@kici-dev/orchestrator 0.11.0 → 0.13.0

package/dist/oidc/db-signer.d.ts

@@ -8,7 +8,7 @@
  * The in-memory private key is imported NON-EXTRACTABLE (`extractable: false`),
  * so once loaded the raw private material can never be read back out of the
  * process — the only export path is the public JWK. This is what makes the
- * private key "non-exportable by design" (design spec § A / § H).
+ * private key "non-exportable by design".
  */
 import { type JWK } from 'jose';
 import type { Signer } from './signer.js';

package/dist/pipeline/changed-files.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The one changed-files resolver every dispatch path calls: same-source, the
+ * no-lock-file organization-wide pass, cross-source repo mode, and rerun.
+ *
+ * `unavailable` means the orchestrator holds no authoritative list; whether the
+ * agent can compute one is the range's question, answered by `resolveDiffRange`.
+ */
+import { type ChangedFilesStatus, type DiffRange, type LockWorkflow, type SimulatedEvent, type WebhookNormalizer, type WorkflowDecision } from '@kici-dev/engine';
+import type { ProviderBundle } from '../provider-registry.js';
+export interface ResolvedChangedFiles {
+    files: string[];
+    status: ChangedFilesStatus;
+    range: DiffRange;
+}
+/**
+ * Resolve the files an event changed through a bundle's fetcher.
+ *
+ * - no workflow in `workflows` has a `paths` trigger → `skipped`;
+ * - a deleted branch → `fetched` + `[]`, whichever provider delivered it;
+ * - no fetcher, or a fetcher that throws → `unavailable`, never a failed delivery.
+ */
+export declare function resolveEventChangedFiles(args: {
+    bundle: Pick<ProviderBundle, 'changedFilesFetcher'>;
+    credentials: unknown;
+    repoIdentifier: string;
+    eventName: string;
+    payload: unknown;
+    event: SimulatedEvent;
+    /** Omitted: always resolve — a re-evaluation has no lock file to consult. */
+    workflows?: readonly LockWorkflow[];
+}): Promise<ResolvedChangedFiles>;
+/**
+ * Stamp the repository's default branch on a normalized event, so the
+ * new-branch range (`resolveDiffRange`) and the agent that receives this event
+ * read the same value. `extractDefaultBranch` prefers the normalizer's hook,
+ * which covers GitLab's `project.default_branch`.
+ */
+export declare function withDefaultBranch(event: SimulatedEvent, payload: unknown, normalizer: WebhookNormalizer): SimulatedEvent;
+/** Copy a resolved list and its status onto the event the matcher reads. */
+export declare function stampChangedFiles(event: SimulatedEvent, resolved: ResolvedChangedFiles): SimulatedEvent;
+/**
+ * Downgrade a cross-source pull-request deferral to a conservative match.
+ *
+ * A cross-source job checks out the registration's commit, never the pull
+ * request's head, so no agent can diff the pull request for it. A path
+ * decision the orchestrator could not make therefore runs the workflow, as a
+ * range-less push does, instead of handing the agent a diff of the wrong
+ * commits. Push ranges diff explicit commits and keep their deferral.
+ */
+export declare function withoutCrossSourcePrDeferral(decision: WorkflowDecision, event: SimulatedEvent): WorkflowDecision;
+//# sourceMappingURL=changed-files.d.ts.map

package/dist/pipeline/cross-source-tally.d.ts

@@ -0,0 +1,21 @@
+/**
+ * A generic delivery can run both halves — cross-source for other sources'
+ * registrations, and the inbound source's own lock when its normalizer reads a
+ * repository. The delivery still gets one event-log row: the same-source path
+ * writes it, and this wrapper folds the cross-source half into it.
+ */
+import type { ProcessingDeps } from './processor.js';
+export interface CrossSourceTally {
+    candidatesConsidered: number;
+    jobsDispatched: number;
+    /** A cross-source candidate evaluated `paths` against an unavailable diff. */
+    degraded: boolean;
+}
+/**
+ * Wrap `deps.eventLog` so whichever row the same-source path records — corrupt
+ * lock, missing lock, skip or processed — also counts the cross-source half's
+ * dispatched jobs and carries its degraded reason. A reason the same-source
+ * path already set wins.
+ */
+export declare function withCrossSourceTally(deps: ProcessingDeps, tally: CrossSourceTally): ProcessingDeps;
+//# sourceMappingURL=cross-source-tally.d.ts.map

package/dist/pipeline/degraded-reason.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Annotation written to a `processed` event-log row when path filters were
+ * evaluated against an unavailable changed-files diff. Reuses the existing
+ * free-text field so the outcome is never a silent `processed / matched 0` —
+ * no new event-log status enum value is added.
+ */
+export declare const DEGRADED_CHANGED_FILES_REASON = "trigger evaluation degraded: changed files unavailable \u2014 path filters matched conservatively";
+//# sourceMappingURL=degraded-reason.d.ts.map

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -704,6 +704,8 @@ export declare function materializeStaticJobsSafe(staticJobs: readonly LockJob[]
     expansionMap: Map<string, readonly string[]>;
     matrixFailures: RejectedJob[];
 }>;
+/** The `paths` lists this workflow's matching left to the agent, or undefined. */
+export declare function deferredPathsOf(ctx: Pick<WorkflowDispatchContext, 'decision'>): string[][] | undefined;
 /**
  * Scan a lock workflow's always-mode approval timeouts (workflow-level +
  * each static job) for a non-positive / non-finite `timeoutSeconds`. Returns the
@@ -879,6 +881,8 @@ export declare function catchUpNeedsGatedJobs(args: {
 }): Promise<void>;
 /** Why an init result must not lead to a dispatch. */
 export declare enum InitDispatchSuppression {
+    /** The agent's clone diff matched none of the deferred `paths`. */
+    Paths = "paths",
     /** The workflow's own `filter` decided the workflow does not apply. */
     Filter = "filter",
     /** The job is already rejected by a context rule, or held for approval. */
@@ -887,6 +891,11 @@ export declare enum InitDispatchSuppression {
 /**
  * Decide whether an arrived init result may dispatch its job.
  *
+ * `Paths` is checked first: a workflow whose deferred `paths` did not match
+ * never triggered, whatever its filter says. Only an explicit `false`
+ * suppresses — an agent that predates deferred paths reports no verdict, and
+ * that absence dispatches.
+ *
  * `Filter` requires the workflow to actually declare a filter as well as the
  * agent to have reported `false`: a buggy or rogue agent must not be able to
  * suppress a filter-less workflow by inventing the field, and an agent that
@@ -917,6 +926,7 @@ export declare enum InitDispatchSuppression {
  */
 export declare function initDispatchSuppression(workflow: Pick<LockWorkflow, 'hasFilter'>, initResult: {
     filterPassed?: boolean;
+    pathsPassed?: boolean;
 }, jobEnvData: Pick<JobEnvData, 'rejected' | 'held'>): InitDispatchSuppression | null;
 export interface GeneratedJobConfig {
     /**

package/dist/pipeline/global-eval-round.d.ts

@@ -87,8 +87,9 @@ export declare function hasDeferredGenerator(lockEntry: LockWorkflow): boolean;
  * those that must go through an eval round first.
  *
  * A candidate needs the round when it declares a `filter` (only the agent may
- * run the predicate) or carries a needs-free `DynamicJobFn` (only the agent may
- * run the generator, and it depends on nothing the run produces). Everything
+ * run the predicate), carries a needs-free `DynamicJobFn` (only the agent may
+ * run the generator, and it depends on nothing the run produces), or matched
+ * with deferred `paths` (only the agent's clone holds the diff). Everything
  * else — static jobs, and result-aware generators the run evaluates later — is
  * handed to the dispatch pipeline as declared, so routing it through a round
  * would add a job dispatch and an agent round trip for nothing.
@@ -156,8 +157,8 @@ export interface GlobalEvalAgentRegistry {
  * fails outright or reports success without the `globalEvalComplete` the
  * orchestrator is waiting for. Either way the round never settles.
  *
- * Customers upgrade their orchestrator and their agents on their own schedule
- * (`.claude/rules/compatibility.md`), so an orchestrator ahead of its fleet is
+ * Customers upgrade their orchestrator and their agents on their own schedule,
+ * so an orchestrator ahead of its fleet is
  * a supported state and not an error — but it is one this module has to
  * recognise, because the damage is not confined to the new feature. A global
  * workflow that merely *contains* a generator now routes through the round, so

package/dist/pipeline/processor.d.ts

@@ -49,6 +49,8 @@ import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { CronScheduler } from '../cron/cron-scheduler.js';
 import type { GlobalWorkflowPolicy } from '../security/global-workflow-policy.js';
 import type { EventLogWriter } from '../webhook/event-log.js';
+/** The one event-log method the pipeline calls; a per-delivery wrapper can stand in for the writer. */
+export type EventLogRecorder = Pick<EventLogWriter, 'record'>;
 import { EventLogSource } from '@kici-dev/engine';
 import type { LockJob } from '@kici-dev/engine';
 import type { ContextStore } from '../contexts/context-store.js';
@@ -156,8 +158,8 @@ export declare function isRootJob(lockJob: LockJob): boolean;
  * Why this exists
  * ----------------
  * The webhook pipeline binds `lockFileFetcher` to the inbound webhook's
- * provider bundle. When a local-sourced webhook (e.g., the staging
- * stg-ha-smoke failover-dispatch test) arrives for a repo whose lock file
+ * provider bundle. When a local-sourced webhook (e.g., a failover-dispatch
+ * push sent through the internal ingress) arrives for a repo whose lock file
  * is only accessible via a different provider (e.g., github), the inbound
  * fetcher returns null and trigger matching silently drops the webhook.
  * This resolver lets the pipeline consult OTHER bundles whose registrations
@@ -203,6 +205,12 @@ export declare function resolveLockFileWithFallback(args: {
     registrationIndex: RegistrationIndex | undefined;
     lockFileCache: LockFileCache;
     deliveryId: string;
+    /**
+     * False when cross-source repo mode already evaluated this delivery's
+     * other-source registrations for the same repository: the fallback would
+     * re-read exactly those registrations. Defaults to true.
+     */
+    allowRegistrationFallback?: boolean;
 }): Promise<{
     lockFile: FullLockFile | null;
     resolvedVia: 'inbound' | 'fallback' | 'miss' | 'corrupt';
@@ -476,7 +484,7 @@ export interface ProcessingDeps {
     /** Global workflow policy for org-level permission enforcement. Optional -- if not set, global workflows are unrestricted. */
     globalWorkflowPolicy?: GlobalWorkflowPolicy;
     /** Inbound webhook delivery log writer. Optional -- if not set, deliveries are not persisted to event_log. */
-    eventLog?: EventLogWriter;
+    eventLog?: EventLogRecorder;
     /** Where this delivery arrived: 'relay' (Platform WS) or 'direct' (HTTP).
      *  Used by the eventLog writer to populate the source column. Defaults to
      *  'direct' when omitted (independent / direct paths). */

package/dist/pipeline/rerun-inputs.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Inputs every re-run path rebuilds from an original run: its stored webhook
+ * payload, the provider binding its row records, the delivery's event name, the
+ * normalized event, and its changed files. Shared by the per-repository re-run,
+ * the evaluation-round re-run and release, and the cross-repository global
+ * re-run, so the paths cannot disagree about how a run's inputs are read back.
+ */
 import type { SimulatedEvent } from '@kici-dev/engine';
 import type { ProviderRegistry } from '../provider-registry.js';
 import type { TrustPolicyOutcome } from '../security/trust-policy-gate.js';
@@ -59,7 +66,9 @@ export declare function loadDeliveryEventName(originalRun: OriginalRunRow, deps:
 /** The verdict an approved security hold stands for. */
 export declare const RELEASED_DECISION: TrustPolicyOutcome;
 /**
- * The normalized form of the delivery the round was deciding.
+ * The normalized form of the delivery the round was deciding, stamped with the
+ * repository's default branch as the delivery stamped it: the jobs a re-run
+ * dispatches carry this event, and an agent derives a new-branch diff from it.
  *
  * Read-only, and it throws — so it runs before the requestId claim, never
  * inside the re-evaluation.
@@ -69,13 +78,13 @@ export declare function normalizeRoundEvent(originalRun: OriginalRunRow, provide
     action: string | null;
 }, payload: Record<string, unknown>, refusal?: RerunRefusal): SimulatedEvent;
 /**
- * Stamp the re-evaluated event with the source repository's changed files.
+ * Stamp the re-evaluated event with the source repository's default branch and
+ * changed files.
  *
- * Unconditional, unlike the delivery path's fetch: that path skips the fetch
- * when no trigger in the source repo's lock file uses path patterns, and a
- * scoped re-evaluation has no such lock file to read. An error carries
- * `unavailable`, which every path filter downstream already treats
- * conservatively.
+ * The resolve is unconditional: the delivery path skips it when no trigger in
+ * the source repo's lock file uses path patterns, and a scoped re-evaluation
+ * has no such lock file to bound it. A bundle with no fetcher, or a fetch
+ * error, carries `unavailable`.
  */
 export declare function withChangedFiles(opts: {
     event: SimulatedEvent;

package/dist/provenance/retrier-mint.d.ts

@@ -24,7 +24,7 @@ export interface RetrierMintDeps {
     } | undefined;
     /**
      * Test-only fault injection: the build-time test double supplies a predicate
-     * over the audience that forces a TERMINAL rejection, so an E2E can exercise
+     * over the audience that forces a TERMINAL rejection, so a test can exercise
      * the markRejected → gauge-exclusion → `--include-rejected` re-arm cycle with
      * a real deferred row. It returns before the real mint, so the signing choke
      * point is preserved. The shipped orchestrator leaves it undefined.

package/dist/provenance/trust-root.d.ts

@@ -1,7 +1,7 @@
 import type { JSONWebKeySet } from 'jose';
 /**
  * Derive the JWKS URI for a provenance OIDC issuer. Identical to the Platform's
- * own derivation (`packages/platform/src/dashboard/routes/runs.ts`) so a bundle
+ * own derivation so a bundle
  * verified client-side and at ingest resolve the same key set.
  */
 export declare function deriveJwksUri(issuer: string): string;
@@ -17,8 +17,8 @@ export interface ProvenanceTrustRoot {
     setIssuer(issuer: string | null): void;
 }
 /**
- * A trust root backed by the orchestrator's OWN signing keys (Phase 1
- * orchestrator-owned attestations). Verify-at-ingest resolves the key set from
+ * A trust root backed by the orchestrator's OWN signing keys
+ * (orchestrator-owned attestations). Verify-at-ingest resolves the key set from
  * the `orchestrator_signing_keys` table so fresh rotations / revocations are
  * reflected immediately, and the issuer is the orchestrator's own configured
  * provenance issuer. The key set is read fresh from the DB each resolve (a cheap

package/dist/providers/github/changed-files.d.ts

@@ -28,10 +28,15 @@ export declare function withRateLimitRetry<T>(fn: () => Promise<T>, context: str
 /**
  * GitHub-specific implementation of ChangedFilesFetcher.
  *
- * For PRs: uses paginated pulls.listFiles API (handles up to 3000 files).
- * For pushes: uses repos.compareCommits API (logs warning at 300+ files).
- * For initial pushes (zero SHA): returns empty array.
- * For unknown events: returns empty array.
+ * For PRs: uses the paginated pulls.listFiles API; a result at GitHub's
+ * 3000-file cap is truncated, so it reports `unavailable`.
+ * For pushes: uses the repos.compareCommits API; a result at GitHub's 300-file
+ * cap is truncated, so it reports `unavailable`.
+ * For a new branch (zero `before`): compares the default branch against
+ * `after` (three-dot), the files the branch adds. With no known default
+ * branch, or the default branch itself being created, it reports `unavailable`.
+ * For a deleted branch (zero `after`): `fetched` + [].
+ * For unknown events: reports `unavailable`.
  */
 export declare class GitHubChangedFilesFetcher implements ChangedFilesFetcher {
     private readonly config;
@@ -55,5 +60,10 @@ export declare class GitHubChangedFilesFetcher implements ChangedFilesFetcher {
      * Get changed files for a push event using compareCommits API.
      */
     private getPushChangedFiles;
+    /**
+     * Compare two refs through the compareCommits API. A result at GitHub's
+     * 300-file cap is truncated, so it reports `unavailable`.
+     */
+    private compare;
 }
 //# sourceMappingURL=changed-files.d.ts.map

package/dist/providers/universal-git/changed-files.d.ts

@@ -8,6 +8,10 @@
  * `commits[].{added,modified,removed}` arrays in the push payload, so we
  * extract them via JSONPath from the already-delivered webhook body.
  *
+ * Forges cap `commits[]`. A preset whose forge sends a total commit count
+ * (`commitsTotal`) or has a documented list cap (`commitsCap`) reports a
+ * truncated push as `unavailable` rather than a partial list.
+ *
  * For PR events we report `unavailable`: no per-commit diff is present in the
  * webhook body, so the upstream trigger matcher matches path filters
  * conservatively (the workflow runs) instead of silently never matching. A
@@ -38,6 +42,8 @@ export declare class UniversalGitChangedFilesFetcher implements ChangedFilesFetc
      * @param _credentials    Unused — no REST call is made.
      */
     getChangedFiles(_repoIdentifier: string, eventType: string, payload: unknown, _credentials: unknown): Promise<ChangedFilesResult>;
+    /** Whether the payload lists fewer commits than the push carried. */
+    private isTruncated;
     private classifyEvent;
 }
 //# sourceMappingURL=changed-files.d.ts.map

package/dist/providers/universal-git/clone-token.d.ts

@@ -11,14 +11,11 @@
  * The value returned here is the raw secret material:
  *   - `credentialType === 'pat' | 'basic'`: the PAT / password string
  *   - `credentialType === 'ssh'`: the PEM-encoded private key (the agent
- *     materializes it to a tempfile and wires `GIT_SSH_COMMAND` — see
- *     Phase 4 dispatch protocol + agent work)
+ *     materializes it to a tempfile and wires `GIT_SSH_COMMAND`)
  *
  * The token's "kind" (basic vs ssh) is NOT carried through this interface;
- * it is propagated via `QueuedJobInput.gitAuth` in Phase 4. For Phase 2 we
- * expose a richer `issueGitAuth()` method on this class that the dispatcher
- * can call directly once Phase 4 adds `sourceAuth`/`workflowAuth` to the
- * dispatch schema.
+ * the richer `issueGitAuth()` method on this class returns it, and the
+ * dispatcher carries it in the dispatch's `sourceAuth`/`workflowAuth` fields.
  */
 import type { CloneTokenProvider, ProviderGitAuth } from '@kici-dev/engine';
 import type { SecretResolver } from '../../secrets/secret-resolver.js';
@@ -26,7 +23,7 @@ import type { UniversalGitConfig } from './config.js';
 /**
  * Structured auth material the agent needs to clone a universal-git repo.
  *
- * Phase 4: serialized into the new `sourceAuth` / `workflowAuth` fields on
+ * Serialized into the `sourceAuth` / `workflowAuth` fields on
  * `jobDispatchSchema`. The shape matches `ProviderGitAuth` from
  * `@kici-dev/engine` with additional SSH fields pulled from the source
  * config (`sshHostKeyPolicy`, `sshKnownHostsPem`).
@@ -52,11 +49,10 @@ export declare class UniversalGitCloneTokenProvider implements CloneTokenProvide
     /**
      * Create a clone token — the raw secret material (PAT / password / SSH key).
      *
-     * The orchestrator dispatch pipeline currently threads this string into
-     * `jobDispatch.token`, which the agent uses as HTTPS Basic-auth password
-     * via `http.extraHeader`. SSH support requires the Phase 4 dispatch-schema
-     * split (sourceAuth.kind = 'ssh') — which is where the agent gains the
-     * ability to materialize the PEM key and wire `GIT_SSH_COMMAND`.
+     * A bare token reaches `jobDispatch.token`, which the agent uses as HTTPS
+     * Basic-auth password via `http.extraHeader`. SSH needs the structured
+     * `sourceAuth` (`kind: 'ssh'`) from `issueGitAuth()` — which is where the
+     * agent materializes the PEM key and wires `GIT_SSH_COMMAND`.
      *
      * @returns The resolved secret string, or `null` when the secret is
      * missing (source misconfigured — caller treats this as a clone failure).
@@ -64,7 +60,7 @@ export declare class UniversalGitCloneTokenProvider implements CloneTokenProvide
     createCloneToken(_repoIdentifier: string, _credentials: unknown): Promise<string | null>;
     /**
      * Richer variant that returns the full `UniversalGitAuth` shape instead
-     * of just the secret string. The Phase 4 dispatcher calls this via the
+     * of just the secret string. The dispatcher calls this via the
      * `CloneTokenProvider.issueGitAuth?` interface hook so the agent
      * receives the auth `kind` + `user` + SSH host-key policy alongside the
      * secret.

package/dist/providers/universal-git/config.d.ts

@@ -73,6 +73,8 @@ export declare const UniversalGitPayloadPathsSchema: z.ZodObject<{
     commitsModified: z.ZodString;
     commitsRemoved: z.ZodString;
     commitMessage: z.ZodOptional<z.ZodString>;
+    commitsTotal: z.ZodOptional<z.ZodString>;
+    commitsCap: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type UniversalGitPayloadPaths = z.infer<typeof UniversalGitPayloadPathsSchema>;
 /**
@@ -131,6 +133,8 @@ export declare const UniversalGitConfigSchema: z.ZodObject<{
         commitsModified: z.ZodString;
         commitsRemoved: z.ZodString;
         commitMessage: z.ZodOptional<z.ZodString>;
+        commitsTotal: z.ZodOptional<z.ZodString>;
+        commitsCap: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
     eventMapping: z.ZodOptional<z.ZodObject<{
         push: z.ZodArray<z.ZodString>;

package/dist/providers/universal-git/index.d.ts

@@ -18,8 +18,7 @@
  *   - `UniversalGitRepoUrlBuilder` — substitutes `{owner}`/`{name}`/`{repo}`
  *     in the source's `gitUrlTemplate`.
  *
- * No `CheckStatusPoster` is wired for v1 — forge API support for it is uneven
- * and adding it is a separate phase.
+ * No `CheckStatusPoster` is wired — forge API support for it is uneven.
  *
  * The bundle also leaves `hasForkModel` unset. The normalizer does report an
  * `isForkPR`, but it compares two repo names that `extractRepoFullName` reads

package/dist/providers/universal-git/normalizer.d.ts

@@ -79,9 +79,8 @@ export declare class UniversalGitWebhookNormalizer implements WebhookNormalizer
     /**
      * Extension hook used by the processor's `isDefaultBranchPush` check so it
      * does not need to hardcode `payload.repository.default_branch`. The
-     * engine interface does not yet declare this method; it is consumed via
-     * an optional chain (`normalizer.extractDefaultBranch?.(payload)`), so it
-     * is safe to ship ahead of the interface change in Phase 3.
+     * engine interface declares it optional, so it is consumed via
+     * an optional chain (`normalizer.extractDefaultBranch?.(payload)`).
      */
     extractDefaultBranch(payload: unknown): string | null;
     /**

package/dist/providers/universal-git/ssh-auth.d.ts

@@ -10,9 +10,9 @@
  *
  * This module provides the orchestrator-side primitives for preparing those
  * artefacts. It is used in two contexts:
- *   - **Agent-side** (Phase 4+): the agent receives the PEM + host-key policy
+ *   - **Agent-side**: the agent receives the PEM + host-key policy
  *     in the dispatch message and materializes them before cloning.
- *   - **Lock-file fetcher** (Phase 2, this module's immediate consumer):
+ *   - **Lock-file fetcher**:
  *     the orchestrator shallow-clones the source repo itself at registration
  *     time, using the same SSH materialization path.
  *
@@ -82,8 +82,8 @@ export declare function prepareSshAuthSync(opts: PrepareSshAuthOptions): SshAuth
  * mismatches against cached keys). The per-call file is wiped by `cleanup()`.
  *
  * IdentitiesOnly=yes ensures ssh ignores any agent-forwarded keys and only
- * uses the one we provided; this is critical in staging where the runner
- * user may have a populated ssh-agent.
+ * uses the one we provided; this is critical on any host where the
+ * orchestrator's runtime user may have a populated ssh-agent.
  */
 export declare function composeGitSshCommand(privateKeyPath: string, policy: SshHostKeyPolicy, knownHostsPath: string): string;
 /**

package/dist/queue/cleanup.d.ts

@@ -94,8 +94,8 @@ export interface CleanupExtras {
  * as terminal status updates so the Platform execution_jobs projection
  * stays in sync.
  *
- * Event-log row + payload retention used to live here too, but Phase E
- * replaced the 30-day hard-delete with cold-store archive-then-delete
+ * Event-log row + payload retention is not here: event_log rows are
+ * archived to cold-store and then deleted
  * (see `packages/orchestrator/src/cold-store/tables/event-log.ts`).
  *
  * @returns Counts of cleaned entries.

package/dist/queue/job-queue.d.ts

@@ -612,12 +612,12 @@ export declare class JobQueue {
      * declared failed, so any dispatch_queue row still in `Pending`,
      * `Recovering`, or `Dispatched` is by definition orphaned and must
      * also be moved to `Failed` — leaving a `Dispatched` row in place
-     * keeps the row in a non-terminal state forever, which the build-timeout
-     * E2E (and any operator query for "is this run actually done") relies
-     * on never happening. The complementary {@link markCompleted} status
-     * guard ensures a late `job.complete` from the agent that was still
-     * working when the run was declared failed cannot flip the row back
-     * to `Completed`.
+     * keeps the row in a non-terminal state forever, which any caller
+     * polling for a terminal state (and any operator query for "is this
+     * run actually done") relies on never happening. The complementary
+     * {@link markCompleted} status guard ensures a late `job.complete` from
+     * the agent that was still working when the run was declared failed
+     * cannot flip the row back to `Completed`.
      *
      * @returns Number of affected rows.
      */

package/dist/queue/scheduled-job.d.ts

@@ -1,19 +1,17 @@
 /**
  * Orchestrator scheduled-job wrapper.
  *
- * Mirrors `packages/platform/src/queue/scheduled-job.ts` in observable
+ * Mirrors the Platform's scheduled-job wrapper in observable
  * surface (5 Prometheus metrics + structured logs + audit row on
  * failure) but uses `setInterval` instead of pg-boss — the orchestrator
  * has no pg-boss dependency and we're not adding one.
  *
- * All future orchestrator periodic jobs MUST use this wrapper — per
- * CLAUDE.md "no workarounds", the legacy setInterval call sites in
- * queue/cleanup.ts and secrets/cleanup.ts migrate in the same phase
- * they'd otherwise be updated.
+ * Every orchestrator periodic job MUST use this wrapper, as the cleanup
+ * jobs in queue/cleanup.ts and secrets/cleanup.ts do.
  *
  * `triggerNow()` on the returned handle forces one off-cadence tick
  * (used by the admin `/api/v1/admin/scheduled-jobs/:name/trigger`
- * endpoint and by E2E harnesses). It does NOT reset the interval
+ * endpoint and by tests). It does NOT reset the interval
  * timer — a real tick still fires at the scheduled cadence after.
  */
 import { z } from 'zod';
@@ -60,7 +58,7 @@ export interface OrchestratorScheduledJobHandle {
     stop(): void;
     /**
      * Force one off-cadence tick and await it (success or failure).
-     * Returns the tick's outcome so E2E and admin routes can report it.
+     * Returns the tick's outcome so callers such as the admin route can report it.
      */
     triggerNow(): Promise<{
         ok: boolean;

package/dist/registration/extractor.d.ts

@@ -5,7 +5,7 @@ import type { LockFile, LockTrigger, LockWorkflow } from '@kici-dev/engine';
  * Non-Git-provider triggers (kici_event, schedule, webhook, …) live in the
  * registration table because they have no per-repo lock file pipeline to
  * fall back to. Git-provider triggers (push, pr, tag, …) ALSO live in the
- * registration table so that the cross-source dispatch path (phase 28.5)
+ * registration table so that the cross-source dispatch path
  * can resolve them by (customer_id, repo_identifier) when a generic webhook
  * targets an externally-hosted repo. The per-event lock file pipeline still
  * handles same-source dispatch for git triggers; registration is an additive

package/dist/registration/registration-index.d.ts

@@ -73,7 +73,7 @@ export declare class RegistrationIndex {
     private byOrgAndEvent;
     /**
      * Quinary index: registrations keyed by `${customerId}|${repoIdentifier}`.
-     * Drives the cross-source repo lookup (phase 28.5): when a generic webhook
+     * Drives the cross-source repo lookup: when a generic webhook
      * carries a repository identifier in its payload, the dispatcher looks up
      * registrations for that (org, repo) pair across ALL routing keys and uses
      * each registration's stored `providerContext` + `routingKey` to reach the

package/dist/reporting/execution-tracker.d.ts

@@ -716,7 +716,7 @@ export declare class ExecutionTracker {
      */
     private runInvokeGateAggregationHook;
     /**
-     * Phase 9: stuck-jobs invariant check ( Layer 3).
+     * Phase 9: stuck-jobs invariant check (Layer 3).
      * Before declaring a run complete, verify no stuck jobs exist. If any are
      * found, fail them via recursive onJobStatus calls and signal the caller to
      * stop (returns true) — the recursive calls will re-enter and re-check
@@ -786,8 +786,8 @@ export declare class ExecutionTracker {
      * Create a failed execution run when the build timed out before onExecutionStarted
      * had a chance to insert the row (buildJobTrackedEarly was false).
      *
-     * Inserts a minimal execution_runs row with status='failed' directly so the E2E
-     * test (and dashboard) can observe the failure instead of a missing run.
+     * Inserts a minimal execution_runs row with status='failed' directly so the
+     * dashboard (and any run query) can observe the failure instead of a missing run.
      *
      * The fifth pre-dispatch recording site, and the third that writes the row and
      * returns. Its row is terminal with no resume path, so no invoke gate ever

package/dist/routes/admin-access-log.d.ts

@@ -4,7 +4,7 @@
  * Operator-facing read access to read + orchestrator-admin mutation attempts
  * captured with ActorPrincipal attribution. Mirrors the dashboard's
  * dashboard.access-log.list WS handler but exposed over HTTP + Bearer auth
- * so operators can dogfood from the CLI without going through the dashboard.
+ * so operators can read it from the CLI without going through the dashboard.
  *
  *   GET /api/v1/admin/access-log
  *     Filters: orgId, actorType, actorId, action, source, outcome,

package/dist/routes/admin-auth.d.ts

@@ -26,8 +26,8 @@ import type { Role } from '../secrets/rbac.js';
  * The three admin-auth response bodies.
  *
  * A single map rather than string literals repeated across every admin router:
- * the 401 wordings are observed by operators and by E2E assertions, so they are
- * pinned in exactly one place.
+ * the 401 wordings are observed by operators and asserted on by tests, so they
+ * are pinned in exactly one place.
  */
 export declare const AUTH_ERROR: {
     readonly missing: 'Missing authorization';

package/dist/routes/admin-event-log.d.ts

@@ -4,7 +4,7 @@
  * Operator-facing read access to the per-delivery records the orchestrator
  * persists for every inbound webhook. Mirrors the dashboard's WS handler
  * (`DashboardHandler.handleEventLogList/Detail`) but is exposed over HTTP +
- * Bearer auth so operators can dogfood from the CLI without going through
+ * Bearer auth so operators can read it from the CLI without going through
  * the dashboard.
  *
  *   GET /api/v1/admin/event-log
@@ -28,7 +28,7 @@ export interface AdminEventLogRoutesDeps {
     logStorage: LogStorage;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
-    /** Phase E: optional cold-store for archived event_log rows. */
+    /** Optional cold-store for archived event_log rows. */
     coldStore?: ColdStore;
 }
 type AdminEnv = {

package/dist/routes/admin-runs.d.ts

@@ -14,9 +14,9 @@
  *   GET /api/v1/admin/runs/:runId/ephemeral-key   — scrub status
  *   GET /api/v1/admin/runs/:runId/secret-outputs  — masked by default; ?reveal=true
  *
- * This is the server-side counterpart to `kici-admin runs` — the dogfooded
- * replacement for hand-rolled curl commands and dashboard clicks when
- * verifying execution state.
+ * This is the server-side counterpart to `kici-admin runs`, which replaces
+ * hand-rolled curl commands and dashboard clicks when verifying execution
+ * state.
  */
 import { Hono } from 'hono';
 import type { Kysely } from 'kysely';

package/dist/routes/admin-scheduled-jobs.d.ts

@@ -6,9 +6,8 @@
  *     Requires: scheduled_job.trigger role permission (owner + admin roles)
  *     Returns: { triggered: true, ok: boolean, durationMs: number, error?: string }
  *
- * Phase A's E2E smoke uses this endpoint to force a cold-store-archive
- * tick without waiting for the hourly cron. Future dashboard "Run now"
- * buttons use it too.
+ * Use it, for example, to force a cold-store-archive tick without waiting
+ * for the hourly cadence.
  *
  * The access_log row is written directly (not via the typed
  * AccessLogWriter) because `scheduled_job.trigger` is not in the