@kici-dev/orchestrator 0.1.5 → 0.1.7

package/dist/server.js

@@ -135,7 +135,7 @@ var init_verification = __esmMin((() => {}));
 //#endregion
 //#region src/webhook/verify-inbound.ts
 init_verification();
-const logger$96 = createLogger({ prefix: "verify-inbound" });
+const logger$97 = createLogger({ prefix: "verify-inbound" });
 /** Fixed org_id for source secrets in PgSecretStore (matches SourceStore). */
 const SOURCE_ORG_ID$1 = "__system__";
 /** Default GitHub-style signature header. */
@@ -151,7 +151,7 @@ async function verifyInboundWebhook(deps, input) {
 	const { routingKey } = input;
 	if (routingKey.startsWith("github:")) return verifyGithub(deps, input);
 	if (routingKey.startsWith("generic:")) return verifyGeneric(deps, input);
-	logger$96.warn("Unknown routing-key prefix", { routingKey });
+	logger$97.warn("Unknown routing-key prefix", { routingKey });
 	return {
 		result: "rejected_unknown_source",
 		reason: `provider not implemented for routing key prefix`
@@ -177,7 +177,7 @@ async function verifyGithub(deps, input) {
 	try {
 		secrets = await getGithubWebhookSecrets(secretStore, source.id);
 	} catch (err) {
-		logger$96.error("Failed to read webhook secret from PgSecretStore", {
+		logger$97.error("Failed to read webhook secret from PgSecretStore", {
 			routingKey,
 			sourceId: source.id,
 			error: toErrorMessage(err)
@@ -227,7 +227,7 @@ async function verifyGeneric(deps, input) {
 	try {
 		config = parseGenericVerificationConfig(source.verification_method, source.verification_config);
 	} catch (err) {
-		logger$96.error("Malformed verification_config JSON", {
+		logger$97.error("Malformed verification_config JSON", {
 			routingKey,
 			method: source.verification_method,
 			error: toErrorMessage(err)
@@ -380,6 +380,15 @@ var init_config$5 = __esmMin((() => {
 		* behavior). Trailing slash optional.
 		*/
 		dashboardUrl: z.string().optional(),
+		/**
+		* Public base URL at which this orchestrator's own webhook ingress is
+		* reachable (independent/hybrid self-serve generic webhooks:
+		* `<base>/webhook/<customerId>/generic/<sourceId>`). Used by
+		* `kici-admin source add` to print a generic source's webhook URL. GitHub-App
+		* ingress is Platform-relayed, so GitHub URLs come from the Platform's
+		* `source.register.ack`, not this value. Trailing slash optional.
+		*/
+		webhookPublicUrl: z.string().optional(),
 		databaseUrl: z.string().default(""),
 		lockfileCacheMax: z.coerce.number().default(500),
 		lockfileCacheTtlMs: z.coerce.number().default(36e5),
@@ -572,6 +581,7 @@ var init_config$5 = __esmMin((() => {
 			platformUrl: "KICI_PLATFORM_URL",
 			platformToken: "KICI_PLATFORM_TOKEN",
 			dashboardUrl: "KICI_DASHBOARD_URL",
+			webhookPublicUrl: "KICI_WEBHOOK_PUBLIC_URL",
 			databaseUrl: "KICI_DATABASE_URL",
 			cacheStorageType: "KICI_STORAGE_TYPE",
 			cacheStoragePath: "KICI_STORAGE_PATH",
@@ -731,9 +741,9 @@ var init_event_buffer = __esmMin((() => {
 * `rejected_misconfigured` ack. This keeps the WS handler inside its 5 s budget
 * and prevents a malicious sender from killing the orch process via a bad frame.
 */
-var logger$95, DEFAULT_BUFFER_TTL_MS, RelayBufferRegistry;
+var logger$96, DEFAULT_BUFFER_TTL_MS, RelayBufferRegistry;
 var init_relay_buffer = __esmMin((() => {
-	logger$95 = createLogger({ prefix: "relay-buffer" });
+	logger$96 = createLogger({ prefix: "relay-buffer" });
 	DEFAULT_BUFFER_TTL_MS = 3e4;
 	RelayBufferRegistry = class {
 		buffers = /* @__PURE__ */ new Map();
@@ -767,7 +777,7 @@ var init_relay_buffer = __esmMin((() => {
 			};
 			const ttl = setTimeout(() => {
 				this.buffers.delete(messageId);
-				logger$95.warn("Reassembly buffer TTL expired before final chunk", {
+				logger$96.warn("Reassembly buffer TTL expired before final chunk", {
 					messageId,
 					deliveryId: meta.deliveryId,
 					receivedChunks: this.buffers.get(messageId)?.expectedSequence ?? 0
@@ -902,11 +912,11 @@ function toSourceRegistrationEntry(source) {
 		subtype: source.subtype
 	};
 }
-var logger$94, PlatformClient$1;
+var logger$95, PlatformClient$1;
 var init_platform_client = __esmMin((() => {
 	init_event_buffer();
 	init_relay_buffer();
-	logger$94 = createLogger({ prefix: "platform-client" });
+	logger$95 = createLogger({ prefix: "platform-client" });
 	PlatformClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -919,6 +929,12 @@ var init_platform_client = __esmMin((() => {
 		token;
 		onWebhookRelay;
 		providerSources;
+		/**
+		* Pending `registerSourceAndAwait()` callers, keyed by routing key. Resolved
+		* with the Platform-computed webhook URL when the matching
+		* `source.register.ack` arrives, or rejected on timeout / disconnect.
+		*/
+		pendingSourceRegistrations = /* @__PURE__ */ new Map();
 		instanceId;
 		clusterName;
 		clusterId;
@@ -961,7 +977,7 @@ var init_platform_client = __esmMin((() => {
 		/**
 		* Returns the cached public alias of the orchestrator's owning org,
 		* or `undefined` if Platform has not supplied one yet. Read by
-		* `commit-status.ts` when building `details_url`.
+		* `check-run-reporter.ts` when building `details_url`.
 		*/
 		getOrgPublicAlias() {
 			return this._orgPublicAlias;
@@ -1048,7 +1064,7 @@ var init_platform_client = __esmMin((() => {
 		*/
 		async completeChunkedRelay(messageId, meta, body) {
 			if (!this.onVerifyInbound) {
-				logger$94.error("Chunked webhook.relay received but no onVerifyInbound configured", {
+				logger$95.error("Chunked webhook.relay received but no onVerifyInbound configured", {
 					messageId,
 					deliveryId: meta.deliveryId
 				});
@@ -1063,7 +1079,7 @@ var init_platform_client = __esmMin((() => {
 			}
 			const outcome = await this.onVerifyInbound(meta, body);
 			if (outcome.result !== "accepted") {
-				logger$94.warn("Chunked webhook.relay verify rejected", {
+				logger$95.warn("Chunked webhook.relay verify rejected", {
 					messageId,
 					deliveryId: meta.deliveryId,
 					routingKey: meta.routingKey,
@@ -1084,7 +1100,7 @@ var init_platform_client = __esmMin((() => {
 			if (contentType.includes("application/json") || contentType === "") try {
 				payload = body.length === 0 ? {} : JSON.parse(body.toString("utf8"));
 			} catch (err) {
-				logger$94.warn("Accepted webhook body is not valid JSON; rejecting", {
+				logger$95.warn("Accepted webhook body is not valid JSON; rejecting", {
 					messageId,
 					deliveryId: meta.deliveryId,
 					error: toErrorMessage(err)
@@ -1119,7 +1135,7 @@ var init_platform_client = __esmMin((() => {
 				...meta.requestId && { requestId: meta.requestId }
 			};
 			this.onWebhookRelay(relay).catch((err) => {
-				logger$94.error("Error processing chunked webhook relay", {
+				logger$95.error("Error processing chunked webhook relay", {
 					messageId,
 					deliveryId: meta.deliveryId,
 					error: toErrorMessage(err)
@@ -1132,7 +1148,7 @@ var init_platform_client = __esmMin((() => {
 		*/
 		connect() {
 			if (this._state !== "disconnected") {
-				logger$94.warn("connect() called while not disconnected", { state: this._state });
+				logger$95.warn("connect() called while not disconnected", { state: this._state });
 				return;
 			}
 			this.intentionalDisconnect = false;
@@ -1226,7 +1242,9 @@ var init_platform_client = __esmMin((() => {
 				...this.address !== void 0 && { address: this.address },
 				...this.version && { version: this.version },
 				...this.mode && { mode: this.mode },
-				...this.scalerBackends && { scalerBackends: this.scalerBackends }
+				...this.scalerBackends && { scalerBackends: this.scalerBackends },
+				...this.s3LogAccess !== void 0 && { s3LogAccess: this.s3LogAccess },
+				...this.queueTimeoutMs && { queueTimeoutMs: this.queueTimeoutMs }
 			});
 			else if (newSources.length === 0 && this.providerSources.length > 0) this.send({
 				type: "source.register",
@@ -1245,6 +1263,50 @@ var init_platform_client = __esmMin((() => {
 			this.providerSources.length = 0;
 			this.providerSources.push(...newSources);
 		}
+		/**
+		* Push the full source list to the Platform and resolve with the webhook URL
+		* the Platform computed for `routingKey` (from the `source.register.ack`), or
+		* `null` if the Platform has no public webhook base configured.
+		*
+		* Used by `kici-admin source add` (platform/hybrid mode) to print the URL
+		* synchronously. Passing the **full** source list keeps this on the single
+		* `updateSources` push path — the routing key being newly added means
+		* `updateSources` emits a `source.register` whose ack carries the URL; the
+		* later NOTIFY-driven republish then diffs to a no-op.
+		*
+		* Rejects on timeout or disconnect; the caller degrades to a "(unavailable)"
+		* note rather than fabricating a URL.
+		*/
+		registerSourceAndAwait(fullSources, routingKey, timeoutMs = 5e3) {
+			return new Promise((resolve, reject) => {
+				const existing = this.pendingSourceRegistrations.get(routingKey);
+				if (existing) {
+					clearTimeout(existing.timer);
+					existing.reject(/* @__PURE__ */ new Error("superseded by a newer registration"));
+				}
+				const timer = setTimeout(() => {
+					this.pendingSourceRegistrations.delete(routingKey);
+					reject(/* @__PURE__ */ new Error(`timed out waiting for source.register.ack for ${routingKey}`));
+				}, timeoutMs);
+				this.pendingSourceRegistrations.set(routingKey, {
+					resolve,
+					reject,
+					timer
+				});
+				this.updateSources(fullSources);
+			});
+		}
+		/**
+		* Reject every pending `registerSourceAndAwait()` — called on disconnect so a
+		* `source add` issued while the link drops fails fast instead of hanging.
+		*/
+		rejectPendingSourceRegistrations(reason) {
+			for (const [, pending] of this.pendingSourceRegistrations) {
+				clearTimeout(pending.timer);
+				pending.reject(new Error(reason));
+			}
+			this.pendingSourceRegistrations.clear();
+		}
 		getReconnectDelay() {
 			return getReconnectDelay(this.reconnectAttempts, this.maxReconnectDelayMs);
 		}
@@ -1259,14 +1321,14 @@ var init_platform_client = __esmMin((() => {
 					}
 				});
 			} catch (err) {
-				logger$94.error("Failed to create WebSocket", { error: toErrorMessage(err) });
+				logger$95.error("Failed to create WebSocket", { error: toErrorMessage(err) });
 				this._state = "disconnected";
 				this.scheduleReconnect();
 				return;
 			}
 			this.ws.on("open", () => {
 				this._state = "authenticating";
-				logger$94.info("Connected to Platform, sending auth request", { url: this.url });
+				logger$95.info("Connected to Platform, sending auth request", { url: this.url });
 				this.ws.send(JSON.stringify({
 					type: "auth.request",
 					token: this.token,
@@ -1279,16 +1341,17 @@ var init_platform_client = __esmMin((() => {
 			});
 			this.ws.on("close", (code, reason) => {
 				const reasonText = reason.toString();
-				logger$94.info("Platform connection closed", {
+				logger$95.info("Platform connection closed", {
 					code,
 					reason: reasonText
 				});
 				this._state = "disconnected";
 				this.stopHeartbeat();
+				this.rejectPendingSourceRegistrations("Platform connection closed before ack");
 				if (!this.intentionalDisconnect) this.scheduleReconnect();
 			});
 			this.ws.on("error", (err) => {
-				logger$94.error("Platform WebSocket error", { error: err.message });
+				logger$95.error("Platform WebSocket error", { error: err.message });
 				if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 			});
 		}
@@ -1297,7 +1360,7 @@ var init_platform_client = __esmMin((() => {
 			try {
 				raw = JSON.parse(data.toString());
 			} catch {
-				logger$94.warn("Malformed JSON received from Platform");
+				logger$95.warn("Malformed JSON received from Platform");
 				return;
 			}
 			const parsed = platformToOrchestratorMessageSchema.safeParse(raw);
@@ -1324,11 +1387,11 @@ var init_platform_client = __esmMin((() => {
 				this.onJoinRequest(joinParsed.data).then((response) => {
 					this.sendRaw(response);
 				}).catch((err) => {
-					logger$94.error("Error handling join request", { error: toErrorMessage(err) });
+					logger$95.error("Error handling join request", { error: toErrorMessage(err) });
 				});
 				return;
 			}
-			logger$94.warn("Invalid message from Platform", { errors: primaryIssues });
+			logger$95.warn("Invalid message from Platform", { errors: primaryIssues });
 		}
 		/**
 		* Dispatch a parsed platform message to the appropriate per-area
@@ -1354,7 +1417,7 @@ var init_platform_client = __esmMin((() => {
 					this.handleSourceRegisterAck(msg);
 					break;
 				case "source.deregister.ack":
-					logger$94.info("Source deregistration acknowledged", { removed: msg.removed });
+					logger$95.info("Source deregistration acknowledged", { removed: msg.removed });
 					break;
 				case "peer.discover":
 					this.handlePeerDiscover(msg);
@@ -1363,14 +1426,14 @@ var init_platform_client = __esmMin((() => {
 					this.handlePeerUpdate(msg);
 					break;
 				case "dashboard.run.detail":
-					logger$94.debug("Dashboard run detail request received", {
+					logger$95.debug("Dashboard run detail request received", {
 						requestId: msg.requestId,
 						runId: msg.runId
 					});
 					this.onDashboardRunDetail?.(msg);
 					break;
 				case "dashboard.step.logs":
-					logger$94.debug("Dashboard step logs request received", {
+					logger$95.debug("Dashboard step logs request received", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						jobId: msg.jobId,
@@ -1379,7 +1442,7 @@ var init_platform_client = __esmMin((() => {
 					this.onDashboardStepLogs?.(msg);
 					break;
 				case "run.rerun.request":
-					logger$94.info("Run rerun request received", {
+					logger$95.info("Run rerun request received", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						actor: msg.actor
@@ -1387,7 +1450,7 @@ var init_platform_client = __esmMin((() => {
 					this.onRunRerun?.(msg);
 					break;
 				case "run.manual_schedule.request":
-					logger$94.info("Manual schedule request received", {
+					logger$95.info("Manual schedule request received", {
 						requestId: msg.requestId,
 						registrationId: msg.registrationId,
 						actor: msg.actor
@@ -1395,7 +1458,7 @@ var init_platform_client = __esmMin((() => {
 					this.onManualSchedule?.(msg);
 					break;
 				case "run.cancel.request":
-					logger$94.info("Run cancel request received", {
+					logger$95.info("Run cancel request received", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						actor: msg.actor
@@ -1403,14 +1466,14 @@ var init_platform_client = __esmMin((() => {
 					this.onRunCancel?.(msg);
 					break;
 				case "dashboard.payload":
-					logger$94.debug("Dashboard payload request received", {
+					logger$95.debug("Dashboard payload request received", {
 						requestId: msg.requestId,
 						runId: msg.runId
 					});
 					this.onDashboardPayload?.(msg);
 					break;
 				case "dashboard.orch.logs":
-					logger$94.debug("Dashboard orchestration logs request received", {
+					logger$95.debug("Dashboard orchestration logs request received", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						jobId: msg.jobId
@@ -1418,30 +1481,30 @@ var init_platform_client = __esmMin((() => {
 					this.onDashboardOrchLogs?.(msg);
 					break;
 				case "trust_policy.update":
-					logger$94.info("Trust policy updated", { orgId: msg.orgId });
+					logger$95.info("Trust policy updated", { orgId: msg.orgId });
 					this.onTrustPolicyUpdate?.(msg);
 					break;
 				case "stale.checkrun.cleanup":
-					logger$94.info("Stale check run cleanup request received", { runCount: msg.runs.length });
+					logger$95.info("Stale check run cleanup request received", { runCount: msg.runs.length });
 					this.onStaleCheckrunCleanup?.(msg);
 					break;
 				case "dashboard.diagnostics":
-					logger$94.debug("Dashboard diagnostics request received", { requestId: msg.requestId });
+					logger$95.debug("Dashboard diagnostics request received", { requestId: msg.requestId });
 					this.onDashboardDiagnostics?.(msg);
 					break;
 				case "dashboard.scaler.capacity":
-					logger$94.debug("Dashboard scaler capacity request received", { requestId: msg.requestId });
+					logger$95.debug("Dashboard scaler capacity request received", { requestId: msg.requestId });
 					this.onDashboardScalerCapacity?.(msg);
 					break;
 				case "dashboard.scaler.agents":
-					logger$94.debug("Dashboard scaler agents request received", {
+					logger$95.debug("Dashboard scaler agents request received", {
 						requestId: msg.requestId,
 						scalerName: msg.scalerName
 					});
 					this.onDashboardScalerAgents?.(msg);
 					break;
 				case "dashboard.access-log.list":
-					logger$94.debug("Dashboard access-log list request received", {
+					logger$95.debug("Dashboard access-log list request received", {
 						requestId: msg.requestId,
 						orgId: msg.orgId
 					});
@@ -1487,19 +1550,19 @@ var init_platform_client = __esmMin((() => {
 				case "dashboard.backends.test":
 				case "dashboard.global-workflows.get":
 				case "dashboard.global-workflows.update":
-					logger$94.debug("Dashboard environment message received", {
+					logger$95.debug("Dashboard environment message received", {
 						type: msg.type,
 						requestId: msg.requestId
 					});
 					this.onDashboardEnvMessage?.(msg);
 					break;
 				default:
-					logger$94.warn("Unknown platform message type", { type: msg.type });
+					logger$95.warn("Unknown platform message type", { type: msg.type });
 					break;
 			}
 		}
 		handleAuthSuccess(msg) {
-			logger$94.info("Authenticated with Platform", {
+			logger$95.info("Authenticated with Platform", {
 				connectionId: msg.connectionId,
 				orgPublicAlias: msg.orgPublicAlias
 			});
@@ -1521,7 +1584,7 @@ var init_platform_client = __esmMin((() => {
 				...this.s3LogAccess !== void 0 && { s3LogAccess: this.s3LogAccess },
 				...this.queueTimeoutMs && { queueTimeoutMs: this.queueTimeoutMs }
 			});
-			logger$94.info("Sent source.register", {
+			logger$95.info("Sent source.register", {
 				sources: this.providerSources.map((s) => s.routingKey),
 				instanceId: this.instanceId,
 				scalerBackends: this.scalerBackends ?? null
@@ -1529,7 +1592,7 @@ var init_platform_client = __esmMin((() => {
 			this.flushBuffer();
 		}
 		handleAuthFailure(msg) {
-			logger$94.error("Platform auth failed", { reason: msg.reason });
+			logger$95.error("Platform auth failed", { reason: msg.reason });
 			if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close(1e3, "Auth failed");
 		}
 		handleWebhookRelayStart(msg) {
@@ -1547,7 +1610,7 @@ var init_platform_client = __esmMin((() => {
 				...msg.requestId && { requestId: msg.requestId }
 			});
 			if (startRes.status === "error") {
-				logger$94.warn("Rejecting webhook.relay.start", {
+				logger$95.warn("Rejecting webhook.relay.start", {
 					messageId: msg.messageId,
 					reason: startRes.reason
 				});
@@ -1558,7 +1621,7 @@ var init_platform_client = __esmMin((() => {
 					result: "rejected_misconfigured",
 					reason: startRes.reason
 				});
-			} else logger$94.info("Webhook relay stream started", {
+			} else logger$95.info("Webhook relay stream started", {
 				messageId: msg.messageId,
 				deliveryId: msg.deliveryId,
 				event: msg.event,
@@ -1570,7 +1633,7 @@ var init_platform_client = __esmMin((() => {
 			const applyRes = this.relayBuffer.chunk(msg.messageId, msg.sequence, msg.data, msg.final);
 			if (applyRes.status === "pending") return;
 			if (applyRes.status === "error") {
-				logger$94.warn("Rejecting webhook.relay.chunk", {
+				logger$95.warn("Rejecting webhook.relay.chunk", {
 					messageId: msg.messageId,
 					sequence: msg.sequence,
 					reason: applyRes.reason
@@ -1591,7 +1654,7 @@ var init_platform_client = __esmMin((() => {
 				routingKey: meta.routingKey
 			}, () => {
 				this.completeChunkedRelay(msg.messageId, meta, body).catch((err) => {
-					logger$94.error("Error completing chunked relay", {
+					logger$95.error("Error completing chunked relay", {
 						messageId: msg.messageId,
 						error: toErrorMessage(err)
 					});
@@ -1608,10 +1671,18 @@ var init_platform_client = __esmMin((() => {
 		handleSourceRegisterAck(msg) {
 			const accepted = msg.accepted;
 			const rejected = msg.rejected;
-			if (accepted.length > 0) logger$94.info("Source registration accepted", { routingKeys: accepted });
-			if (rejected.length > 0) logger$94.warn("Source registration rejected", { rejected: rejected.map((r) => `${r.routingKey}: ${r.reason}`) });
+			if (accepted.length > 0) logger$95.info("Source registration accepted", { routingKeys: accepted.map((a) => a.routingKey) });
+			for (const entry of accepted) {
+				const pending = this.pendingSourceRegistrations.get(entry.routingKey);
+				if (pending) {
+					clearTimeout(pending.timer);
+					this.pendingSourceRegistrations.delete(entry.routingKey);
+					pending.resolve(entry.webhookUrl);
+				}
+			}
+			if (rejected.length > 0) logger$95.warn("Source registration rejected", { rejected: rejected.map((r) => `${r.routingKey}: ${r.reason}`) });
 			if (msg.peers && msg.peers.length > 0 && this.onPeerDiscover) for (const peer of msg.peers) {
-				logger$94.info("Peer discovered via source.register.ack", {
+				logger$95.info("Peer discovered via source.register.ack", {
 					connectionId: peer.connectionId,
 					instanceId: peer.instanceId,
 					address: peer.address,
@@ -1623,7 +1694,7 @@ var init_platform_client = __esmMin((() => {
 		}
 		handlePeerDiscover(msg) {
 			const { peer } = msg;
-			logger$94.info("Peer discovered via Platform matchmaker", {
+			logger$95.info("Peer discovered via Platform matchmaker", {
 				connectionId: peer.connectionId,
 				instanceId: peer.instanceId,
 				address: peer.address,
@@ -1633,7 +1704,7 @@ var init_platform_client = __esmMin((() => {
 		}
 		handlePeerUpdate(msg) {
 			if (msg.peers && this.onPeerDiscover) for (const peer of msg.peers) {
-				logger$94.info("Peer discovered via peer.update", {
+				logger$95.info("Peer discovered via peer.update", {
 					connectionId: peer.connectionId,
 					instanceId: peer.instanceId,
 					address: peer.address,
@@ -1653,7 +1724,7 @@ var init_platform_client = __esmMin((() => {
 		flushBuffer() {
 			const messages = this.eventBuffer.flush();
 			if (messages.length > 0) {
-				logger$94.info("Flushing event buffer", { count: messages.length });
+				logger$95.info("Flushing event buffer", { count: messages.length });
 				for (const msg of messages) this.sendDirect(msg);
 			}
 		}
@@ -1676,7 +1747,7 @@ var init_platform_client = __esmMin((() => {
 			this.cancelReconnect();
 			const delay = this.getReconnectDelay();
 			this.reconnectAttempts++;
-			logger$94.info("Scheduling reconnect", {
+			logger$95.info("Scheduling reconnect", {
 				attempt: this.reconnectAttempts,
 				delayMs: Math.round(delay)
 			});
@@ -2035,7 +2106,7 @@ var trust_resolver_exports = /* @__PURE__ */ __exportAll({
 function findIdentityLink(identityLinks, provider, providerUsername, providerUserId) {
 	if (providerUserId === void 0 || providerUserId.length === 0) {
 		trustMatchRefusedNoIdTotal.add(1, { reason: "event_missing" });
-		logger$93.warn("Trust match refused: webhook event has no provider numeric id", {
+		logger$94.warn("Trust match refused: webhook event has no provider numeric id", {
 			provider,
 			providerUsername
 		});
@@ -2047,7 +2118,7 @@ function findIdentityLink(identityLinks, provider, providerUsername, providerUse
 	if (byUsername) {
 		const reason = byUsername.providerUserId === null || byUsername.providerUserId === void 0 ? "link_missing" : "id_mismatch";
 		trustMatchRefusedNoIdTotal.add(1, { reason });
-		logger$93.warn("Trust match refused: numeric id missing on link or did not match event", {
+		logger$94.warn("Trust match refused: numeric id missing on link or did not match event", {
 			provider,
 			providerUsername,
 			providerUserId,
@@ -2075,10 +2146,10 @@ function isReadOrHigher(permission) {
 function isCiTrustWriteOrHigher(level) {
 	return level === "write" || level === "admin";
 }
-var logger$93, TrustResolver$1;
+var logger$94, TrustResolver$1;
 var init_trust_resolver = __esmMin((() => {
 	init_prometheus();
-	logger$93 = createLogger({ prefix: "trust-resolver" });
+	logger$94 = createLogger({ prefix: "trust-resolver" });
 	TrustResolver$1 = class {
 		constructor(contributorCache) {
 			this.contributorCache = contributorCache;
@@ -2208,14 +2279,14 @@ async function handleApprovalComment(params) {
 	const { commentBody, commenterUsername, commenterUserId, provider, orgId, identityLinks, orgMemberPermissions, heldRunStore } = params;
 	const command = parseKiciCommand(commentBody);
 	if (!command) return { handled: false };
-	logger$92.info("Processing /kici command", {
+	logger$93.info("Processing /kici command", {
 		action: command.action,
 		commenter: commenterUsername,
 		runId: command.runId
 	});
 	const identityLink = findIdentityLink(identityLinks, provider, commenterUsername, commenterUserId);
 	if (!identityLink) {
-		logger$92.info("No identity link for commenter", {
+		logger$93.info("No identity link for commenter", {
 			commenter: commenterUsername,
 			provider
 		});
@@ -2226,7 +2297,7 @@ async function handleApprovalComment(params) {
 	}
 	const ciTrustLevel = orgMemberPermissions.get(identityLink.userId) ?? "none";
 	if (ciTrustLevel !== "write" && ciTrustLevel !== "admin") {
-		logger$92.info("Insufficient ci_trust level", {
+		logger$93.info("Insufficient ci_trust level", {
 			commenter: commenterUsername,
 			userId: identityLink.userId,
 			ciTrustLevel
@@ -2238,12 +2309,12 @@ async function handleApprovalComment(params) {
 	}
 	const pendingHolds = await heldRunStore.listByQueueType(orgId, "security", { status: "pending" });
 	if (pendingHolds.length === 0) {
-		logger$92.info("No pending security holds found", { orgId });
+		logger$93.info("No pending security holds found", { orgId });
 		return { handled: true };
 	}
 	const targetHolds = command.runId ? pendingHolds.filter((h) => h.run_id === command.runId) : pendingHolds;
 	if (targetHolds.length === 0) {
-		logger$92.info("No matching security holds found", {
+		logger$93.info("No matching security holds found", {
 			orgId,
 			runId: command.runId
 		});
@@ -2254,14 +2325,14 @@ async function handleApprovalComment(params) {
 	for (const hold of targetHolds) try {
 		if (approved) {
 			await heldRunStore.approveByQueueType(orgId, hold.id, identityLink.userId, "security");
-			logger$92.info("Security hold approved", {
+			logger$93.info("Security hold approved", {
 				heldRunId: hold.id,
 				runId: hold.run_id,
 				approvedBy: identityLink.userId
 			});
 		} else {
 			await heldRunStore.reject(orgId, hold.id, `Rejected by ${commenterUsername} via /kici reject`);
-			logger$92.info("Security hold rejected", {
+			logger$93.info("Security hold rejected", {
 				heldRunId: hold.id,
 				runId: hold.run_id,
 				rejectedBy: commenterUsername
@@ -2269,7 +2340,7 @@ async function handleApprovalComment(params) {
 		}
 		processedCount++;
 	} catch (err) {
-		logger$92.error("Failed to process security hold", {
+		logger$93.error("Failed to process security hold", {
 			heldRunId: hold.id,
 			action: command.action,
 			error: toErrorMessage(err)
@@ -2279,15 +2350,15 @@ async function handleApprovalComment(params) {
 		const title = approved ? "Approved" : "Rejected";
 		const summary = approved ? `Approved by ${commenterUsername} via /kici approve` : `Rejected by ${commenterUsername} via /kici reject`;
 		params.checkStatusPoster.postCheckStatus(params.repoIdentifier, params.commitSha, approved ? "success" : "failure", title, summary, params.credentials).catch((err) => {
-			logger$92.warn("Failed to update check status after approval", { error: toErrorMessage(err) });
+			logger$93.warn("Failed to update check status after approval", { error: toErrorMessage(err) });
 		});
 	}
 	return { handled: true };
 }
-var logger$92;
+var logger$93;
 var init_comment_handler = __esmMin((() => {
 	init_trust_resolver();
-	logger$92 = createLogger({ prefix: "comment-handler" });
+	logger$93 = createLogger({ prefix: "comment-handler" });
 }));
 //#endregion
 //#region src/registration/extractor.ts
@@ -2381,9 +2452,9 @@ function payloadFromObject$1(payload) {
 function payloadFromRawBody(body) {
 	return { raw: Buffer.from(body, "utf-8") };
 }
-var logger$91, EventLogWriter;
+var logger$92, EventLogWriter;
 var init_event_log$1 = __esmMin((() => {
-	logger$91 = createLogger({ prefix: "event-log" });
+	logger$92 = createLogger({ prefix: "event-log" });
 	EventLogWriter = class EventLogWriter {
 		db;
 		logStorage;
@@ -2419,7 +2490,7 @@ var init_event_log$1 = __esmMin((() => {
 			if (sizeBytes > this.opts.maxPayloadBytes) {
 				payloadOmitted = true;
 				payloadOmittedReason = PayloadOmittedReason.enum.size_exceeded;
-				logger$91.warn("Webhook payload exceeds soft cap; recording metadata only", {
+				logger$92.warn("Webhook payload exceeds soft cap; recording metadata only", {
 					deliveryId: info.deliveryId,
 					sizeBytes,
 					maxBytes: this.opts.maxPayloadBytes
@@ -2433,7 +2504,7 @@ var init_event_log$1 = __esmMin((() => {
 				} catch (err) {
 					payloadOmitted = true;
 					payloadOmittedReason = PayloadOmittedReason.enum.storage_failed;
-					logger$91.error("Failed to upload event-log payload to object storage", {
+					logger$92.error("Failed to upload event-log payload to object storage", {
 						deliveryId: info.deliveryId,
 						orgId: outcome.orgId,
 						error: toErrorMessage(err)
@@ -2470,7 +2541,7 @@ var init_event_log$1 = __esmMin((() => {
 					ref: row.ref
 				})).execute();
 			} catch (err) {
-				logger$91.error("Failed to record event_log row", {
+				logger$92.error("Failed to record event_log row", {
 					deliveryId: info.deliveryId,
 					orgId: outcome.orgId,
 					error: toErrorMessage(err)
@@ -3501,7 +3572,7 @@ async function mintCloneTokenForReroute(args) {
 	try {
 		return await args.bundle.cloneTokenProvider?.createCloneToken(args.repoIdentifier, args.credentials) ?? void 0;
 	} catch (err) {
-		logger$90.warn("Failed to pre-resolve clone token for cluster reroute, agent may fail clone", {
+		logger$91.warn("Failed to pre-resolve clone token for cluster reroute, agent may fail clone", {
 			runId: args.runId,
 			workflow: args.workflowName,
 			error: toErrorMessage(err)
@@ -3512,7 +3583,7 @@ async function mintCloneTokenForReroute(args) {
 /**
 * Build the wrapped dispatcher, overlay info with effective routing/provider,
 * persist the webhook payload, fire source-location callbacks, and post the
-* pending commit-status check. Pure side-effects + a typed result bag for
+* pending check-run check. Pure side-effects + a typed result bag for
 * downstream phases.
 */
 async function setupDispatchContext(ctx) {
@@ -3539,14 +3610,14 @@ async function setupDispatchContext(ctx) {
 		const backend = deps.logStorage.constructor.name;
 		try {
 			await deps.logStorage.append(payloadPath, payloadBytes);
-			logger$90.info("Stored webhook payload for run", {
+			logger$91.info("Stored webhook payload for run", {
 				runId,
 				payloadPath,
 				bytes: payloadBytes.length,
 				logStorageBackend: backend
 			});
 		} catch (err) {
-			logger$90.error("Failed to store webhook payload", {
+			logger$91.error("Failed to store webhook payload", {
 				runId,
 				payloadPath,
 				bytes: payloadBytes.length,
@@ -3563,10 +3634,10 @@ async function setupDispatchContext(ctx) {
 		const locs = job.steps.map((s) => s.sourceLocation);
 		if (locs.some((l) => l !== void 0)) deps.onSourceLocationsExtracted(workflow.name, job.name, locs);
 	}
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
 		const jobNames = workflow.jobs.filter(isLockStaticJob).map((j) => j.name);
-		await deps.commitStatusReporter.setPendingAwait({
+		await deps.checkRunReporter.setPendingAwait({
 			provider: info.provider,
 			owner,
 			repo,
@@ -3622,13 +3693,13 @@ async function probeCaches(ctx, setup, contentHash, lockfileHash, targetPlatform
 		sourceHit = await deps.sourceCache.has(contentHash);
 		if (sourceHit) {
 			sourceCacheHitsTotal.add(1);
-			logger$90.info("Source cache hit", {
+			logger$91.info("Source cache hit", {
 				workflow: workflow.name,
 				contentHash
 			});
 		} else {
 			sourceCacheMissesTotal.add(1);
-			logger$90.info("Source cache miss", {
+			logger$91.info("Source cache miss", {
 				workflow: workflow.name,
 				contentHash
 			});
@@ -3643,13 +3714,13 @@ async function probeCaches(ctx, setup, contentHash, lockfileHash, targetPlatform
 		depHit = await deps.depCache.has(lockfileHash, targetPlatform, targetArch);
 		if (depHit) {
 			depCacheHitsTotal.add(1);
-			logger$90.info("Dep cache hit", {
+			logger$91.info("Dep cache hit", {
 				workflow: workflow.name,
 				lockfileHash
 			});
 		} else {
 			depCacheMissesTotal.add(1);
-			logger$90.info("Dep cache miss", {
+			logger$91.info("Dep cache miss", {
 				workflow: workflow.name,
 				lockfileHash
 			});
@@ -3718,9 +3789,9 @@ async function runBuildJob(args) {
 	let rejected = false;
 	let error;
 	const coalescingKey = `${contentHash || "none"}:${lockfileHash || "none"}`;
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
-		deps.commitStatusReporter.setBuildPending({
+		deps.checkRunReporter.setBuildPending({
 			provider: setup.info.provider,
 			owner,
 			repo,
@@ -3741,7 +3812,7 @@ async function runBuildJob(args) {
 			const result = await setup.dispatcher.dispatch(buildJobInput);
 			if (result.status === "rejected") {
 				const reason = `Build job dispatch rejected: ${result.reason}`;
-				logger$90.error(reason, {
+				logger$91.error(reason, {
 					runId,
 					workflow: workflow.name
 				});
@@ -3789,9 +3860,9 @@ async function runBuildJob(args) {
 async function recordBuildFailure(args) {
 	const { ctx, setup, buildJobTrackedEarly, err, buildJobId } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId } = ctx;
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
-		deps.commitStatusReporter.setBuildComplete({
+		deps.checkRunReporter.setBuildComplete({
 			provider: setup.info.provider,
 			owner,
 			repo,
@@ -3809,7 +3880,7 @@ async function recordBuildFailure(args) {
 		if (buildJobTrackedEarly) await deps.executionTracker.onBuildFailed(runId);
 		else await deps.executionTracker.onBuildFailedBeforeTracking(runId, workflow.name, setup.info.provider, repoIdentifier, event.targetBranch, ref, setup.effectiveDeliveryId, credentials, setup.info.routingKey, buildTriggerEvent(event.type, event.action), extractCommitMessage$1(setup.info.event, setup.info.payload), toErrorMessage(err));
 	} catch (cleanupErr) {
-		logger$90.warn("Failed to mark run as failed after build error", {
+		logger$91.warn("Failed to mark run as failed after build error", {
 			runId,
 			error: toErrorMessage(cleanupErr)
 		});
@@ -3817,7 +3888,7 @@ async function recordBuildFailure(args) {
 	if (buildJobId) try {
 		await deps.dispatcher.cancelQueuedJob(buildJobId, `Build failed: ${toErrorMessage(err)}`);
 	} catch (cleanupErr) {
-		logger$90.warn("Failed to mark build job dispatch_queue row as failed", {
+		logger$91.warn("Failed to mark build job dispatch_queue row as failed", {
 			runId,
 			buildJobId,
 			error: toErrorMessage(cleanupErr)
@@ -3831,9 +3902,9 @@ async function recordBuildFailure(args) {
 async function readPostBuildCacheUrls(args) {
 	const { ctx, setup, contentHash, lockfileHash, targetPlatform, targetArch } = args;
 	const { deps, workflow, repoIdentifier, credentials, ref, runId } = ctx;
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
-		deps.commitStatusReporter.setBuildComplete({
+		deps.checkRunReporter.setBuildComplete({
 			provider: setup.info.provider,
 			owner,
 			repo,
@@ -3929,7 +4000,7 @@ async function prepareCacheAndBuild(ctx, setup) {
 		if (result.error !== void 0) {
 			const buildDuration = Number(process.hrtime.bigint() - buildStart) / 1e9;
 			buildDurationSeconds.record(buildDuration);
-			logger$90.warn("Build failed, skipping execution for workflow", {
+			logger$91.warn("Build failed, skipping execution for workflow", {
 				workflow: workflow.name,
 				coalescingKey: `${contentHash || "none"}:${lockfileHash || "none"}`,
 				error: toErrorMessage(result.error)
@@ -3943,7 +4014,7 @@ async function prepareCacheAndBuild(ctx, setup) {
 			});
 			if (hasDynamicEntries) {
 				buildFailed = true;
-				logger$90.info("Build failed but workflow has dynamic entries, continuing with dynamic dispatch", {
+				logger$91.info("Build failed but workflow has dynamic entries, continuing with dynamic dispatch", {
 					workflow: workflow.name,
 					dynamicEntryCount: dynamicEntries.length
 				});
@@ -3989,7 +4060,7 @@ async function prepareCacheAndBuild(ctx, setup) {
 			depsHash = depResult.hash;
 		}
 	}
-	if (!contentHash && deps.sourceCache) logger$90.debug("Workflow missing contentHash, agents will compile from source", { workflow: workflow.name });
+	if (!contentHash && deps.sourceCache) logger$91.debug("Workflow missing contentHash, agents will compile from source", { workflow: workflow.name });
 	return {
 		sourceTarUrl,
 		sourceTarHash,
@@ -4017,7 +4088,7 @@ async function resolveWorkflowSecretsAndKey(ctx) {
 	const declaredContexts = workflow.contexts ?? [];
 	if (declaredContexts.length > 0) {
 		if (!deps.secretResolver) {
-			logger$90.error("Workflow declares secret contexts but secrets subsystem is not configured (KICI_SECRET_KEY missing)", {
+			logger$91.error("Workflow declares secret contexts but secrets subsystem is not configured (KICI_SECRET_KEY missing)", {
 				workflow: workflow.name,
 				contexts: declaredContexts
 			});
@@ -4036,7 +4107,7 @@ async function resolveWorkflowSecretsAndKey(ctx) {
 				resolvedNamespacedSecrets = mergedNamespaced;
 			}
 		} catch (err) {
-			logger$90.error("Secret resolution failed, skipping workflow", {
+			logger$91.error("Secret resolution failed, skipping workflow", {
 				workflow: workflow.name,
 				error: toErrorMessage(err)
 			});
@@ -4054,7 +4125,7 @@ async function resolveWorkflowSecretsAndKey(ctx) {
 			public_key: runPublicKeyBase64
 		}).execute();
 	} catch (err) {
-		logger$90.warn("Failed to generate ephemeral key pair for run, secret outputs disabled", {
+		logger$91.warn("Failed to generate ephemeral key pair for run, secret outputs disabled", {
 			runId,
 			error: toErrorMessage(err)
 		});
@@ -4089,7 +4160,7 @@ async function resolveWorkflowInstallSecrets(ctx, secrets) {
 	if (deps.db) try {
 		allowHttp = (await deps.db.selectFrom("org_settings").select("allow_http_npm_registries").where("customer_id", "=", resolvedOrgId).executeTakeFirst())?.allow_http_npm_registries ?? false;
 	} catch (err) {
-		logger$90.warn("Failed to read org_settings.allow_http_npm_registries — defaulting to false", {
+		logger$91.warn("Failed to read org_settings.allow_http_npm_registries — defaulting to false", {
 			runId,
 			workflow: workflow.name,
 			error: toErrorMessage(err)
@@ -4113,20 +4184,20 @@ async function resolveWorkflowInstallSecrets(ctx, secrets) {
 		protectionContext
 	});
 	if (result.decision === "reject") {
-		logger$90.error("Workflow install-secrets resolution rejected dispatch", {
+		logger$91.error("Workflow install-secrets resolution rejected dispatch", {
 			runId,
 			workflow: workflow.name,
 			reason: result.reason
 		});
 		return { skipDispatch: true };
 	}
-	if (result.contributorStripped) logger$90.warn("Skipping registries:/installEnv: resolution for untrusted contributor — install will fail naturally if private deps are required", {
+	if (result.contributorStripped) logger$91.warn("Skipping registries:/installEnv: resolution for untrusted contributor — install will fail naturally if private deps are required", {
 		runId,
 		workflow: workflow.name,
 		contributor: trustResolution?.contributorUsername,
 		tier: trustResolution?.tier
 	});
-	else logger$90.info("Resolved workflow install secrets", {
+	else logger$91.info("Resolved workflow install secrets", {
 		runId,
 		workflow: workflow.name,
 		registryCount: result.npmRegistries?.length ?? 0,
@@ -4242,7 +4313,7 @@ async function applyEnvironmentRulesAndSecrets(args) {
 	if (gateResult.action === "reject") {
 		jobEnvData.rejected = true;
 		jobEnvData.rejectReason = gateResult.reason ?? "Rejected by protection rules";
-		logger$90.info("Job rejected by protection rules", {
+		logger$91.info("Job rejected by protection rules", {
 			runId,
 			workflow: workflow.name,
 			job: lockJob.name,
@@ -4263,7 +4334,7 @@ async function applyEnvironmentRulesAndSecrets(args) {
 			await deps.heldRunStore.create(resolvedOrgId, heldRunData);
 		}
 		jobEnvData.held = true;
-		logger$90.info("Job held by protection rules", {
+		logger$91.info("Job held by protection rules", {
 			runId,
 			workflow: workflow.name,
 			job: lockJob.name,
@@ -4274,7 +4345,7 @@ async function applyEnvironmentRulesAndSecrets(args) {
 		if (gateResult.holdType === "security" && bundle.checkStatusPoster) {
 			const holdSummary = buildSecurityHoldSummary("environment_trust", trustResolution?.tier ?? "unknown", trustResolution?.contributorUsername);
 			bundle.checkStatusPoster.postCheckStatus(repoIdentifier, ref, "pending", "Held for approval", holdSummary, credentials).catch((err) => {
-				logger$90.warn("Failed to post security hold check", {
+				logger$91.warn("Failed to post security hold check", {
 					runId,
 					job: lockJob.name,
 					error: toErrorMessage(err)
@@ -4293,7 +4364,7 @@ async function applyEnvironmentRulesAndSecrets(args) {
 			jobEnvData.jobNamespacedSecrets = { [environmentName]: envSecrets };
 		}
 	} catch (err) {
-		logger$90.error("Per-job secret resolution failed", {
+		logger$91.error("Per-job secret resolution failed", {
 			runId,
 			workflow: workflow.name,
 			job: lockJob.name,
@@ -4317,7 +4388,7 @@ async function evaluateJobEnvironments(args) {
 	for (const lockJob of buildPrep.staticJobs) {
 		const jobEnvData = {};
 		const { inlineEnvironmentName, inlineEnv, inlineConcurrencyGroup } = evaluateInlineFields(lockJob, inlinePayload);
-		if (inlineEnvironmentName || inlineEnv || inlineConcurrencyGroup) logger$90.debug("Inline evaluation resolved dynamic fields", {
+		if (inlineEnvironmentName || inlineEnv || inlineConcurrencyGroup) logger$91.debug("Inline evaluation resolved dynamic fields", {
 			job: lockJob.name,
 			environment: !!inlineEnvironmentName,
 			env: !!inlineEnv,
@@ -4433,12 +4504,12 @@ function logRoleAwareFailure(failure, flatLabels, runId, workflowName) {
 		const roleName = roleLabel.replace("kici:role:", "");
 		const platformLabels = flatLabels.filter((l) => l.startsWith("kici:os:") || l.startsWith("kici:arch:")).map((l) => l.split(":").pop());
 		const platformDesc = platformLabels.length > 0 ? platformLabels.join(", ") : "any platform";
-		logger$90.error(`No ${roleName} available for [${platformDesc}]. Add 'roles: [${roleName}]' to a scaler with matching labels, or use default 'roles: [all]'.`, {
+		logger$91.error(`No ${roleName} available for [${platformDesc}]. Add 'roles: [${roleName}]' to a scaler with matching labels, or use default 'roles: [all]'.`, {
 			runId,
 			workflow: workflowName,
 			job: failure.jobName
 		});
-	} else logger$90.warn("Job routing failed", {
+	} else logger$91.warn("Job routing failed", {
 		runId,
 		workflow: workflowName,
 		job: failure.jobName,
@@ -4470,7 +4541,7 @@ async function preRegisterNonRootJobs(args) {
 			jobName: gatedJob.name,
 			runsOnLabels
 		});
-		logger$90.info("Job gated by needs scheduler (cluster path)", {
+		logger$91.info("Job gated by needs scheduler (cluster path)", {
 			runId,
 			workflow: workflow.name,
 			job: gatedJob.name
@@ -4482,7 +4553,7 @@ async function clusterRouteRootJobs(args) {
 	const { ctx, setup, buildPrep, buildJobConfig, rootDispatchableJobs, needsGatedCount, dispatchedJobs, rejectedJobs } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId, bundle } = ctx;
 	if (rootDispatchableJobs.length === 0) {
-		logger$90.info("All dispatchable jobs deferred or needs-gated, skipping coordinator routing", {
+		logger$91.info("All dispatchable jobs deferred or needs-gated, skipping coordinator routing", {
 			runId,
 			workflow: workflow.name,
 			needsGated: needsGatedCount
@@ -4530,7 +4601,7 @@ async function clusterRouteRootJobs(args) {
 	const routeResult = await Promise.race([deps.coordinator.routeJobs(runCtx, jobsToRoute), new Promise((_, reject) => {
 		routeTimeout = setTimeout(() => reject(/* @__PURE__ */ new Error("routeJobs timed out after 30s")), 3e4);
 	})]).catch((err) => {
-		logger$90.warn("Coordinator routing timed out, dispatching locally", {
+		logger$91.warn("Coordinator routing timed out, dispatching locally", {
 			runId,
 			workflow: workflow.name,
 			error: toErrorMessage(err)
@@ -4573,7 +4644,7 @@ async function clusterRouteRootJobs(args) {
 					jobId: syntheticId,
 					reason: result.reason
 				});
-			} else if (result.status === "queued-no-backend") logger$90.warn("Job has no matching backend (cluster fallback), skipping", {
+			} else if (result.status === "queued-no-backend") logger$91.warn("Job has no matching backend (cluster fallback), skipping", {
 				runId,
 				workflow: workflow.name,
 				job: jtr.jobName,
@@ -4603,7 +4674,7 @@ async function clusterRouteRootJobs(args) {
 			jobName: rerouted.jobName,
 			runsOnLabels: flatLabels
 		});
-		logger$90.info("Job rerouted to peer", {
+		logger$91.info("Job rerouted to peer", {
 			runId,
 			workflow: workflow.name,
 			job: rerouted.jobName,
@@ -4620,7 +4691,7 @@ async function dispatchSingleOrchPath(args) {
 	for (const jobOrFactory of buildPrep.staticJobs) {
 		const envData = jobEnvironmentData.get(jobOrFactory.name);
 		if (envData?.rejected) {
-			logger$90.info("Job skipped (rejected by protection rules)", {
+			logger$91.info("Job skipped (rejected by protection rules)", {
 				runId,
 				workflow: workflow.name,
 				job: jobOrFactory.name,
@@ -4629,7 +4700,7 @@ async function dispatchSingleOrchPath(args) {
 			continue;
 		}
 		if (envData?.held) {
-			logger$90.info("Job held by protection rules", {
+			logger$91.info("Job held by protection rules", {
 				runId,
 				workflow: workflow.name,
 				job: jobOrFactory.name
@@ -4659,7 +4730,7 @@ async function dispatchSingleOrchPath(args) {
 				jobName: jobOrFactory.name,
 				runsOnLabels
 			});
-			logger$90.info("Job gated by needs scheduler (not dispatched yet)", {
+			logger$91.info("Job gated by needs scheduler (not dispatched yet)", {
 				runId,
 				workflow: workflow.name,
 				job: jobOrFactory.name
@@ -4678,7 +4749,7 @@ async function dispatchSingleOrchPath(args) {
 				jobId: syntheticId,
 				reason: result.reason
 			});
-		} else if (result.status === "queued-no-backend") logger$90.warn("Job has no matching backend, skipping execution tracking", {
+		} else if (result.status === "queued-no-backend") logger$91.warn("Job has no matching backend, skipping execution tracking", {
 			runId,
 			workflow: workflow.name,
 			job: jobOrFactory.name,
@@ -4690,7 +4761,7 @@ async function dispatchSingleOrchPath(args) {
 			jobName: jobOrFactory.name,
 			runsOnLabels
 		});
-		logger$90.info("Job dispatched", {
+		logger$91.info("Job dispatched", {
 			runId,
 			workflow: workflow.name,
 			job: jobOrFactory.name,
@@ -4710,7 +4781,7 @@ async function dispatchStaticJobs(args) {
 	const { ctx, setup, buildPrep, buildJobConfig, jobEnvironmentData, dispatchedJobs, rejectedJobs } = args;
 	const { deps, workflow, runId } = ctx;
 	if (buildPrep.buildFailed) {
-		logger$90.info("Skipping static job dispatch due to build failure", {
+		logger$91.info("Skipping static job dispatch due to build failure", {
 			runId,
 			workflow: workflow.name,
 			staticJobCount: buildPrep.staticJobs.length
@@ -4763,7 +4834,7 @@ async function recordRunStart(args) {
 		await deps.executionTracker.addJobsToRun(runId, executionJobs, declaredContexts.length > 0 ? [...declaredContexts] : void 0);
 	} else await deps.executionTracker.onExecutionStarted(runId, workflow.name, setup.info.provider, repoIdentifier, event.targetBranch, ref, setup.effectiveDeliveryId, credentials, summarizeDecision(decision), dispatchedJobs, setup.info.routingKey, declaredContexts.length > 0 ? [...declaredContexts] : void 0, buildTriggerEvent(event.type, event.action), extractCommitMessage$1(setup.info.event, setup.info.payload), void 0, void 0, void 0, setup.workflowConcurrency);
 	if (runEnvironmentName && deps.db) deps.db.updateTable("execution_runs").set({ environment: runEnvironmentName }).where("run_id", "=", runId).execute().catch((err) => {
-		logger$90.error("Failed to set environment on execution run", {
+		logger$91.error("Failed to set environment on execution run", {
 			runId,
 			environment: runEnvironmentName,
 			error: toErrorMessage(err)
@@ -4774,7 +4845,7 @@ async function recordRunStart(args) {
 		lock_file_source: lockFileSource,
 		contributor_username: trustResolution.contributorUsername
 	}).where("run_id", "=", runId).execute().catch((err) => {
-		logger$90.error("Failed to set trust context on execution run", {
+		logger$91.error("Failed to set trust context on execution run", {
 			runId,
 			error: toErrorMessage(err)
 		});
@@ -4786,7 +4857,7 @@ async function insertEdgesAndMarkRejected(args) {
 	if (deps.db && dispatchedJobs.length > 0) try {
 		await insertEdgesForRun(deps.db, runId, staticJobs);
 	} catch (err) {
-		logger$90.error("Failed to insert needs edges for run", {
+		logger$91.error("Failed to insert needs edges for run", {
 			runId,
 			error: toErrorMessage(err)
 		});
@@ -4794,7 +4865,7 @@ async function insertEdgesAndMarkRejected(args) {
 	if (deps.executionTracker && rejectedJobs.length > 0) {
 		const now = Date.now();
 		for (const { jobId, reason } of rejectedJobs) deps.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, now, void 0, { error: reason }).catch((err) => {
-			logger$90.error("Failed to mark rejected job as failed", {
+			logger$91.error("Failed to mark rejected job as failed", {
 				runId,
 				jobId,
 				error: toErrorMessage(err)
@@ -4826,7 +4897,7 @@ async function applyInitResultEnvironment(args) {
 						jobEnvData.jobNamespacedSecrets = { [initResult.environmentName]: envSecrets };
 					}
 				} catch (err) {
-					logger$90.error("Deferred init: secret resolution failed", {
+					logger$91.error("Deferred init: secret resolution failed", {
 						runId,
 						job: lockJob.name,
 						error: toErrorMessage(err)
@@ -4903,7 +4974,7 @@ async function dispatchExecutionAfterInit(args) {
 			jobName: local.jobName,
 			runsOnLabels: jobInput.runsOnLabels
 		}]).catch((err) => {
-			logger$90.error("Failed to add deferred init job to execution tracker", {
+			logger$91.error("Failed to add deferred init job to execution tracker", {
 				runId,
 				error: toErrorMessage(err)
 			});
@@ -4924,13 +4995,13 @@ async function dispatchExecutionAfterInit(args) {
 			jobName: lockJob.name,
 			runsOnLabels: jobInput.runsOnLabels
 		}]).catch((err) => {
-			logger$90.error("Failed to add deferred init job to execution tracker", {
+			logger$91.error("Failed to add deferred init job to execution tracker", {
 				runId,
 				error: toErrorMessage(err)
 			});
 		});
 	}
-	logger$90.info("Deferred init job resolved, execution job dispatched", {
+	logger$91.info("Deferred init job resolved, execution job dispatched", {
 		runId,
 		workflow: workflow.name,
 		job: lockJob.name,
@@ -4941,14 +5012,14 @@ function startDeferredInitDispatch(args) {
 	const { ctx, setup, buildPrep, buildJobConfig, jobEnvironmentData, deferredInitJobs } = args;
 	const { deps, workflow, runId } = ctx;
 	if (deferredInitJobs.length === 0 || !deps.pendingInits) return;
-	logger$90.info("Starting deferred init dispatch", {
+	logger$91.info("Starting deferred init dispatch", {
 		runId,
 		count: deferredInitJobs.length
 	});
 	const pendingInits = deps.pendingInits;
 	for (const { lockJob, initJobInput } of deferredInitJobs) (async () => {
 		try {
-			logger$90.info("Dispatching deferred init job", {
+			logger$91.info("Dispatching deferred init job", {
 				runId,
 				workflow: workflow.name,
 				job: lockJob.name,
@@ -4974,7 +5045,7 @@ function startDeferredInitDispatch(args) {
 				lockJob
 			});
 		} catch (err) {
-			logger$90.error("Deferred init job failed", {
+			logger$91.error("Deferred init job failed", {
 				runId,
 				workflow: workflow.name,
 				job: lockJob.name,
@@ -4992,7 +5063,7 @@ async function dispatchEvalJob(args) {
 	const { ctx, setup, buildPrep, dynamicEntry } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId, bundle } = ctx;
 	const evalJobName = `__dynamic__${workflow.name}__${dynamicEntry.source.index}`;
-	logger$90.info("Dispatching dynamic eval job", {
+	logger$91.info("Dispatching dynamic eval job", {
 		runId,
 		workflow: workflow.name,
 		evalJob: evalJobName,
@@ -5076,7 +5147,7 @@ async function resolveGeneratedJobConfigs(args) {
 						};
 					}
 				} catch (err) {
-					logger$90.error("Dynamic job: secret resolution failed", {
+					logger$91.error("Dynamic job: secret resolution failed", {
 						runId,
 						job: genJob.name,
 						error: toErrorMessage(err)
@@ -5116,7 +5187,7 @@ async function resolveGeneratedJobConfigs(args) {
 			runsOnLabels: Array.isArray(genJob.runsOn) ? [...genJob.runsOn] : [genJob.runsOn]
 		});
 	} catch (err) {
-		logger$90.error("Failed to resolve secrets for dynamic generated job", {
+		logger$91.error("Failed to resolve secrets for dynamic generated job", {
 			runId,
 			job: genJob.name,
 			error: toErrorMessage(err)
@@ -5173,7 +5244,7 @@ async function gateAndStoreNonRootGeneratedJobs(args) {
 			jobName: genJob.name,
 			runsOnLabels
 		}]);
-		logger$90.info("Generated job gated by cross-domain needs", {
+		logger$91.info("Generated job gated by cross-domain needs", {
 			runId,
 			workflow: workflow.name,
 			job: genJob.name,
@@ -5211,13 +5282,13 @@ async function directDispatchGeneratedJobs(args) {
 			jobName: genJob.name,
 			runsOnLabels
 		}]);
-		logger$90.info("Dynamic generated job dispatched (direct)", {
+		logger$91.info("Dynamic generated job dispatched (direct)", {
 			runId,
 			job: genJob.name,
 			status: genResult.status
 		});
 	} catch (err) {
-		logger$90.error("Failed to dispatch dynamic generated job", {
+		logger$91.error("Failed to dispatch dynamic generated job", {
 			runId,
 			job: genJob.name,
 			error: toErrorMessage(err)
@@ -5278,7 +5349,7 @@ async function routeRootGeneratedJobs(args) {
 	const routeResult = await Promise.race([deps.coordinator.routeJobs(genRunCtx, generatedJobsToRoute), new Promise((_, reject) => {
 		genRouteTimeout = setTimeout(() => reject(/* @__PURE__ */ new Error("routeJobs timed out after 60s")), 6e4);
 	})]).catch((err) => {
-		logger$90.warn("Generated job coordinator routing timed out, falling back to direct dispatch", {
+		logger$91.warn("Generated job coordinator routing timed out, falling back to direct dispatch", {
 			runId,
 			workflow: workflow.name,
 			error: toErrorMessage(err),
@@ -5303,25 +5374,25 @@ async function routeRootGeneratedJobs(args) {
 			jobName: local.jobName,
 			runsOnLabels: matchingConfig?.runsOnLabels ?? []
 		}]).catch((err) => {
-			logger$90.error("Failed to add generated job to execution tracker", {
+			logger$91.error("Failed to add generated job to execution tracker", {
 				runId,
 				job: local.jobName,
 				error: toErrorMessage(err)
 			});
 		});
 	}
-	for (const rerouted of routeResult.reroutedJobs) logger$90.info("Generated job rerouted to peer", {
+	for (const rerouted of routeResult.reroutedJobs) logger$91.info("Generated job rerouted to peer", {
 		runId,
 		job: rerouted.jobName,
 		peerId: rerouted.peerId
 	});
-	for (const failed of routeResult.failedJobs) logger$90.error(`Generated job '${failed.jobName}' routing failed: ${failed.reason}. This indicates a capability advertisement mismatch — the peer was selected based on advertised labels but rejected the job.`, {
+	for (const failed of routeResult.failedJobs) logger$91.error(`Generated job '${failed.jobName}' routing failed: ${failed.reason}. This indicates a capability advertisement mismatch — the peer was selected based on advertised labels but rejected the job.`, {
 		runId,
 		workflow: workflow.name,
 		job: failed.jobName,
 		reason: failed.reason
 	});
-	logger$90.info("Generated jobs routed via coordinator", {
+	logger$91.info("Generated jobs routed via coordinator", {
 		runId,
 		workflow: workflow.name,
 		local: routeResult.localJobs.length,
@@ -5334,7 +5405,7 @@ async function setGroupNameAndResolveEdges(args) {
 	const { deps, runId } = ctx;
 	if (!deps.db || !groupName) return;
 	for (const memberName of generatedJobNames) await deps.db.updateTable("execution_jobs").set({ group_name: groupName }).where("run_id", "=", runId).where("job_name", "=", memberName).execute().catch((err) => {
-		logger$90.warn("Failed to set group_name on generated job", {
+		logger$91.warn("Failed to set group_name on generated job", {
 			runId,
 			jobName: memberName,
 			groupName,
@@ -5350,7 +5421,7 @@ async function setGroupNameAndResolveEdges(args) {
 	});
 	if (dependentStaticJobs.length > 0) {
 		await resolveGroupEdges(deps.db, runId, groupName, generatedJobNames, dependentStaticJobs);
-		logger$90.info("Group edges resolved", {
+		logger$91.info("Group edges resolved", {
 			runId,
 			groupName,
 			members: generatedJobNames.length,
@@ -5408,7 +5479,7 @@ async function detectAndFailCycles(args) {
 	if (visited >= allJobRows.length) return { cycle: false };
 	const cycleJobs = [...inDegree.entries()].filter(([, d]) => d > 0).map(([n]) => n);
 	const cycleTrace = cycleJobs.join(" -> ");
-	logger$90.error("Eval-time cycle detected in job graph", {
+	logger$91.error("Eval-time cycle detected in job graph", {
 		runId,
 		cycleTrace
 	});
@@ -5443,7 +5514,7 @@ async function processDynamicEntry(args) {
 			dynamicEntry
 		});
 		const generatedJobs = await deps.pendingDynamics.track(evalJobId);
-		logger$90.info("Dynamic eval completed, dispatching generated jobs", {
+		logger$91.info("Dynamic eval completed, dispatching generated jobs", {
 			runId,
 			workflow: workflow.name,
 			generatedCount: generatedJobs.length,
@@ -5490,7 +5561,7 @@ async function processDynamicEntry(args) {
 			memberJobNames: generatedJobs.map((j) => j.name)
 		});
 	} catch (err) {
-		logger$90.error("Dynamic eval job failed", {
+		logger$91.error("Dynamic eval job failed", {
 			runId,
 			workflow: workflow.name,
 			sourceIndex: dynamicEntry.source.index,
@@ -5613,7 +5684,7 @@ async function dispatchMatchedWorkflow(ctx) {
 	});
 	if (buildPrep.dynamicEntries.length > 0 && ctx.deps.pendingDynamics) {
 		const hasStaticJobs = buildPrep.staticJobs.length > 0;
-		logger$90.info(hasStaticJobs ? "Starting deferred dynamic job dispatch" : "Dynamic-only workflow dispatching eval jobs", {
+		logger$91.info(hasStaticJobs ? "Starting deferred dynamic job dispatch" : "Dynamic-only workflow dispatching eval jobs", {
 			runId: ctx.runId,
 			workflow: ctx.workflow.name,
 			dynamicEntryCount: buildPrep.dynamicEntries.length,
@@ -5637,7 +5708,7 @@ async function dispatchMatchedWorkflow(ctx) {
 	}
 	return { dispatchedJobCount: dispatchedJobs.length };
 }
-var logger$90;
+var logger$91;
 var init_dispatch_matched_workflow = __esmMin((() => {
 	init_pipeline();
 	init_environment_store();
@@ -5647,7 +5718,7 @@ var init_dispatch_matched_workflow = __esmMin((() => {
 	init_needs_scheduler();
 	init_prometheus();
 	init_processor();
-	logger$90 = createLogger({ prefix: "pipeline" });
+	logger$91 = createLogger({ prefix: "pipeline" });
 }));
 //#endregion
 //#region src/pipeline/process-webhook.ts
@@ -5702,7 +5773,7 @@ async function recordSkipEventLog(info, deps, resolvedOrgId, status) {
 async function dedupAndResolveProvider(info, deps) {
 	const resolvedOrgId = await resolveOrgIdSafe(deps, info.routingKey);
 	if (await deps.dedup.exists(info.deliveryId)) {
-		logger$89.debug("Duplicate webhook, skipping", { deliveryId: info.deliveryId });
+		logger$90.debug("Duplicate webhook, skipping", { deliveryId: info.deliveryId });
 		dedupHitsTotal.add(1);
 		await recordSkipEventLog(info, deps, resolvedOrgId, EventLogStatus.enum.duplicate);
 		return { status: "skip" };
@@ -5714,7 +5785,7 @@ async function dedupAndResolveProvider(info, deps) {
 	});
 	const bundle = deps.providerRegistry.getByRoutingKey(info.routingKey);
 	if (!bundle) {
-		logger$89.debug("Unknown provider, skipping", {
+		logger$90.debug("Unknown provider, skipping", {
 			deliveryId: info.deliveryId,
 			provider: info.provider,
 			routingKey: info.routingKey
@@ -5751,7 +5822,7 @@ function invalidateContributorCacheForEvent(info, deps, bundle) {
 			totalDeleted += deps.contributorCache.invalidateByUserInOrg(provider, inv.orgLogin, inv.username);
 			break;
 	}
-	logger$89.info("Invalidated contributor cache entries", {
+	logger$90.info("Invalidated contributor cache entries", {
 		deliveryId: info.deliveryId,
 		event: info.event,
 		action: info.action,
@@ -5766,7 +5837,7 @@ function invalidateContributorCacheForEvent(info, deps, bundle) {
 async function normalizeWebhookEvent(info, deps, bundle, resolvedOrgId) {
 	const event = bundle.normalizer.normalizeEvent(info.event, info.action, info.payload);
 	if (event) return event;
-	logger$89.debug("Unknown event type, skipping", {
+	logger$90.debug("Unknown event type, skipping", {
 		deliveryId: info.deliveryId,
 		event: info.event
 	});
@@ -5787,7 +5858,7 @@ async function gatherCrossSourceCandidates(info, deps, resolvedOrgId, inboundEve
 		const remoteVersion = await deps.registrationStore.getVersion();
 		await deps.registrationIndex.refreshIfNeeded(remoteVersion);
 	} catch (err) {
-		logger$89.warn("Cross-source dispatch: registration index refresh failed", {
+		logger$90.warn("Cross-source dispatch: registration index refresh failed", {
 			deliveryId: info.deliveryId,
 			error: toErrorMessage(err)
 		});
@@ -5847,7 +5918,7 @@ async function dispatchOneCrossSourceCandidate(args) {
 	const { reg } = candidate;
 	const syntheticEvent = buildCrossSourceEvent(info, deps, candidate, inboundEventName);
 	if (!syntheticEvent) {
-		logger$89.debug("Cross-source repo dispatch: unable to normalize inbound event", {
+		logger$90.debug("Cross-source repo dispatch: unable to normalize inbound event", {
 			deliveryId: info.deliveryId,
 			registrationId: reg.id,
 			routingKey: reg.routingKey,
@@ -5859,7 +5930,7 @@ async function dispatchOneCrossSourceCandidate(args) {
 	if (matchedDecisions.length === 0) return 0;
 	const crossDedupKey = `${info.deliveryId}:${reg.id}`;
 	if (await deps.dedup.exists(crossDedupKey)) {
-		logger$89.debug("Cross-source dispatch: composite dedup hit", {
+		logger$90.debug("Cross-source dispatch: composite dedup hit", {
 			deliveryId: info.deliveryId,
 			registrationId: reg.id
 		});
@@ -5868,7 +5939,7 @@ async function dispatchOneCrossSourceCandidate(args) {
 	await deps.dedup.mark(crossDedupKey);
 	const regBundle = deps.providerRegistry.getByRoutingKey(reg.routingKey);
 	if (!regBundle) {
-		logger$89.warn("Cross-source dispatch: registration bundle not found", {
+		logger$90.warn("Cross-source dispatch: registration bundle not found", {
 			deliveryId: info.deliveryId,
 			registrationId: reg.id,
 			routingKey: reg.routingKey
@@ -5884,7 +5955,7 @@ async function dispatchOneCrossSourceCandidate(args) {
 			token
 		};
 	} catch (err) {
-		logger$89.error("Cross-source dispatch: clone token issuance failed", {
+		logger$90.error("Cross-source dispatch: clone token issuance failed", {
 			deliveryId: info.deliveryId,
 			registrationId: reg.id,
 			routingKey: reg.routingKey,
@@ -5969,7 +6040,7 @@ async function recordCrossSourceCompletion(args) {
 		timestamp: Date.now()
 	});
 	webhooksProcessedTotal.add(1, { result: jobsDispatched > 0 ? "matched" : "skipped" });
-	logger$89.info("Cross-source webhook processed", {
+	logger$90.info("Cross-source webhook processed", {
 		deliveryId: info.deliveryId,
 		inboundEventName,
 		registrationsConsidered: candidatesConsidered,
@@ -6004,7 +6075,7 @@ async function dispatchCrossSourceWorkflows(info, deps, event, resolvedOrgId) {
 	const candidates = await gatherCrossSourceCandidates(info, deps, resolvedOrgId, inboundEventName);
 	crossSourceFanoutSize.record(candidates.length, { event: inboundEventName });
 	if (candidates.length === 0) {
-		logger$89.debug("Cross-source: no registrations for event, falling through", {
+		logger$90.debug("Cross-source: no registrations for event, falling through", {
 			deliveryId: info.deliveryId,
 			inboundEventName,
 			orgId: resolvedOrgId
@@ -6037,7 +6108,7 @@ async function dispatchCrossSourceWorkflows(info, deps, event, resolvedOrgId) {
 async function extractRepoAndCredentials(info, deps, bundle, resolvedOrgId) {
 	const repoIdentifier = bundle.normalizer.extractRepoIdentifier(info.payload);
 	if (!repoIdentifier) {
-		logger$89.debug("Missing repository info in payload, skipping", { deliveryId: info.deliveryId });
+		logger$90.debug("Missing repository info in payload, skipping", { deliveryId: info.deliveryId });
 		webhooksProcessedTotal.add(1, { result: "skipped" });
 		await recordSkipEventLog(info, deps, resolvedOrgId, EventLogStatus.enum.received);
 		return null;
@@ -6082,7 +6153,7 @@ async function handleApprovalCommentIfPresent(args) {
 		credentials
 	});
 	if (result.handled) {
-		logger$89.info("Handled /kici command from comment", {
+		logger$90.info("Handled /kici command from comment", {
 			deliveryId: info.deliveryId,
 			action: command.action,
 			commenter: senderUsername,
@@ -6124,7 +6195,7 @@ async function resolveTrustForPR(args) {
 			credentials
 		});
 		const lockFileSource = selectLockFileSource(isPREvent, trustResolution.tier);
-		logger$89.info("Trust tier resolved for PR", {
+		logger$90.info("Trust tier resolved for PR", {
 			deliveryId: info.deliveryId,
 			sender: event.senderUsername,
 			tier: trustResolution.tier,
@@ -6136,7 +6207,7 @@ async function resolveTrustForPR(args) {
 			lockFileSource
 		};
 	} catch (err) {
-		logger$89.warn("Trust resolution failed, defaulting to base lock file", {
+		logger$90.warn("Trust resolution failed, defaulting to base lock file", {
 			deliveryId: info.deliveryId,
 			sender: event.senderUsername,
 			error: toErrorMessage(err)
@@ -6161,7 +6232,7 @@ async function resolveTrustForPR(args) {
 */
 async function fetchLockFileWithFallbackPhase(args) {
 	const { info, deps, bundle, event, resolvedOrgId, repoIdentifier, credentials, ref, isPREvent, lockFileSource } = args;
-	if (!bundle.lockFileFetcher) logger$89.debug("No lock file fetcher available for inbound provider, relying on fallback", { deliveryId: info.deliveryId });
+	if (!bundle.lockFileFetcher) logger$90.debug("No lock file fetcher available for inbound provider, relying on fallback", { deliveryId: info.deliveryId });
 	let lockFile;
 	let headLockFileForDiff;
 	let resolvedFallbackBundle;
@@ -6225,7 +6296,7 @@ async function fetchLockFileWithFallbackPhase(args) {
 	if (resolvedFallbackBundle) {
 		dispatchBundle = resolvedFallbackBundle;
 		dispatchCredentials = resolvedFallbackCredentials ?? credentials;
-		logger$89.info("Cross-provider dispatch: using fallback bundle for clone URL + token", {
+		logger$90.info("Cross-provider dispatch: using fallback bundle for clone URL + token", {
 			deliveryId: info.deliveryId,
 			inboundRoutingKey: info.routingKey,
 			fallbackRoutingKey: resolvedFallbackRoutingKey,
@@ -6314,7 +6385,7 @@ async function tryDispatchGlobalsWithoutLockFile(args) {
 		if (deps.globalWorkflowPolicy) {
 			const sourceCheck = await deps.globalWorkflowPolicy.isSourceRepoAllowed(info.routingKey, repoIdentifier, resolvedOrgId);
 			if (!sourceCheck.allowed) {
-				logger$89.info("Skipping global workflow dispatch: source repo in deny-list", {
+				logger$90.info("Skipping global workflow dispatch: source repo in deny-list", {
 					sourceRepo: repoIdentifier,
 					eventRoutingKey: info.routingKey,
 					workflowRoutingKey: reg.routingKey,
@@ -6347,7 +6418,7 @@ async function tryDispatchGlobalsWithoutLockFile(args) {
 			});
 			for (const { lockJobName, input } of inputs) {
 				const result = await deps.dispatcher.dispatch(input);
-				if (result.status !== "rejected") logger$89.info("Global workflow job dispatched (no lock file path)", {
+				if (result.status !== "rejected") logger$90.info("Global workflow job dispatched (no lock file path)", {
 					runId: globalRunId,
 					workflow: reg.lockEntry.name,
 					job: lockJobName,
@@ -6378,7 +6449,7 @@ function applyWorkflowModificationsAndSecurityHold(args) {
 		workflowModifications = detectWorkflowModifications(fullLockFile, headLockFileForDiff);
 		if (workflowModifications.length > 0) {
 			const tier = trustResolution?.tier ?? "unknown";
-			logger$89.info("Workflow modifications detected in PR", {
+			logger$90.info("Workflow modifications detected in PR", {
 				deliveryId: info.deliveryId,
 				sender: event.senderUsername,
 				tier,
@@ -6394,7 +6465,7 @@ function applyWorkflowModificationsAndSecurityHold(args) {
 				...workflowModifications.map((m) => `- **${m.changeType}**: \`${m.workflowName}\``)
 			].join("\n");
 			bundle.checkStatusPoster.postCheckStatus(repoIdentifier, ref, "neutral", "Workflow changes detected", modSummary, credentials).catch((err) => {
-				logger$89.warn("Failed to post workflow modification check", {
+				logger$90.warn("Failed to post workflow modification check", {
 					deliveryId: info.deliveryId,
 					error: toErrorMessage(err)
 				});
@@ -6404,7 +6475,7 @@ function applyWorkflowModificationsAndSecurityHold(args) {
 	if (securityHold && bundle.checkStatusPoster) {
 		const holdSummary = buildSecurityHoldSummary(securityHold.reason, trustResolution?.tier ?? "unknown", trustResolution?.contributorUsername);
 		bundle.checkStatusPoster.postCheckStatus(repoIdentifier, ref, "pending", "Held for approval", holdSummary, credentials).catch((err) => {
-			logger$89.warn("Failed to post security hold check", {
+			logger$90.warn("Failed to post security hold check", {
 				deliveryId: info.deliveryId,
 				error: toErrorMessage(err)
 			});
@@ -6434,7 +6505,7 @@ async function registerWorkflowsOnDefaultBranchPush(args) {
 		if (globalWorkflows.length > 0) {
 			const permission = await deps.globalWorkflowPolicy.isWorkflowRepoAllowed(info.routingKey, repoIdentifier, resolvedOrgId);
 			if (!permission.allowed) {
-				logger$89.warn("Skipping global workflow registration: not permitted", {
+				logger$90.warn("Skipping global workflow registration: not permitted", {
 					reason: permission.reason,
 					repo: repoIdentifier
 				});
@@ -6452,7 +6523,7 @@ async function registerWorkflowsOnDefaultBranchPush(args) {
 	const newVersion = await deps.registrationStore.bumpVersion();
 	await deps.registrationIndex.refreshIfNeeded(newVersion);
 	if (deps.cronScheduler) await deps.cronScheduler.refreshCache();
-	logger$89.info("Workflow registrations updated", {
+	logger$90.info("Workflow registrations updated", {
 		repoIdentifier,
 		workflowCount: registerableWorkflows.length,
 		registryVersion: newVersion
@@ -6559,7 +6630,7 @@ async function dispatchGlobalWorkflowsForOtherRepos(args) {
 		if (deps.globalWorkflowPolicy) {
 			const sourceCheck = await deps.globalWorkflowPolicy.isSourceRepoAllowed(info.routingKey, repoIdentifier, resolvedOrgId);
 			if (!sourceCheck.allowed) {
-				logger$89.info("Skipping global workflow dispatch: source repo in deny-list", {
+				logger$90.info("Skipping global workflow dispatch: source repo in deny-list", {
 					sourceRepo: repoIdentifier,
 					eventRoutingKey: info.routingKey,
 					workflowRoutingKey: reg.routingKey,
@@ -6593,7 +6664,7 @@ async function dispatchGlobalWorkflowsForOtherRepos(args) {
 			});
 			for (const { lockJobName, input } of inputs) {
 				const result = await deps.dispatcher.dispatch(input);
-				if (result.status !== "rejected") logger$89.info("Global workflow job dispatched", {
+				if (result.status !== "rejected") logger$90.info("Global workflow job dispatched", {
 					runId: globalRunId,
 					workflow: reg.lockEntry.name,
 					job: lockJobName,
@@ -6631,7 +6702,7 @@ async function forwardTracesAndRecordEventLog(args) {
 	webhooksProcessedTotal.add(1, { result: matchedCount > 0 ? "matched" : "skipped" });
 	if (deps.webhookPayloadDir) {
 		const payloadDir = join(deps.webhookPayloadDir, repoIdentifier, info.deliveryId);
-		mkdir(payloadDir, { recursive: true }).then(() => writeFile(join(payloadDir, "payload.json"), JSON.stringify(payload, null, 2))).catch((err) => logger$89.warn("Failed to write webhook payload", { error: String(err) }));
+		mkdir(payloadDir, { recursive: true }).then(() => writeFile(join(payloadDir, "payload.json"), JSON.stringify(payload, null, 2))).catch((err) => logger$90.warn("Failed to write webhook payload", { error: String(err) }));
 	}
 	if (deps.eventLog) {
 		const firstRunId = matchedRunIds[0] ?? null;
@@ -6645,7 +6716,7 @@ async function forwardTracesAndRecordEventLog(args) {
 			runId: firstRunId
 		});
 	}
-	logger$89.info("Webhook processed", {
+	logger$90.info("Webhook processed", {
 		deliveryId: info.deliveryId,
 		event: info.event,
 		matchedWorkflows: matchedCount,
@@ -6716,7 +6787,7 @@ async function processWebhook$1(info, deps) {
 		lockFileSource: trust.lockFileSource
 	});
 	if (!lockOutcome.lockFile) {
-		logger$89.debug("No lock file found for per-repo matching, checking global workflows", {
+		logger$90.debug("No lock file found for per-repo matching, checking global workflows", {
 			deliveryId: info.deliveryId,
 			repoIdentifier,
 			ref,
@@ -6818,7 +6889,7 @@ async function processWebhook$1(info, deps) {
 		ref
 	});
 }
-var logger$89;
+var logger$90;
 var init_process_webhook = __esmMin((() => {
 	init_lock_source();
 	init_workflow_diff();
@@ -6828,7 +6899,7 @@ var init_process_webhook = __esmMin((() => {
 	init_prometheus();
 	init_dispatch_matched_workflow();
 	init_processor();
-	logger$89 = createLogger({ prefix: "pipeline" });
+	logger$90 = createLogger({ prefix: "pipeline" });
 }));
 //#endregion
 //#region src/pipeline/processor.ts
@@ -7014,7 +7085,7 @@ async function resolveLockFileWithFallback(args) {
 	};
 	const sameTenantRegistrations = registrationIndex.getByOrgAndRepo(customerId, repoIdentifier);
 	if (sameTenantRegistrations.length === 0) {
-		logger$88.info("Multi-provider fallback: no same-customer registrations for repo", {
+		logger$89.info("Multi-provider fallback: no same-customer registrations for repo", {
 			deliveryId,
 			inboundRoutingKey,
 			customerId,
@@ -7035,7 +7106,7 @@ async function resolveLockFileWithFallback(args) {
 		fallbackRoutingKeys.push(reg.routingKey);
 	}
 	if (fallbackRoutingKeys.length === 0) {
-		logger$88.info("Multi-provider fallback: all same-customer registrations share the inbound routingKey", {
+		logger$89.info("Multi-provider fallback: all same-customer registrations share the inbound routingKey", {
 			deliveryId,
 			inboundRoutingKey,
 			customerId,
@@ -7057,7 +7128,7 @@ async function resolveLockFileWithFallback(args) {
 		try {
 			lockFile = await lockFileCache.get(fallbackBundle.lockFileFetcher, repoIdentifier, ref, fallbackCredentials);
 		} catch (err) {
-			logger$88.warn("Multi-provider fallback: fetcher threw, continuing", {
+			logger$89.warn("Multi-provider fallback: fetcher threw, continuing", {
 				deliveryId,
 				inboundRoutingKey,
 				fallbackRoutingKey,
@@ -7067,7 +7138,7 @@ async function resolveLockFileWithFallback(args) {
 			continue;
 		}
 		if (lockFile) {
-			logger$88.info("Lock file resolved via fallback provider bundle", {
+			logger$89.info("Lock file resolved via fallback provider bundle", {
 				deliveryId,
 				inboundRoutingKey,
 				fallbackRoutingKey,
@@ -7084,7 +7155,7 @@ async function resolveLockFileWithFallback(args) {
 			};
 		}
 	}
-	logger$88.info("Multi-provider fallback exhausted without resolving lock file", {
+	logger$89.info("Multi-provider fallback exhausted without resolving lock file", {
 		deliveryId,
 		inboundRoutingKey,
 		customerId,
@@ -7108,7 +7179,7 @@ async function resolveOrgId(db, routingKey) {
 	if (source?.customer_id) return source.customer_id;
 	const genericSource = await db.selectFrom("generic_webhook_sources").select("customer_id").where("routing_key", "=", routingKey).executeTakeFirst();
 	if (genericSource?.customer_id) return genericSource.customer_id;
-	logger$88.warn("No customer_id found for routing key, falling back to __default__", { routingKey });
+	logger$89.warn("No customer_id found for routing key, falling back to __default__", { routingKey });
 	return "__default__";
 }
 /**
@@ -7230,7 +7301,7 @@ function triggerHasPathFilters(trigger) {
 async function dispatchReadyJob(runId, jobName, dispatcher, executionTracker, coordinator, db) {
 	const pendingCtx = await consumePendingJobContext(db, runId, jobName);
 	if (!pendingCtx) {
-		logger$88.warn("No pending dispatch context for ready job (may have been dispatched already)", {
+		logger$89.warn("No pending dispatch context for ready job (may have been dispatched already)", {
 			runId,
 			jobName
 		});
@@ -7239,13 +7310,13 @@ async function dispatchReadyJob(runId, jobName, dispatcher, executionTracker, co
 	try {
 		const result = await dispatcher.dispatch(pendingCtx.jobInput);
 		if (result.status === "rejected") {
-			logger$88.error("Scheduler-dispatched job rejected by dispatcher", {
+			logger$89.error("Scheduler-dispatched job rejected by dispatcher", {
 				runId,
 				jobName,
 				reason: result.reason
 			});
 			if (executionTracker) await executionTracker.onJobStatus(runId, jobName, ExecutionJobStatus.enum.failed, Date.now(), void 0, { error: `dispatch rejected: ${result.reason}` });
-		} else if (result.status === "queued-no-backend") logger$88.warn("Scheduler-dispatched job has no matching backend", {
+		} else if (result.status === "queued-no-backend") logger$89.warn("Scheduler-dispatched job has no matching backend", {
 			runId,
 			jobName
 		});
@@ -7262,14 +7333,14 @@ async function dispatchReadyJob(runId, jobName, dispatcher, executionTracker, co
 					ready_at: /* @__PURE__ */ new Date()
 				}).where("run_id", "=", runId).where("job_id", "=", result.jobId).execute();
 			}
-			logger$88.info("Scheduler-dispatched job ready and dispatched", {
+			logger$89.info("Scheduler-dispatched job ready and dispatched", {
 				runId,
 				jobName,
 				jobId: result.jobId
 			});
 		}
 	} catch (err) {
-		logger$88.error("Failed to dispatch scheduler-ready job", {
+		logger$89.error("Failed to dispatch scheduler-ready job", {
 			runId,
 			jobName,
 			error: toErrorMessage(err)
@@ -7306,10 +7377,10 @@ function summarizeDecision(decision) {
 		checksCount: decision.checks.length
 	};
 }
-var logger$88, pendingJobContexts;
+var logger$89, pendingJobContexts;
 var init_processor = __esmMin((() => {
 	init_process_webhook();
-	logger$88 = createLogger({ prefix: "pipeline" });
+	logger$89 = createLogger({ prefix: "pipeline" });
 	pendingJobContexts = /* @__PURE__ */ new Map();
 }));
 //#endregion
@@ -7325,9 +7396,9 @@ var init_processor = __esmMin((() => {
 * and are not handled here.
 */
 var log_pull_handler_exports = /* @__PURE__ */ __exportAll({ LogPullHandler: () => LogPullHandler$1 });
-var logger$87, LogPullHandler$1;
+var logger$88, LogPullHandler$1;
 var init_log_pull_handler = __esmMin((() => {
-	logger$87 = createLogger({ prefix: "log-pull" });
+	logger$88 = createLogger({ prefix: "log-pull" });
 	LogPullHandler$1 = class {
 		constructor(deps) {
 			this.deps = deps;
@@ -7416,7 +7487,7 @@ var init_log_pull_handler = __esmMin((() => {
 					complete: true
 				});
 			} catch (err) {
-				logger$87.error("Error handling log request", {
+				logger$88.error("Error handling log request", {
 					executionId: msg.executionId,
 					error: toErrorMessage(err)
 				});
@@ -7471,13 +7542,13 @@ async function loadEventLogRange(args) {
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
-			logger$86.error("cold-store fetchRange failed with no hot fallback; propagating", {
+			logger$87.error("cold-store fetchRange failed with no hot fallback; propagating", {
 				routingKey,
 				error: toErrorMessage(err)
 			});
 			throw err;
 		}
-		logger$86.warn("cold-store fetchRange failed; returning hot rows only", {
+		logger$87.warn("cold-store fetchRange failed; returning hot rows only", {
 			routingKey,
 			error: toErrorMessage(err)
 		});
@@ -7503,7 +7574,7 @@ async function loadEventLogByDeliveryId(args) {
 	if (hotRow) return hotRow;
 	if (!coldStore) return null;
 	if (!routingKey) {
-		logger$86.warn("cold-store delivery lookup without routingKey hint — scan skipped", {
+		logger$87.warn("cold-store delivery lookup without routingKey hint — scan skipped", {
 			orgId,
 			deliveryId
 		});
@@ -7519,7 +7590,7 @@ async function loadEventLogByDeliveryId(args) {
 			toTs: warmCutoff
 		})) if (row.org_id === orgId && row.delivery_id === deliveryId) return row;
 	} catch (err) {
-		logger$86.warn("cold-store fetchRange failed for delivery lookup", {
+		logger$87.warn("cold-store fetchRange failed for delivery lookup", {
 			routingKey,
 			orgId,
 			deliveryId,
@@ -7528,9 +7599,9 @@ async function loadEventLogByDeliveryId(args) {
 	}
 	return null;
 }
-var logger$86, EVENT_LOG_WARM_TTL_DAYS;
+var logger$87, EVENT_LOG_WARM_TTL_DAYS;
 var init_load_event_log_range = __esmMin((() => {
-	logger$86 = createLogger({ prefix: "load-event-log-range" });
+	logger$87 = createLogger({ prefix: "load-event-log-range" });
 	EVENT_LOG_WARM_TTL_DAYS = 30;
 }));
 //#endregion
@@ -7593,7 +7664,7 @@ function parsePolicyColumn(raw) {
 	const candidate = typeof raw === "string" ? safeParseJson(raw) : raw;
 	const result = dashboardWritePolicyMapSchema.safeParse(candidate);
 	if (!result.success) {
-		logger$85.warn("Invalid dashboard_write_policy column shape — treating as empty", { error: result.error.message });
+		logger$86.warn("Invalid dashboard_write_policy column shape — treating as empty", { error: result.error.message });
 		return {};
 	}
 	return result.data;
@@ -7735,9 +7806,9 @@ async function resetDashboardWritePolicy(db, customerId, options) {
 	if (Object.keys(updates).length === 0) return current;
 	return setDashboardWritePolicy(db, customerId, updates, options);
 }
-var logger$85, CACHE_TTL_MS, cache, dashboardWritePolicyEvents$1, DashboardWritePolicyDisabledError;
+var logger$86, CACHE_TTL_MS, cache, dashboardWritePolicyEvents$1, DashboardWritePolicyDisabledError;
 var init_dashboard_write_policy = __esmMin((() => {
-	logger$85 = createLogger({ prefix: "dashboard-write-policy" });
+	logger$86 = createLogger({ prefix: "dashboard-write-policy" });
 	CACHE_TTL_MS = 3e4;
 	cache = /* @__PURE__ */ new Map();
 	dashboardWritePolicyEvents$1 = new EventEmitter();
@@ -7815,11 +7886,11 @@ function decodeEventLogCursor(s) {
 		return null;
 	}
 }
-var logger$84, DashboardHandler$1;
+var logger$85, DashboardHandler$1;
 var init_handler = __esmMin((() => {
 	init_load_event_log_range();
 	init_dashboard_write_policy();
-	logger$84 = createLogger({ prefix: "dashboard-handler" });
+	logger$85 = createLogger({ prefix: "dashboard-handler" });
 	DashboardHandler$1 = class {
 		db;
 		logStorage;
@@ -8074,7 +8145,7 @@ var init_handler = __esmMin((() => {
 					...trustContext && { trustContext }
 				});
 				if (!validated.success) {
-					logger$84.error("Outgoing dashboard.run.detail response validation failed", {
+					logger$85.error("Outgoing dashboard.run.detail response validation failed", {
 						runId: msg.runId,
 						errors: validated.error.issues
 					});
@@ -8101,7 +8172,7 @@ var init_handler = __esmMin((() => {
 					...validated.data.trustContext && { trustContext: validated.data.trustContext }
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.run.detail", {
+				logger$85.error("Error handling dashboard.run.detail", {
 					runId: msg.runId,
 					error: toErrorMessage(err)
 				});
@@ -8159,7 +8230,7 @@ var init_handler = __esmMin((() => {
 					totalLines: lines.length
 				});
 				if (!validated.success) {
-					logger$84.error("Outgoing dashboard.step.logs response validation failed", {
+					logger$85.error("Outgoing dashboard.step.logs response validation failed", {
 						runId: msg.runId,
 						jobId: msg.jobId,
 						stepIndex: msg.stepIndex,
@@ -8189,7 +8260,7 @@ var init_handler = __esmMin((() => {
 					totalLines: validated.data.totalLines
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.step.logs", {
+				logger$85.error("Error handling dashboard.step.logs", {
 					runId: msg.runId,
 					jobId: msg.jobId,
 					stepIndex: msg.stepIndex,
@@ -8216,7 +8287,7 @@ var init_handler = __esmMin((() => {
 			const ctx = this.contextOrFallback(await this.resolveOrgForRun(msg.runId));
 			const payloadPath = `executions/${msg.runId}/webhook-payload.json`;
 			const backend = this.logStorage.constructor.name;
-			logger$84.info("Dashboard payload request received", {
+			logger$85.info("Dashboard payload request received", {
 				requestId: msg.requestId,
 				runId: msg.runId,
 				payloadPath,
@@ -8226,7 +8297,7 @@ var init_handler = __esmMin((() => {
 			try {
 				const result = await this.logStorage.read(payloadPath);
 				if (!result.data) {
-					logger$84.info("Dashboard payload not found", {
+					logger$85.info("Dashboard payload not found", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						payloadPath,
@@ -8248,7 +8319,7 @@ var init_handler = __esmMin((() => {
 				try {
 					payload = JSON.parse(result.data);
 				} catch {
-					logger$84.error("Dashboard payload data is not valid JSON", {
+					logger$85.error("Dashboard payload data is not valid JSON", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						payloadPath,
@@ -8266,7 +8337,7 @@ var init_handler = __esmMin((() => {
 					});
 					return;
 				}
-				logger$84.info("Dashboard payload served", {
+				logger$85.info("Dashboard payload served", {
 					requestId: msg.requestId,
 					runId: msg.runId,
 					bytes: result.data.length,
@@ -8282,7 +8353,7 @@ var init_handler = __esmMin((() => {
 					payload
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.payload", {
+				logger$85.error("Error handling dashboard.payload", {
 					requestId: msg.requestId,
 					runId: msg.runId,
 					payloadPath,
@@ -8370,7 +8441,7 @@ var init_handler = __esmMin((() => {
 					newRunId: result.newRunId
 				});
 			} catch (err) {
-				logger$84.error("Error handling run.rerun.request", {
+				logger$85.error("Error handling run.rerun.request", {
 					runId: msg.runId,
 					error: toErrorMessage(err)
 				});
@@ -8405,7 +8476,7 @@ var init_handler = __esmMin((() => {
 					cancelledJobs: result.cancelledJobs
 				});
 			} catch (err) {
-				logger$84.error("Error handling run.cancel.request", {
+				logger$85.error("Error handling run.cancel.request", {
 					runId: msg.runId,
 					error: toErrorMessage(err)
 				});
@@ -8486,7 +8557,7 @@ var init_handler = __esmMin((() => {
 					nextCursor
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.event-log.list", {
+				logger$85.error("Error handling dashboard.event-log.list", {
 					orgId: msg.orgId,
 					error: toErrorMessage(err)
 				});
@@ -8556,7 +8627,7 @@ var init_handler = __esmMin((() => {
 					nextCursor: result.nextCursor
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.access-log.list", {
+				logger$85.error("Error handling dashboard.access-log.list", {
 					orgId: msg.orgId,
 					error: toErrorMessage(err)
 				});
@@ -8619,7 +8690,7 @@ var init_handler = __esmMin((() => {
 					item
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.event-log.detail", {
+				logger$85.error("Error handling dashboard.event-log.detail", {
 					orgId: msg.orgId,
 					deliveryId: msg.deliveryId,
 					error: toErrorMessage(err)
@@ -8678,7 +8749,7 @@ var init_handler = __esmMin((() => {
 					routingKey: msg.routingKey
 				});
 			} catch (err) {
-				logger$84.error("Error loading event-log row for payload stream", {
+				logger$85.error("Error loading event-log row for payload stream", {
 					orgId: msg.orgId,
 					deliveryId: msg.deliveryId,
 					error: toErrorMessage(err)
@@ -8711,7 +8782,7 @@ var init_handler = __esmMin((() => {
 				const result = await this.logStorage.read(row.payload_key);
 				decompressed = gunzipSync(Buffer.from(result.data, "binary"));
 			} catch (err) {
-				logger$84.warn("Failed to read or decode event-log payload for stream", {
+				logger$85.warn("Failed to read or decode event-log payload for stream", {
 					deliveryId: msg.deliveryId,
 					payloadKey: row.payload_key,
 					error: toErrorMessage(err)
@@ -8813,7 +8884,7 @@ var init_handler = __esmMin((() => {
 					nextCursor
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.event-dlq.list", {
+				logger$85.error("Error handling dashboard.event-dlq.list", {
 					orgId: msg.orgId,
 					error: toErrorMessage(err)
 				});
@@ -8854,7 +8925,7 @@ var init_handler = __esmMin((() => {
 					total
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.event-dlq.count", {
+				logger$85.error("Error handling dashboard.event-dlq.count", {
 					orgId: msg.orgId,
 					error: toErrorMessage(err)
 				});
@@ -8915,7 +8986,7 @@ var init_handler = __esmMin((() => {
 				try {
 					await sql`SELECT pg_notify('kici_event_channel', ${msg.eventId})`.execute(this.eventStore.getDb());
 				} catch (err) {
-					logger$84.warn("pg_notify failed after DLQ retry; scanner will catch up", {
+					logger$85.warn("pg_notify failed after DLQ retry; scanner will catch up", {
 						eventId: msg.eventId,
 						error: toErrorMessage(err)
 					});
@@ -8930,7 +9001,7 @@ var init_handler = __esmMin((() => {
 					retried: true
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.event-dlq.retry", {
+				logger$85.error("Error handling dashboard.event-dlq.retry", {
 					orgId: msg.orgId,
 					eventId: msg.eventId,
 					error: toErrorMessage(err)
@@ -9001,7 +9072,7 @@ var init_handler = __esmMin((() => {
 					discarded: true
 				});
 			} catch (err) {
-				logger$84.error("Error handling dashboard.event-dlq.discard", {
+				logger$85.error("Error handling dashboard.event-dlq.discard", {
 					orgId: msg.orgId,
 					eventId: msg.eventId,
 					error: toErrorMessage(err)
@@ -9035,7 +9106,7 @@ var init_handler = __esmMin((() => {
 					newRunId: result.newRunId
 				});
 			} catch (err) {
-				logger$84.error("Error handling run.manual_schedule.request", {
+				logger$85.error("Error handling run.manual_schedule.request", {
 					registrationId: msg.registrationId,
 					error: toErrorMessage(err)
 				});
@@ -9080,7 +9151,7 @@ var init_handler = __esmMin((() => {
 						if (r.run_id === runId) rows.push(r);
 					}
 				} catch (err) {
-					logger$84.warn("cold-store fetchRange failed for run-detail", {
+					logger$85.warn("cold-store fetchRange failed for run-detail", {
 						table,
 						runId,
 						error: toErrorMessage(err)
@@ -9417,10 +9488,10 @@ async function loadActiveGenericRoutingKeys$1(db) {
 		has_git_config: row.git_config !== null
 	}));
 }
-var logger$83, GenericSourceManager;
+var logger$84, GenericSourceManager;
 var init_generic_sources = __esmMin((() => {
 	init_config$4();
-	logger$83 = createLogger({ prefix: "generic-sources" });
+	logger$84 = createLogger({ prefix: "generic-sources" });
 	GenericSourceManager = class {
 		constructor(db) {
 			this.db = db;
@@ -9464,7 +9535,7 @@ var init_generic_sources = __esmMin((() => {
 				git_config: validatedGitConfig ? JSON.stringify(validatedGitConfig) : null
 			};
 			const result = await this.db.insertInto("generic_webhook_sources").values(row).returningAll().executeTakeFirstOrThrow();
-			logger$83.info("Generic webhook source created", {
+			logger$84.info("Generic webhook source created", {
 				id: result.id,
 				orgId: input.orgId,
 				name: input.name,
@@ -9550,7 +9621,7 @@ var init_generic_sources = __esmMin((() => {
 				...updates,
 				updated_at: sql`now()`
 			}).where("id", "=", id).where("deleted_at", "is", null).returningAll().executeTakeFirst();
-			if (result) logger$83.info("Generic webhook source updated", {
+			if (result) logger$84.info("Generic webhook source updated", {
 				id,
 				fields: Object.keys(updates)
 			});
@@ -9561,14 +9632,14 @@ var init_generic_sources = __esmMin((() => {
 		*/
 		async softDelete(id) {
 			await this.db.updateTable("generic_webhook_sources").set({ deleted_at: sql`now()` }).where("id", "=", id).where("deleted_at", "is", null).execute();
-			logger$83.info("Generic webhook source soft-deleted", { id });
+			logger$84.info("Generic webhook source soft-deleted", { id });
 		}
 		/**
 		* Hard delete a source (removes the row entirely).
 		*/
 		async hardDelete(id) {
 			await this.db.deleteFrom("generic_webhook_sources").where("id", "=", id).execute();
-			logger$83.info("Generic webhook source hard-deleted", { id });
+			logger$84.info("Generic webhook source hard-deleted", { id });
 		}
 		/**
 		* Enable a source.
@@ -9578,7 +9649,7 @@ var init_generic_sources = __esmMin((() => {
 				enabled: true,
 				updated_at: sql`now()`
 			}).where("id", "=", id).where("deleted_at", "is", null).execute();
-			logger$83.info("Generic webhook source enabled", { id });
+			logger$84.info("Generic webhook source enabled", { id });
 		}
 		/**
 		* Disable a source.
@@ -9588,7 +9659,7 @@ var init_generic_sources = __esmMin((() => {
 				enabled: false,
 				updated_at: sql`now()`
 			}).where("id", "=", id).where("deleted_at", "is", null).execute();
-			logger$83.info("Generic webhook source disabled", { id });
+			logger$84.info("Generic webhook source disabled", { id });
 		}
 		/**
 		* Check if a request is a duplicate within the dedup window.
@@ -9820,9 +9891,9 @@ var init_normalizer$3 = __esmMin((() => {
 * kici.lock.json directly from the local filesystem. Used when the internal
 * provider processes webhooks for repos accessible via file:// URLs.
 */
-var logger$82, InternalLockFileFetcher;
+var logger$83, InternalLockFileFetcher;
 var init_lock_file_fetcher = __esmMin((() => {
-	logger$82 = createLogger({ prefix: "internal-lock-file" });
+	logger$83 = createLogger({ prefix: "internal-lock-file" });
 	InternalLockFileFetcher = class {
 		provider = "internal";
 		/**
@@ -9850,10 +9921,10 @@ var init_lock_file_fetcher = __esmMin((() => {
 				const content = await readFile(lockFilePath, "utf-8");
 				const lockFile = JSON.parse(content);
 				if (typeof lockFile.schemaVersion !== "number") {
-					logger$82.warn("Invalid lock file: missing or invalid schemaVersion", { lockFilePath });
+					logger$83.warn("Invalid lock file: missing or invalid schemaVersion", { lockFilePath });
 					return null;
 				}
-				logger$82.info("Lock file fetched from filesystem", {
+				logger$83.info("Lock file fetched from filesystem", {
 					lockFilePath,
 					schemaVersion: lockFile.schemaVersion,
 					workflowCount: lockFile.workflows.length
@@ -9861,10 +9932,10 @@ var init_lock_file_fetcher = __esmMin((() => {
 				return lockFile;
 			} catch (err) {
 				if (err.code === "ENOENT") {
-					logger$82.info("Lock file not found", { lockFilePath });
+					logger$83.info("Lock file not found", { lockFilePath });
 					return null;
 				}
-				logger$82.error("Failed to read lock file", {
+				logger$83.error("Failed to read lock file", {
 					lockFilePath,
 					error: toErrorMessage(err)
 				});
@@ -9952,13 +10023,6 @@ var init_internal = __esmMin((() => {
 * Extracted to eliminate code duplication between the two entry points.
 * Both entry points import these helpers instead of maintaining separate copies.
 */
-var entry_helpers_exports = /* @__PURE__ */ __exportAll({
-	canServeGenericProviderType: () => canServeGenericProviderType$1,
-	diffProviderSources: () => diffProviderSources,
-	extractRepoIdentifier: () => extractRepoIdentifier,
-	genericProviderTypeToSubtype: () => genericProviderTypeToSubtype$1,
-	registerInternalProviderIfConfigured: () => registerInternalProviderIfConfigured
-});
 /**
 * Map a generic_webhook_sources `provider_type` (plus optional `git_config`
 * presence) to the canonical {@link SourceSubtype}.
@@ -9969,7 +10033,7 @@ var entry_helpers_exports = /* @__PURE__ */ __exportAll({
 * subtype emitted to Platform stays consistent with what the dashboard
 * eventually renders.
 */
-function genericProviderTypeToSubtype$1(providerType, options) {
+function genericProviderTypeToSubtype(providerType, options) {
 	if (options.hasGitConfig) return SourceSubtype.enum.universal_git;
 	if (providerType === "universal-git") return SourceSubtype.enum.universal_git;
 	if (providerType === "internal") return SourceSubtype.enum.internal;
@@ -10054,7 +10118,7 @@ function registerInternalProviderIfConfigured(registry, config) {
 *   the same base dir).
 * - Any unknown provider_type returns false to fail closed.
 */
-function canServeGenericProviderType$1(providerType, config) {
+function canServeGenericProviderType(providerType, config) {
 	if (providerType === "generic" || providerType === "universal-git") return true;
 	if (providerType === "internal") {
 		const path = config.internalProviderRepoPath;
@@ -10071,6 +10135,53 @@ var init_entry_helpers = __esmMin((() => {
 	init_internal();
 }));
 //#endregion
+//#region src/sources/build-platform-sources.ts
+var build_platform_sources_exports = /* @__PURE__ */ __exportAll({ buildPlatformProviderSources: () => buildPlatformProviderSources$1 });
+/**
+* Build the full provider-source list the orchestrator advertises to the
+* Platform: GitHub-app sources from the {@link SourceManager} plus every
+* *servable* generic-webhook source.
+*
+* Used both at boot and by the live republish closure (platform mode). It MUST
+* return the complete set every time — a live source change re-sends the whole
+* list via `platformClient.updateSources()`, which diffs against the previously
+* sent set; a partial list would make the Platform deregister the sources that
+* happened to be omitted.
+*
+* The generic-row loader is injected (rather than taking a `db`) so the merge
+* logic is unit-testable without a live database.
+*/
+async function buildPlatformProviderSources$1(sourceManager, loadGenericRows, config) {
+	const providerSources = [...sourceManager.getSources()];
+	try {
+		const genericRows = await loadGenericRows();
+		const skipped = [];
+		for (const gs of genericRows) if (canServeGenericProviderType(gs.provider_type, config)) providerSources.push({
+			provider: "generic",
+			routingKey: gs.routing_key,
+			name: gs.name,
+			subtype: genericProviderTypeToSubtype(gs.provider_type, { hasGitConfig: gs.has_git_config })
+		});
+		else skipped.push({
+			routing_key: gs.routing_key,
+			provider_type: gs.provider_type
+		});
+		if (genericRows.length > 0) logger$82.info("Added generic sources to Platform registration", {
+			count: genericRows.length - skipped.length,
+			skipped: skipped.length
+		});
+		if (skipped.length > 0) logger$82.info("Skipped non-servable generic sources for Platform registration", { skipped });
+	} catch (err) {
+		logger$82.warn("Failed to load generic sources for Platform registration", { error: toErrorMessage(err) });
+	}
+	return providerSources;
+}
+var logger$82;
+var init_build_platform_sources = __esmMin((() => {
+	init_entry_helpers();
+	logger$82 = createLogger({ prefix: "platform-sources" });
+}));
+//#endregion
 //#region src/ws/dashboard-env-handler.ts
 /**
 * Dashboard environment handler for the orchestrator.
@@ -11271,7 +11382,7 @@ var init_dashboard_registrations_handler = __esmMin((() => {
 					"git_config"
 				]).where("deleted_at", "is", null).where("routing_key", "in", routingKeys).execute();
 				for (const row of genericRows) {
-					const subtype = genericProviderTypeToSubtype$1(row.provider_type, { hasGitConfig: row.git_config !== null });
+					const subtype = genericProviderTypeToSubtype(row.provider_type, { hasGitConfig: row.git_config !== null });
 					result.set(row.routing_key, {
 						routingKey: row.routing_key,
 						name: row.name,
@@ -12610,10 +12721,10 @@ async function emitRerunEventAndCheckRun(opts) {
 		sourceRepo: originalRun.repo_identifier,
 		sourceRoutingKey: originalRun.routing_key ?? void 0
 	});
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = originalRun.repo_identifier.split("/");
 		const jobNames = workflow.jobs.filter(isLockStaticJob).map((j) => j.name);
-		deps.commitStatusReporter.setPending({
+		deps.checkRunReporter.setPending({
 			provider: originalRun.provider,
 			owner,
 			repo,
@@ -15038,7 +15149,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$73 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.5";
+	SOFTWARE_VERSION$1 = "0.1.7";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -16501,7 +16612,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$72 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.5";
+	SOFTWARE_VERSION = "0.1.7";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -17135,7 +17246,7 @@ var init_coordinator = __esmMin((() => {
 		peerRegistry;
 		dispatcher;
 		executionTracker;
-		commitStatusReporter;
+		checkRunReporter;
 		getPeerClient;
 		sendAndWaitAckViaHandler;
 		sendToPeerViaHandler;
@@ -17157,7 +17268,7 @@ var init_coordinator = __esmMin((() => {
 			this.peerRegistry = deps.peerRegistry;
 			this.dispatcher = deps.dispatcher;
 			this.executionTracker = deps.executionTracker;
-			this.commitStatusReporter = deps.commitStatusReporter;
+			this.checkRunReporter = deps.checkRunReporter;
 			this.getPeerClient = deps.getPeerClient;
 			this.sendAndWaitAckViaHandler = deps.sendAndWaitAckViaHandler;
 			this.sendToPeerViaHandler = deps.sendToPeerViaHandler;
@@ -17280,10 +17391,10 @@ var init_coordinator = __esmMin((() => {
 			const repoIdentifier = (msg.repoUrl ?? "").replace(/\.git$/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/^[^/]+@[^:]+:/, "") || "";
 			const providerContext = msg.providerContext ?? {};
 			const installationId = typeof providerContext.installationId === "number" ? providerContext.installationId : void 0;
-			if (this.commitStatusReporter && repoIdentifier && msg.sha) {
+			if (this.checkRunReporter && repoIdentifier && msg.sha) {
 				const [owner, repo] = repoIdentifier.split("/");
 				if (owner && repo) try {
-					await this.commitStatusReporter.setPendingAwait({
+					await this.checkRunReporter.setPendingAwait({
 						provider: msg.provider ?? "",
 						owner,
 						repo,
@@ -23533,7 +23644,7 @@ var init_check_run_summary = __esmMin((() => {
 	];
 }));
 //#endregion
-//#region src/reporting/commit-status.ts
+//#region src/reporting/check-run-reporter.ts
 /**
 * GitHub check run integration module.
 *
@@ -23548,7 +23659,7 @@ var init_check_run_summary = __esmMin((() => {
 * Check run IDs are tracked in-memory after creation so that subsequent
 * updates (job complete, workflow complete) can reference them via checks.update().
 *
-* Enriched output (Phase 14):
+* Enriched output:
 * - Live step progress with checklist-style updates (debounced at 5s)
 * - Failed check runs include step names, error messages, exit codes, and log context
 * - Check run annotations link failures to step source locations in workflow files (.kici/workflows/*.ts)
@@ -23558,7 +23669,7 @@ var init_check_run_summary = __esmMin((() => {
 * Note: The engine-level CheckStatusPoster interface (packages/engine/src/provider/check-status-poster.ts)
 * provides a provider-agnostic API for posting security-related check statuses (holds, approvals,
 * workflow modifications). The GitHub implementation is at packages/orchestrator/src/providers/github/check-status-poster.ts.
-* This CommitStatusReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
+* This CheckRunReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
 * Future cleanup may unify both under CheckStatusPoster, but they serve different purposes today.
 */
 /**
@@ -23580,14 +23691,14 @@ function buildJobFailureDescription(data) {
 	if (data.error) return `Job error: ${data.error}`;
 	return "Job failed";
 }
-var logger$60, PROGRESS_DEBOUNCE_MS, CommitStatusReporter;
-var init_commit_status = __esmMin((() => {
+var logger$60, PROGRESS_DEBOUNCE_MS, CheckRunReporter;
+var init_check_run_reporter = __esmMin((() => {
 	init_auth();
 	init_prometheus();
 	init_check_run_summary();
-	logger$60 = createLogger({ prefix: "commit-status" });
+	logger$60 = createLogger({ prefix: "check-run-reporter" });
 	PROGRESS_DEBOUNCE_MS = 5e3;
-	CommitStatusReporter = class {
+	CheckRunReporter = class {
 		/**
 		* L1 cache: composite key → check run ID.
 		*
@@ -23842,7 +23953,7 @@ var init_commit_status = __esmMin((() => {
 		*/
 		async recoverState() {
 			if (!this.deps.trackingStore) return;
-			logger$60.info("CommitStatusReporter recovered (DB-backed state lookups enabled)");
+			logger$60.info("CheckRunReporter recovered (DB-backed state lookups enabled)");
 		}
 		/** Track a check run key associated with a runId for later cleanup. */
 		trackRunKey(runId, key) {
@@ -26975,10 +27086,29 @@ function createSourceRoutes(deps) {
 				privateKey,
 				webhookSecret
 			});
+			let webhookUrl = null;
+			let webhookNote;
+			if (deps.resolveSourceWebhookUrl) try {
+				const resolved = await deps.resolveSourceWebhookUrl({
+					routingKey: source.routing_key,
+					provider,
+					sourceId: source.id
+				});
+				webhookUrl = resolved.webhookUrl;
+				webhookNote = resolved.webhookNote;
+			} catch (err) {
+				logger$53.warn("Failed to resolve webhook URL for added source", {
+					routingKey: source.routing_key,
+					error: toErrorMessage(err)
+				});
+				webhookNote = "resolve-failed";
+			}
 			return c.json({
 				routingKey: source.routing_key,
 				id: source.id,
-				name: source.name
+				name: source.name,
+				webhookUrl,
+				...webhookNote && { webhookNote }
 			}, 201);
 		} catch (err) {
 			logger$53.error("Failed to add source", { error: toErrorMessage(err) });
@@ -30966,7 +31096,10 @@ function createAdminRoutes(deps) {
 			return handleError$3(c, err);
 		}
 	});
-	if (deps.sourceStore) app.route("/api/v1/admin", createSourceRoutes({ sourceStore: deps.sourceStore }));
+	if (deps.sourceStore) app.route("/api/v1/admin", createSourceRoutes({
+		sourceStore: deps.sourceStore,
+		resolveSourceWebhookUrl: deps.resolveSourceWebhookUrl
+	}));
 	if (deps.db && deps.pool) app.route("/api/v1/admin", createDbRoutes({
 		db: deps.db,
 		pool: deps.pool
@@ -31837,7 +31970,7 @@ var init_universal_git = __esmMin((() => {
 */
 function registerProviderBundleForSource(row, deps) {
 	if (row.provider_type === "internal") {
-		if (!canServeGenericProviderType$1("internal", deps.config)) {
+		if (!canServeGenericProviderType("internal", deps.config)) {
 			logger$40.info("Skipping internal provider bundle registration — KICI_INTERNAL_PROVIDER_REPO_PATH not configured on this peer", {
 				routingKey: row.routing_key,
 				sourceName: row.name
@@ -33916,14 +34049,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.5",
-			buildDate: "2026-05-25T13:18:39.135Z",
-			buildCommit: "600c43faa",
-			sdkVersion: "0.1.5",
+			version: "0.1.7",
+			buildDate: "2026-05-26T13:18:35.789Z",
+			buildCommit: "4c0abe030",
+			sdkVersion: "0.1.7",
 			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.5",
-			sharedBundleHash: "12d8f17547ef0a63c0d54c59d918eefb5c5ad16d44c3b4d7fce081d23fe44a7a",
-			engineVersion: "0.1.5",
+			sharedVersion: "0.1.7",
+			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
+			engineVersion: "0.1.7",
 			engineBundleHash: "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -33958,7 +34091,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.5",
+			orchestratorVersion: "0.1.7",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -34873,7 +35006,7 @@ function createApp(deps) {
 		sourceCache: deps.sourceCache,
 		depCache: deps.depCache,
 		cacheStorage: deps.cacheStorage,
-		onJobStatus: deps.platformClient || deps.executionTracker || deps.commitStatusReporter || deps.pendingBuilds || deps.pendingInits ? (_agentId, msg) => {
+		onJobStatus: deps.platformClient || deps.executionTracker || deps.checkRunReporter || deps.pendingBuilds || deps.pendingInits ? (_agentId, msg) => {
 			if (deps.pendingBuilds && deps.pendingBuilds.has(msg.jobId)) {
 				if (msg.state === ExecutionJobStatus.enum.success && msg.data?.buildComplete) deps.pendingBuilds.resolve(msg.jobId);
 				else if (msg.state === ExecutionJobStatus.enum.failed || msg.state === ExecutionJobStatus.enum.cancelled) deps.pendingBuilds.reject(msg.jobId, new Error(msg.data?.error ?? `Build ${msg.state}`));
@@ -34905,13 +35038,13 @@ function createApp(deps) {
 				},
 				timestamp: msg.timestamp
 			});
-			if (deps.commitStatusReporter && deps.executionTracker && (msg.state === ExecutionJobStatus.enum.success || msg.state === ExecutionJobStatus.enum.failed || msg.state === ExecutionJobStatus.enum.cancelled)) {
+			if (deps.checkRunReporter && deps.executionTracker && (msg.state === ExecutionJobStatus.enum.success || msg.state === ExecutionJobStatus.enum.failed || msg.state === ExecutionJobStatus.enum.cancelled)) {
 				const execContext = deps.executionTracker.getExecutionContext(msg.runId);
 				if (execContext) {
 					const [owner, repo] = execContext.repoIdentifier.split("/");
 					let description;
 					if (msg.state === ExecutionJobStatus.enum.failed && msg.data) description = buildJobFailureDescription(msg.data);
-					deps.commitStatusReporter.updateJobStatus({
+					deps.checkRunReporter.updateJobStatus({
 						provider: execContext.provider,
 						owner,
 						repo,
@@ -34962,11 +35095,11 @@ function createApp(deps) {
 				} : msg.data;
 				deps.executionTracker.onStepStatus(msg.runId, msg.jobId, msg.stepIndex, msg.stepName, msg.state, msg.timestamp, data, msg.logBytesStreamed);
 			}
-			if (deps.commitStatusReporter && deps.executionTracker) {
+			if (deps.checkRunReporter && deps.executionTracker) {
 				const execContext = deps.executionTracker.getExecutionContext(msg.runId);
 				if (execContext) {
 					const [owner, repo] = execContext.repoIdentifier.split("/");
-					deps.commitStatusReporter.updateStepProgress({
+					deps.checkRunReporter.updateStepProgress({
 						provider: execContext.provider,
 						owner,
 						repo,
@@ -35260,7 +35393,7 @@ function createApp(deps) {
 						pendingBuilds: deps.pendingBuilds,
 						pendingInits: deps.pendingInits,
 						pendingDynamics: deps.pendingDynamics,
-						commitStatusReporter: deps.commitStatusReporter,
+						checkRunReporter: deps.checkRunReporter,
 						executionTracker: deps.executionTracker,
 						onSourceLocationsExtracted,
 						eventRouter: deps.eventRouter,
@@ -35301,7 +35434,8 @@ function createApp(deps) {
 	}));
 	if (deps.adminDeps) app.route("", createAdminRoutes({
 		...deps.adminDeps,
-		accessLog: deps.accessLogWriter
+		accessLog: deps.accessLogWriter,
+		resolveSourceWebhookUrl: deps.resolveSourceWebhookUrl
 	}));
 	if (deps.genericSourceManager && deps.trustStore && deps.adminDeps) app.route("", createAdminEventRoutes({
 		sourceManager: deps.genericSourceManager,
@@ -35358,7 +35492,7 @@ function createApp(deps) {
 			lockFileCache: deps.lockFileCache,
 			dispatcher: deps.dispatcher,
 			executionTracker: deps.executionTracker,
-			commitStatusReporter: deps.commitStatusReporter,
+			checkRunReporter: deps.checkRunReporter,
 			sourceCache: deps.sourceCache,
 			buildCoordinator: deps.buildCoordinator,
 			depCache: deps.depCache,
@@ -35515,7 +35649,7 @@ var init_app = __esmMin((() => {
 	init_blob_routes();
 	init_agent_api_registry();
 	init_server_options();
-	init_commit_status();
+	init_check_run_reporter();
 	init_agent_handler();
 	init_observer_handler();
 	init_test_trigger();
@@ -42726,7 +42860,7 @@ var init_stale_run_detector = __esmMin((() => {
 	StaleRunDetector = class {
 		db;
 		executionTracker;
-		commitStatusReporter;
+		checkRunReporter;
 		scalerManager;
 		dispatcher;
 		registry;
@@ -42737,7 +42871,7 @@ var init_stale_run_detector = __esmMin((() => {
 		constructor(deps) {
 			this.db = deps.db;
 			this.executionTracker = deps.executionTracker;
-			this.commitStatusReporter = deps.commitStatusReporter;
+			this.checkRunReporter = deps.checkRunReporter;
 			this.scalerManager = deps.scalerManager;
 			this.dispatcher = deps.dispatcher;
 			this.registry = deps.registry;
@@ -42959,11 +43093,11 @@ var init_stale_run_detector = __esmMin((() => {
 					});
 					markedCount++;
 					staleRunsDetectedTotal.add(1);
-					if (this.commitStatusReporter) {
+					if (this.checkRunReporter) {
 						const [owner, repo] = entry.repo_identifier.split("/");
 						const providerCtx = typeof entry.provider_context === "string" ? JSON.parse(entry.provider_context) : entry.provider_context ?? {};
 						const installationId = typeof providerCtx.installationId === "number" ? providerCtx.installationId : void 0;
-						this.commitStatusReporter.updateJobStatus({
+						this.checkRunReporter.updateJobStatus({
 							provider: entry.provider,
 							owner,
 							repo,
@@ -43021,11 +43155,11 @@ var init_stale_run_detector = __esmMin((() => {
 			});
 			await this.executionTracker.cancelStepsForJob(job.run_id, job.job_id, errorMessage);
 			affectedRunIds.add(job.run_id);
-			if (this.commitStatusReporter) {
+			if (this.checkRunReporter) {
 				const [owner, repo] = job.repo_identifier.split("/");
 				const providerCtx = typeof job.provider_context === "string" ? JSON.parse(job.provider_context) : job.provider_context ?? {};
 				const installationId = typeof providerCtx.installationId === "number" ? providerCtx.installationId : void 0;
-				this.commitStatusReporter.updateJobStatus({
+				this.checkRunReporter.updateJobStatus({
 					provider: job.provider,
 					owner,
 					repo,
@@ -44115,10 +44249,27 @@ var init_source_manager = __esmMin((() => {
 		currentSources = [];
 		debounceTimer = null;
 		debounceMs;
+		/**
+		* Change callback. Stored in a mutable field (not read off `opts`) so a
+		* mode-specific hook can rewire it after construction — the platform-mode
+		* boot wires it to push the full source list to the Platform via
+		* `platformClient.updateSources()`. Defaults to the (possibly no-op) value
+		* passed at construction.
+		*/
+		onSourcesChanged;
 		constructor(opts) {
 			this.opts = opts;
 			this.registry = new ProviderRegistry();
 			this.debounceMs = opts.debounceMs ?? 200;
+			this.onSourcesChanged = opts.onSourcesChanged;
+		}
+		/**
+		* Replace the change callback after construction. The SourceManager is built
+		* early (before the Platform client exists); the platform-mode boot calls
+		* this once the client is ready so live source changes propagate upstream.
+		*/
+		setOnSourcesChanged(cb) {
+			this.onSourcesChanged = cb;
 		}
 		/** Get current ProviderRegistry (rebuilt on each reload). */
 		getRegistry() {
@@ -44193,7 +44344,7 @@ var init_source_manager = __esmMin((() => {
 				added: diff.added.length,
 				removed: diff.removed.length
 			});
-			if (diff.added.length > 0 || diff.removed.length > 0) this.opts.onSourcesChanged(diff);
+			if (diff.added.length > 0 || diff.removed.length > 0) this.onSourcesChanged(diff);
 		}
 		/**
 		* Build a ProviderBundle for a source with decrypted secrets.
@@ -45842,9 +45993,19 @@ var init_generic_sources_listener = __esmMin((() => {
 		pending = /* @__PURE__ */ new Set();
 		debounceTimer = null;
 		debounceMs;
+		/**
+		* Drain-applied-change callback. Mutable so the platform-mode boot can wire
+		* it after the Platform client exists (this listener is constructed before).
+		*/
+		onChange;
 		constructor(opts) {
 			this.opts = opts;
 			this.debounceMs = opts.debounceMs ?? 200;
+			this.onChange = opts.onChange;
+		}
+		/** Replace the drain-applied-change callback after construction. */
+		setOnChange(cb) {
+			this.onChange = cb;
 		}
 		/** Open the dedicated client and subscribe. Cold-boot bundle
 		*  registration is handled by the orchestrator-core startup loop
@@ -45890,6 +46051,7 @@ var init_generic_sources_listener = __esmMin((() => {
 		async drain() {
 			const keys = Array.from(this.pending);
 			this.pending.clear();
+			let appliedChange = false;
 			for (const routingKey of keys) try {
 				const row = await this.opts.sourceManager.getByRoutingKey(routingKey);
 				if (!row) {
@@ -45898,6 +46060,7 @@ var init_generic_sources_listener = __esmMin((() => {
 						routingKey,
 						removed
 					});
+					appliedChange = true;
 					continue;
 				}
 				this.opts.providerRegistry.unregister(routingKey);
@@ -45906,12 +46069,14 @@ var init_generic_sources_listener = __esmMin((() => {
 					config: this.opts.config,
 					secretResolver: this.opts.secretResolver
 				});
+				appliedChange = true;
 			} catch (err) {
 				logger$8.error("Failed to apply generic-source change", {
 					routingKey,
 					error: toErrorMessage(err)
 				});
 			}
+			if (appliedChange) this.onChange?.();
 		}
 	};
 }));
@@ -47659,7 +47824,7 @@ function buildOnEventMatched(dispatcherRef, executionTracker, providerRegistryRe
 		}
 	};
 }
-function initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, commitStatusReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef) {
+function initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, checkRunReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef) {
 	const peerClients = /* @__PURE__ */ new Map();
 	const getLocalInventory = () => ({
 		instanceId: config.instanceId,
@@ -47763,7 +47928,7 @@ function initializeCluster(config, db, agentRegistry, dispatcher, executionTrack
 		peerRegistry,
 		dispatcher,
 		executionTracker,
-		commitStatusReporter,
+		checkRunReporter,
 		getPeerClient: (instanceId) => peerClients.get(instanceId),
 		sendAndWaitAckViaHandler: (targetId, msg, timeoutMs) => peerHandlerObj?.sendAndWaitAck(targetId, msg, timeoutMs) ?? Promise.resolve(false),
 		sendToPeerViaHandler: (targetId, msg) => peerHandlerObj?.sendToPeer(targetId, msg) ?? false
@@ -47973,7 +48138,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	const stepLogBuffer = new StepLogBuffer();
 	const sourceLocationStore = new SourceLocationStore();
 	const checkRunTrackingStore = new CheckRunTrackingStore(db);
-	const commitStatusReporter = new CommitStatusReporter({
+	const checkRunReporter = new CheckRunReporter({
 		providerRegistry,
 		stepLogBuffer,
 		trackingStore: checkRunTrackingStore,
@@ -48020,7 +48185,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 					});
 				});
 				const [owner, repo] = context.repoIdentifier.split("/");
-				commitStatusReporter.updateWorkflowStatus({
+				checkRunReporter.updateWorkflowStatus({
 					provider: context.provider,
 					owner,
 					repo,
@@ -48070,7 +48235,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		orgId: trackerExtras?.orgId,
 		onRunPruned: (runId) => {
 			stepLogBuffer.cleanup(runId);
-			commitStatusReporter.cleanupRun(runId);
+			checkRunReporter.cleanupRun(runId);
 		},
 		onWorkflowComplete: (data) => {
 			if (!eventEmitter) return;
@@ -48176,7 +48341,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	if (pgSecretStore) {
 		providerRegistry = await sourceManager.start();
 		providerRegistryRef.current = providerRegistry;
-		commitStatusReporter.updateRegistry(providerRegistry);
+		checkRunReporter.updateRegistry(providerRegistry);
 		const registeredKeys = providerRegistry.getRoutingKeys();
 		if (registeredKeys.length > 0) logger$2.info("Provider registry built from sources", { routingKeys: registeredKeys });
 		else logger$2.info("No sources configured yet (orchestrator can start with zero sources)");
@@ -48323,7 +48488,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		ttl: config.lockfileCacheTtlMs
 	});
 	const configReloaderRef = { current: null };
-	const cluster = initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, commitStatusReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef);
+	const cluster = initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, checkRunReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef);
 	coordinatorRef.current = cluster.coordinator;
 	if (adminDeps) adminDeps.broadcastAgentTokenRevoke = cluster.broadcastAgentTokenRevoke;
 	let masterKeyForStore = null;
@@ -48362,7 +48527,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		pendingBuilds,
 		pendingInits,
 		pendingDynamics,
-		commitStatusReporter,
+		checkRunReporter,
 		stepLogBuffer,
 		sourceLocationStore,
 		logStorage,
@@ -48398,6 +48563,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		localConfigVersion: localConfigVersionRef.value,
 		sourceStore,
 		sourceManager,
+		genericSourcesChangeListener,
 		eventLogWriter,
 		accessLogWriter,
 		coldStore: coldStoreSingleton,
@@ -48449,7 +48615,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 			await sourceManager.reload();
 			providerRegistry = sourceManager.getRegistry();
 			providerRegistryRef.current = providerRegistry;
-			commitStatusReporter.updateRegistry(providerRegistry);
+			checkRunReporter.updateRegistry(providerRegistry);
 			logger$2.info("Provider registry reloaded from sources", { routingKeys: providerRegistry.getRoutingKeys() });
 		}),
 		onScalerReload: scalerManager ? async () => {
@@ -48550,7 +48716,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		pendingBuilds,
 		pendingInits,
 		pendingDynamics,
-		commitStatusReporter,
+		checkRunReporter,
 		executionTracker,
 		logWriter,
 		stepLogBuffer,
@@ -48604,7 +48770,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	const staleRunDetector = new StaleRunDetector({
 		db,
 		executionTracker,
-		commitStatusReporter,
+		checkRunReporter,
 		scalerManager: scalerManager ?? void 0,
 		dispatcher,
 		registry: agentRegistry,
@@ -48811,7 +48977,7 @@ var init_orchestrator_core = __esmMin((() => {
 	init_scaler();
 	init_storage();
 	init_cache();
-	init_commit_status();
+	init_check_run_reporter();
 	init_check_run_tracking_store();
 	init_scaler_state_store();
 	init_processor();
@@ -50060,13 +50226,13 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.5";
-	WORKER_BUILD_COMMIT = "600c43faa";
-	WORKER_SDK_VERSION = "0.1.5";
+	ORCHESTRATOR_VERSION$1 = "0.1.7";
+	WORKER_BUILD_COMMIT = "4c0abe030";
+	WORKER_SDK_VERSION = "0.1.7";
 	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.5";
-	WORKER_SHARED_BUNDLE_HASH = "12d8f17547ef0a63c0d54c59d918eefb5c5ad16d44c3b4d7fce081d23fe44a7a";
-	WORKER_ENGINE_VERSION = "0.1.5";
+	WORKER_SHARED_VERSION = "0.1.7";
+	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
+	WORKER_ENGINE_VERSION = "0.1.7";
 	WORKER_ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 	logger$1 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -50088,13 +50254,13 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown in reverse order:
 * Platform client -> agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.5";
-const BUILD_COMMIT = "600c43faa";
-const SDK_VERSION = "0.1.5";
+const ORCHESTRATOR_VERSION = "0.1.7";
+const BUILD_COMMIT = "4c0abe030";
+const SDK_VERSION = "0.1.7";
 const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.5";
-const SHARED_BUNDLE_HASH = "12d8f17547ef0a63c0d54c59d918eefb5c5ad16d44c3b4d7fce081d23fe44a7a";
-const ENGINE_VERSION = "0.1.5";
+const SHARED_VERSION = "0.1.7";
+const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
+const ENGINE_VERSION = "0.1.7";
 const ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
@@ -50107,7 +50273,7 @@ const { LogPullHandler } = await Promise.resolve().then(() => (init_log_pull_han
 const { DashboardHandler } = await Promise.resolve().then(() => (init_handler(), handler_exports));
 const { payloadFromObject } = await Promise.resolve().then(() => (init_event_log$1(), event_log_exports));
 const { loadActiveGenericRoutingKeys } = await Promise.resolve().then(() => (init_generic_sources(), generic_sources_exports));
-const { canServeGenericProviderType, genericProviderTypeToSubtype } = await Promise.resolve().then(() => (init_entry_helpers(), entry_helpers_exports));
+const { buildPlatformProviderSources } = await Promise.resolve().then(() => (init_build_platform_sources(), build_platform_sources_exports));
 const { DashboardEnvHandler } = await Promise.resolve().then(() => (init_dashboard_env_handler(), dashboard_env_handler_exports));
 const { DashboardRegistrationsHandler } = await Promise.resolve().then(() => (init_dashboard_registrations_handler(), dashboard_registrations_handler_exports));
 const { DashboardBackendsHandler } = await Promise.resolve().then(() => (init_dashboard_backends_handler(), dashboard_backends_handler_exports));
@@ -50342,28 +50508,8 @@ await guardStartup(logger, async () => {
 			let identityLinks = [];
 			let orgMemberPermissions = /* @__PURE__ */ new Map();
 			const heldRunStore = new HeldRunStore(sub.db);
-			const providerSources = [...sub.sourceManager.getSources()];
-			try {
-				const genericRows = await loadActiveGenericRoutingKeys(sub.db);
-				const skipped = [];
-				for (const gs of genericRows) if (canServeGenericProviderType(gs.provider_type, config)) providerSources.push({
-					provider: "generic",
-					routingKey: gs.routing_key,
-					name: gs.name,
-					subtype: genericProviderTypeToSubtype(gs.provider_type, { hasGitConfig: gs.has_git_config })
-				});
-				else skipped.push({
-					routing_key: gs.routing_key,
-					provider_type: gs.provider_type
-				});
-				if (genericRows.length > 0) logger.info("Added generic sources to Platform registration", {
-					count: genericRows.length - skipped.length,
-					skipped: skipped.length
-				});
-				if (skipped.length > 0) logger.info("Skipped non-servable generic sources for Platform registration", { skipped });
-			} catch (err) {
-				logger.warn("Failed to load generic sources for Platform registration", { error: toErrorMessage(err) });
-			}
+			const loadGenericRows = () => loadActiveGenericRoutingKeys(sub.db);
+			const providerSources = await buildPlatformProviderSources(sub.sourceManager, loadGenericRows, config);
 			let logPullSendFn = null;
 			const logPullHandler = new LogPullHandler({
 				logStorage: sub.logStorage,
@@ -50391,7 +50537,7 @@ await guardStartup(logger, async () => {
 						dispatcher: sub.dispatcher,
 						jobQueue: sub.queue,
 						platformClient,
-						commitStatusReporter: sub.commitStatusReporter,
+						checkRunReporter: sub.checkRunReporter,
 						coordinator: sub.coordinator,
 						secretResolver: sub.secretResolver,
 						eventRouter: sub.eventRouter,
@@ -50412,7 +50558,7 @@ await guardStartup(logger, async () => {
 						dispatcher: sub.dispatcher,
 						jobQueue: sub.queue,
 						platformClient,
-						commitStatusReporter: sub.commitStatusReporter,
+						checkRunReporter: sub.checkRunReporter,
 						coordinator: sub.coordinator,
 						secretResolver: sub.secretResolver,
 						eventRouter: sub.eventRouter,
@@ -50756,7 +50902,7 @@ await guardStartup(logger, async () => {
 				onStaleCheckrunCleanup: (msg) => {
 					for (const run of msg.runs) {
 						const [owner, repo] = run.repoIdentifier.split("/");
-						sub.commitStatusReporter.cleanupStaleCheckRuns({
+						sub.checkRunReporter.cleanupStaleCheckRuns({
 							provider: run.provider,
 							routingKey: run.routingKey,
 							owner,
@@ -50908,7 +51054,7 @@ await guardStartup(logger, async () => {
 							pendingBuilds: sub.pendingBuilds,
 							pendingInits: sub.pendingInits,
 							pendingDynamics: sub.pendingDynamics,
-							commitStatusReporter: sub.commitStatusReporter,
+							checkRunReporter: sub.checkRunReporter,
 							executionTracker: sub.executionTracker,
 							coordinator: sub.coordinator,
 							secretResolver: sub.secretResolver ?? void 0,
@@ -50948,13 +51094,18 @@ await guardStartup(logger, async () => {
 					}
 				}
 			});
-			sub.commitStatusReporter.setOrgPublicAliasResolver(() => platformClient.getOrgPublicAlias());
+			sub.checkRunReporter.setOrgPublicAliasResolver(() => platformClient.getOrgPublicAlias());
 			logPullSendFn = (msg) => platformClient.sendRaw(msg);
 			dashboardSendFn = (msg) => platformClient.sendRaw(msg);
 			dashboardEnvSendFn = (msg) => platformClient.sendRaw(msg);
 			dashboardRegSendFn = (msg) => platformClient.sendRaw(msg);
 			dashboardBackendsSendFn = (msg) => platformClient.sendRaw(msg);
 			dashboardGlobalWorkflowsSendFn = (msg) => platformClient.sendRaw(msg);
+			const republishSources = () => {
+				buildPlatformProviderSources(sub.sourceManager, loadGenericRows, config).then((sources) => platformClient.updateSources(sources)).catch((err) => logger.warn("Failed to republish sources to Platform", { error: toErrorMessage(err) }));
+			};
+			sub.sourceManager.setOnSourcesChanged(() => republishSources());
+			sub.genericSourcesChangeListener.setOnChange(() => republishSources());
 			const metricsReporter = new MetricsReporter({
 				send: (msg) => platformClient.send(msg),
 				intervalMs: 3e4,
@@ -50971,6 +51122,29 @@ await guardStartup(logger, async () => {
 				client.connect();
 				logger.info("Static peer client dialing", { rawUrl });
 			}
+			const resolveSourceWebhookUrl = async (params) => {
+				if (params.provider !== "github") return {
+					webhookUrl: null,
+					webhookNote: "unsupported-provider"
+				};
+				try {
+					const fullSources = await buildPlatformProviderSources(sub.sourceManager, loadGenericRows, config);
+					const webhookUrl = await platformClient.registerSourceAndAwait(fullSources, params.routingKey);
+					return webhookUrl ? { webhookUrl } : {
+						webhookUrl: null,
+						webhookNote: "platform-no-public-url"
+					};
+				} catch (err) {
+					logger.warn("Failed to resolve GitHub webhook URL from Platform", {
+						routingKey: params.routingKey,
+						error: toErrorMessage(err)
+					});
+					return {
+						webhookUrl: null,
+						webhookNote: "platform-unavailable"
+					};
+				}
+			};
 			return {
 				appDepsExtras: {
 					platformClient,
@@ -50978,14 +51152,15 @@ await guardStartup(logger, async () => {
 					variableStore,
 					heldRunStore,
 					globalWorkflowPolicy,
-					contributorCache
+					contributorCache,
+					resolveSourceWebhookUrl
 				},
 				configReloaderExtras: {
 					onProviderChange: async (_newConfig, _oldConfig, s) => {
 						await s.sourceManager.reload();
 						const newRegistry = s.sourceManager.getRegistry();
 						s.providerRegistry = newRegistry;
-						s.commitStatusReporter.updateRegistry(newRegistry);
+						s.checkRunReporter.updateRegistry(newRegistry);
 						logger.info("Provider registry reloaded from sources", { routingKeys: newRegistry.getRoutingKeys() });
 					},
 					onPlatformReconnect: async (newConfig) => {