@kici-dev/orchestrator 0.14.2 → 0.16.0

package/dist/metrics/prometheus.d.ts

@@ -703,11 +703,6 @@ export declare const wsUnsupportedMessageSentTotal: import("@opentelemetry/api")
  * `received_type`.
  */
 export declare const wsNackReceivedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
-/**
- * Feature-gated sends the orchestrator SUPPRESSED because the Platform advertised
- * a capability set that lacks the required flag. Labelled by `capability` + `type`.
- */
-export declare const wsPlatformCapabilityGapTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
 /**
  * Register every queued orchestrator observable gauge on the real meter.
  *

package/dist/oidc/id-token-claims.d.ts

@@ -1,7 +1,7 @@
 /**
  * OIDC ID-token claims for orchestrator-side minting — shared by the
  * production orchestrator-owned mint (`orchestrator-mint.ts`) and the local
- * dev-signed identity (`local-mint.ts`). Mirrors the Platform's claim shape so
+ * dev-signed identity (`local-mint.ts`). One claim shape, so
  * every bundle carries the exact same claims the agent's statement builder +
  * the engine verifier expect — the cross-check between the in-toto statement
  * and the token claims is identical across all minters. The dev-signed path

package/dist/oidc/resolve-signer.d.ts

@@ -1,10 +1,8 @@
 /**
  * Bounded wait for the orchestrator's provenance signer.
  *
- * A mint that arrives before any node has generated the key must NOT fall
- * back to a Platform-signed bundle (it would fail verification against the
- * orchestrator trust root), so the resolver waits for the key instead of
- * deferring on the first miss. But the wait exists for ONE condition — a
+ * A mint that arrives before any node has generated the key must not fail,
+ * so the resolver waits for the key instead of deferring on the first miss. But the wait exists for ONE condition — a
  * reconcile that returns `null` because a non-leader is still leaving key
  * creation to the leader. A reconcile that THROWS is a different answer:
  * a signing key sealed under a master key this process does not hold, or `db`

package/dist/orchestrator-core.d.ts

@@ -31,6 +31,7 @@ import { AgentMetricsAggregator } from './metrics/agent-metrics-aggregator.js';
 import { SourceLocationStore } from './app.js';
 import { ExecutionJobStatus, type PeerHeartbeat, type PeerLogsCollectRequest, type PeerToPeerMessage, type InvokeResult } from '@kici-dev/engine';
 import { ScalerManager } from './scaler/index.js';
+import { type ScalerFileReload } from './scaler/file-reload.js';
 import type { ScalerConfig } from './scaler/index.js';
 import type { CacheStorage } from './storage/index.js';
 import { type ProvenanceTrustRoot } from './provenance/trust-root.js';
@@ -90,9 +91,9 @@ export interface OrchestratorSubsystems {
     scalerConfig: ScalerConfig | null;
     cacheStorage: CacheStorage | undefined;
     /**
-     * Provenance trust root used to verify build-provenance bundles at ingest.
-     * The mode-specific hook (server.ts) wires the live issuer onto it from the
-     * Platform `auth.success` message via `onProvenanceIssuer`.
+     * Provenance trust root used to verify build-provenance bundles at ingest:
+     * the orchestrator's own key set, the local dev plane's signer, or the
+     * configured `KICI_PROVENANCE_ISSUER`.
      */
     provenanceTrustRoot: ProvenanceTrustRoot;
     /**
@@ -174,6 +175,12 @@ export interface OrchestratorSubsystems {
      * in setupCluster).
      */
     answerPeerForgetRequest: PeerForgetRequestHandler;
+    /**
+     * Reloads this orchestrator's scaler config (`kici-admin scaler reload`,
+     * SIGHUP). Wired into every outgoing PeerClient to answer a
+     * peer.scaler.reload.request.
+     */
+    scalerFileReload: ScalerFileReload;
     getLocalInventory: () => Omit<PeerHeartbeat, 'type'>;
     broadcastHeartbeatToAllPeers: () => void;
     broadcastAgentTokenRevoke: (tokenId: string) => void;

package/dist/pipeline/global-eval-round.d.ts

@@ -16,7 +16,7 @@
  * This module owns the partition, the grouping, and the dispatch-and-await. The
  * caller decides what to do with the verdicts.
  */
-import type { AgentCapabilities, GlobalEvalCandidateResult, LockJobOrFactory, LockWorkflow, SimulatedEvent, WorkflowDecision } from '@kici-dev/engine';
+import type { GlobalEvalCandidateResult, LockJobOrFactory, LockWorkflow, SimulatedEvent, WorkflowDecision } from '@kici-dev/engine';
 import { type GlobalEvalRoundCache } from '../cache/global-eval-round-cache.js';
 import type { PendingGlobalEvalTracker } from '../cache/pending-global-evals.js';
 import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
@@ -135,17 +135,12 @@ export interface GlobalEvalAgentRegistry {
         arch: string;
         version?: string | null;
     }>;
-    /**
-     * Every registered agent, busy or idle. Optional so a test double can omit
-     * it; without it the up-front result-aware refusal never fires.
-     */
+    /** Every registered agent, busy or idle. Optional so a test double can omit it. */
     getAllEntries?(): Iterable<{
         labels: ReadonlySet<string>;
         platform: string;
         arch: string;
         version: string | null;
-        /** What the agent advertised on `agent.register`; `null` = supports nothing optional. */
-        capabilities: AgentCapabilities | null;
     }>;
 }
 /**
@@ -226,25 +221,6 @@ export interface GlobalEvalRoundArgs {
  * timeout message that says nothing about agent versions.
  */
 export declare function unsupportedFleetReason(agentRegistry?: GlobalEvalAgentRegistry): string | null;
-/**
- * Why a candidate with a result-aware generator is refused before any round.
- *
- * An agent without the capability runs every generator in the round, a
- * result-aware one included; that generator sees no upstream outputs and
- * returns the wrong jobs.
- */
-export declare const RESULT_AWARE_UNSUPPORTED_REASON: string;
-/**
- * Why no agent can run a round holding a result-aware generator, or `null`
- * when one might.
- *
- * The same bar as {@link unsupportedFleetReason}: refused only on proof. That
- * means init-runners ARE registered, every one reports a readable version, and
- * none advertises the capability. An empty fleet, a busy capable agent, or an
- * agent whose version cannot be read is not refused — the round queues on the
- * agent-feature label, and a scaler or a registering agent can still serve it.
- */
-export declare function resultAwareUnsupportedReason(agentRegistry?: GlobalEvalAgentRegistry): string | null;
 /**
  * Narrow one wire verdict into a value the dispatch path can trust.
  *

package/dist/pipeline/install-secrets-resolver.d.ts

@@ -116,9 +116,6 @@ export declare function validateRegistryUrlScheme(url: string, allowHttp: boolea
  * it set one, otherwise the `HoldType` member its action implies. Column and
  * gate share one vocabulary, so nothing is translated here.
  *
- * Distinct from the engine's `normalizePersistedHoldType`, which maps a value
- * read back OUT of the column onto that same vocabulary.
- *
  * Exported for tests.
  */
 export declare function resolveHoldType(action: 'hold' | 'wait' | 'queue', raw: string | undefined): string;

package/dist/pipeline/manual-schedule.d.ts

@@ -41,13 +41,7 @@ export declare function buildManualJobConfig(workflow: LockWorkflow, mat: Materi
     source: import("@kici-dev/engine").LockSource | undefined;
     workflowName: string;
     steps: readonly import("@kici-dev/engine").LockStepEntry[];
-    needs: readonly (string | {
-        name: string;
-        runOn: ("cancelled" | "cancelling" | "drift_dropped" | "failed" | "pending" | "queued" | "recovering" | "running" | "skipped" | "success" | "timed_out_stale" | "unroutable")[];
-    } | {
-        group: string;
-        runOn: ("cancelled" | "cancelling" | "drift_dropped" | "failed" | "pending" | "queued" | "recovering" | "running" | "skipped" | "success" | "timed_out_stale" | "unroutable")[];
-    })[];
+    needs: readonly (string | import("@kici-dev/engine").LockNeedsEntry | import("@kici-dev/engine").LockNeedsGroupEntry)[];
     rules: readonly import("@kici-dev/engine").LockRule[] | undefined;
     gitCredentials?: Readonly<Record<string, Readonly<Record<string, string>>>> | undefined;
     dispatchInputs?: Record<string, unknown> | undefined;

package/dist/provenance/dispatch-context.d.ts

@@ -31,13 +31,11 @@ import type { Database } from '../db/types.js';
  * `repository` / `ref` / `sha` / `workflowRef` / `runId` / `jobId`, none of
  * which depends on who signs the token. Only the statement's `builder.id`
  * needs an issuer, and an unset one reproduces the `/orchestrator/unknown`
- * builder the local guess has always recorded.
- *
- * Gating on the issuer here dropped the context for every orchestrator still
- * on the deprecated Platform-relay mint, so its agent fell back to the local
- * guess — `repository: 'unknown/unknown'` for a `file://` clone, and a bare
- * workflow name where the claim is `<name>@<sha>` — and the capture check
- * then refused every one of its deferred attestations.
+ * builder the local guess has always recorded. Gating on the issuer would send
+ * an orchestrator without one back to the local guess —
+ * `repository: 'unknown/unknown'` for a `file://` clone, and a bare workflow
+ * name where the claim is `<name>@<sha>` — and the capture check would refuse
+ * every one of its deferred attestations.
  */
 export declare function loadProvenanceContext(db: Kysely<Database>, runId: string, jobId: string, opts: {
     issuer: string | undefined;

package/dist/provenance/pending-attestations-repo.d.ts

@@ -26,7 +26,7 @@ export declare class PendingAttestationsRepo {
     /**
      * List pending rows oldest-first, optionally scoped to a run. Terminally
      * rejected rows (`rejected_at IS NOT NULL`) are excluded — the retrier never
-     * re-picks a row the Platform definitively cannot mint.
+     * re-picks a row the orchestrator definitively cannot mint.
      */
     list(opts?: {
         runId?: string;

package/dist/provenance/trust-root.d.ts

@@ -6,15 +6,14 @@ import type { JSONWebKeySet } from 'jose';
  */
 export declare function deriveJwksUri(issuer: string): string;
 /**
- * The orchestrator's view of the provenance trust root. The issuer arrives over
- * the `auth.success` connect message for the live process, or from config/env
- * (`KICI_PROVENANCE_ISSUER`) for the CLI backfill which has no live handshake.
- * The JWKS is fetched lazily and cached with a single refetch-on-`kid`-miss.
+ * The orchestrator's view of the provenance trust root. The issuer is fixed at
+ * construction: the orchestrator's own signing issuer, the local dev plane's
+ * `kici-local`, or the configured `KICI_PROVENANCE_ISSUER`. The JWKS is fetched
+ * lazily and cached with a single refetch-on-`kid`-miss.
  */
 export interface ProvenanceTrustRoot {
     getIssuer(): string | null;
     getJwks(kid?: string): Promise<JSONWebKeySet | null>;
-    setIssuer(issuer: string | null): void;
 }
 /**
  * A trust root backed by the orchestrator's OWN signing keys

package/dist/provenance/verify-deferred-capture.d.ts

@@ -27,9 +27,9 @@ export type DeferredCaptureVerdict = {
  * A rejection is a DROP: the job stays green and has no attestation.
  * That is a degradation, whereas storing an unchecked statement re-introduces
  * the forgery primitive — every gate that lets one through is the hole again.
- * An agent too old to receive `provenanceContext` freezes the legacy statement
- * shape and is dropped for the same reason, with the mismatched field named so
- * the operator can see the upgrade is what fixes it.
+ * A dispatch that carried no `provenanceContext` makes the agent freeze its
+ * local statement, which is dropped for the same reason, with the mismatched
+ * field named.
  */
 export declare function checkDeferredCapture(deps: {
     db: Kysely<Database>;

package/dist/provider-registry.d.ts

@@ -75,9 +75,9 @@ export interface ProviderBundle {
  *   registry.registerByRoutingKey('github:67890', bundleForApp2);
  *   const bundle = registry.getByRoutingKey('github:12345');
  *
- * Usage (backward-compatible single-app):
- *   registry.register('github', bundle);
- *   const bundle = registry.get('github');
+ * A provider-wide default bundle, registered with `register(type)`, stands in
+ * for every routing key of that type that has no bundle of its own:
+ *   registry.register('generic', genericBundle);
  */
 export declare class ProviderRegistry {
     private readonly bundles;
@@ -89,26 +89,16 @@ export declare class ProviderRegistry {
      */
     registerByRoutingKey(routingKey: string, bundle: ProviderBundle): void;
     /**
-     * Register a provider implementation bundle by provider type.
-     *
-     * Backward-compatible: stores the bundle under a synthetic routing key
-     * "{type}:default". Only works for single-app scenarios.
-     *
-     * For multi-app support, use registerByRoutingKey() instead.
+     * Register the provider-wide default bundle for `type`, stored under the
+     * synthetic routing key "{type}:default". It answers every routing key of
+     * that type that has no bundle of its own.
      */
     register(type: ProviderType, bundle: ProviderBundle): void;
-    /**
-     * Get the provider bundle for a given type.
-     *
-     * Backward-compatible: returns the first bundle matching the provider type
-     * prefix. For multi-app, use getByRoutingKey() instead.
-     */
-    get(type: ProviderType): ProviderBundle | undefined;
     /**
      * Whether a bundle is registered at EXACTLY this routing key.
      *
-     * `getByRoutingKey` cannot answer this: it falls back to a provider-type
-     * lookup, so it returns a bundle for a key it has never seen. A caller that
+     * `getByRoutingKey` cannot answer this: it falls back to the type's default
+     * bundle, so it returns a bundle for a key it has never seen. A caller that
      * needs to know whether the source's OWN bundle is present — rather than
      * whether some bundle can be produced — has to ask here.
      */
@@ -117,17 +107,11 @@ export declare class ProviderRegistry {
      * Get the provider bundle by routing key.
      * Routing keys have the format "{provider}:{id}" (e.g., "github:12345").
      *
-     * Falls back to get(providerType) if the exact key is not found, for
-     * backward compatibility with single-app registration.
-     *
-     * The fallback is deliberately narrower for a `generic:` key. Such a key is
-     * fully qualified (`generic:{orgId}:{sourceId}`), so the type-prefix scan in
-     * `get()` cannot be a "the single configured app" shortcut the way it is for
-     * `github:` — it returns whichever `generic:`-prefixed bundle happens to sit
-     * first in insertion order, which may belong to a different source, or to a
-     * different ORGANIZATION. Only the shared default bundle (`generic:default`,
-     * the one that genuinely stands in for every plain generic source) is an
-     * acceptable stand-in, so that is the only fallback offered here.
+     * A key with no bundle of its own falls back only to its type's default
+     * bundle (`{type}:default`, e.g. `generic:default`, which stands in for every
+     * plain generic source). It never falls back to another key's bundle: that
+     * bundle belongs to a different App or source, possibly in a different
+     * organization.
      */
     getByRoutingKey(routingKey: string): ProviderBundle | undefined;
     /**
@@ -139,21 +123,10 @@ export declare class ProviderRegistry {
      * Iterate over all registered bundles.
      */
     getAll(): IterableIterator<[string, ProviderBundle]>;
-    /**
-     * Check if a provider type has at least one registered bundle.
-     */
-    has(type: ProviderType): boolean;
     /**
      * Get all registered routing keys.
      */
     getRoutingKeys(): string[];
-    /**
-     * Get routing keys matching a specific provider type.
-     *
-     * @param type - Provider type (e.g., "github")
-     * @returns Array of routing keys matching the type prefix
-     */
-    getRoutingKeysForProvider(type: ProviderType): string[];
     /**
      * Remove a routing key and its bundle.
      * Used during config reload when apps are removed.

package/dist/providers/github/manifest.d.ts

@@ -41,6 +41,22 @@ export interface GithubAppManifest {
  * does not receive events at it; the operator owns delivery.
  */
 export declare function validateWebhookUrl(value: string): string;
+/**
+ * Every permission and event a KiCI GitHub App needs. The manifest requests
+ * exactly these, and `kici-admin source refresh` reports an existing App that
+ * lacks any of them.
+ */
+export declare const GITHUB_APP_REQUIREMENTS: {
+    readonly permissions: {
+        readonly contents: 'read';
+        readonly metadata: 'read';
+        readonly pull_requests: 'read';
+        readonly checks: 'write';
+        readonly members: 'read';
+        readonly issues: 'read';
+    };
+    readonly events: readonly ["push", "pull_request", "check_run", "check_suite", "issue_comment"];
+};
 export declare function buildGithubAppManifest(input: GithubManifestInput): GithubAppManifest;
 /** Credentials returned by GitHub's manifest-conversion endpoint. */
 export interface GithubAppCredentials {
@@ -62,21 +78,56 @@ export interface GithubAppCredentials {
 export declare function convertManifestCode(code: string, deps?: {
     octokit?: Pick<Octokit, 'request'>;
 }): Promise<GithubAppCredentials>;
+/** What `GET /app` says about the App: identity plus its grant. */
+export interface GithubAppIdentity {
+    name: string;
+    slug: string;
+    /** Events the App subscribes to. */
+    events: string[];
+    /** The App's permissions, name → access level. */
+    permissions: Record<string, string>;
+}
 /**
  * Ask GitHub who this App is (`GET /app`, authenticated as the App via its
- * JWT) and return its authoritative display `name` + `slug`. This is the single
- * "fetch the App's identity from GitHub" helper, reused at source creation, by
- * the daily refresher, and by `kici-admin source refresh`.
+ * JWT) and return its authoritative display `name` + `slug`, plus the events
+ * and permissions the App holds, which the requirement gap check reads. This is
+ * the single "fetch the App's identity from GitHub" helper, reused at source
+ * creation, by the daily refresher, and by `kici-admin source refresh`.
  *
  * GitHub is the source of truth: a rename in the GitHub UI changes the value
  * `GET /app` returns, which is what keeps the dashboard name fresh.
  */
 export declare function fetchGithubAppIdentity(creds: Pick<GithubAppCredentials, 'appId' | 'privateKey'>, deps?: {
     appOctokit?: Pick<Octokit, 'request'>;
-}): Promise<{
-    name: string;
-    slug: string;
-}>;
+}): Promise<GithubAppIdentity>;
+/** One installation's grant, as the gap check reads it. */
+export interface GithubAppInstallationGrant {
+    id: number;
+    /** Login of the account the App is installed on (an enterprise's slug). */
+    account: string;
+    /** `Organization`, `User`, or null for an enterprise installation. */
+    accountType: string | null;
+    permissions: Record<string, string>;
+}
+/** Every installation of the App (`GET /app/installations`, all pages), as the App. */
+export declare function listGithubAppInstallations(creds: Pick<GithubAppCredentials, 'appId' | 'privateKey'>, deps?: {
+    appOctokit?: Pick<Octokit, 'request'>;
+}): Promise<GithubAppInstallationGrant[]>;
+/** Required events and permissions an App or its installations lack. */
+export interface GithubAppRequirementGaps {
+    missingEvents: string[];
+    missingPermissions: string[];
+    /** Installations that have not accepted a permission the App itself holds. */
+    installationsPendingApproval: Array<{
+        installationId: number;
+        account: string;
+        missingPermissions: string[];
+    }>;
+}
+/** Compare an App and its installations with {@link GITHUB_APP_REQUIREMENTS}. */
+export declare function findGithubAppRequirementGaps(app: Pick<GithubAppIdentity, 'events' | 'permissions'>, installations: GithubAppInstallationGrant[]): GithubAppRequirementGaps;
+/** Whether any gap array is non-empty. */
+export declare function hasRequirementGaps(gaps: GithubAppRequirementGaps): boolean;
 /**
  * Poll GitHub (as the App, via a JWT) until at least one installation exists,
  * returning the first installation's id + account login. Throws on timeout.

package/dist/providers/universal-git/ssh-auth.d.ts

@@ -86,9 +86,4 @@ export declare function prepareSshAuthSync(opts: PrepareSshAuthOptions): SshAuth
  * orchestrator's runtime user may have a populated ssh-agent.
  */
 export declare function composeGitSshCommand(privateKeyPath: string, policy: SshHostKeyPolicy, knownHostsPath: string): string;
-/**
- * Shell-quote a path for embedding in `GIT_SSH_COMMAND`. Single-quotes the
- * string and escapes embedded single quotes — matches POSIX shell parsing.
- */
-export declare function quoteShell(path: string): string;
 //# sourceMappingURL=ssh-auth.d.ts.map

package/dist/reporting/check-run-reporter.d.ts

@@ -25,7 +25,6 @@
  * This CheckRunReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
  * Future cleanup may unify both under CheckStatusPoster, but they serve different purposes today.
  */
-import { type GitHubAppConfig } from '../providers/github/auth.js';
 import type { ProviderRegistry } from '../provider-registry.js';
 import type { StepLogBuffer } from './step-log-buffer.js';
 import { type SourceLocationData } from './check-run-summary.js';
@@ -36,17 +35,11 @@ import { CheckRunConclusion, type TerminalJobStatus } from '@kici-dev/engine';
  */
 interface CheckRunReporterDeps {
     /**
-     * Provider registry for per-routing-key credential lookup.
-     * When provided, the reporter resolves GitHub App credentials by routing key
-     * from the registry's CloneTokenProvider config. Takes precedence over githubConfig.
+     * Provider registry for per-routing-key credential lookup: the reporter
+     * resolves GitHub App credentials by routing key from the registry's
+     * CloneTokenProvider config.
      */
     providerRegistry?: ProviderRegistry;
-    /**
-     * GitHub App config for creating Octokit instances.
-     * Fallback for backward compatibility when providerRegistry is not provided
-     * or when no routing key is available.
-     */
-    githubConfig?: GitHubAppConfig;
     /** Step log buffer for enriched failure summaries. */
     stepLogBuffer?: StepLogBuffer;
     /**
@@ -73,8 +66,7 @@ interface CheckRunReporterDeps {
      * Resolver for the orchestrator's owning org public alias. Typically
      * wired to `PlatformClient.getOrgPublicAlias()`. Returns the
      * `oal_<12-char>` alias supplied by Platform on `auth.success`, or
-     * `undefined` before auth completes / when running against a
-     * Platform that predates the alias plumbing.
+     * `undefined` before auth completes.
      */
     getOrgPublicAlias?: () => string | undefined;
 }
@@ -254,7 +246,7 @@ interface UpdateStepProgressOptions {
     jobName: string;
     stepIndex: number;
     stepName: string;
-    state: 'running' | 'success' | 'failed' | 'skipped' | 'cancelled' | 'error';
+    state: 'running' | 'success' | 'failed' | 'skipped' | 'cancelled';
     durationMs?: number;
     installationId?: number;
     /** Routing key for per-app credential lookup (e.g., "github:12345"). */
@@ -526,14 +518,9 @@ export declare class CheckRunReporter {
      */
     private persistBuildCreationPending;
     /**
-     * Resolve GitHub App credentials for a given routing key.
-     *
-     * Resolution order:
-     * 1. If providerRegistry is provided AND routingKey is given, look up the bundle
-     *    by routing key and extract config from the CloneTokenProvider's getAppConfig().
-     * 2. Fall back to the direct githubConfig dep (backward compatible).
-     *
-     * Returns undefined if no config is available.
+     * Resolve GitHub App credentials for a given routing key from the bundle's
+     * CloneTokenProvider `getAppConfig()`. Returns undefined when no routing key,
+     * registry, bundle or GitHub provider is available.
      */
     private resolveGithubConfig;
     /**

package/dist/reporting/check-run-summary.d.ts

@@ -17,7 +17,7 @@ import type { StepLogBuffer } from './step-log-buffer.js';
 /** Step result data as sent by the agent in job.status data.stepResults. */
 export interface StepResultData {
     name: string;
-    status: 'success' | 'failed' | 'error' | 'skipped' | 'cancelled';
+    status: 'success' | 'failed' | 'skipped' | 'cancelled';
     durationMs?: number;
     error?: string;
     exitCode?: number;
@@ -43,7 +43,7 @@ export interface CheckAnnotation {
 /** Step progress entry for live updates. */
 export interface StepProgressEntry {
     name: string;
-    status: 'pending' | 'running' | 'success' | 'failed' | 'error' | 'skipped' | 'cancelled';
+    status: 'pending' | 'running' | 'success' | 'failed' | 'skipped' | 'cancelled';
     durationMs?: number;
 }
 interface BuildCheckRunSummaryOptions {

package/dist/reporting/execution-tracker.d.ts

@@ -1299,7 +1299,7 @@ export declare class ExecutionTracker {
         startedAt: number;
         completedAt?: number;
         durationMs?: number;
-        statusEpoch?: number;
+        statusEpoch: number;
         jobs: Array<{
             jobId: string;
             jobName: string;

package/dist/reporting/log-chunk-sink.d.ts

@@ -24,7 +24,7 @@ export interface NormalizedLogChunk {
     stepIndex: number;
     lines: string[];
     timestamp: number;
-    stream?: LogStream;
+    stream: LogStream;
 }
 /** Which ingress produced the chunk. Stamped onto the two log counters. */
 export type LogChunkSource = 'local' | 'peer';

package/dist/reporting/run-summary-fields.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The run fields every `onExecutionStatusChange` context built from an
+ * in-memory run carries, in one place so a new column cannot be forwarded from
+ * some status transitions and silently dropped from others.
+ */
+import type { ExecutionContext } from './execution-tracker.js';
+type RunSummaryKey = 'workflowName' | 'provider' | 'repoIdentifier' | 'workflowRepoIdentifier' | 'sha' | 'installationId' | 'requestId' | 'routingKey' | 'ref' | 'triggerEvent' | 'commitMessage' | 'parentRunId' | 'originalRunId' | 'triggeredBy' | 'triggeredByAgentLabel' | 'triggerActorUsername' | 'triggerActorUserId';
+/** The slice of a tracked run {@link runSummaryFields} reads. */
+export type RunSummarySource = Pick<ExecutionContext, RunSummaryKey> & {
+    statusEpoch?: number | null;
+};
+/** The `statusEpoch` context field for a run, omitted at 0 (its default). */
+export declare function statusEpochField(epoch: number | null | undefined): {
+    statusEpoch?: number;
+};
+/**
+ * The shared part of a run's status-change context.
+ *
+ * `workflowRepoIdentifier` is copied only when set, because its presence is
+ * what marks a cross-repository global run downstream. `localWorkingTree` is
+ * left to the caller: only some transitions forward it.
+ */
+export declare function runSummaryFields(run: RunSummarySource): Pick<ExecutionContext, RunSummaryKey | 'statusEpoch'>;
+export {};
+//# sourceMappingURL=run-summary-fields.d.ts.map

package/dist/reporting/s3-log-storage.d.ts

@@ -22,7 +22,7 @@
  *   finalize(path) at run completion.
  *
  * - finalize() seals the remaining tail buffer for a step key.
- * - read() lists sealed segments (plus any legacy/single object written by
+ * - read() lists sealed segments (plus any single object written by
  *   append()) and streams them via the byte-offset cursor.
  * - exists()/list() are segment-aware: `exists` is true when a single object or
  *   any segment is present; `list` collapses segment keys to their logical step
@@ -113,7 +113,7 @@ export declare class S3LogStorage implements LogStorage {
     /**
      * Single-object size (or null) + sealed segments in ascending seq order for a
      * key. The single object is the content written by append() (single-shot
-     * writers) or any legacy step log written before the append-only change.
+     * writers).
      */
     private layout;
     /** Fetch an inclusive byte range from one object. */

package/dist/routes/admin-access-log.d.ts

@@ -18,19 +18,12 @@
 import { Hono } from 'hono';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminAccessLogRoutesDeps {
     accessLog: AccessLogWriter;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createAdminAccessLogRoutes(deps: AdminAccessLogRoutesDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-access-log.d.ts.map

package/dist/routes/admin-backends.d.ts

@@ -12,14 +12,7 @@ import { Hono } from 'hono';
 import type { BackendSyncManager } from '@kici-dev/engine';
 import type { BackendRegistry } from '../secrets/backend-registry.js';
 import type { BackendHealthChecker } from '../secrets/backend-health.js';
-import type { Role } from '../secrets/rbac.js';
-type AdminBackendsEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
+import { type AdminEnv } from './admin-env.js';
 interface BackendRouteDeps {
     registry: BackendRegistry;
     healthChecker: BackendHealthChecker;
@@ -31,6 +24,6 @@ interface BackendRouteDeps {
  * @param deps - Backend route dependencies (registry, health checker, sync manager)
  * @returns Hono app with backend routes
  */
-export declare function createBackendRoutes(deps: BackendRouteDeps): Hono<AdminBackendsEnv>;
+export declare function createBackendRoutes(deps: BackendRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-backends.d.ts.map

package/dist/routes/admin-cluster-name.d.ts

@@ -25,8 +25,9 @@ import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import { CLUSTER_NAME_REGEX } from '@kici-dev/engine/protocol/cluster-name';
 import type { Database } from '../db/types.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import { type AdminEnv } from './admin-env.js';
 interface ClusterNameRouteDeps {
     db: Kysely<Database>;
     rbac: RbacEnforcer;
@@ -38,13 +39,6 @@ interface ClusterNameRouteDeps {
      */
     accessLog?: AccessLogWriter;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createClusterNameRoutes(deps: ClusterNameRouteDeps): Hono<AdminEnv>;
 export { CLUSTER_NAME_REGEX };
 //# sourceMappingURL=admin-cluster-name.d.ts.map