono';
+import type { Role } from '../secrets/rbac.js';
+/**
+ * The three admin-auth response bodies.
+ *
+ * A single map rather than string literals repeated across every admin router:
+ * the 401 wordings are observed by operators and by E2E assertions, so they are
+ * pinned in exactly one place.
+ */
+export declare const AUTH_ERROR: {
+    readonly missing: 'Missing authorization';
+    readonly invalid: 'Invalid or expired token';
+    readonly unavailable: 'Authentication unavailable';
+};
+/** What a successful admin-token validation yields. */
+export interface AuthTokenInfo {
+    id: string;
+    role: Role;
+    routingKey: string | null;
+    label: string;
+}
+/** The slice of TokenManager this middleware needs (keeps tests trivial to fake). */
+export interface AuthTokenValidator {
+    validate(token: string): Promise<AuthTokenInfo | null>;
+}
+/**
+ * The result of resolving one `Authorization` header.
+ *
+ * Failures carry the status and body rather than a `Response` so a caller that
+ * is not a middleware (the inline run-cancel route on the coordinator app) can
+ * answer with the identical shape.
+ */
+export type BearerAuthOutcome = {
+    ok: true;
+    tokenInfo: AuthTokenInfo;
+} | {
+    ok: false;
+    status: 401 | 503;
+    error: string;
+};
+export interface BearerAuthDeps {
+    tokenManager: AuthTokenValidator;
+    /** Route-family label recorded on the 503 log line (e.g. 'admin-runs'). */
+    scope: string;
+    /** Overridable for tests; defaults to the module logger. */
+    logger?: {
+        error(msg: string, meta?: Record<string, unknown>): void;
+    };
+}
+/**
+ * Resolve one request's `Authorization` header into an authenticated token or
+ * a rejection. This is the boundary itself; the middleware below is a thin
+ * wrapper so a route that needs the token info inline can share it.
+ *
+ * @param c - The request context (only the header, method, and path are read).
+ * @param deps - Token validator, a scope label for logs, and an optional logger.
+ * @returns The token info, or the status + body to answer with.
+ */
+export declare function resolveBearerAuth(c: Context<any>, deps: BearerAuthDeps): Promise<BearerAuthOutcome>;
+/**
+ * Build the bearer-auth middleware for one admin route family.
+ *
+ * @param deps - Token validator, a scope label for logs, and an optional logger.
+ * @returns A Hono middleware that authenticates or rejects; it never calls
+ *   `next()` on an unresolved credential.
+ */
+export declare function createBearerAuthMiddleware(deps: BearerAuthDeps): MiddlewareHandler<any>;
+//# sourceMappingURL=admin-auth.d.ts.map

package/dist/routes/admin-cluster-settings.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Admin API routes for cluster-global (fleet-wide) orchestrator tunables.
+ *
+ * Exposes GET / PATCH `/api/v1/admin/cluster-settings` so `kici-admin
+ * cluster-settings` can read and write the single `cluster_settings` row
+ * (id='default') without going through the Platform dashboard proxy — the CLI
+ * stays operable even when Platform is unavailable.
+ *
+ * These knobs are fleet-wide, not per-tenant, so the route is deliberately NOT
+ * under `/orgs/:customerId/*`. Mutations require the `secret.write` RBAC
+ * capability (already granted to admin / owner roles), matching the gating
+ * posture used by `admin-org-settings.ts`.
+ */
+import { Hono } from 'hono';
+import { type Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+interface ClusterSettingsRouteDeps {
+    db: Kysely<Database>;
+    rbac: RbacEnforcer;
+}
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+        routingKey: string | null;
+    };
+};
+export declare function createClusterSettingsRoutes(deps: ClusterSettingsRouteDeps): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-cluster-settings.d.ts.map

package/dist/routes/admin-events.d.ts

@@ -16,6 +16,7 @@ import type { RbacEnforcer, Role } from '../secrets/rbac.js';
 import type { AppConfig } from '../config.js';
 import type { ProviderRegistry } from '../provider-registry.js';
 import type { SecretResolver } from '../secrets/secret-resolver.js';
+import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
 /**
  * Dependencies for admin event routes.
  */
@@ -38,6 +39,8 @@ interface AdminEventRouteDeps {
     /** Required for universal-git source registration — `null` is allowed;
      *  rows with `git_config` are skipped + metric-bumped in that case. */
     secretResolver: SecretResolver | null;
+    /** Fleet-wide settings reader; threads the live lock-file cap into newly-registered universal-git sources. */
+    clusterSettings?: ClusterSettingsReader;
     /**
      * Optional — when provided, the `POST /api/v1/admin/events/emit` route is
      * mounted so operators can INSERT into `kici_events` + `pg_notify` via HTTP.

package/dist/routes/admin-orchestrator-drain.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Orchestrator drain admin routes.
+ *
+ * Backs the `kici-admin orchestrator drain` / `resume` / `drain --status`
+ * verbs used to quiesce a coordinator before an upgrade. Mounted inside
+ * `createAdminRoutes` at `/api/v1/admin/orchestrator/drain`, so it inherits the
+ * Bearer-token auth middleware (which resolves the caller's role) and gates on
+ * the `orchestrator.drain` RBAC permission (owner + admin).
+ *
+ * - `GET  /api/v1/admin/orchestrator/drain` → current `{ draining, jobsRunning }`.
+ * - `POST /api/v1/admin/orchestrator/drain { action: 'drain' | 'resume' }` →
+ *   flips the drain flag and returns the new snapshot.
+ */
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { DrainController } from '../drain/drain-controller.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+export declare const DrainActionSchema: z.ZodEnum<{
+    drain: "drain";
+    resume: "resume";
+}>;
+export type DrainAction = z.infer<typeof DrainActionSchema>;
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+        routingKey: string | null;
+    };
+};
+export declare function createOrchestratorDrainRoutes(deps: {
+    drainController: DrainController;
+    rbac: RbacEnforcer;
+}): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-orchestrator-drain.d.ts.map

package/dist/routes/admin-runs.d.ts

@@ -25,6 +25,15 @@ import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { LogStorage } from '../reporting/log-storage.js';
+/**
+ * Statuses accepted by the `?status=` filter.
+ *
+ * The full canonical union rather than just `ExecutionRunStatus.options`: only
+ * run statuses can appear in `execution_runs.status`, but the job-only members
+ * were accepted before and simply match no row, so keeping them avoids turning
+ * an empty result into a rejected request.
+ */
+export declare const RUN_STATUSES: ReadonlySet<string>;
 /**
  * Dependencies for admin run routes.
  */

package/dist/routes/admin-sources.d.ts

@@ -9,6 +9,7 @@
  * the admin auth middleware in admin.ts.
  */
 import { Hono } from 'hono';
+import { OrchestratorMode } from '@kici-dev/engine';
 import type { SourceStore } from '../sources/source-store.js';
 import type { Role } from '../secrets/rbac.js';
 import { type FetchGithubAppIdentity } from '../github-app-name-refresher/github-app-name-refresher.js';
@@ -46,6 +47,12 @@ interface SourceRouteDeps {
      * `source refresh` route.
      */
     fetchAppIdentity?: FetchGithubAppIdentity;
+    /**
+     * Orchestrator operating mode. `observed` refuses GitHub-App source creation:
+     * those sources are ingested through the Platform relay, and an observed
+     * orchestrator never accepts a relay. Omitted (undefined) behaves as before.
+     */
+    mode?: OrchestratorMode;
 }
 type AdminSourcesEnv = {
     Variables: {

package/dist/routes/admin-trust-policy.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Admin API routes for the org trust policy.
+ *
+ * Exposes GET / PATCH `/api/v1/admin/trust-policy` so `kici-admin` can read the
+ * enforced policy and, on an independent orchestrator, set it.
+ *
+ * The policy is Platform-owned wherever a Platform is attached: the Platform
+ * pushes it on `trust_policy.update` and the next push would clobber a local
+ * write. PATCH therefore refuses on any Platform-attached orchestrator, and the
+ * refusal is server-side so it cannot be bypassed by calling the API directly.
+ */
+import { Hono } from 'hono';
+import type { OrchestratorMode } from '@kici-dev/engine';
+import type { TrustPolicyStore } from '../security/trust-policy-store.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { AccessLogWriter } from '../audit/access-log.js';
+/**
+ * Wording for the Platform-managed refusal. Shared with the CLI through the
+ * response body — the CLI surfaces this verbatim rather than inventing its own.
+ */
+export declare const PLATFORM_MANAGED_MESSAGE: string;
+interface TrustPolicyRouteDeps {
+    store: TrustPolicyStore;
+    rbac: RbacEnforcer;
+    /** This orchestrator's mode; decides whether PATCH is permitted at all. */
+    mode: OrchestratorMode;
+    /**
+     * Audit sink for the PATCH, written inside the policy transaction.
+     *
+     * REQUIRED, not optional. The guarantee this route makes is that a loosened
+     * `forkPolicy` can never land unattributed; an optional sink would leave that
+     * resting on every construction site remembering to pass one, and a route
+     * built without one would accept the write and silently skip the audit. A
+     * required dependency moves the guarantee from convention to the compiler —
+     * and `admin.ts` skips mounting the route entirely rather than mounting an
+     * unauditable one.
+     */
+    accessLog: AccessLogWriter;
+}
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+        routingKey: string | null;
+    };
+};
+export declare function createTrustPolicyRoutes(deps: TrustPolicyRouteDeps): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-trust-policy.d.ts.map

package/dist/routes/admin.d.ts

@@ -16,11 +16,12 @@ import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { AgentTokenStore } from '../agent/token-store.js';
 import type { AgentRegistry } from '../agent/registry.js';
 import type { SharedConfigStore } from '../config/shared-store.js';
+import type { DrainController } from '../drain/drain-controller.js';
 import type { SourceStore } from '../sources/source-store.js';
 import type { JoinTokenManager } from '../cluster/join-token.js';
 import type { BackendRegistry } from '../secrets/backend-registry.js';
 import type { BackendHealthChecker } from '../secrets/backend-health.js';
-import type { BackendSyncManager } from '@kici-dev/engine';
+import type { BackendSyncManager, OrchestratorMode } from '@kici-dev/engine';
 import type { Kysely } from 'kysely';
 import type pg from 'pg';
 import type { AccessLogWriter } from '../audit/access-log.js';
@@ -29,9 +30,22 @@ import type { AccessLogWriter } from '../audit/access-log.js';
  */
 export interface AdminRouteDeps {
     tokenManager: TokenManager;
+    /**
+     * Orchestrator operating mode. Gates mode-specific admin behavior — today the
+     * `observed`-mode refusal of GitHub-App source creation (those sources are
+     * Platform-relayed by nature, and an observed orchestrator never accepts a
+     * relay). Optional so WS-only / test admins can omit it.
+     */
+    mode?: OrchestratorMode;
     rbac: RbacEnforcer;
     secretStore: PgSecretStore;
     auditLogger: AuditLogger;
+    /**
+     * Optional -- the coordinator drain controller. When provided, the
+     * `POST`/`GET /api/v1/admin/orchestrator/drain` routes are mounted (backing
+     * the `kici-admin orchestrator drain` verbs). Omitted on WS-only admins.
+     */
+    drainController?: DrainController;
     /** Optional -- for agent token CRUD endpoints. */
     tokenStore?: AgentTokenStore;
     /**

package/dist/routes/github-webhook.d.ts

@@ -1,6 +1,8 @@
 import { Hono } from 'hono';
+import type { OrchestratorMode } from '@kici-dev/engine';
 import type { WebhookInfo } from '../webhook/handler.js';
 import type { SourceStore } from '../sources/source-store.js';
+import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
 import { type VerifyInboundDeps } from '../webhook/verify-inbound.js';
 import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
 /** Dependencies for the direct GitHub webhook ingress route. */
@@ -11,13 +13,17 @@ export interface GithubWebhookRoutesDeps {
     verifyDeps: VerifyInboundDeps;
     /** Pipeline entry — owns the atomic dedup claim + dispatch. */
     onWebhook: (info: WebhookInfo) => Promise<WebhookIngestOutcome>;
+    /** Fleet-wide settings reader; overrides the payload cap per request. */
+    clusterSettings?: ClusterSettingsReader;
+    /** Cluster default payload cap (bytes) when no cluster_settings override is set. */
+    maxGithubPayloadBytes?: number;
 }
 /**
  * Whether the orchestrator serves the direct GitHub ingress route for a given
- * operating mode. Hybrid and independent modes serve a local GitHub source
- * config; platform mode is relay-only (no local GitHub source to serve).
+ * operating mode. Hybrid, independent, and observed modes serve their own
+ * ingress; platform mode is relay-only (no local GitHub source to serve).
  */
-export declare function shouldServeGithubIngress(mode: 'platform' | 'hybrid' | 'independent'): boolean;
+export declare function shouldServeGithubIngress(mode: OrchestratorMode): boolean;
 /**
  * Direct GitHub-App webhook ingress: `POST /webhook/:orgId/github/:sourceId`.
  *

package/dist/routes/provenance-oidc.d.ts

@@ -0,0 +1,38 @@
+import { Hono } from 'hono';
+import type { OrchestratorSigningKeyRepo } from '../db/repos/signing-keys-repo.js';
+import type { DashboardEncryptionKeyRepo } from '../db/repos/dashboard-encryption-keys-repo.js';
+/** OIDC discovery document for the orchestrator provenance issuer. */
+export interface OpenidConfiguration {
+    issuer: string;
+    jwks_uri: string;
+    id_token_signing_alg_values_supported: string[];
+    response_types_supported: string[];
+    subject_types_supported: string[];
+    claims_supported: string[];
+}
+/** Build the `/.well-known/openid-configuration` document for the orchestrator issuer. */
+export declare function buildOpenidConfiguration(issuer: string): OpenidConfiguration;
+export interface ProvenanceOidcRoutesDeps {
+    /** The orchestrator's own provenance issuer (config.provenanceSigningIssuer). */
+    issuer: string | undefined;
+    repo: Pick<OrchestratorSigningKeyRepo, 'listTrusted'>;
+    /** Whether orchestrator-owned signing is configured. */
+    enabled: boolean;
+    /**
+     * Dashboard-encryption key repo. When present, the JWKS additionally serves
+     * the non-revoked X25519 `use:'enc'` key(s) for browser-sealed dashboard
+     * writes (the Verified tier's trust root). Independent of provenance signing.
+     */
+    dashboardEncryptionRepo?: Pick<DashboardEncryptionKeyRepo, 'listNonRevoked'>;
+}
+/**
+ * Public, unauthenticated OIDC discovery + JWKS endpoints for the orchestrator
+ * provenance issuer. Serves ONLY the public key halves (safe to expose).
+ *
+ * The discovery document returns 503 when orchestrator-owned signing is not
+ * configured. The JWKS does not: it also carries the X25519 dashboard-encryption
+ * key, which is unrelated to build attestations, and returns 503 only when there
+ * is no key of either kind to publish.
+ */
+export declare function createProvenanceOidcRoutes(deps: ProvenanceOidcRoutesDeps): Hono;
+//# sourceMappingURL=provenance-oidc.d.ts.map

package/dist/routes/verify-attestation.d.ts

@@ -0,0 +1,21 @@
+import { Hono } from 'hono';
+import type { OrchestratorSigningKeyRepo } from '../db/repos/signing-keys-repo.js';
+export interface VerifyAttestationRoutesDeps {
+    /** The orchestrator's own provenance issuer (config.provenanceSigningIssuer). */
+    issuer: string | undefined;
+    repo: Pick<OrchestratorSigningKeyRepo, 'listTrusted'>;
+    /** Whether orchestrator-owned signing is configured. */
+    enabled: boolean;
+}
+/**
+ * Native online verify endpoint: a third party POSTs a bundle and the
+ * orchestrator verifies it against its LIVE key set (fresh rotations /
+ * revocations included), returning a structured verdict. No Platform involved.
+ *
+ * The token `iss` is ALWAYS pinned out-of-band to the orchestrator's configured
+ * issuer — the bundle can never name its own trusted issuer. Never throws on a
+ * verification failure (returns `verified:false`); the shared engine core owns
+ * all crypto (ES256 pinned; no alg-confusion / alg:none).
+ */
+export declare function createVerifyAttestationRoutes(deps: VerifyAttestationRoutesDeps): Hono;
+//# sourceMappingURL=verify-attestation.d.ts.map

package/dist/scaler/bare-metal-backend.d.ts

@@ -7,7 +7,7 @@
  */
 import { type ToolRequirement } from '@kici-dev/shared';
 import type { AgentTokenStore } from '../agent/token-store.js';
-import type { ScalerBackend, ScalerEntry, ManagedAgent, LabelSetConfig, LogCapture, ResourceRequest, ScalerEventCallback, ValidationResult, EffectiveLimits } from './types.js';
+import type { ScalerBackend, ScalerEntry, ManagedAgent, LabelSetConfig, LogCapture, ResourceRequest, ScalerEventCallback, ValidationResult, EffectiveLimits, SpawnContext } from './types.js';
 export interface BareMetalScalerBackendOptions {
     /** Human-readable name for this scaler */
     name: string;
@@ -21,6 +21,12 @@ export interface BareMetalScalerBackendOptions {
     tokenStore?: AgentTokenStore;
     /** TTL for ephemeral agent tokens in ms. Default: 1 hour. */
     tokenTtlMs?: number;
+    /**
+     * Live resolver for the ephemeral agent-token TTL (ms). When set, called per
+     * spawn so the leader can serve the fleet-wide
+     * `cluster_settings.agent_token_ttl_ms` override; falls back to `tokenTtlMs`.
+     */
+    tokenTtlProvider?: () => Promise<number>;
     /** Agent roles for this scaler. undefined = all, [] = execution only. */
     roles?: string[];
     /**
@@ -47,6 +53,7 @@ export declare class BareMetalScalerBackend implements ScalerBackend {
     private readonly defaultResources?;
     private readonly tokenStore?;
     private readonly tokenTtlMs;
+    private readonly tokenTtlProvider?;
     private readonly roles;
     private readonly enforceCgroups;
     /** Tracks all managed agent processes */
@@ -72,7 +79,7 @@ export declare class BareMetalScalerBackend implements ScalerBackend {
     static getRequiredTools(entry: ScalerEntry): ToolRequirement[];
     get labelSets(): LabelSetConfig[];
     getActiveCount(): number;
-    spawn(labelSet: string[], agentId: string, orchestratorUrl: string, onEvent?: ScalerEventCallback, effectiveLimits?: EffectiveLimits): Promise<ManagedAgent>;
+    spawn(labelSet: string[], agentId: string, orchestratorUrl: string, onEvent?: ScalerEventCallback, effectiveLimits?: EffectiveLimits, _spawnContext?: SpawnContext, _signal?: AbortSignal): Promise<ManagedAgent>;
     getScalerContext(agentId: string): Record<string, unknown> | undefined;
     destroy(managedId: string): Promise<void>;
     /**