@kici-dev/orchestrator 0.10.0 → 0.12.0

package/dist/cluster/cluster-identity.d.ts

@@ -34,10 +34,10 @@ export interface ClusterIdentityDeps {
  * `cacheStorageS3Prefix` default). Empty means the cache blobs and the
  * cluster-identity sentinel live at the bucket root — the bucket already scopes
  * the cluster. Every place that resolves a sentinel prefix (the orchestrator
- * runtime, the `kici-admin cluster reconcile-identity` CLI, and the staging
- * deploy's self-heal step) MUST fall back to THIS value when no explicit prefix
- * is set, otherwise they compute divergent sentinel keys and crash-loop the
- * orchestrator boot on a spurious "Cluster identity mismatch".
+ * runtime and the `kici-admin cluster reconcile-identity` CLI, including a
+ * deploy's pre-start self-heal run of it) MUST fall back to THIS value when no
+ * explicit prefix is set, otherwise they compute divergent sentinel keys and
+ * crash-loop the orchestrator boot on a spurious "Cluster identity mismatch".
  */
 export declare const DEFAULT_CACHE_STORAGE_S3_PREFIX = "";
 /**

package/dist/cluster/join-token.d.ts

@@ -79,8 +79,8 @@ export declare class JoinTokenManager {
 /**
  * Build a JoinTokenManager backed by its own connection pool to the given
  * orchestrator database URL. Mirrors `createPeerCredentialStoreFromUrl`;
- * consumed by E2E tests that need to exercise token validation/reuse against
- * the real cluster DB.
+ * used by tests that need to exercise token validation/reuse against a real
+ * cluster DB.
  */
 export declare function createJoinTokenManagerFromUrl(databaseUrl: string, opts?: {
     maxConnections?: number;

package/dist/cluster/leader-gated-scheduler.d.ts

@@ -23,7 +23,8 @@ export interface LeaderGatedSchedulerOptions {
 /**
  * Raft-leader-only periodic scheduler. Encapsulates the become -> (optional async setup) ->
  * start-interval / lose -> stop lifecycle that the orchestrator's leader-gated schedulers share.
- * The interval runs only while this node is the leader.
+ * The interval runs only while this node is the leader. `stop()` is final: no
+ * later leadership change starts another tenure.
  */
 export declare class LeaderGatedScheduler {
     private readonly opts;
@@ -39,6 +40,11 @@ export declare class LeaderGatedScheduler {
      * would leak a timer running tick() while no longer leader.
      */
     private generation;
+    /**
+     * Set by {@link stop}: the owning process is shutting down, so no later
+     * leadership change starts another tenure.
+     */
+    private stopped;
     constructor(opts: LeaderGatedSchedulerOptions);
     get isLeader(): boolean;
     onBecomeLeader(): Promise<void>;

package/dist/cluster/peer-credentials.d.ts

@@ -107,7 +107,7 @@ export declare function readCredentialFile(filePath: string): Promise<Credential
  * store plus a disposer that closes the underlying pool. Lets tests
  * exercise the real Kysely-backed store without importing pg/kysely.
  *
- * Intended for e2e coverage of the store's own CRUD methods — production
+ * Intended for tests of the store's own CRUD methods — production
  * code constructs the store with an already-allocated Kysely instance
  * shared with the orchestrator.
  */

package/dist/cluster/raft-state.d.ts

@@ -28,6 +28,12 @@ export declare class RaftStateStore {
      * Upsert full Raft state into the DB.
      */
     save(state: RaftPersistentState): Promise<void>;
+    /**
+     * Upsert full Raft state unless the stored term is newer. A coordinator that
+     * leaves the cluster saves through this: the row is shared, and the remaining
+     * coordinators may already have elected a leader in a newer term.
+     */
+    saveUnlessNewerTerm(state: RaftPersistentState): Promise<void>;
     /**
      * Update just the leader and term fields (lightweight update for heartbeat acceptance).
      */

package/dist/cluster/raft.d.ts

@@ -4,12 +4,16 @@
  * Implements only leader election (no log replication) for cluster coordination.
  * State machine: follower -> candidate -> leader. State is persisted to Postgres
  * via RaftStateStore for crash recovery. Election timeout is 5-10s with randomized
- * jitter (WAN-appropriate per research). Leader sends heartbeats every 2s.
+ * jitter (WAN-appropriate). Leader sends heartbeats every 2s.
  *
  * Dormant mode: When peerRegistry has 0 connected peers, the node self-elects
  * immediately (single-orchestrator deployment). If peers connect later, normal
  * election resumes.
  *
+ * `stop()` takes the node out of every election until the next `start()`: it
+ * ends the node's leadership and ignores every election input afterwards, so a
+ * process that is shutting down cannot be elected again.
+ *
  * Raft heartbeat (raft.append.entries every 2s) is separate from peer inventory
  * heartbeat (peer.heartbeat every 30s). Raft heartbeat is purely for leader
  * liveness detection.
@@ -47,6 +51,13 @@ export declare class RaftNode {
     private votedFor;
     private leaderId;
     private role;
+    /**
+     * Set by {@link stop}. A stopped node takes no further part in any election:
+     * it belongs to a process that is shutting down, and an election would restart
+     * the leader-only services the shutdown is stopping and write Raft state to a
+     * database that is being closed.
+     */
+    private stopped;
     private electionTimer;
     private leaderHeartbeatTimer;
     /** Votes received during the current election as candidate. */
@@ -65,7 +76,10 @@ export declare class RaftNode {
      */
     start(): Promise<void>;
     /**
-     * Stop the Raft node. Clears all timers and persists state.
+     * Stop the Raft node. Clears its timers, ends its leadership (so the
+     * leader-only services stop with it), and persists its state. Every election
+     * input after this is ignored until the next {@link start}. A second call does
+     * nothing.
      */
     stop(): Promise<void>;
     /** Whether this node is the current leader. */

package/dist/cold-store/load-access-log-range.d.ts

@@ -1,11 +1,11 @@
 /**
- * Read-through helper for `access_log` (Orchestrator) — Phase D.
+ * Read-through helper for `access_log` (Orchestrator).
  *
  * Unlike `audit_log` and `secret_audit_log`, the `access_log` callers
  * (dashboard "Data access" tab, admin HTTP route, `kici-admin
  * access-log list` CLI) all use the same cursor-based pagination
- * already implemented by `AccessLogWriter.query()`. Phase D's design
- * §7 row 11 classifies access_log as "paginated/transparent" — there
+ * already implemented by `AccessLogWriter.query()`. access_log is
+ * "paginated/transparent" — there
  * is NO `--include-archived` flag. The helper merges cold rows
  * automatically when pagination crosses the warm cutoff or the caller
  * supplies a `from` timestamp older than warm.

package/dist/cold-store/load-event-log-range.d.ts

@@ -1,5 +1,5 @@
 /**
- * Read-through helper for `event_log` (Orchestrator) — Phase E.
+ * Read-through helper for `event_log` (Orchestrator).
  *
  * Mirrors the Platform-side `load-event-log-range.ts`. Tenant column is
  * `routing_key` (NOT NULL on this side) so cold-store partitioning

package/dist/cold-store/load-secret-audit-log-range.d.ts

@@ -1,7 +1,7 @@
 /**
- * Read-through helper for `secret_audit_log` (Orchestrator) — Phase D.
+ * Read-through helper for `secret_audit_log` (Orchestrator).
  *
- * Mirrors the Phase B/C reader pattern. Wraps `AuditLogger.query()`'s
+ * Mirrors the execution-table reader pattern. Wraps `AuditLogger.query()`'s
  * existing offset/limit shape; cold-store rows are fetched only when
  * `includeArchived === true`.
  *

package/dist/cold-store/orchestrator-cold-store.d.ts

@@ -1,10 +1,9 @@
 /**
  * Orchestrator-side cold-store.
  *
- * Extends BaseColdStore with orchestrator-specific table adapters.
- * Phase A registered no adapters; Phase C added execution_runs /
- * execution_jobs / execution_steps. Phase D adds secret_audit_log
- * and access_log.
+ * Extends BaseColdStore with orchestrator-specific table adapters:
+ * execution_runs / execution_jobs / execution_steps, secret_audit_log,
+ * access_log and event_log.
  */
 import { type Kysely } from 'kysely';
 import { BaseColdStore, type BaseColdStoreDeps, type ColdStoreConfig, type PurgeableChunk } from '@kici-dev/shared';
@@ -17,7 +16,7 @@ export declare class OrchestratorColdStore extends BaseColdStore {
     private readonly kdb;
     constructor(deps: OrchestratorColdStoreDeps);
     /**
-     * Phase 2 — query the orchestrator's `cold_store_chunks` table for
+     * Query the orchestrator's `cold_store_chunks` table for
      * chunks past their per-row cold-retention horizon. See the matching
      * Platform-side method for the full rationale.
      */
@@ -27,7 +26,7 @@ export declare class OrchestratorColdStore extends BaseColdStore {
         limit: number;
     }): Promise<PurgeableChunk[]>;
     /**
-     * Phase 2 — per-chunk advisory lock keyed on
+     * Per-chunk advisory lock keyed on
      * `hashtext('cold-store-purge|orchestrator|<table>|<chunkId>')`.
      */
     protected withPurgeLock<T>(args: {
@@ -37,10 +36,9 @@ export declare class OrchestratorColdStore extends BaseColdStore {
 }
 /**
  * Build the orchestrator cold-store config from env vars. Reads
- * `KICI_COLD_STORE_*` vars mirrored with the Platform side. YAML
- * integration (per the design doc) lands in a follow-up commit that
- * wires the `coldStore` section of the orchestrator config schema;
- * Phase A ships the env-var path only.
+ * `KICI_COLD_STORE_*` vars mirrored with the Platform side. The
+ * orchestrator config schema has no `coldStore` section, so env vars are
+ * the only input.
  */
 export declare function readOrchestratorColdStoreConfig(env?: NodeJS.ProcessEnv): ColdStoreConfig;
 /**
@@ -50,7 +48,7 @@ export declare function readOrchestratorColdStoreConfig(env?: NodeJS.ProcessEnv)
  */
 export declare function createColdStoreArchiveHandler(instanceId: string, kdb: Kysely<Database>): () => Promise<void>;
 /**
- * Phase 2 — build the cold-store-purge scheduled-job handler. Same
+ * Build the cold-store-purge scheduled-job handler. Same
  * env-var re-read pattern as the archive handler so SIGHUP picks up
  * config changes mid-run.
  */

package/dist/cold-store/tables/access-log.d.ts

@@ -5,7 +5,7 @@
  * Contract:
  *   - tenant column: `org_id` (NULL → synthetic `__orchestrator__`)
  *   - partition column: `created_at`
- *   - warm TTL: 30 days (design §5 matrix row 11)
+ *   - warm TTL: 30 days
  *
  * Replaces the previous 90-day `expires_at`-based hard delete (removed
  * by migration 007). Rows older than 30 days now live in S3
@@ -57,7 +57,7 @@ export declare class AccessLogAdapter implements TableAdapter<AccessLogColdStore
     rowId(row: AccessLogColdStoreRow): string | number;
     rowTimestamp(row: AccessLogColdStoreRow): Date | string;
     /**
-     * Phase 2 — per-row cold-retention TTL. Mirrors the warm-side override
+     * Per-row cold-retention TTL. Mirrors the warm-side override
      * layering: outcome=denied/error → 730d (forensic), platform_operator →
      * `'forever'` (compliance), otherwise per-action map. The framework
      * groups rows by `coldDaysToBucket(coldTtlDays(row))` at archive time.

package/dist/cold-store/tables/event-log.d.ts

@@ -1,25 +1,19 @@
 /**
- * `event_log` cold-store adapter (Orchestrator side) —.
- *
- *  §2 row 6
- * and §10.
+ * `event_log` cold-store adapter (Orchestrator side).
  *
  * Contract:
  *   - tenant column: `routing_key` (NOT NULL on this side — no
  *     synthetic-tenant fallback like access_log / secret_audit_log)
  *   - partition column: `received_at`
- *   - warm TTL: 30 days (replaces the previous 30-day hard delete in
- *     `packages/orchestrator/src/webhook/event-log.ts:cleanup` +
- *     `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 4)
+ *   - warm TTL: 30 days (rows are archived, not hard-deleted)
  *
  * Per-row payload retention: rows on this table carry a `payload_key`
  * pointing at a gzipped webhook body in object storage (LogStorage).
  * Cold-store packages the row metadata — including `payload_key` —
  * but does NOT touch the body the key points to. The body remains in
  * S3 indefinitely so the dashboard delivery-detail page resolves
- * payload reads identically for hot and cold rows. The pre-Phase-E
- * cleanup that deleted both the row and the payload blob in
- * lock-step is retired.
+ * payload reads identically for hot and cold rows. Nothing deletes the
+ * row and the payload blob in lock-step.
  *
  * Recursive write: archiving event_log rows writes one access_log
  * audit row per chunk (the orchestrator's audit surface). The new

package/dist/cold-store/tables/execution-jobs.d.ts

@@ -5,7 +5,7 @@
  * Contract:
  *   - tenant column: `routing_key` (denormalized in migration 006)
  *   - partition column: `created_at`
- *   - warm TTL: 30 days (design §5 matrix row 8)
+ *   - warm TTL: 30 days
  *   - eligibility: terminal job status AND no live steps remain for this
  *     (run, job)
  *

package/dist/cold-store/tables/execution-runs.d.ts

@@ -5,7 +5,7 @@
  * Contract:
  *   - tenant column: `routing_key`
  *   - partition column: `created_at`
- *   - warm TTL: 30 days (design §5 matrix row 7)
+ *   - warm TTL: 30 days
  *   - eligibility: terminal run status AND no live jobs reference this run
  *
  * Order: registered LAST in the orchestrator cold-store. Within one
@@ -51,17 +51,17 @@ export declare class ExecutionRunsAdapter implements TableAdapter<ExecutionRunRo
     rowId(row: ExecutionRunRow): string | number;
     rowTimestamp(row: ExecutionRunRow): Date | string;
     /**
-     * Phase F — natural-key extractor used by `replayRow` so callers
+     * Natural-key extractor used by `replayRow` so callers
      * (the rerun pipeline) can locate the chunk holding a given UUID
      * `run_id` without knowing the internal SERIAL `id` returned by
      * `rowId()`.
      */
     replayLookupKey(row: ExecutionRunRow): string;
     /**
-     * Phase F — replay a chunk's `execution_runs` rows back into
+     * Replay a chunk's `execution_runs` rows back into
      * Orchestrator PG. Mirrors the Platform-side replayInsert; the
      * audit row goes to `access_log` (not `audit_log`) because the
-     * orchestrator's audit surface is access_log per design §8.
+     * orchestrator's audit surface is access_log.
      *
      * Idempotent on duplicate replays via `ON CONFLICT (run_id) DO
      * NOTHING`. Decrements `cold_store_chunk_counts` (floored at 0).

package/dist/cold-store/tables/execution-steps.d.ts

@@ -5,7 +5,7 @@
  * Contract:
  *   - tenant column: `routing_key` (denormalized in migration 006)
  *   - partition column: `created_at`
- *   - warm TTL: 30 days (design §5 matrix row 9)
+ *   - warm TTL: 30 days
  *   - eligibility: created_at < cutoff (steps are append-only and have no
  *     terminal-status predicate — there is no UPDATE statement against
  *     `execution_steps` in the orchestrator codebase, so age alone is

package/dist/cold-store/tables/secret-audit-log.d.ts

@@ -5,8 +5,8 @@
  * Contract:
  *   - tenant column: `routing_key` (NULL → synthetic `__orchestrator__`)
  *   - partition column: `timestamp`
- *   - warm TTL: 90 days (longer window than other audit tables — design
- *     §5 matrix row 10. Volume is low, forensic value is high)
+ *   - warm TTL: 90 days (longer window than other audit tables — volume is
+ *     low, forensic value is high)
  *
  * Synthetic tenant: rows without `routing_key` (e.g. orchestrator-level
  * key rotations done before any source is bound) collapse to a single
@@ -51,7 +51,7 @@ export declare class SecretAuditLogAdapter implements TableAdapter<SecretAuditLo
     rowId(row: SecretAuditLogRow): string | number;
     rowTimestamp(row: SecretAuditLogRow): Date | string;
     /**
-     * Phase 2 — per-row cold-retention TTL. Sampled `resolve` /
+     * Per-row cold-retention TTL. Sampled `resolve` /
      * `resolve_named` rows get 180d cold; mutations get `'forever'`. The
      * denied-outcome override promotes to 730d (forensic).
      *

package/dist/config.d.ts

@@ -15,6 +15,8 @@
  * and PgSecretStore, not through config. See SourceStore and SourceManager.
  */
 import { z } from 'zod';
+/** How long the database pool waits for a connection when `KICI_DB_POOL_ACQUIRE_TIMEOUT_MS` is unset. */
+export declare const DB_POOL_ACQUIRE_TIMEOUT_DEFAULT_MS = 5000;
 /**
  * Default for `sealed_secrets_retry_backoff_ms`: how long a coordinator stops
  * offering a queued job it put back because it could not open its seal. The
@@ -484,7 +486,7 @@ export type AppConfig = z.infer<typeof configSchema> & {
 };
 /**
  * Env-var definition for the orchestrator. Exported so the docs generator and
- * the deploy-stg pre-validator can re-parse without going through process.env.
+ * config pre-validation can re-parse without going through process.env.
  *
  * Note: passes the inner `baseSchema` (a ZodObject) so describe() can walk
  * `.shape`, but uses the outer `configSchema` (with .superRefine) as the parser

package/dist/contexts/held-runs.d.ts

@@ -321,8 +321,8 @@ export declare class HeldRunStore {
 /**
  * Build a HeldRunStore backed by its own connection pool to the given
  * orchestrator database URL. Mirrors `createPeerCredentialStoreFromUrl` /
- * `createJoinTokenManagerFromUrl`; consumed by E2E tests that exercise the
- * PR-scoped hold selection against the real deployed orchestrator DB.
+ * `createJoinTokenManagerFromUrl`; used by tests that exercise the PR-scoped
+ * hold selection against a real orchestrator DB.
  */
 export declare function createHeldRunStoreFromUrl(databaseUrl: string, opts?: {
     maxConnections?: number;

package/dist/contexts/variable-store.d.ts

@@ -20,6 +20,8 @@ export declare class VariableStore {
     deleteVar(orgId: string, contextId: string, key: string): Promise<void>;
     /** List source overrides for a specific source (routing key). */
     listSourceOverrides(orgId: string, contextId: string, routingKey: string): Promise<ContextSourceOverride[]>;
+    /** List every source override in a context, across all routing keys. */
+    listAllSourceOverrides(orgId: string, contextId: string): Promise<ContextSourceOverride[]>;
     /** Upsert a source override. */
     setSourceOverride(orgId: string, contextId: string, routingKey: string, key: string, value: string): Promise<void>;
     /** Delete a source override. */

package/dist/dashboard/attestation-filters.d.ts

@@ -5,7 +5,7 @@ import type { Database } from '../db/types.js';
  * The org-wide attestations base query: joins `attestations` to `execution_jobs`
  * (for the job name) and `execution_runs` (for repository / workflow context).
  *
- * `attestations.run_id` / `job_id` are TEXT (P1.5 schema) while the
+ * `attestations.run_id` / `job_id` are TEXT while the
  * `execution_*` keys are `uuid`; Postgres won't compare `uuid = text` implicitly,
  * so the join casts the uuid side to text — mirroring `resolveAttestationsForRun`.
  * The `execution_runs` join is a LEFT join so a row with no matching run still

package/dist/dashboard/handler.d.ts

@@ -23,7 +23,7 @@ interface DashboardHandlerDeps {
      * so the dashboard verifies it client-side without a second fetch. Optional —
      * when absent (e.g. orchestrators without provenance configured) the handler
      * replies with an `error` and an empty list. Reuses the cache storage backend
-     * (the same one P1.5 writes bundles to).
+     * (the same one attestation bundles are written to).
      */
     provenanceStorage?: CacheStorage | null;
     /**
@@ -58,14 +58,14 @@ interface DashboardHandlerDeps {
      * Long-lived cold-store handle for read fallback. When set, run /
      * job / step lookups fall through to S3 if the row has aged out of
      * PG. `null` means the orchestrator is running without cold-store
-     * configured — handler then returns its pre-Phase-C behavior.
+     * configured — handler then serves PG rows only.
      */
     coldStore?: ColdStore | null;
     /**
      * Callback for handling re-run requests.
      * Returns { newRunId } on success or throws on failure.
      *
-     * Phase F — `routingKey` is forwarded from the Platform (read from
+     * `routingKey` is forwarded from the Platform (read from
      * Platform's denormalized `execution_runs.routing_key`) so the
      * orchestrator can probe its cold-store under the right tenant
      * prefix when the run row is missing from PG. Optional for back-
@@ -114,7 +114,7 @@ interface DashboardHandlerDeps {
     /**
      * **Test-only fault injection**, supplied only by the build-time test double:
      * `handleRerunRequest` awaits this hook before invoking `onRerun`, so an HA
-     * E2E can force a slow first coordinator and trigger a relay failover.
+     * test can force a slow first coordinator and trigger a relay failover.
      * Undefined (the shipped default) means no delay.
      */
     beforeRerun?: () => Promise<void>;
@@ -167,7 +167,7 @@ export declare class DashboardHandler {
      * Resolve the org owning a routing key by consulting both source tables
      * (GitHub-app `sources` first, then `generic_webhook_sources`). Used
      * directly for `handleRerunRequest` (which gets a `routingKey` hint from
-     * Platform — Phase F denormalization) and indirectly via
+     * Platform's denormalized copy) and indirectly via
      * `resolveOrgForRun`.
      */
     private resolveOrgForRoutingKey;
@@ -206,7 +206,7 @@ export declare class DashboardHandler {
     handleRunDetail(msg: DashboardRunDetailRequest): Promise<void>;
     /**
      * Handle a dashboard.run.structured request — the user-plane equivalent of
-     * the orchestrator-admin `/runs/:id/structured` endpoint. Reuses the Phase-1
+     * the orchestrator-admin `/runs/:id/structured` endpoint. Reuses the
      * aggregator + provenance mapper so the result is byte-identical to the admin
      * surface; emits an `access_log` `run.structured.read` row (carrying the
      * agent label when the actor came through an agent PAT).
@@ -396,7 +396,7 @@ export declare class DashboardHandler {
      * Handle a run.rerun.request.
      * Delegates to the onRerun callback which invokes handleRerun from the rerun module.
      *
-     * Resolution: prefer `msg.routingKey` (Phase F denormalization hint from
+     * Resolution: prefer `msg.routingKey` (denormalization hint from
      * Platform — `execution_runs.routing_key` mirror). The hint is the ONLY
      * org context we have when the run row has been cold-archived out of PG,
      * so consult sources/generic_webhook_sources directly. If the hint is
@@ -512,7 +512,7 @@ export declare class DashboardHandler {
      */
     handleManualScheduleRequest(msg: ManualScheduleRequest): Promise<void>;
     /**
-     * Phase C cold-store fallback: fetch the run + its jobs + its steps
+     * Cold-store fallback: fetch the run + its jobs + its steps
      * from S3 when the PG copy has been archived. Bounded scan: stops at
      * the warm cutoff (older entries don't exist in cold-store yet by
      * construction). Each row is filtered by `run_id` because chunks

package/dist/db/deferred-indexes.d.ts

@@ -15,8 +15,8 @@
  * server is already serving. `IF NOT EXISTS` makes every build idempotent, and
  * a failed build retries on the next boot.
  *
- * `hack/check-migration-safety.ts` enforces that new indexes on those tables
- * land here rather than in a migration.
+ * A repository check enforces that new indexes on those tables land here
+ * rather than in a migration.
  */
 import type pg from 'pg';
 import { type Logger } from '@kici-dev/shared';

package/dist/db/migrations/005_cold_store_chunk_counter.d.ts

@@ -7,12 +7,10 @@ import { type Kysely } from 'kysely';
  * `kici-admin cold-store list-chunks` CLI can report totals without
  * issuing S3 LIST calls (expensive + rate-limited).
  *
- * Phase A creates the table empty; the cold-store archiver
- * (Phase B+) updates it transactionally with every successful chunk
+ * The table starts empty; the cold-store archiver
+ * updates it transactionally with every successful chunk
  * write via `INSERT ... ON CONFLICT (db, table_name, tenant_id) DO
  * UPDATE SET chunk_count = chunk_count + EXCLUDED.chunk_count, ...`.
- *
- * sections 5 and 8.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/006_runs_jobs_steps_archived_at.d.ts

@@ -3,12 +3,12 @@ import { type Kysely } from 'kysely';
  * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
  * schema additions.
  *
- * Phase C of the cold-storage archival system. See
+ * Part of the cold-storage archival system.
  *
  * Each table gets `archived_at TIMESTAMPTZ NULL` and
  * `archive_object_key TEXT NULL` (set inside the archive tx before the
- * DELETE; survivors carry NULL — same pattern as Phase B's migration
- * 004 for `run_events`).
+ * DELETE; survivors carry NULL — the same pattern `run_events` carries
+ * in the Platform's schema).
  *
  * Tenant column denormalization: the orchestrator side partitions by
  * `routing_key`, but only `execution_runs` carries the column today.
@@ -17,7 +17,7 @@ import { type Kysely } from 'kysely';
  * denormalize `routing_key` onto both tables and backfill from the
  * existing run rows. Backfill is one-shot inside this migration. New
  * inserts must populate the column going forward (enforced at the
- * application layer in the same phase).
+ * application layer).
  *
  * The denormalized column is left NULLable for safety: if an insert
  * site is missed in the rollout, the row still lands in PG; the

package/dist/db/migrations/007_audit_logs_archived_at.d.ts

@@ -3,13 +3,12 @@ import { type Kysely } from 'kysely';
  * `secret_audit_log` and `access_log` cold-store schema additions, plus
  * the removal of `access_log`'s `expires_at`-based hard delete.
  *
- * Phase D of the cold-storage archival system. See
+ * Part of the cold-storage archival system.
  *
  * Both tables get the same `archived_at TIMESTAMPTZ NULL` /
- * `archive_object_key TEXT NULL` pair that Phase B added to `run_events`
- * (`packages/platform/src/db/migrations/004_run_events_archived_at.ts`)
- * and Phase C added to `execution_runs` / `execution_jobs` /
- * `execution_steps` (`006_runs_jobs_steps_archived_at.ts`). Set inside
+ * `archive_object_key TEXT NULL` pair that `run_events` carries
+ * (in the Platform's schema) and that `execution_runs` / `execution_jobs` /
+ * `execution_steps` got in `006_runs_jobs_steps_archived_at.ts`. Set inside
  * the archive transaction before the DELETE; survivors carry NULL.
  *
  * `secret_audit_log` gets a composite
@@ -23,7 +22,7 @@ import { type Kysely } from 'kysely';
  * (range scans use either direction).
  *
  * Drops `access_log.expires_at` column and `access_log_expires_idx`.
- * Until Phase D, `expires_at` powered a 90-day hard-delete sweep in
+ * Before this migration, `expires_at` powered a 90-day hard-delete sweep in
  * `packages/orchestrator/src/audit/access-log.ts:cleanup` (called from
  * `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 5). With
  * cold-store, `access_log` rows older than 30 days are archived rather
@@ -31,11 +30,9 @@ import { type Kysely } from 'kysely';
  * column would mean either (a) double-evicting rows or (b) silently
  * mismatching the new contract. Drop it.
  *
- * Per the project's "no backward compatibility (pre-release)" rule,
  * `down()` recreates `expires_at` with a default of `now() + 90 days`
  * — best effort; rows inserted between `up()` and a hypothetical
- * `down()` would not have meaningful retention bounds. Acceptable for
- * staging.
+ * `down()` would not have meaningful retention bounds.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/008_event_log_archived_at.d.ts

@@ -3,13 +3,11 @@ import { type Kysely } from 'kysely';
  * `event_log` cold-store schema additions plus removal of the
  * `expires_at`-based 30-day hard delete.
  *
- * Phase E of the cold-storage archival system. See
- *  §10
- * Phase E.
+ * Part of the cold-storage archival system.
  *
  * Adds the same `archived_at TIMESTAMPTZ NULL` /
- * `archive_object_key TEXT NULL` pair Phase D added on this side
- * (`007_audit_logs_archived_at.ts`). Set inside the archive
+ * `archive_object_key TEXT NULL` pair
+ * `007_audit_logs_archived_at.ts` added on this side. Set inside the archive
  * transaction before the DELETE; survivors carry NULL.
  *
  * Adds `idx_event_log_routing_received` on `(routing_key, received_at)`
@@ -20,7 +18,7 @@ import { type Kysely } from 'kysely';
  * archiver scan.
  *
  * Drops `event_log.expires_at` and the matching
- * `event_log_expires_at_idx` index. Until Phase E, `expires_at`
+ * `event_log_expires_at_idx` index. Before this migration, `expires_at`
  * powered the 30-day hard-delete sweep in
  * `packages/orchestrator/src/webhook/event-log.ts:cleanup`, called
  * from `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 4

package/dist/db/migrations/010_cold_store_chunks.d.ts

@@ -1,6 +1,6 @@
 import { type Kysely } from 'kysely';
 /**
- * Cold-store chunk index — Phase 2 (cold-store purge).
+ * Cold-store chunk index (cold-store purge).
  *
  * One row per archived chunk that the GC sweep can later purge from S3.
  * Inserted inside the same transaction as `markArchivedAndDelete` so a
@@ -25,7 +25,7 @@ import { type Kysely } from 'kysely';
  *   uses this to issue `DeleteObject` directly without recomputing the
  *   key from the prefix.
  *
- * Pre-Phase-2 chunks (v1 manifest) are NOT in this table — they live
+ * V1-manifest chunks are NOT in this table — they live
  * forever. Adapters that don't opt into per-bucket archival via
  * `coldTtlDays` don't insert here either.
  */

package/dist/db/migrations/012_peer_credentials_active_uniq.d.ts

@@ -12,13 +12,11 @@ import { type Kysely } from 'kysely';
  * nothing and both `INSERT`s succeeded, leaving 2+ ACTIVE rows for the same
  * `instance_id`. The peer's local credential file then ended up holding a
  * hash that a later concurrent `save()` had revoked, causing an endless
- * "Peer HMAC proof invalid" loop. See
- *  for the
- * full incident write-up (DB rows + log evidence from real staging deploys).
+ * "Peer HMAC proof invalid" loop.
  *
  * The `up()` first dedupes any pre-existing duplicates (revoke all but the
  * newest active row per `instance_id`) — required because earlier migrations
- * predate the constraint and existing staging DBs already have the dupes.
+ * predate the constraint and existing databases may already hold the dupes.
  *
  * `down()` only drops the index; it does NOT undo the dedupe (there's no
  * safe way to recreate revoked rows, and the dedupe is monotonic).

package/dist/db/migrations/016_org_settings_allow_http_npm.d.ts

@@ -5,8 +5,8 @@ import { type Kysely } from 'kysely';
  * Operators flip this on a per-org basis to permit `http://` (non-HTTPS)
  * registry URLs in workflow `registries:` declarations. By default only
  * `https://` registries are accepted, with an automatic exemption for
- * loopback / `*.local` / private link-local hosts so dev fixtures
- * (Verdaccio at `http://verdaccio.local:4873`) keep working.
+ * loopback / `*.local` / private link-local hosts so a local registry
+ * (for example `http://registry.local:4873`) keeps working.
  *
  * Idempotent: a re-run on a DB that already has the column is a no-op.
  */

package/dist/db/migrations/045_host_properties.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  *   the separate queryable host-vars dimension.
  *
  * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
- * the column is a no-op. Staging data is preserved (additive column).
+ * the column is a no-op. Existing data is preserved (additive column).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;