@kici-dev/orchestrator 0.1.5 → 0.1.7

package/dist/standalone.js

@@ -134,6 +134,15 @@ var init_config$5 = __esmMin((() => {
 		* behavior). Trailing slash optional.
 		*/
 		dashboardUrl: z.string().optional(),
+		/**
+		* Public base URL at which this orchestrator's own webhook ingress is
+		* reachable (independent/hybrid self-serve generic webhooks:
+		* `<base>/webhook/<customerId>/generic/<sourceId>`). Used by
+		* `kici-admin source add` to print a generic source's webhook URL. GitHub-App
+		* ingress is Platform-relayed, so GitHub URLs come from the Platform's
+		* `source.register.ack`, not this value. Trailing slash optional.
+		*/
+		webhookPublicUrl: z.string().optional(),
 		databaseUrl: z.string().default(""),
 		lockfileCacheMax: z.coerce.number().default(500),
 		lockfileCacheTtlMs: z.coerce.number().default(36e5),
@@ -326,6 +335,7 @@ var init_config$5 = __esmMin((() => {
 			platformUrl: "KICI_PLATFORM_URL",
 			platformToken: "KICI_PLATFORM_TOKEN",
 			dashboardUrl: "KICI_DASHBOARD_URL",
+			webhookPublicUrl: "KICI_WEBHOOK_PUBLIC_URL",
 			databaseUrl: "KICI_DATABASE_URL",
 			cacheStorageType: "KICI_STORAGE_TYPE",
 			cacheStoragePath: "KICI_STORAGE_PATH",
@@ -1028,7 +1038,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$85 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.5";
+	SOFTWARE_VERSION$1 = "0.1.7";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -2491,7 +2501,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$84 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.5";
+	SOFTWARE_VERSION = "0.1.7";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -3125,7 +3135,7 @@ var init_coordinator = __esmMin((() => {
 		peerRegistry;
 		dispatcher;
 		executionTracker;
-		commitStatusReporter;
+		checkRunReporter;
 		getPeerClient;
 		sendAndWaitAckViaHandler;
 		sendToPeerViaHandler;
@@ -3147,7 +3157,7 @@ var init_coordinator = __esmMin((() => {
 			this.peerRegistry = deps.peerRegistry;
 			this.dispatcher = deps.dispatcher;
 			this.executionTracker = deps.executionTracker;
-			this.commitStatusReporter = deps.commitStatusReporter;
+			this.checkRunReporter = deps.checkRunReporter;
 			this.getPeerClient = deps.getPeerClient;
 			this.sendAndWaitAckViaHandler = deps.sendAndWaitAckViaHandler;
 			this.sendToPeerViaHandler = deps.sendToPeerViaHandler;
@@ -3270,10 +3280,10 @@ var init_coordinator = __esmMin((() => {
 			const repoIdentifier = (msg.repoUrl ?? "").replace(/\.git$/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/^[^/]+@[^:]+:/, "") || "";
 			const providerContext = msg.providerContext ?? {};
 			const installationId = typeof providerContext.installationId === "number" ? providerContext.installationId : void 0;
-			if (this.commitStatusReporter && repoIdentifier && msg.sha) {
+			if (this.checkRunReporter && repoIdentifier && msg.sha) {
 				const [owner, repo] = repoIdentifier.split("/");
 				if (owner && repo) try {
-					await this.commitStatusReporter.setPendingAwait({
+					await this.checkRunReporter.setPendingAwait({
 						provider: msg.provider ?? "",
 						owner,
 						repo,
@@ -9760,7 +9770,7 @@ var init_check_run_summary = __esmMin((() => {
 	];
 }));
 //#endregion
-//#region src/reporting/commit-status.ts
+//#region src/reporting/check-run-reporter.ts
 /**
 * GitHub check run integration module.
 *
@@ -9775,7 +9785,7 @@ var init_check_run_summary = __esmMin((() => {
 * Check run IDs are tracked in-memory after creation so that subsequent
 * updates (job complete, workflow complete) can reference them via checks.update().
 *
-* Enriched output (Phase 14):
+* Enriched output:
 * - Live step progress with checklist-style updates (debounced at 5s)
 * - Failed check runs include step names, error messages, exit codes, and log context
 * - Check run annotations link failures to step source locations in workflow files (.kici/workflows/*.ts)
@@ -9785,7 +9795,7 @@ var init_check_run_summary = __esmMin((() => {
 * Note: The engine-level CheckStatusPoster interface (packages/engine/src/provider/check-status-poster.ts)
 * provides a provider-agnostic API for posting security-related check statuses (holds, approvals,
 * workflow modifications). The GitHub implementation is at packages/orchestrator/src/providers/github/check-status-poster.ts.
-* This CommitStatusReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
+* This CheckRunReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
 * Future cleanup may unify both under CheckStatusPoster, but they serve different purposes today.
 */
 /**
@@ -9807,14 +9817,14 @@ function buildJobFailureDescription(data) {
 	if (data.error) return `Job error: ${data.error}`;
 	return "Job failed";
 }
-var logger$70, PROGRESS_DEBOUNCE_MS, CommitStatusReporter;
-var init_commit_status = __esmMin((() => {
+var logger$70, PROGRESS_DEBOUNCE_MS, CheckRunReporter;
+var init_check_run_reporter = __esmMin((() => {
 	init_auth();
 	init_prometheus();
 	init_check_run_summary();
-	logger$70 = createLogger({ prefix: "commit-status" });
+	logger$70 = createLogger({ prefix: "check-run-reporter" });
 	PROGRESS_DEBOUNCE_MS = 5e3;
-	CommitStatusReporter = class {
+	CheckRunReporter = class {
 		/**
 		* L1 cache: composite key → check run ID.
 		*
@@ -10069,7 +10079,7 @@ var init_commit_status = __esmMin((() => {
 		*/
 		async recoverState() {
 			if (!this.deps.trackingStore) return;
-			logger$70.info("CommitStatusReporter recovered (DB-backed state lookups enabled)");
+			logger$70.info("CheckRunReporter recovered (DB-backed state lookups enabled)");
 		}
 		/** Track a check run key associated with a runId for later cleanup. */
 		trackRunKey(runId, key) {
@@ -13358,10 +13368,29 @@ function createSourceRoutes(deps) {
 				privateKey,
 				webhookSecret
 			});
+			let webhookUrl = null;
+			let webhookNote;
+			if (deps.resolveSourceWebhookUrl) try {
+				const resolved = await deps.resolveSourceWebhookUrl({
+					routingKey: source.routing_key,
+					provider,
+					sourceId: source.id
+				});
+				webhookUrl = resolved.webhookUrl;
+				webhookNote = resolved.webhookNote;
+			} catch (err) {
+				logger$63.warn("Failed to resolve webhook URL for added source", {
+					routingKey: source.routing_key,
+					error: toErrorMessage(err)
+				});
+				webhookNote = "resolve-failed";
+			}
 			return c.json({
 				routingKey: source.routing_key,
 				id: source.id,
-				name: source.name
+				name: source.name,
+				webhookUrl,
+				...webhookNote && { webhookNote }
 			}, 201);
 		} catch (err) {
 			logger$63.error("Failed to add source", { error: toErrorMessage(err) });
@@ -17742,7 +17771,10 @@ function createAdminRoutes(deps) {
 			return handleError$3(c, err);
 		}
 	});
-	if (deps.sourceStore) app.route("/api/v1/admin", createSourceRoutes({ sourceStore: deps.sourceStore }));
+	if (deps.sourceStore) app.route("/api/v1/admin", createSourceRoutes({
+		sourceStore: deps.sourceStore,
+		resolveSourceWebhookUrl: deps.resolveSourceWebhookUrl
+	}));
 	if (deps.db && deps.pool) app.route("/api/v1/admin", createDbRoutes({
 		db: deps.db,
 		pool: deps.pool
@@ -21504,14 +21536,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.5",
-			buildDate: "2026-05-25T13:18:39.135Z",
-			buildCommit: "600c43faa",
-			sdkVersion: "0.1.5",
+			version: "0.1.7",
+			buildDate: "2026-05-26T13:18:35.789Z",
+			buildCommit: "4c0abe030",
+			sdkVersion: "0.1.7",
 			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.5",
-			sharedBundleHash: "12d8f17547ef0a63c0d54c59d918eefb5c5ad16d44c3b4d7fce081d23fe44a7a",
-			engineVersion: "0.1.5",
+			sharedVersion: "0.1.7",
+			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
+			engineVersion: "0.1.7",
 			engineBundleHash: "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -21546,7 +21578,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.5",
+			orchestratorVersion: "0.1.7",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -23036,7 +23068,7 @@ async function mintCloneTokenForReroute(args) {
 /**
 * Build the wrapped dispatcher, overlay info with effective routing/provider,
 * persist the webhook payload, fire source-location callbacks, and post the
-* pending commit-status check. Pure side-effects + a typed result bag for
+* pending check-run check. Pure side-effects + a typed result bag for
 * downstream phases.
 */
 async function setupDispatchContext(ctx) {
@@ -23087,10 +23119,10 @@ async function setupDispatchContext(ctx) {
 		const locs = job.steps.map((s) => s.sourceLocation);
 		if (locs.some((l) => l !== void 0)) deps.onSourceLocationsExtracted(workflow.name, job.name, locs);
 	}
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
 		const jobNames = workflow.jobs.filter(isLockStaticJob).map((j) => j.name);
-		await deps.commitStatusReporter.setPendingAwait({
+		await deps.checkRunReporter.setPendingAwait({
 			provider: info.provider,
 			owner,
 			repo,
@@ -23242,9 +23274,9 @@ async function runBuildJob(args) {
 	let rejected = false;
 	let error;
 	const coalescingKey = `${contentHash || "none"}:${lockfileHash || "none"}`;
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
-		deps.commitStatusReporter.setBuildPending({
+		deps.checkRunReporter.setBuildPending({
 			provider: setup.info.provider,
 			owner,
 			repo,
@@ -23313,9 +23345,9 @@ async function runBuildJob(args) {
 async function recordBuildFailure(args) {
 	const { ctx, setup, buildJobTrackedEarly, err, buildJobId } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId } = ctx;
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
-		deps.commitStatusReporter.setBuildComplete({
+		deps.checkRunReporter.setBuildComplete({
 			provider: setup.info.provider,
 			owner,
 			repo,
@@ -23355,9 +23387,9 @@ async function recordBuildFailure(args) {
 async function readPostBuildCacheUrls(args) {
 	const { ctx, setup, contentHash, lockfileHash, targetPlatform, targetArch } = args;
 	const { deps, workflow, repoIdentifier, credentials, ref, runId } = ctx;
-	if (deps.commitStatusReporter) {
+	if (deps.checkRunReporter) {
 		const [owner, repo] = repoIdentifier.split("/");
-		deps.commitStatusReporter.setBuildComplete({
+		deps.checkRunReporter.setBuildComplete({
 			provider: setup.info.provider,
 			owner,
 			repo,
@@ -27317,7 +27349,7 @@ function createApp(deps) {
 		sourceCache: deps.sourceCache,
 		depCache: deps.depCache,
 		cacheStorage: deps.cacheStorage,
-		onJobStatus: deps.platformClient || deps.executionTracker || deps.commitStatusReporter || deps.pendingBuilds || deps.pendingInits ? (_agentId, msg) => {
+		onJobStatus: deps.platformClient || deps.executionTracker || deps.checkRunReporter || deps.pendingBuilds || deps.pendingInits ? (_agentId, msg) => {
 			if (deps.pendingBuilds && deps.pendingBuilds.has(msg.jobId)) {
 				if (msg.state === ExecutionJobStatus.enum.success && msg.data?.buildComplete) deps.pendingBuilds.resolve(msg.jobId);
 				else if (msg.state === ExecutionJobStatus.enum.failed || msg.state === ExecutionJobStatus.enum.cancelled) deps.pendingBuilds.reject(msg.jobId, new Error(msg.data?.error ?? `Build ${msg.state}`));
@@ -27349,13 +27381,13 @@ function createApp(deps) {
 				},
 				timestamp: msg.timestamp
 			});
-			if (deps.commitStatusReporter && deps.executionTracker && (msg.state === ExecutionJobStatus.enum.success || msg.state === ExecutionJobStatus.enum.failed || msg.state === ExecutionJobStatus.enum.cancelled)) {
+			if (deps.checkRunReporter && deps.executionTracker && (msg.state === ExecutionJobStatus.enum.success || msg.state === ExecutionJobStatus.enum.failed || msg.state === ExecutionJobStatus.enum.cancelled)) {
 				const execContext = deps.executionTracker.getExecutionContext(msg.runId);
 				if (execContext) {
 					const [owner, repo] = execContext.repoIdentifier.split("/");
 					let description;
 					if (msg.state === ExecutionJobStatus.enum.failed && msg.data) description = buildJobFailureDescription(msg.data);
-					deps.commitStatusReporter.updateJobStatus({
+					deps.checkRunReporter.updateJobStatus({
 						provider: execContext.provider,
 						owner,
 						repo,
@@ -27406,11 +27438,11 @@ function createApp(deps) {
 				} : msg.data;
 				deps.executionTracker.onStepStatus(msg.runId, msg.jobId, msg.stepIndex, msg.stepName, msg.state, msg.timestamp, data, msg.logBytesStreamed);
 			}
-			if (deps.commitStatusReporter && deps.executionTracker) {
+			if (deps.checkRunReporter && deps.executionTracker) {
 				const execContext = deps.executionTracker.getExecutionContext(msg.runId);
 				if (execContext) {
 					const [owner, repo] = execContext.repoIdentifier.split("/");
-					deps.commitStatusReporter.updateStepProgress({
+					deps.checkRunReporter.updateStepProgress({
 						provider: execContext.provider,
 						owner,
 						repo,
@@ -27704,7 +27736,7 @@ function createApp(deps) {
 						pendingBuilds: deps.pendingBuilds,
 						pendingInits: deps.pendingInits,
 						pendingDynamics: deps.pendingDynamics,
-						commitStatusReporter: deps.commitStatusReporter,
+						checkRunReporter: deps.checkRunReporter,
 						executionTracker: deps.executionTracker,
 						onSourceLocationsExtracted,
 						eventRouter: deps.eventRouter,
@@ -27745,7 +27777,8 @@ function createApp(deps) {
 	}));
 	if (deps.adminDeps) app.route("", createAdminRoutes({
 		...deps.adminDeps,
-		accessLog: deps.accessLogWriter
+		accessLog: deps.accessLogWriter,
+		resolveSourceWebhookUrl: deps.resolveSourceWebhookUrl
 	}));
 	if (deps.genericSourceManager && deps.trustStore && deps.adminDeps) app.route("", createAdminEventRoutes({
 		sourceManager: deps.genericSourceManager,
@@ -27802,7 +27835,7 @@ function createApp(deps) {
 			lockFileCache: deps.lockFileCache,
 			dispatcher: deps.dispatcher,
 			executionTracker: deps.executionTracker,
-			commitStatusReporter: deps.commitStatusReporter,
+			checkRunReporter: deps.checkRunReporter,
 			sourceCache: deps.sourceCache,
 			buildCoordinator: deps.buildCoordinator,
 			depCache: deps.depCache,
@@ -27959,7 +27992,7 @@ var init_app = __esmMin((() => {
 	init_blob_routes();
 	init_agent_api_registry();
 	init_server_options();
-	init_commit_status();
+	init_check_run_reporter();
 	init_agent_handler();
 	init_observer_handler();
 	init_test_trigger();
@@ -35170,7 +35203,7 @@ var init_stale_run_detector = __esmMin((() => {
 	StaleRunDetector = class {
 		db;
 		executionTracker;
-		commitStatusReporter;
+		checkRunReporter;
 		scalerManager;
 		dispatcher;
 		registry;
@@ -35181,7 +35214,7 @@ var init_stale_run_detector = __esmMin((() => {
 		constructor(deps) {
 			this.db = deps.db;
 			this.executionTracker = deps.executionTracker;
-			this.commitStatusReporter = deps.commitStatusReporter;
+			this.checkRunReporter = deps.checkRunReporter;
 			this.scalerManager = deps.scalerManager;
 			this.dispatcher = deps.dispatcher;
 			this.registry = deps.registry;
@@ -35403,11 +35436,11 @@ var init_stale_run_detector = __esmMin((() => {
 					});
 					markedCount++;
 					staleRunsDetectedTotal.add(1);
-					if (this.commitStatusReporter) {
+					if (this.checkRunReporter) {
 						const [owner, repo] = entry.repo_identifier.split("/");
 						const providerCtx = typeof entry.provider_context === "string" ? JSON.parse(entry.provider_context) : entry.provider_context ?? {};
 						const installationId = typeof providerCtx.installationId === "number" ? providerCtx.installationId : void 0;
-						this.commitStatusReporter.updateJobStatus({
+						this.checkRunReporter.updateJobStatus({
 							provider: entry.provider,
 							owner,
 							repo,
@@ -35465,11 +35498,11 @@ var init_stale_run_detector = __esmMin((() => {
 			});
 			await this.executionTracker.cancelStepsForJob(job.run_id, job.job_id, errorMessage);
 			affectedRunIds.add(job.run_id);
-			if (this.commitStatusReporter) {
+			if (this.checkRunReporter) {
 				const [owner, repo] = job.repo_identifier.split("/");
 				const providerCtx = typeof job.provider_context === "string" ? JSON.parse(job.provider_context) : job.provider_context ?? {};
 				const installationId = typeof providerCtx.installationId === "number" ? providerCtx.installationId : void 0;
-				this.commitStatusReporter.updateJobStatus({
+				this.checkRunReporter.updateJobStatus({
 					provider: job.provider,
 					owner,
 					repo,
@@ -36559,10 +36592,27 @@ var init_source_manager = __esmMin((() => {
 		currentSources = [];
 		debounceTimer = null;
 		debounceMs;
+		/**
+		* Change callback. Stored in a mutable field (not read off `opts`) so a
+		* mode-specific hook can rewire it after construction — the platform-mode
+		* boot wires it to push the full source list to the Platform via
+		* `platformClient.updateSources()`. Defaults to the (possibly no-op) value
+		* passed at construction.
+		*/
+		onSourcesChanged;
 		constructor(opts) {
 			this.opts = opts;
 			this.registry = new ProviderRegistry();
 			this.debounceMs = opts.debounceMs ?? 200;
+			this.onSourcesChanged = opts.onSourcesChanged;
+		}
+		/**
+		* Replace the change callback after construction. The SourceManager is built
+		* early (before the Platform client exists); the platform-mode boot calls
+		* this once the client is ready so live source changes propagate upstream.
+		*/
+		setOnSourcesChanged(cb) {
+			this.onSourcesChanged = cb;
 		}
 		/** Get current ProviderRegistry (rebuilt on each reload). */
 		getRegistry() {
@@ -36637,7 +36687,7 @@ var init_source_manager = __esmMin((() => {
 				added: diff.added.length,
 				removed: diff.removed.length
 			});
-			if (diff.added.length > 0 || diff.removed.length > 0) this.opts.onSourcesChanged(diff);
+			if (diff.added.length > 0 || diff.removed.length > 0) this.onSourcesChanged(diff);
 		}
 		/**
 		* Build a ProviderBundle for a source with decrypted secrets.
@@ -39537,9 +39587,19 @@ var init_generic_sources_listener = __esmMin((() => {
 		pending = /* @__PURE__ */ new Set();
 		debounceTimer = null;
 		debounceMs;
+		/**
+		* Drain-applied-change callback. Mutable so the platform-mode boot can wire
+		* it after the Platform client exists (this listener is constructed before).
+		*/
+		onChange;
 		constructor(opts) {
 			this.opts = opts;
 			this.debounceMs = opts.debounceMs ?? 200;
+			this.onChange = opts.onChange;
+		}
+		/** Replace the drain-applied-change callback after construction. */
+		setOnChange(cb) {
+			this.onChange = cb;
 		}
 		/** Open the dedicated client and subscribe. Cold-boot bundle
 		*  registration is handled by the orchestrator-core startup loop
@@ -39585,6 +39645,7 @@ var init_generic_sources_listener = __esmMin((() => {
 		async drain() {
 			const keys = Array.from(this.pending);
 			this.pending.clear();
+			let appliedChange = false;
 			for (const routingKey of keys) try {
 				const row = await this.opts.sourceManager.getByRoutingKey(routingKey);
 				if (!row) {
@@ -39593,6 +39654,7 @@ var init_generic_sources_listener = __esmMin((() => {
 						routingKey,
 						removed
 					});
+					appliedChange = true;
 					continue;
 				}
 				this.opts.providerRegistry.unregister(routingKey);
@@ -39601,12 +39663,14 @@ var init_generic_sources_listener = __esmMin((() => {
 					config: this.opts.config,
 					secretResolver: this.opts.secretResolver
 				});
+				appliedChange = true;
 			} catch (err) {
 				logger$8.error("Failed to apply generic-source change", {
 					routingKey,
 					error: toErrorMessage(err)
 				});
 			}
+			if (appliedChange) this.onChange?.();
 		}
 	};
 }));
@@ -41353,7 +41417,7 @@ function buildOnEventMatched(dispatcherRef, executionTracker, providerRegistryRe
 		}
 	};
 }
-function initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, commitStatusReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef) {
+function initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, checkRunReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef) {
 	const peerClients = /* @__PURE__ */ new Map();
 	const getLocalInventory = () => ({
 		instanceId: config.instanceId,
@@ -41457,7 +41521,7 @@ function initializeCluster(config, db, agentRegistry, dispatcher, executionTrack
 		peerRegistry,
 		dispatcher,
 		executionTracker,
-		commitStatusReporter,
+		checkRunReporter,
 		getPeerClient: (instanceId) => peerClients.get(instanceId),
 		sendAndWaitAckViaHandler: (targetId, msg, timeoutMs) => peerHandlerObj?.sendAndWaitAck(targetId, msg, timeoutMs) ?? Promise.resolve(false),
 		sendToPeerViaHandler: (targetId, msg) => peerHandlerObj?.sendToPeer(targetId, msg) ?? false
@@ -41667,7 +41731,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	const stepLogBuffer = new StepLogBuffer();
 	const sourceLocationStore = new SourceLocationStore();
 	const checkRunTrackingStore = new CheckRunTrackingStore(db);
-	const commitStatusReporter = new CommitStatusReporter({
+	const checkRunReporter = new CheckRunReporter({
 		providerRegistry,
 		stepLogBuffer,
 		trackingStore: checkRunTrackingStore,
@@ -41714,7 +41778,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 					});
 				});
 				const [owner, repo] = context.repoIdentifier.split("/");
-				commitStatusReporter.updateWorkflowStatus({
+				checkRunReporter.updateWorkflowStatus({
 					provider: context.provider,
 					owner,
 					repo,
@@ -41764,7 +41828,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		orgId: trackerExtras?.orgId,
 		onRunPruned: (runId) => {
 			stepLogBuffer.cleanup(runId);
-			commitStatusReporter.cleanupRun(runId);
+			checkRunReporter.cleanupRun(runId);
 		},
 		onWorkflowComplete: (data) => {
 			if (!eventEmitter) return;
@@ -41870,7 +41934,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	if (pgSecretStore) {
 		providerRegistry = await sourceManager.start();
 		providerRegistryRef.current = providerRegistry;
-		commitStatusReporter.updateRegistry(providerRegistry);
+		checkRunReporter.updateRegistry(providerRegistry);
 		const registeredKeys = providerRegistry.getRoutingKeys();
 		if (registeredKeys.length > 0) logger$2.info("Provider registry built from sources", { routingKeys: registeredKeys });
 		else logger$2.info("No sources configured yet (orchestrator can start with zero sources)");
@@ -42017,7 +42081,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		ttl: config.lockfileCacheTtlMs
 	});
 	const configReloaderRef = { current: null };
-	const cluster = initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, commitStatusReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef);
+	const cluster = initializeCluster(config, db, agentRegistry, dispatcher, executionTracker, checkRunReporter, cacheStorage, scalerManager, registrationIndex, cronScheduler, configReloaderRef, localConfigVersionRef, stepLogBuffer, eventRetryScannerRef);
 	coordinatorRef.current = cluster.coordinator;
 	if (adminDeps) adminDeps.broadcastAgentTokenRevoke = cluster.broadcastAgentTokenRevoke;
 	let masterKeyForStore = null;
@@ -42056,7 +42120,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		pendingBuilds,
 		pendingInits,
 		pendingDynamics,
-		commitStatusReporter,
+		checkRunReporter,
 		stepLogBuffer,
 		sourceLocationStore,
 		logStorage,
@@ -42092,6 +42156,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		localConfigVersion: localConfigVersionRef.value,
 		sourceStore,
 		sourceManager,
+		genericSourcesChangeListener,
 		eventLogWriter,
 		accessLogWriter,
 		coldStore: coldStoreSingleton,
@@ -42143,7 +42208,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 			await sourceManager.reload();
 			providerRegistry = sourceManager.getRegistry();
 			providerRegistryRef.current = providerRegistry;
-			commitStatusReporter.updateRegistry(providerRegistry);
+			checkRunReporter.updateRegistry(providerRegistry);
 			logger$2.info("Provider registry reloaded from sources", { routingKeys: providerRegistry.getRoutingKeys() });
 		}),
 		onScalerReload: scalerManager ? async () => {
@@ -42244,7 +42309,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		pendingBuilds,
 		pendingInits,
 		pendingDynamics,
-		commitStatusReporter,
+		checkRunReporter,
 		executionTracker,
 		logWriter,
 		stepLogBuffer,
@@ -42298,7 +42363,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	const staleRunDetector = new StaleRunDetector({
 		db,
 		executionTracker,
-		commitStatusReporter,
+		checkRunReporter,
 		scalerManager: scalerManager ?? void 0,
 		dispatcher,
 		registry: agentRegistry,
@@ -42505,7 +42570,7 @@ var init_orchestrator_core = __esmMin((() => {
 	init_scaler();
 	init_storage();
 	init_cache();
-	init_commit_status();
+	init_check_run_reporter();
 	init_check_run_tracking_store();
 	init_scaler_state_store();
 	init_processor();
@@ -43640,13 +43705,13 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.5";
-	WORKER_BUILD_COMMIT = "600c43faa";
-	WORKER_SDK_VERSION = "0.1.5";
+	ORCHESTRATOR_VERSION$1 = "0.1.7";
+	WORKER_BUILD_COMMIT = "4c0abe030";
+	WORKER_SDK_VERSION = "0.1.7";
 	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.5";
-	WORKER_SHARED_BUNDLE_HASH = "12d8f17547ef0a63c0d54c59d918eefb5c5ad16d44c3b4d7fce081d23fe44a7a";
-	WORKER_ENGINE_VERSION = "0.1.5";
+	WORKER_SHARED_VERSION = "0.1.7";
+	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
+	WORKER_ENGINE_VERSION = "0.1.7";
 	WORKER_ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 	logger$1 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -43671,13 +43736,13 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown:
 * agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.5";
-const BUILD_COMMIT = "600c43faa";
-const SDK_VERSION = "0.1.5";
+const ORCHESTRATOR_VERSION = "0.1.7";
+const BUILD_COMMIT = "4c0abe030";
+const SDK_VERSION = "0.1.7";
 const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.5";
-const SHARED_BUNDLE_HASH = "12d8f17547ef0a63c0d54c59d918eefb5c5ad16d44c3b4d7fce081d23fe44a7a";
-const ENGINE_VERSION = "0.1.5";
+const SHARED_VERSION = "0.1.7";
+const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
+const ENGINE_VERSION = "0.1.7";
 const ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
@@ -43807,12 +43872,18 @@ await guardStartup(logger, async () => {
 				client.connect();
 			}
 			return {
-				appDepsExtras: {},
+				appDepsExtras: { resolveSourceWebhookUrl: async (params) => params.provider === "github" ? {
+					webhookUrl: null,
+					webhookNote: "github-ingress-platform-only"
+				} : {
+					webhookUrl: null,
+					webhookNote: "unsupported-provider"
+				} },
 				configReloaderExtras: { onProviderChange: async (_newConfig, _oldConfig, s) => {
 					await s.sourceManager.reload();
 					const newRegistry = s.sourceManager.getRegistry();
 					s.providerRegistry = newRegistry;
-					s.commitStatusReporter.updateRegistry(newRegistry);
+					s.checkRunReporter.updateRegistry(newRegistry);
 					logger.info("Provider registry reloaded from sources (standalone)", { routingKeys: newRegistry.getRoutingKeys() });
 				} },
 				shutdownExtras: [],

package/dist/webhook/generic-sources-listener.d.ts

@@ -53,6 +53,14 @@ export interface GenericSourcesChangeListenerOptions {
     secretResolver: SecretResolver | null;
     /** Coalesce window for rapid NOTIFYs against the same row. Default 200 ms. */
     debounceMs?: number;
+    /**
+     * Invoked once per drain pass that applied at least one change. The
+     * platform-mode boot wires this to re-push the full source list to the
+     * Platform (`platformClient.updateSources()`) so a generic source added /
+     * removed at runtime reaches the Platform's `webhook_sources` immediately,
+     * not just the local registry.
+     */
+    onChange?: () => void;
 }
 export declare class GenericSourcesChangeListener {
     private readonly opts;
@@ -60,7 +68,14 @@ export declare class GenericSourcesChangeListener {
     private readonly pending;
     private debounceTimer;
     private readonly debounceMs;
+    /**
+     * Drain-applied-change callback. Mutable so the platform-mode boot can wire
+     * it after the Platform client exists (this listener is constructed before).
+     */
+    private onChange?;
     constructor(opts: GenericSourcesChangeListenerOptions);
+    /** Replace the drain-applied-change callback after construction. */
+    setOnChange(cb: () => void): void;
     /** Open the dedicated client and subscribe. Cold-boot bundle
      *  registration is handled by the orchestrator-core startup loop
      *  via the same helper; this listener only services warm-path