@kici-dev/orchestrator 0.11.0 → 0.13.0

package/dist/dashboard/handler.d.ts

@@ -23,7 +23,7 @@ interface DashboardHandlerDeps {
      * so the dashboard verifies it client-side without a second fetch. Optional —
      * when absent (e.g. orchestrators without provenance configured) the handler
      * replies with an `error` and an empty list. Reuses the cache storage backend
-     * (the same one P1.5 writes bundles to).
+     * (the same one attestation bundles are written to).
      */
     provenanceStorage?: CacheStorage | null;
     /**
@@ -58,14 +58,14 @@ interface DashboardHandlerDeps {
      * Long-lived cold-store handle for read fallback. When set, run /
      * job / step lookups fall through to S3 if the row has aged out of
      * PG. `null` means the orchestrator is running without cold-store
-     * configured — handler then returns its pre-Phase-C behavior.
+     * configured — handler then serves PG rows only.
      */
     coldStore?: ColdStore | null;
     /**
      * Callback for handling re-run requests.
      * Returns { newRunId } on success or throws on failure.
      *
-     * Phase F — `routingKey` is forwarded from the Platform (read from
+     * `routingKey` is forwarded from the Platform (read from
      * Platform's denormalized `execution_runs.routing_key`) so the
      * orchestrator can probe its cold-store under the right tenant
      * prefix when the run row is missing from PG. Optional for back-
@@ -114,7 +114,7 @@ interface DashboardHandlerDeps {
     /**
      * **Test-only fault injection**, supplied only by the build-time test double:
      * `handleRerunRequest` awaits this hook before invoking `onRerun`, so an HA
-     * E2E can force a slow first coordinator and trigger a relay failover.
+     * test can force a slow first coordinator and trigger a relay failover.
      * Undefined (the shipped default) means no delay.
      */
     beforeRerun?: () => Promise<void>;
@@ -167,7 +167,7 @@ export declare class DashboardHandler {
      * Resolve the org owning a routing key by consulting both source tables
      * (GitHub-app `sources` first, then `generic_webhook_sources`). Used
      * directly for `handleRerunRequest` (which gets a `routingKey` hint from
-     * Platform — Phase F denormalization) and indirectly via
+     * Platform's denormalized copy) and indirectly via
      * `resolveOrgForRun`.
      */
     private resolveOrgForRoutingKey;
@@ -206,7 +206,7 @@ export declare class DashboardHandler {
     handleRunDetail(msg: DashboardRunDetailRequest): Promise<void>;
     /**
      * Handle a dashboard.run.structured request — the user-plane equivalent of
-     * the orchestrator-admin `/runs/:id/structured` endpoint. Reuses the Phase-1
+     * the orchestrator-admin `/runs/:id/structured` endpoint. Reuses the
      * aggregator + provenance mapper so the result is byte-identical to the admin
      * surface; emits an `access_log` `run.structured.read` row (carrying the
      * agent label when the actor came through an agent PAT).
@@ -396,7 +396,7 @@ export declare class DashboardHandler {
      * Handle a run.rerun.request.
      * Delegates to the onRerun callback which invokes handleRerun from the rerun module.
      *
-     * Resolution: prefer `msg.routingKey` (Phase F denormalization hint from
+     * Resolution: prefer `msg.routingKey` (denormalization hint from
      * Platform — `execution_runs.routing_key` mirror). The hint is the ONLY
      * org context we have when the run row has been cold-archived out of PG,
      * so consult sources/generic_webhook_sources directly. If the hint is
@@ -512,7 +512,7 @@ export declare class DashboardHandler {
      */
     handleManualScheduleRequest(msg: ManualScheduleRequest): Promise<void>;
     /**
-     * Phase C cold-store fallback: fetch the run + its jobs + its steps
+     * Cold-store fallback: fetch the run + its jobs + its steps
      * from S3 when the PG copy has been archived. Bounded scan: stops at
      * the warm cutoff (older entries don't exist in cold-store yet by
      * construction). Each row is filtered by `run_id` because chunks

package/dist/db/deferred-indexes.d.ts

@@ -15,8 +15,8 @@
  * server is already serving. `IF NOT EXISTS` makes every build idempotent, and
  * a failed build retries on the next boot.
  *
- * `hack/check-migration-safety.ts` enforces that new indexes on those tables
- * land here rather than in a migration.
+ * A repository check enforces that new indexes on those tables land here
+ * rather than in a migration.
  */
 import type pg from 'pg';
 import { type Logger } from '@kici-dev/shared';

package/dist/db/migrations/005_cold_store_chunk_counter.d.ts

@@ -7,12 +7,10 @@ import { type Kysely } from 'kysely';
  * `kici-admin cold-store list-chunks` CLI can report totals without
  * issuing S3 LIST calls (expensive + rate-limited).
  *
- * Phase A creates the table empty; the cold-store archiver
- * (Phase B+) updates it transactionally with every successful chunk
+ * The table starts empty; the cold-store archiver
+ * updates it transactionally with every successful chunk
  * write via `INSERT ... ON CONFLICT (db, table_name, tenant_id) DO
  * UPDATE SET chunk_count = chunk_count + EXCLUDED.chunk_count, ...`.
- *
- * sections 5 and 8.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/006_runs_jobs_steps_archived_at.d.ts

@@ -3,12 +3,12 @@ import { type Kysely } from 'kysely';
  * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
  * schema additions.
  *
- * Phase C of the cold-storage archival system. See
+ * Part of the cold-storage archival system.
  *
  * Each table gets `archived_at TIMESTAMPTZ NULL` and
  * `archive_object_key TEXT NULL` (set inside the archive tx before the
- * DELETE; survivors carry NULL — same pattern as Phase B's migration
- * 004 for `run_events`).
+ * DELETE; survivors carry NULL — the same pattern `run_events` carries
+ * in the Platform's schema).
  *
  * Tenant column denormalization: the orchestrator side partitions by
  * `routing_key`, but only `execution_runs` carries the column today.
@@ -17,7 +17,7 @@ import { type Kysely } from 'kysely';
  * denormalize `routing_key` onto both tables and backfill from the
  * existing run rows. Backfill is one-shot inside this migration. New
  * inserts must populate the column going forward (enforced at the
- * application layer in the same phase).
+ * application layer).
  *
  * The denormalized column is left NULLable for safety: if an insert
  * site is missed in the rollout, the row still lands in PG; the

package/dist/db/migrations/007_audit_logs_archived_at.d.ts

@@ -3,13 +3,12 @@ import { type Kysely } from 'kysely';
  * `secret_audit_log` and `access_log` cold-store schema additions, plus
  * the removal of `access_log`'s `expires_at`-based hard delete.
  *
- * Phase D of the cold-storage archival system. See
+ * Part of the cold-storage archival system.
  *
  * Both tables get the same `archived_at TIMESTAMPTZ NULL` /
- * `archive_object_key TEXT NULL` pair that Phase B added to `run_events`
- * (`packages/platform/src/db/migrations/004_run_events_archived_at.ts`)
- * and Phase C added to `execution_runs` / `execution_jobs` /
- * `execution_steps` (`006_runs_jobs_steps_archived_at.ts`). Set inside
+ * `archive_object_key TEXT NULL` pair that `run_events` carries
+ * (in the Platform's schema) and that `execution_runs` / `execution_jobs` /
+ * `execution_steps` got in `006_runs_jobs_steps_archived_at.ts`. Set inside
  * the archive transaction before the DELETE; survivors carry NULL.
  *
  * `secret_audit_log` gets a composite
@@ -23,7 +22,7 @@ import { type Kysely } from 'kysely';
  * (range scans use either direction).
  *
  * Drops `access_log.expires_at` column and `access_log_expires_idx`.
- * Until Phase D, `expires_at` powered a 90-day hard-delete sweep in
+ * Before this migration, `expires_at` powered a 90-day hard-delete sweep in
  * `packages/orchestrator/src/audit/access-log.ts:cleanup` (called from
  * `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 5). With
  * cold-store, `access_log` rows older than 30 days are archived rather
@@ -31,11 +30,9 @@ import { type Kysely } from 'kysely';
  * column would mean either (a) double-evicting rows or (b) silently
  * mismatching the new contract. Drop it.
  *
- * Per the project's "no backward compatibility (pre-release)" rule,
  * `down()` recreates `expires_at` with a default of `now() + 90 days`
  * — best effort; rows inserted between `up()` and a hypothetical
- * `down()` would not have meaningful retention bounds. Acceptable for
- * staging.
+ * `down()` would not have meaningful retention bounds.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/008_event_log_archived_at.d.ts

@@ -3,13 +3,11 @@ import { type Kysely } from 'kysely';
  * `event_log` cold-store schema additions plus removal of the
  * `expires_at`-based 30-day hard delete.
  *
- * Phase E of the cold-storage archival system. See
- *  §10
- * Phase E.
+ * Part of the cold-storage archival system.
  *
  * Adds the same `archived_at TIMESTAMPTZ NULL` /
- * `archive_object_key TEXT NULL` pair Phase D added on this side
- * (`007_audit_logs_archived_at.ts`). Set inside the archive
+ * `archive_object_key TEXT NULL` pair
+ * `007_audit_logs_archived_at.ts` added on this side. Set inside the archive
  * transaction before the DELETE; survivors carry NULL.
  *
  * Adds `idx_event_log_routing_received` on `(routing_key, received_at)`
@@ -20,7 +18,7 @@ import { type Kysely } from 'kysely';
  * archiver scan.
  *
  * Drops `event_log.expires_at` and the matching
- * `event_log_expires_at_idx` index. Until Phase E, `expires_at`
+ * `event_log_expires_at_idx` index. Before this migration, `expires_at`
  * powered the 30-day hard-delete sweep in
  * `packages/orchestrator/src/webhook/event-log.ts:cleanup`, called
  * from `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 4

package/dist/db/migrations/010_cold_store_chunks.d.ts

@@ -1,6 +1,6 @@
 import { type Kysely } from 'kysely';
 /**
- * Cold-store chunk index — Phase 2 (cold-store purge).
+ * Cold-store chunk index (cold-store purge).
  *
  * One row per archived chunk that the GC sweep can later purge from S3.
  * Inserted inside the same transaction as `markArchivedAndDelete` so a
@@ -25,7 +25,7 @@ import { type Kysely } from 'kysely';
  *   uses this to issue `DeleteObject` directly without recomputing the
  *   key from the prefix.
  *
- * Pre-Phase-2 chunks (v1 manifest) are NOT in this table — they live
+ * V1-manifest chunks are NOT in this table — they live
  * forever. Adapters that don't opt into per-bucket archival via
  * `coldTtlDays` don't insert here either.
  */

package/dist/db/migrations/012_peer_credentials_active_uniq.d.ts

@@ -12,13 +12,11 @@ import { type Kysely } from 'kysely';
  * nothing and both `INSERT`s succeeded, leaving 2+ ACTIVE rows for the same
  * `instance_id`. The peer's local credential file then ended up holding a
  * hash that a later concurrent `save()` had revoked, causing an endless
- * "Peer HMAC proof invalid" loop. See
- *  for the
- * full incident write-up (DB rows + log evidence from real staging deploys).
+ * "Peer HMAC proof invalid" loop.
  *
  * The `up()` first dedupes any pre-existing duplicates (revoke all but the
  * newest active row per `instance_id`) — required because earlier migrations
- * predate the constraint and existing staging DBs already have the dupes.
+ * predate the constraint and existing databases may already hold the dupes.
  *
  * `down()` only drops the index; it does NOT undo the dedupe (there's no
  * safe way to recreate revoked rows, and the dedupe is monotonic).

package/dist/db/migrations/016_org_settings_allow_http_npm.d.ts

@@ -5,8 +5,8 @@ import { type Kysely } from 'kysely';
  * Operators flip this on a per-org basis to permit `http://` (non-HTTPS)
  * registry URLs in workflow `registries:` declarations. By default only
  * `https://` registries are accepted, with an automatic exemption for
- * loopback / `*.local` / private link-local hosts so dev fixtures
- * (Verdaccio at `http://verdaccio.local:4873`) keep working.
+ * loopback / `*.local` / private link-local hosts so a local registry
+ * (for example `http://registry.local:4873`) keeps working.
  *
  * Idempotent: a re-run on a DB that already has the column is a no-op.
  */

package/dist/db/migrations/045_host_properties.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  *   the separate queryable host-vars dimension.
  *
  * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
- * the column is a no-op. Staging data is preserved (additive column).
+ * the column is a no-op. Existing data is preserved (additive column).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/046_join_token_consumed_by_instance.d.ts

@@ -10,7 +10,7 @@ import { type Kysely } from 'kysely';
  *   join token already in its env — no operator action, no cluster redeploy.
  *
  * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
- * the column is a no-op. Staging data is preserved (additive nullable column).
+ * the column is a no-op. Existing data is preserved (additive nullable column).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/048_host_reboot_pending.d.ts

@@ -11,7 +11,7 @@ import { type Kysely } from 'kysely';
  * (3) clears on the next reconnect (down-then-up), releasing the held job. NULL
  * = no reboot pending.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/049_held_runs_payload.d.ts

@@ -6,7 +6,7 @@ import { type Kysely } from 'kysely';
  * the dashboard approval queue and the CLI render the computed diff the
  * operator approves. NULL for every non-drift hold.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/050_sources_slug.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  * hasn't populated it yet (manual `--app-id` flow whose initial fetch failed,
  * or a row created before the rollout).
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/051_binding_host_pattern.d.ts

@@ -11,7 +11,7 @@ import { type Kysely } from 'kysely';
  *   distinct per-host selectors.
  *
  * Idempotent: re-running on a DB that already has the column / index is a no-op.
- * Additive — staging data is preserved.
+ * Additive — existing data is preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/052_host_reach_metadata.d.ts

@@ -12,7 +12,7 @@ import { type Kysely } from 'kysely';
  *
  * All nullable: a host with no reach metadata simply cannot be bootstrapped and
  * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
- * so staging data is preserved.
+ * so existing data is preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/053_agent_token_single_use.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  *   default for every existing static / ephemeral token, which stay reusable
  *   until expiry).
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/054_local_working_tree.d.ts

@@ -7,7 +7,7 @@ import { type Kysely } from 'kysely';
  *   lock file). The dashboard renders a "Local machine" badge for these runs
  *   and avoids building an external repository link from the repo identifier.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so existing
  * data is preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/055_agent_token_mandatory_labels.d.ts

@@ -10,7 +10,7 @@ import { type Kysely } from 'kysely';
  *   agent accepts any job its advertised labels match), so every existing token
  *   stays unconfined until re-minted.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/056_execution_jobs_environments.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  *   fully-resolved list when a deferred-init agent eval resolves dynamic
  *   elements. NULL = the job binds no environment.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/064_execution_jobs_skipped_environments.d.ts

@@ -9,7 +9,7 @@ import { type Kysely } from 'kysely';
  * - `execution_jobs.env_warning text NULL` — the user-visible warning naming the
  *   skipped environments, surfaced on the dashboard run view. NULL = no warning.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/152_org_settings_cache_upload_settle_timeout.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.cache_upload_settle_timeout_ms BIGINT` (nullable).
+ *
+ * Per-org bound on how long a build job's `job.status success` waits for the
+ * cache publish (object metadata plus pointer) its agent reported just before
+ * it. NULL falls back to the cluster default
+ * (`KICI_CACHE_UPLOAD_SETTLE_TIMEOUT_MS`, 10s); 0 turns the wait off. Operators
+ * tune it via `kici-admin org-settings cache-upload-settle`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=152_org_settings_cache_upload_settle_timeout.d.ts.map

package/dist/db/migrations/153_execution_runs_cancel_force.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `execution_runs.cancel_force BOOLEAN` (nullable, no default).
+ *
+ * TRUE once a forced cancel reached the run. The leader's stuck-cancelling
+ * sweep reads it to re-send a cancel that did not complete with `force` set,
+ * so a forced cancel whose first forward to a sibling coordinator was lost is
+ * not re-sent as a graceful one. NULL (every existing row, and every run no
+ * forced cancel reached) re-sends gracefully. No backfill: nothing recorded
+ * whether an earlier cancel was forced.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=153_execution_runs_cancel_force.d.ts.map

package/dist/db/types.d.ts

@@ -514,6 +514,13 @@ export interface ExecutionRunTable {
      * cancelled and for one that entered `cancelling` before the column existed.
      */
     cancelling_at: ColumnType<Date | null, Date | null | undefined, Date | null>;
+    /**
+     * TRUE once a forced cancel reached the run (migration 153). The
+     * stuck-cancelling re-drive reads it so a cancel that did not complete is
+     * re-sent with `force`. Never reset to FALSE: a later graceful cancel does
+     * not undo a forced one. NULL re-drives gracefully.
+     */
+    cancel_force: ColumnType<boolean | null, boolean | null | undefined, boolean | null>;
     /**
      * The run's status generation (migration 150). Starts at 0 and rises by one
      * each time the run leaves a terminal status to continue. Forwarded on every
@@ -714,8 +721,8 @@ export interface ExecutionRunTable {
     check_mode: string | null;
     /**
      * Set inside the cold-store archive transaction before the row is
-     * DELETEd. Survivors carry NULL. Exists so a future
-     * "promote-chunk-back-into-PG" path (Phase F) can restore rows with
+     * DELETEd. Survivors carry NULL. Exists so the
+     * "promote-chunk-back-into-PG" path can restore rows with
      * their original archive pointer.
      */
     archived_at: Date | null;
@@ -1301,7 +1308,7 @@ export interface SecretAuditLogTable {
     metadata: string | null;
     /**
      * Set inside the archive transaction before the row is DELETEd.
-     * Survivors carry NULL. See cold-storage Phase D notes.
+     * Survivors carry NULL.
      */
     archived_at: Date | null;
     /** S3 object key of the chunk that carried this row; see `archived_at`. */
@@ -1338,9 +1345,8 @@ export interface AccessLogTable {
     created_at: Generated<Date>;
     /**
      * Set inside the archive transaction before the row is DELETEd.
-     * Survivors carry NULL. See cold-storage Phase D notes.
-     * Phase D removed the previous `expires_at`-based TTL — rows older
-     * than 30 days are archived to S3 instead of hard-deleted.
+     * Survivors carry NULL. The table has no `expires_at`-based TTL — rows
+     * older than 30 days are archived to S3 instead of hard-deleted.
      */
     archived_at: Date | null;
     /** S3 object key of the chunk that carried this row; see `archived_at`. */
@@ -1995,6 +2001,14 @@ export interface OrgSettingsTable {
      * returns a string on select; accept a number on insert/update.
      */
     queue_timeout_ms: ColumnType<string | null, number | null | undefined, number | null>;
+    /**
+     * Per-org bound (ms) on how long a build job's success waits for the cache
+     * publish its agent reported just before it. 0 turns the wait off. Null =
+     * cluster default (config.cacheUploadSettleTimeoutMs /
+     * KICI_CACHE_UPLOAD_SETTLE_TIMEOUT_MS). Postgres BIGINT — pg returns a string
+     * on select; accept a number on insert/update.
+     */
+    cache_upload_settle_timeout_ms: ColumnType<string | null, number | null | undefined, number | null>;
     /**
      * Per-org expiry (seconds) for a held approval element before it is rejected
      * and its run/job/step fails. NOT NULL, default 86400 (one day). An SDK
@@ -2403,9 +2417,9 @@ export interface EventLogTable {
     error_message: string | null;
     /** When the delivery was received */
     received_at: Generated<Date>;
-    /** Phase E cold-store: set inside the archive transaction; NULL for hot rows. */
+    /** Cold-store: set inside the archive transaction; NULL for hot rows. */
     archived_at: Date | null;
-    /** Phase E cold-store: chunk object key when row is archived. */
+    /** Cold-store: chunk object key when row is archived. */
     archive_object_key: string | null;
 }
 export type EventLogRow = Selectable<EventLogTable>;
@@ -2415,8 +2429,8 @@ export type EventLogRowUpdate = Updateable<EventLogTable>;
  * Cold-store chunk counts table (cold_store_chunk_counts).
  * Tracks per-(db, table, tenant) archived-chunk metadata so the
  * `cold_store_chunks_total` gauge and the `kici-admin cold-store list-chunks`
- * CLI can report totals without S3 LIST calls. Phase A creates the table
- * empty; Phase B+ populates it transactionally on each chunk write.
+ * CLI can report totals without S3 LIST calls. The cold-store archiver
+ * populates it transactionally on each chunk write.
  */
 export interface ColdStoreChunkCountsTable {
     /** DbKind identifier ('orchestrator' on this side). */
@@ -2438,12 +2452,12 @@ export type ColdStoreChunkCountsRow = Selectable<ColdStoreChunkCountsTable>;
 export type NewColdStoreChunkCountsRow = Insertable<ColdStoreChunkCountsTable>;
 export type ColdStoreChunkCountsUpdate = Updateable<ColdStoreChunkCountsTable>;
 /**
- * Cold-store chunk index (cold_store_chunks). Phase 2.
+ * Cold-store chunk index (cold_store_chunks).
  *
  * One row per archived chunk that the GC sweep can later purge from S3.
  * Inserted inside `markArchivedAndDelete`'s transaction by adapters that
- * opt into the per-bucket layout via `coldTtlDays(row)`. Pre-Phase-2
- * (v1) chunks are NOT in this table — they're treated as
+ * opt into the per-bucket layout via `coldTtlDays(row)`. V1
+ * chunks are NOT in this table — they're treated as
  * `'forever'` and never purged.
  */
 export interface ColdStoreChunksTable {

package/dist/events/types.d.ts

@@ -31,7 +31,7 @@ export interface EventRouterConfig {
     /**
      * **Test-only.** Per-event-name fault injection: when `attempts <= N`,
      * the EventRouter throws a synthetic dispatch error to drive the retry /
-     * DLQ path. Used by the fault-injection E2E to prove the lease + retry
+     * DLQ path. Used by fault-injection tests to prove the lease + retry
      * loop dispatches a real run when the inner dispatch eventually
      * succeeds, and lands the row in the DLQ when N exceeds
      * `maxDispatchAttempts`.

package/dist/fault-injection-types.d.ts

@@ -29,7 +29,7 @@ export interface OrchestratorFaultInjection {
     skipS3Sentinel?: boolean;
     /**
      * Predicate over an OIDC `audience`: when true, the *initial* provenance
-     * mint fails transiently (defer), so an E2E can exercise the
+     * mint fails transiently (defer), so a test can exercise the
      * deferred-attestation retry + per-run serve path.
      */
     initialMintFault?: (audience: string) => boolean;
@@ -40,7 +40,7 @@ export interface OrchestratorFaultInjection {
      */
     remintReject?: (audience: string) => boolean;
     /**
-     * Invoked by `handleRerunRequest` before `onRerun`, so an HA E2E can make
+     * Invoked by `handleRerunRequest` before `onRerun`, so an HA test can make
      * the first coordinator slow enough that the Platform relay fails over.
      */
     beforeRerun?: () => Promise<void>;

package/dist/firecracker/host-network.d.ts

@@ -43,9 +43,9 @@ export declare function cidrToNetwork(cidr: string): string;
  * serializes them.
  *
  * The command list NEVER deletes the table. It is a self-heal — `ensureHostReady`
- * runs it whenever `verifyBridge` reports unhealthy, which happens on any of
- * four conditions none of which knows how many VMs are live — so dropping the
- * table would leave every running VM fail-open, with full RFC1918 and
+ * runs it whenever `verifyBridge` reports unhealthy, and none of the
+ * conditions it checks says how many VMs are live — so dropping the table
+ * would leave every running VM fail-open, with full RFC1918 and
  * cloud-metadata reach, until it was destroyed. Instead the baseline lives in
  * its own regular chain (`baseline`, see {@link BASELINE_CHAIN}) that is flushed
  * and refilled, and the hooked `forward` chain keeps its per-VM rules
@@ -80,6 +80,10 @@ export interface BridgeHealth {
     tablePresent: boolean;
     /** The regular baseline chain exists and `forward` ends in a jump to it. */
     baselineChainPresent: boolean;
+    /** The table's `postrouting` chain masquerades the bridge subnet — the guests' internet egress. */
+    natPresent: boolean;
+    /** The baseline chain holds the bridge subnet's rules, in the order the provisioner writes them. */
+    baselineRulesPresent: boolean;
     /** Every enslaved kici-* TAP carries bridge port isolation. */
     tapIsolationPresent: boolean;
     healthy: boolean;
@@ -125,6 +129,20 @@ export declare function verifyBridge(cfg: FirecrackerBridgeConfig, opts?: ExecOp
  * `denyAll` drop.
  */
 export declare function forwardEndsInBaselineJump(nftJson: string): boolean;
+/**
+ * True when a `nft -j list chain … postrouting` listing masquerades traffic
+ * whose source is `subnet` (the network CIDR, e.g. `10.0.0.0/24`).
+ */
+export declare function postroutingMasqueradesSubnet(nftJson: string, subnet: string): boolean;
+/**
+ * True when a `nft -j list chain … baseline` listing holds this bridge's
+ * subnet-scoped accepts and drops exactly as {@link buildBridgeCommands} writes
+ * them, in the same order.
+ *
+ * Order is part of the check: the internet accept is terminal, so ahead of the
+ * RFC1918 and metadata drops it would let the guests reach every private range.
+ */
+export declare function baselineHoldsBridgeRules(nftJson: string, cfg: FirecrackerBridgeConfig): boolean;
 /**
  * Names of the kici-* TAPs enslaved to the bridge that are NOT port-isolated,
  * read from `ip -d -j link show master <bridge>`.

package/dist/firecracker/net-interfaces.d.ts

@@ -4,7 +4,7 @@
  *
  * A leaf module on purpose: it imports nothing, so an out-of-package consumer
  * can read the constant without pulling the orchestrator runtime graph in with
- * it. The NetworkManager drift watchdog (`hack/lib/nm-watchdog.ts`) derives its
+ * it. A NetworkManager drift watchdog derives its
  * expected-pattern set from here rather than re-typing the patterns — a second
  * copy desyncs silently the moment a pattern is added. `host-network.ts`
  * re-exports it and renders `NM_CONF_CONTENT` from it, so the drop-in and the

package/dist/helpers/run-detached.d.ts

@@ -0,0 +1,12 @@
+/** The part of a logger that `runDetached` writes a failure to. */
+export interface DetachedFailureLogger {
+    error(message: string, meta?: Record<string, unknown>): unknown;
+}
+/**
+ * Run `work` without waiting for it. A throw, or a rejection of the promise it
+ * returns, is logged at error level as `<task> failed` with `context` and the
+ * error message, and goes no further. `context` is read when the failure is
+ * logged, so the work may fill it in while it runs.
+ */
+export declare function runDetached(logger: DetachedFailureLogger, task: string, work: () => unknown, context?: Record<string, unknown>): void;
+//# sourceMappingURL=run-detached.d.ts.map