@kici-dev/orchestrator 0.10.0 → 0.12.0

package/dist/db/migrations/046_join_token_consumed_by_instance.d.ts

@@ -10,7 +10,7 @@ import { type Kysely } from 'kysely';
  *   join token already in its env — no operator action, no cluster redeploy.
  *
  * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
- * the column is a no-op. Staging data is preserved (additive nullable column).
+ * the column is a no-op. Existing data is preserved (additive nullable column).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/048_host_reboot_pending.d.ts

@@ -11,7 +11,7 @@ import { type Kysely } from 'kysely';
  * (3) clears on the next reconnect (down-then-up), releasing the held job. NULL
  * = no reboot pending.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/049_held_runs_payload.d.ts

@@ -6,7 +6,7 @@ import { type Kysely } from 'kysely';
  * the dashboard approval queue and the CLI render the computed diff the
  * operator approves. NULL for every non-drift hold.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/050_sources_slug.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  * hasn't populated it yet (manual `--app-id` flow whose initial fetch failed,
  * or a row created before the rollout).
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/051_binding_host_pattern.d.ts

@@ -11,7 +11,7 @@ import { type Kysely } from 'kysely';
  *   distinct per-host selectors.
  *
  * Idempotent: re-running on a DB that already has the column / index is a no-op.
- * Additive — staging data is preserved.
+ * Additive — existing data is preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/052_host_reach_metadata.d.ts

@@ -12,7 +12,7 @@ import { type Kysely } from 'kysely';
  *
  * All nullable: a host with no reach metadata simply cannot be bootstrapped and
  * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
- * so staging data is preserved.
+ * so existing data is preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/053_agent_token_single_use.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  *   default for every existing static / ephemeral token, which stay reusable
  *   until expiry).
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/054_local_working_tree.d.ts

@@ -7,7 +7,7 @@ import { type Kysely } from 'kysely';
  *   lock file). The dashboard renders a "Local machine" badge for these runs
  *   and avoids building an external repository link from the repo identifier.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so existing
  * data is preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/055_agent_token_mandatory_labels.d.ts

@@ -10,7 +10,7 @@ import { type Kysely } from 'kysely';
  *   agent accepts any job its advertised labels match), so every existing token
  *   stays unconfined until re-minted.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/056_execution_jobs_environments.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  *   fully-resolved list when a deferred-init agent eval resolves dynamic
  *   elements. NULL = the job binds no environment.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/064_execution_jobs_skipped_environments.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  * - `execution_jobs.env_warning text NULL` — the user-visible warning naming the
  *   skipped environments, surfaced on the dashboard run view. NULL = no warning.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/types.d.ts

@@ -714,8 +714,8 @@ export interface ExecutionRunTable {
     check_mode: string | null;
     /**
      * Set inside the cold-store archive transaction before the row is
-     * DELETEd. Survivors carry NULL. Exists so a future
-     * "promote-chunk-back-into-PG" path (Phase F) can restore rows with
+     * DELETEd. Survivors carry NULL. Exists so the
+     * "promote-chunk-back-into-PG" path can restore rows with
      * their original archive pointer.
      */
     archived_at: Date | null;
@@ -1301,7 +1301,7 @@ export interface SecretAuditLogTable {
     metadata: string | null;
     /**
      * Set inside the archive transaction before the row is DELETEd.
-     * Survivors carry NULL. See cold-storage Phase D notes.
+     * Survivors carry NULL.
      */
     archived_at: Date | null;
     /** S3 object key of the chunk that carried this row; see `archived_at`. */
@@ -1338,9 +1338,8 @@ export interface AccessLogTable {
     created_at: Generated<Date>;
     /**
      * Set inside the archive transaction before the row is DELETEd.
-     * Survivors carry NULL. See cold-storage Phase D notes.
-     * Phase D removed the previous `expires_at`-based TTL — rows older
-     * than 30 days are archived to S3 instead of hard-deleted.
+     * Survivors carry NULL. The table has no `expires_at`-based TTL — rows
+     * older than 30 days are archived to S3 instead of hard-deleted.
      */
     archived_at: Date | null;
     /** S3 object key of the chunk that carried this row; see `archived_at`. */
@@ -2403,9 +2402,9 @@ export interface EventLogTable {
     error_message: string | null;
     /** When the delivery was received */
     received_at: Generated<Date>;
-    /** Phase E cold-store: set inside the archive transaction; NULL for hot rows. */
+    /** Cold-store: set inside the archive transaction; NULL for hot rows. */
     archived_at: Date | null;
-    /** Phase E cold-store: chunk object key when row is archived. */
+    /** Cold-store: chunk object key when row is archived. */
     archive_object_key: string | null;
 }
 export type EventLogRow = Selectable<EventLogTable>;
@@ -2415,8 +2414,8 @@ export type EventLogRowUpdate = Updateable<EventLogTable>;
  * Cold-store chunk counts table (cold_store_chunk_counts).
  * Tracks per-(db, table, tenant) archived-chunk metadata so the
  * `cold_store_chunks_total` gauge and the `kici-admin cold-store list-chunks`
- * CLI can report totals without S3 LIST calls. Phase A creates the table
- * empty; Phase B+ populates it transactionally on each chunk write.
+ * CLI can report totals without S3 LIST calls. The cold-store archiver
+ * populates it transactionally on each chunk write.
  */
 export interface ColdStoreChunkCountsTable {
     /** DbKind identifier ('orchestrator' on this side). */
@@ -2438,12 +2437,12 @@ export type ColdStoreChunkCountsRow = Selectable<ColdStoreChunkCountsTable>;
 export type NewColdStoreChunkCountsRow = Insertable<ColdStoreChunkCountsTable>;
 export type ColdStoreChunkCountsUpdate = Updateable<ColdStoreChunkCountsTable>;
 /**
- * Cold-store chunk index (cold_store_chunks). Phase 2.
+ * Cold-store chunk index (cold_store_chunks).
  *
  * One row per archived chunk that the GC sweep can later purge from S3.
  * Inserted inside `markArchivedAndDelete`'s transaction by adapters that
- * opt into the per-bucket layout via `coldTtlDays(row)`. Pre-Phase-2
- * (v1) chunks are NOT in this table — they're treated as
+ * opt into the per-bucket layout via `coldTtlDays(row)`. V1
+ * chunks are NOT in this table — they're treated as
  * `'forever'` and never purged.
  */
 export interface ColdStoreChunksTable {

package/dist/events/types.d.ts

@@ -31,7 +31,7 @@ export interface EventRouterConfig {
     /**
      * **Test-only.** Per-event-name fault injection: when `attempts <= N`,
      * the EventRouter throws a synthetic dispatch error to drive the retry /
-     * DLQ path. Used by the fault-injection E2E to prove the lease + retry
+     * DLQ path. Used by fault-injection tests to prove the lease + retry
      * loop dispatches a real run when the inner dispatch eventually
      * succeeds, and lands the row in the DLQ when N exceeds
      * `maxDispatchAttempts`.

package/dist/fault-injection-types.d.ts

@@ -29,7 +29,7 @@ export interface OrchestratorFaultInjection {
     skipS3Sentinel?: boolean;
     /**
      * Predicate over an OIDC `audience`: when true, the *initial* provenance
-     * mint fails transiently (defer), so an E2E can exercise the
+     * mint fails transiently (defer), so a test can exercise the
      * deferred-attestation retry + per-run serve path.
      */
     initialMintFault?: (audience: string) => boolean;
@@ -40,7 +40,7 @@ export interface OrchestratorFaultInjection {
      */
     remintReject?: (audience: string) => boolean;
     /**
-     * Invoked by `handleRerunRequest` before `onRerun`, so an HA E2E can make
+     * Invoked by `handleRerunRequest` before `onRerun`, so an HA test can make
      * the first coordinator slow enough that the Platform relay fails over.
      */
     beforeRerun?: () => Promise<void>;

package/dist/firecracker/host-network.d.ts

@@ -43,9 +43,9 @@ export declare function cidrToNetwork(cidr: string): string;
  * serializes them.
  *
  * The command list NEVER deletes the table. It is a self-heal — `ensureHostReady`
- * runs it whenever `verifyBridge` reports unhealthy, which happens on any of
- * four conditions none of which knows how many VMs are live — so dropping the
- * table would leave every running VM fail-open, with full RFC1918 and
+ * runs it whenever `verifyBridge` reports unhealthy, and none of the
+ * conditions it checks says how many VMs are live — so dropping the table
+ * would leave every running VM fail-open, with full RFC1918 and
  * cloud-metadata reach, until it was destroyed. Instead the baseline lives in
  * its own regular chain (`baseline`, see {@link BASELINE_CHAIN}) that is flushed
  * and refilled, and the hooked `forward` chain keeps its per-VM rules
@@ -80,6 +80,10 @@ export interface BridgeHealth {
     tablePresent: boolean;
     /** The regular baseline chain exists and `forward` ends in a jump to it. */
     baselineChainPresent: boolean;
+    /** The table's `postrouting` chain masquerades the bridge subnet — the guests' internet egress. */
+    natPresent: boolean;
+    /** The baseline chain holds the bridge subnet's rules, in the order the provisioner writes them. */
+    baselineRulesPresent: boolean;
     /** Every enslaved kici-* TAP carries bridge port isolation. */
     tapIsolationPresent: boolean;
     healthy: boolean;
@@ -125,6 +129,20 @@ export declare function verifyBridge(cfg: FirecrackerBridgeConfig, opts?: ExecOp
  * `denyAll` drop.
  */
 export declare function forwardEndsInBaselineJump(nftJson: string): boolean;
+/**
+ * True when a `nft -j list chain … postrouting` listing masquerades traffic
+ * whose source is `subnet` (the network CIDR, e.g. `10.0.0.0/24`).
+ */
+export declare function postroutingMasqueradesSubnet(nftJson: string, subnet: string): boolean;
+/**
+ * True when a `nft -j list chain … baseline` listing holds this bridge's
+ * subnet-scoped accepts and drops exactly as {@link buildBridgeCommands} writes
+ * them, in the same order.
+ *
+ * Order is part of the check: the internet accept is terminal, so ahead of the
+ * RFC1918 and metadata drops it would let the guests reach every private range.
+ */
+export declare function baselineHoldsBridgeRules(nftJson: string, cfg: FirecrackerBridgeConfig): boolean;
 /**
  * Names of the kici-* TAPs enslaved to the bridge that are NOT port-isolated,
  * read from `ip -d -j link show master <bridge>`.

package/dist/firecracker/net-interfaces.d.ts

@@ -4,7 +4,7 @@
  *
  * A leaf module on purpose: it imports nothing, so an out-of-package consumer
  * can read the constant without pulling the orchestrator runtime graph in with
- * it. The NetworkManager drift watchdog (`hack/lib/nm-watchdog.ts`) derives its
+ * it. A NetworkManager drift watchdog derives its
  * expected-pattern set from here rather than re-typing the patterns — a second
  * copy desyncs silently the moment a pattern is added. `host-network.ts`
  * re-exports it and renders `NM_CONF_CONTENT` from it, so the drop-in and the

package/dist/helpers/run-detached.d.ts

@@ -0,0 +1,12 @@
+/** The part of a logger that `runDetached` writes a failure to. */
+export interface DetachedFailureLogger {
+    error(message: string, meta?: Record<string, unknown>): unknown;
+}
+/**
+ * Run `work` without waiting for it. A throw, or a rejection of the promise it
+ * returns, is logged at error level as `<task> failed` with `context` and the
+ * error message, and goes no further. `context` is read when the failure is
+ * logged, so the work may fill it in while it runs.
+ */
+export declare function runDetached(logger: DetachedFailureLogger, task: string, work: () => unknown, context?: Record<string, unknown>): void;
+//# sourceMappingURL=run-detached.d.ts.map

package/dist/index.js

@@ -2,7 +2,7 @@ import "node:module";
 import { CopyObjectCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { createLogger, createS3Client, sha256 } from "@kici-dev/shared";
+import { createLogger, createS3Client, sha256, toErrorMessage } from "@kici-dev/shared";
 import * as fs from "node:fs";
 import { mkdtempSync, promises, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -299,7 +299,8 @@ var S3CacheStorage = class {
 * Signature input: `${method}:${key}:${expiresUnixMs}` with HMAC-SHA256 keyed
 * by a per-orchestrator-process secret (random 32-byte hex at boot, persists
 * for the lifetime of the process). Tokens become invalid on orchestrator
-* restart — fine for the filesystem backend's E2E / single-host use case.
+* restart — fine for the filesystem backend's single-host / test-sandbox use
+* case.
 */
 /** Default URL lifetime: 1 hour (matches S3 backend's PUT-URL lifetime). */
 const DEFAULT_SIGN_URL_TTL_MS = 36e5;
@@ -328,7 +329,7 @@ function signToken(secret, method, key, ttlMs = DEFAULT_SIGN_URL_TTL_MS) {
 * are replaced by HMAC-signed `http://<orchUrl>/api/v1/cache/blob/...` URLs
 * — see `sign-url.ts` for the token mechanics and `app.ts` for the route.
 *
-* Intended for single-host deployments and E2E sandboxes where standing up
+* Intended for single-host deployments and test sandboxes where standing up
 * an S3-compatible service is overkill. Production should still use S3.
 *
 * Metadata is co-located as a sibling JSON file (`<key>.meta.json`) so the
@@ -1461,7 +1462,7 @@ async function readCredentialFile(filePath) {
 * store plus a disposer that closes the underlying pool. Lets tests
 * exercise the real Kysely-backed store without importing pg/kysely.
 *
-* Intended for e2e coverage of the store's own CRUD methods — production
+* Intended for tests of the store's own CRUD methods — production
 * code constructs the store with an already-allocated Kysely instance
 * shared with the orchestrator.
 */
@@ -1479,6 +1480,41 @@ async function createPeerCredentialStoreFromUrl(databaseUrl, opts) {
 	};
 }
 //#endregion
+//#region src/helpers/run-detached.ts
+/**
+* Running work that nothing awaits.
+*
+* A promise that nobody awaits and nobody catches becomes an unhandled
+* rejection when it fails, and the orchestrator's shutdown hook treats an
+* unhandled rejection as fatal: one failed query in a timer tick or a message
+* handler would stop the whole process. `runDetached` runs such work and logs
+* its failure instead. ESLint's `no-floating-promises` (with `ignoreVoid:
+* false`) refuses a bare or `void`-ed promise anywhere in this package, so
+* detached work runs through here or carries its own `.catch`.
+*/
+/**
+* Run `work` without waiting for it. A throw, or a rejection of the promise it
+* returns, is logged at error level as `<task> failed` with `context` and the
+* error message, and goes no further. `context` is read when the failure is
+* logged, so the work may fill it in while it runs.
+*/
+function runDetached(logger, task, work, context = {}) {
+	const fail = (err) => {
+		logger.error(`${task} failed`, {
+			...context,
+			error: toErrorMessage(err)
+		});
+	};
+	let outcome;
+	try {
+		outcome = work();
+	} catch (err) {
+		fail(err);
+		return;
+	}
+	Promise.resolve(outcome).catch(fail);
+}
+//#endregion
 //#region src/cluster/peer-auth-coordinator.ts
 /**
 * Per-orchestrator coordinator that owns the shared peer credential file.
@@ -1566,11 +1602,11 @@ var PeerAuthCoordinator = class {
 	}
 	makeComplete(join) {
 		return (issued) => {
-			this.withLock(async () => {
+			runDetached(logger, "Peer token-join completion", () => this.withLock(async () => {
 				if (issued) await writeCredentialFile(this.credentialFile, issued);
 				if (this.inFlightJoin === join) this.inFlightJoin = null;
 				join.resolve(issued);
-			});
+			}), { instanceId: this.instanceId });
 		};
 	}
 	async awaitInFlightJoin() {
@@ -1737,8 +1773,8 @@ var JoinTokenManager = class {
 /**
 * Build a JoinTokenManager backed by its own connection pool to the given
 * orchestrator database URL. Mirrors `createPeerCredentialStoreFromUrl`;
-* consumed by E2E tests that need to exercise token validation/reuse against
-* the real cluster DB.
+* used by tests that need to exercise token validation/reuse against a real
+* cluster DB.
 */
 function createJoinTokenManagerFromUrl(databaseUrl, opts) {
 	const pool = new pg.Pool({
@@ -2137,8 +2173,8 @@ var HeldRunStore = class {
 /**
 * Build a HeldRunStore backed by its own connection pool to the given
 * orchestrator database URL. Mirrors `createPeerCredentialStoreFromUrl` /
-* `createJoinTokenManagerFromUrl`; consumed by E2E tests that exercise the
-* PR-scoped hold selection against the real deployed orchestrator DB.
+* `createJoinTokenManagerFromUrl`; used by tests that exercise the PR-scoped
+* hold selection against a real orchestrator DB.
 */
 function createHeldRunStoreFromUrl(databaseUrl, opts) {
 	const pool = new pg.Pool({
@@ -2303,9 +2339,9 @@ var TrustPolicyStore = class {
 };
 /**
 * Build a TrustPolicyStore backed by its own connection pool to the given
-* orchestrator database URL. Mirrors `createHeldRunStoreFromUrl`; consumed by
-* E2E tests that assert the pushed policy is persisted in the real deployed
-* orchestrator DB rather than held in process memory.
+* orchestrator database URL. Mirrors `createHeldRunStoreFromUrl`; exported for
+* tests that assert the pushed policy is persisted in a real orchestrator DB
+* rather than held in process memory.
 */
 function createTrustPolicyStoreFromUrl(databaseUrl, opts) {
 	const pool = new pg.Pool({
@@ -2509,6 +2545,32 @@ var AdminApiClient = class {
 		return this.request("DELETE", `/api/v1/admin/secrets/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}/${encodeURIComponent(key)}`);
 	}
 	/**
+	* Create an empty secret scope. A `<backend>:` qualifier selects the
+	* backend; an unqualified scope targets the PG backend. Creating a scope
+	* that already exists succeeds and changes nothing.
+	*/
+	async createScope(orgId, scope) {
+		return this.request("POST", "/api/v1/admin/secrets/scopes", {
+			orgId,
+			scope
+		});
+	}
+	/**
+	* Rename a secret scope inside its backend. The route refuses a move between
+	* backends and a rename onto a scope that already exists.
+	*/
+	async renameScope(orgId, oldScope, newScope) {
+		return this.request("PUT", "/api/v1/admin/secrets/scopes/rename", {
+			orgId,
+			oldScope,
+			newScope
+		});
+	}
+	/** Delete a secret scope and every secret in it. */
+	async deleteScope(orgId, scope) {
+		return this.request("DELETE", `/api/v1/admin/secrets/scopes/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}`);
+	}
+	/**
 	* Create (or upsert) a deployment context. `allowLocalExecution` lets
 	* CLI-initiated / local runs resolve secrets through this context.
 	*/
@@ -3081,7 +3143,7 @@ function startManifestLoopback(opts) {
 * blocked launcher) just falls back to copy-paste.
 *
 * `KICI_BROWSER_CMD` overrides the launcher: `none` suppresses it entirely
-* (E2E / headless capture), any other value is run with `{url}` substituted —
+* (automated tests / headless capture), any other value is run with `{url}` substituted —
 * mirroring the `kici login` convention.
 */
 function openBrowserBestEffort(url) {

package/dist/oidc/db-signer.d.ts

@@ -8,7 +8,7 @@
  * The in-memory private key is imported NON-EXTRACTABLE (`extractable: false`),
  * so once loaded the raw private material can never be read back out of the
  * process — the only export path is the public JWK. This is what makes the
- * private key "non-exportable by design" (design spec § A / § H).
+ * private key "non-exportable by design".
  */
 import { type JWK } from 'jose';
 import type { Signer } from './signer.js';

package/dist/pipeline/global-eval-round.d.ts

@@ -156,8 +156,8 @@ export interface GlobalEvalAgentRegistry {
  * fails outright or reports success without the `globalEvalComplete` the
  * orchestrator is waiting for. Either way the round never settles.
  *
- * Customers upgrade their orchestrator and their agents on their own schedule
- * (`.claude/rules/compatibility.md`), so an orchestrator ahead of its fleet is
+ * Customers upgrade their orchestrator and their agents on their own schedule,
+ * so an orchestrator ahead of its fleet is
  * a supported state and not an error — but it is one this module has to
  * recognise, because the damage is not confined to the new feature. A global
  * workflow that merely *contains* a generator now routes through the round, so

package/dist/pipeline/processor.d.ts

@@ -156,8 +156,8 @@ export declare function isRootJob(lockJob: LockJob): boolean;
  * Why this exists
  * ----------------
  * The webhook pipeline binds `lockFileFetcher` to the inbound webhook's
- * provider bundle. When a local-sourced webhook (e.g., the staging
- * stg-ha-smoke failover-dispatch test) arrives for a repo whose lock file
+ * provider bundle. When a local-sourced webhook (e.g., a failover-dispatch
+ * push sent through the internal ingress) arrives for a repo whose lock file
  * is only accessible via a different provider (e.g., github), the inbound
  * fetcher returns null and trigger matching silently drops the webhook.
  * This resolver lets the pipeline consult OTHER bundles whose registrations

package/dist/provenance/retrier-mint.d.ts

@@ -24,7 +24,7 @@ export interface RetrierMintDeps {
     } | undefined;
     /**
      * Test-only fault injection: the build-time test double supplies a predicate
-     * over the audience that forces a TERMINAL rejection, so an E2E can exercise
+     * over the audience that forces a TERMINAL rejection, so a test can exercise
      * the markRejected → gauge-exclusion → `--include-rejected` re-arm cycle with
      * a real deferred row. It returns before the real mint, so the signing choke
      * point is preserved. The shipped orchestrator leaves it undefined.

package/dist/provenance/trust-root.d.ts

@@ -1,7 +1,7 @@
 import type { JSONWebKeySet } from 'jose';
 /**
  * Derive the JWKS URI for a provenance OIDC issuer. Identical to the Platform's
- * own derivation (`packages/platform/src/dashboard/routes/runs.ts`) so a bundle
+ * own derivation so a bundle
  * verified client-side and at ingest resolve the same key set.
  */
 export declare function deriveJwksUri(issuer: string): string;
@@ -17,8 +17,8 @@ export interface ProvenanceTrustRoot {
     setIssuer(issuer: string | null): void;
 }
 /**
- * A trust root backed by the orchestrator's OWN signing keys (Phase 1
- * orchestrator-owned attestations). Verify-at-ingest resolves the key set from
+ * A trust root backed by the orchestrator's OWN signing keys
+ * (orchestrator-owned attestations). Verify-at-ingest resolves the key set from
  * the `orchestrator_signing_keys` table so fresh rotations / revocations are
  * reflected immediately, and the issuer is the orchestrator's own configured
  * provenance issuer. The key set is read fresh from the DB each resolve (a cheap

package/dist/providers/universal-git/clone-token.d.ts

@@ -11,14 +11,11 @@
  * The value returned here is the raw secret material:
  *   - `credentialType === 'pat' | 'basic'`: the PAT / password string
  *   - `credentialType === 'ssh'`: the PEM-encoded private key (the agent
- *     materializes it to a tempfile and wires `GIT_SSH_COMMAND` — see
- *     Phase 4 dispatch protocol + agent work)
+ *     materializes it to a tempfile and wires `GIT_SSH_COMMAND`)
  *
  * The token's "kind" (basic vs ssh) is NOT carried through this interface;
- * it is propagated via `QueuedJobInput.gitAuth` in Phase 4. For Phase 2 we
- * expose a richer `issueGitAuth()` method on this class that the dispatcher
- * can call directly once Phase 4 adds `sourceAuth`/`workflowAuth` to the
- * dispatch schema.
+ * the richer `issueGitAuth()` method on this class returns it, and the
+ * dispatcher carries it in the dispatch's `sourceAuth`/`workflowAuth` fields.
  */
 import type { CloneTokenProvider, ProviderGitAuth } from '@kici-dev/engine';
 import type { SecretResolver } from '../../secrets/secret-resolver.js';
@@ -26,7 +23,7 @@ import type { UniversalGitConfig } from './config.js';
 /**
  * Structured auth material the agent needs to clone a universal-git repo.
  *
- * Phase 4: serialized into the new `sourceAuth` / `workflowAuth` fields on
+ * Serialized into the `sourceAuth` / `workflowAuth` fields on
  * `jobDispatchSchema`. The shape matches `ProviderGitAuth` from
  * `@kici-dev/engine` with additional SSH fields pulled from the source
  * config (`sshHostKeyPolicy`, `sshKnownHostsPem`).
@@ -52,11 +49,10 @@ export declare class UniversalGitCloneTokenProvider implements CloneTokenProvide
     /**
      * Create a clone token — the raw secret material (PAT / password / SSH key).
      *
-     * The orchestrator dispatch pipeline currently threads this string into
-     * `jobDispatch.token`, which the agent uses as HTTPS Basic-auth password
-     * via `http.extraHeader`. SSH support requires the Phase 4 dispatch-schema
-     * split (sourceAuth.kind = 'ssh') — which is where the agent gains the
-     * ability to materialize the PEM key and wire `GIT_SSH_COMMAND`.
+     * A bare token reaches `jobDispatch.token`, which the agent uses as HTTPS
+     * Basic-auth password via `http.extraHeader`. SSH needs the structured
+     * `sourceAuth` (`kind: 'ssh'`) from `issueGitAuth()` — which is where the
+     * agent materializes the PEM key and wires `GIT_SSH_COMMAND`.
      *
      * @returns The resolved secret string, or `null` when the secret is
      * missing (source misconfigured — caller treats this as a clone failure).
@@ -64,7 +60,7 @@ export declare class UniversalGitCloneTokenProvider implements CloneTokenProvide
     createCloneToken(_repoIdentifier: string, _credentials: unknown): Promise<string | null>;
     /**
      * Richer variant that returns the full `UniversalGitAuth` shape instead
-     * of just the secret string. The Phase 4 dispatcher calls this via the
+     * of just the secret string. The dispatcher calls this via the
      * `CloneTokenProvider.issueGitAuth?` interface hook so the agent
      * receives the auth `kind` + `user` + SSH host-key policy alongside the
      * secret.

package/dist/providers/universal-git/index.d.ts

@@ -18,8 +18,7 @@
  *   - `UniversalGitRepoUrlBuilder` — substitutes `{owner}`/`{name}`/`{repo}`
  *     in the source's `gitUrlTemplate`.
  *
- * No `CheckStatusPoster` is wired for v1 — forge API support for it is uneven
- * and adding it is a separate phase.
+ * No `CheckStatusPoster` is wired — forge API support for it is uneven.
  *
  * The bundle also leaves `hasForkModel` unset. The normalizer does report an
  * `isForkPR`, but it compares two repo names that `extractRepoFullName` reads

package/dist/providers/universal-git/normalizer.d.ts

@@ -79,9 +79,8 @@ export declare class UniversalGitWebhookNormalizer implements WebhookNormalizer
     /**
      * Extension hook used by the processor's `isDefaultBranchPush` check so it
      * does not need to hardcode `payload.repository.default_branch`. The
-     * engine interface does not yet declare this method; it is consumed via
-     * an optional chain (`normalizer.extractDefaultBranch?.(payload)`), so it
-     * is safe to ship ahead of the interface change in Phase 3.
+     * engine interface declares it optional, so it is consumed via
+     * an optional chain (`normalizer.extractDefaultBranch?.(payload)`).
      */
     extractDefaultBranch(payload: unknown): string | null;
     /**

package/dist/providers/universal-git/ssh-auth.d.ts

@@ -10,9 +10,9 @@
  *
  * This module provides the orchestrator-side primitives for preparing those
  * artefacts. It is used in two contexts:
- *   - **Agent-side** (Phase 4+): the agent receives the PEM + host-key policy
+ *   - **Agent-side**: the agent receives the PEM + host-key policy
  *     in the dispatch message and materializes them before cloning.
- *   - **Lock-file fetcher** (Phase 2, this module's immediate consumer):
+ *   - **Lock-file fetcher**:
  *     the orchestrator shallow-clones the source repo itself at registration
  *     time, using the same SSH materialization path.
  *
@@ -82,8 +82,8 @@ export declare function prepareSshAuthSync(opts: PrepareSshAuthOptions): SshAuth
  * mismatches against cached keys). The per-call file is wiped by `cleanup()`.
  *
  * IdentitiesOnly=yes ensures ssh ignores any agent-forwarded keys and only
- * uses the one we provided; this is critical in staging where the runner
- * user may have a populated ssh-agent.
+ * uses the one we provided; this is critical on any host where the
+ * orchestrator's runtime user may have a populated ssh-agent.
  */
 export declare function composeGitSshCommand(privateKeyPath: string, policy: SshHostKeyPolicy, knownHostsPath: string): string;
 /**

package/dist/queue/cleanup.d.ts

@@ -94,8 +94,8 @@ export interface CleanupExtras {
  * as terminal status updates so the Platform execution_jobs projection
  * stays in sync.
  *
- * Event-log row + payload retention used to live here too, but Phase E
- * replaced the 30-day hard-delete with cold-store archive-then-delete
+ * Event-log row + payload retention is not here: event_log rows are
+ * archived to cold-store and then deleted
  * (see `packages/orchestrator/src/cold-store/tables/event-log.ts`).
  *
  * @returns Counts of cleaned entries.