@kici-dev/orchestrator 0.17.0 → 0.19.0

package/dist/db/migrations/084_orchestrator_signing_keys.d.ts

@@ -1,19 +1,14 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the `orchestrator_signing_keys` table: the cluster-scoped, long-lived
- * ES256 provenance signing keys the orchestrator uses to sign its own build
- * attestations. One `active` key signs; rotated-out keys go `retiring` then
- * `retired` (still served in the JWKS so historical attestations keep
- * verifying); `revoked` keys are removed from the trust root.
+ * Add `orchestrator_signing_keys`: the cluster-scoped, long-lived ES256 keys that sign the
+ * orchestrator's build attestations. One `active` key signs; rotated-out keys go `retiring` then
+ * `retired` (still in the JWKS so historical attestations verify); `revoked` keys leave the
+ * trust root.
  *
- * `public_jwk` is the non-secret public half served at `/.well-known/jwks.json`.
- * `encrypted_private_jwk` holds the AES-256-GCM-wrapped private JWK for `db`
- * custody (wrapped with the orchestrator's `KICI_SECRET_KEY` master key, same
- * posture as `scoped_secrets`) and is NULL for `aws-kms` / `command` custody
- * where the private key never lives in the DB. `key_ref` locates the external
- * key (KMS ARN / signer command) for non-`db` custody.
- *
- * Idempotent: guarded on table existence.
+ * `public_jwk` is served at `/.well-known/jwks.json`. `encrypted_private_jwk` is the
+ * AES-256-GCM-wrapped private JWK for `db` custody (wrapped with `KICI_SECRET_KEY`, like
+ * `scoped_secrets`), NULL for `aws-kms` / `command` custody where the private key never lives in
+ * the DB; `key_ref` then locates the external key (KMS ARN / signer command). Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/085_cluster_settings_reroute_flap_grace_ms.d.ts

@@ -1,11 +1,10 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.reroute_flap_grace_ms` (nullable BIGINT).
+ * Fleet-wide grace window (ms) in which the recovery sweepers defer a rerouted job while its
+ * worker peer flaps. NULL → cluster default (`config.rerouteFlapGraceMs`,
+ * `KICI_REROUTE_FLAP_GRACE_MS`).
  *
- * Fleet-wide grace window (ms) during which a rerouted job stays deferred from the recovery sweepers while its worker peer momentarily flaps. NULL → cluster default (`config.rerouteFlapGraceMs`, `KICI_REROUTE_FLAP_GRACE_MS`).
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/086_cluster_settings_max_fanout_hosts.d.ts

@@ -2,10 +2,10 @@ import { type Kysely } from 'kysely';
 /**
  * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
  *
- * Fleet-wide cap on `runsOnAll` per-host fan-out children. NULL → cluster default (`config.maxFanoutHosts`, `KICI_MAX_FANOUT_HOSTS`).
+ * Fleet-wide cap on `runsOnAll` per-host fan-out children. NULL → cluster default
+ * (`config.maxFanoutHosts`, `KICI_MAX_FANOUT_HOSTS`).
  *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/087_cluster_settings_event_router_rate_limit.d.ts

@@ -2,10 +2,12 @@ import { type Kysely } from 'kysely';
 /**
  * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
  *
- * Fleet-wide per-(source routing key + event) sliding-window rate limit (events/minute) for the event router. NULL → cluster default (`config.eventRouterRateLimitPerWorkflowPerMinute`, `KICI_EVENT_ROUTER_RATE_LIMIT_PER_WORKFLOW_PER_MINUTE`).
+ * Fleet-wide per-(source routing key + event) sliding-window rate limit
+ * (events/minute) for the event router. NULL → cluster default
+ * (`config.eventRouterRateLimitPerWorkflowPerMinute`,
+ * `KICI_EVENT_ROUTER_RATE_LIMIT_PER_WORKFLOW_PER_MINUTE`).
  *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/088_cluster_settings_cache_max_tarball_bytes.d.ts

@@ -2,10 +2,10 @@ import { type Kysely } from 'kysely';
 /**
  * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
  *
- * Fleet-wide maximum dependency-cache tarball size (bytes); a larger store is rejected. NULL → cluster default (`config.cacheMaxTarballBytes`, `KICI_CACHE_MAX_TARBALL_BYTES`).
+ * Fleet-wide maximum dependency-cache tarball size (bytes); a larger store is rejected.
+ * NULL → cluster default (`config.cacheMaxTarballBytes`, `KICI_CACHE_MAX_TARBALL_BYTES`).
  *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/089_cluster_settings_cache_ttl_days.d.ts

@@ -1,11 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.cache_ttl_days` (nullable INTEGER).
+ * Fleet-wide dependency-cache entry TTL (days): an entry unread for longer expires on the next
+ * lookup. NULL → cluster default (`config.cacheTtlDays`, `KICI_CACHE_TTL_DAYS`).
  *
- * Fleet-wide dependency-cache entry TTL (days). An entry unread for longer is treated as expired on the next lookup. NULL → cluster default (`config.cacheTtlDays`, `KICI_CACHE_TTL_DAYS`).
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.d.ts

@@ -1,11 +1,8 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.concurrency_wait_timeout_ms` (nullable BIGINT).
- *
- * Fleet-wide agent concurrency-slot wait timeout (ms), pushed to the agent on `job.dispatch`. NULL → cluster default (`config.concurrencyWaitTimeoutMs`, `KICI_CONCURRENCY_WAIT_TIMEOUT_MS`).
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Add `cluster_settings.concurrency_wait_timeout_ms`: the fleet-wide agent concurrency-slot wait
+ * timeout (ms), pushed to the agent on `job.dispatch`. NULL is the cluster default
+ * (`config.concurrencyWaitTimeoutMs`, `KICI_CONCURRENCY_WAIT_TIMEOUT_MS`). Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/091_cluster_settings_agent_token_ttl_ms.d.ts

@@ -1,11 +1,8 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.agent_token_ttl_ms` (nullable BIGINT).
- *
- * Fleet-wide ephemeral agent-token TTL (ms), resolved by the leader at spawn. NULL → cluster default (`config.agentTokenTtlMs`, `KICI_AGENT_TOKEN_TTL_MS`).
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * `cluster_settings.agent_token_ttl_ms` (nullable BIGINT): fleet-wide ephemeral
+ * agent-token TTL (ms), resolved by the leader at spawn. NULL → cluster default
+ * (`config.agentTokenTtlMs`, `KICI_AGENT_TOKEN_TTL_MS`). Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/092_cluster_settings_version.d.ts

@@ -1,15 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.version` (monotonic BIGINT, bumped on each settings
- * change).
+ * `cluster_settings.version`, monotonic and bumped on each settings change. The leader
+ * advertises it on `peer.heartbeat`, so DB-less workers detect a change and pull the
+ * worker-relevant settings snapshot. DB-backed, so a newly elected leader continues
+ * monotonically after failover.
  *
- * The leader advertises this version on `peer.heartbeat` so DB-less workers can
- * detect a change and pull the worker-relevant settings snapshot. DB-backed
- * (not an in-memory counter) so it survives leader failover: a newly-elected
- * leader continues monotonically from the row's current value.
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/094_dashboard_encryption_keys.d.ts

@@ -1,20 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the `dashboard_encryption_keys` table: the cluster-scoped, long-lived
- * X25519 keypair the orchestrator owns for browser-sealed dashboard writes.
- * Under the `encrypted` dashboard-write posture the browser seals a secret /
- * variable value to the `active` key's public half before it leaves the page,
- * so the hosted Platform relays only opaque ciphertext.
+ * Add `dashboard_encryption_keys`: the cluster-scoped, long-lived X25519 keypair for
+ * browser-sealed dashboard writes. Under the `encrypted` posture the browser seals a secret /
+ * variable value to the `active` key's public half, so the hosted Platform relays only
+ * ciphertext.
  *
- * Modeled on `orchestrator_signing_keys` (migration 084). `public_jwk` is the
- * non-secret OKP/X25519 public JWK (`use:'enc'`) served at
- * `/.well-known/jwks.json`. `encrypted_private_key` holds the AES-256-GCM
- * master-key-wrapped (KICI_SECRET_KEY) DER private key — db custody only, so it
- * is NOT NULL. One `active` key seals; a rotated-out key goes `revoked` and
- * leaves the published JWKS, while its row stays so envelopes already sealed to
- * it still decrypt.
- *
- * Idempotent: guarded on table existence.
+ * Modeled on `orchestrator_signing_keys` (084). `public_jwk` (OKP/X25519, `use:'enc'`) is served
+ * at `/.well-known/jwks.json`. `encrypted_private_key` is the AES-256-GCM KICI_SECRET_KEY-wrapped
+ * DER private key; db custody only, so NOT NULL. One `active` key seals; a rotated-out key goes
+ * `revoked` and leaves the JWKS, but its row stays so already-sealed envelopes decrypt.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/095_dashboard_write_policy_tristate.d.ts

@@ -8,12 +8,8 @@ import { type Kysely } from 'kysely';
  *     keeping the JSONB minimal — matches setDashboardWritePolicy normalization)
  *   - already-string enum values → left untouched (idempotent re-run)
  *
- * Runtime reads coerce booleans defensively too (so an un-migrated row is never
- * mis-read), but this migration normalizes the at-rest shape so the stored JSONB
- * matches what the tri-state writer produces.
- *
- * Pure SQL rewrite: for each row, rebuild the object keeping only non-`true`
- * entries and mapping `false` → `'disabled'`, leaving existing string values.
+ * Runtime reads also coerce booleans, so an un-migrated row is never mis-read;
+ * this normalizes the at-rest shape to what the tri-state writer produces.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(): Promise<void>;

package/dist/db/migrations/099_cluster_settings_dashboard_verified_issuer.d.ts

@@ -2,19 +2,16 @@ import { type Kysely } from 'kysely';
 /**
  * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
  *
- * The verified-tier origin the dashboard fetches the orchestrator's X25519
- * dashboard-encryption public key from — and always displays next to a secret /
- * variable entry field — under the `encrypted` dashboard-write posture. Fetching
- * the key straight from the customer's own origin makes TLS to that domain the
- * trust root, so an active hosted-control-plane MITM of the key cannot happen.
+ * Under the `encrypted` dashboard-write posture, the verified-tier origin the
+ * dashboard fetches the orchestrator's X25519 public key from and always shows
+ * next to a secret / variable entry field. TLS to the customer's own origin is
+ * the trust root, so the hosted control plane cannot MITM the key.
  *
- * Cluster-global (one orchestrator identity, one `.well-known`), not per-tenant,
- * so it lives on `cluster_settings` rather than `org_settings`. The tier is
- * explicit opt-in with no environment fallback: NULL ⇒ the verified tier is not
- * offered and the convenient tier is used.
+ * Cluster-global (one orchestrator identity, one `.well-known`), so it lives on
+ * `cluster_settings`, not `org_settings`. Explicit opt-in with no environment
+ * fallback: NULL ⇒ the verified tier is not offered; the convenient tier is used.
  *
- * Idempotent: guarded on column existence; a re-run on a DB that already has the
- * column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/101_contexts_hold_expiry_drop_default.d.ts

@@ -2,18 +2,14 @@ import { type Kysely } from 'kysely';
 /**
  * Give the context hold expiry a single default, and retire the stored zeroes.
  *
- * `contexts.hold_expiry_seconds` carried `DEFAULT 86400` while every read-side
- * fallback and the operator docs used 3600 — so a context created without an
- * expiry held for 24 h, and one whose expiry was cleared held for 1 h. Dropping
- * the DDL default (rather than moving it to 3600) makes both paths land on NULL
- * and resolve through `DEFAULT_HOLD_EXPIRY_SECONDS`, so the two cannot drift
- * apart again.
+ * `contexts.hold_expiry_seconds` carried `DEFAULT 86400` while read-side
+ * fallbacks and the docs used 3600 (24 h when created without an expiry, 1 h
+ * when cleared). Dropping the DDL default, rather than moving it to 3600, sends
+ * both paths to NULL and `DEFAULT_HOLD_EXPIRY_SECONDS`, so they cannot drift.
  *
- * The backfill is the other half of rejecting a zero expiry at the write
- * boundary: a stored `0` puts every hold's deadline at the current instant, so
- * the hold is swept to `expired` before a reviewer can act. Validation alone
- * only stops new zeroes arriving; these rows already exist and there was no CLI
- * path to notice them.
+ * The backfill pairs with rejecting a zero expiry at the write boundary: a
+ * stored `0` puts every hold's deadline at now, so it expires before a reviewer
+ * can act. Validation stops only new zeroes, and no CLI path surfaces old ones.
  *
  * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
  * rows on a second run.
@@ -22,10 +18,8 @@ export declare function up(db: Kysely<unknown>): Promise<void>;
 /**
  * Restore the column's original default.
  *
- * Deliberately asymmetric: the zeroed rows are NOT recreated. After the
- * backfill they are indistinguishable from a deliberate NULL, and a row put
- * back to `0` would resume cancelling every hold on its context — so a
- * rollback keeps them on the fallback rather than re-breaking them.
+ * Deliberately asymmetric: zeroed rows are NOT recreated. They now look like a
+ * deliberate NULL, and a `0` would resume cancelling every hold on its context.
  */
 export declare function down(db: Kysely<unknown>): Promise<void>;
 //# sourceMappingURL=101_contexts_hold_expiry_drop_default.d.ts.map

package/dist/db/migrations/102_dispatch_queue_agent_id.d.ts

@@ -2,18 +2,13 @@ import { type Kysely } from 'kysely';
 /**
  * Add `dispatch_queue.agent_id` (nullable text).
  *
- * The durable record of which agent a job was dispatched to. `ack_agent_id` is
- * cleared the moment the agent answers the dispatch, so it cannot answer "who
- * owns this job?" for the rest of the job's life; this column is written at
- * dispatch and cleared only on requeue, so a coordinator that never saw the
- * dispatch — a freshly-elected leader after a failover — can still resolve
- * ownership of a live `dispatched` row straight from the database.
+ * The durable record of which agent a job was dispatched to. `ack_agent_id` clears when the
+ * agent answers the dispatch; this column is written at dispatch and cleared only on requeue,
+ * so a coordinator that never saw the dispatch (a new leader after failover) can still resolve
+ * ownership of a live `dispatched` row from the database.
  *
- * Nullable with no backfill: a row dispatched before this migration keeps a NULL
- * owner and resolves to "not owned", which is the behaviour it already had.
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has the
- * column is a no-op.
+ * No backfill: older rows keep a NULL owner and resolve to "not owned", as before.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.d.ts

@@ -1,19 +1,13 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.ownership_db_check_timeout_ms` (nullable bigint).
+ * Deadline for one DB-backed agent-ownership lookup, which runs inbound on every job-scoped
+ * agent frame that misses the in-memory check. Past it the lookup is undecided and the frame
+ * is refused without counting an ownership violation, so a slow DB cannot stall the frame.
  *
- * Deadline for a single database-backed agent-ownership lookup. The lookup runs
- * on the inbound path of every job-scoped agent frame whose in-memory ownership
- * check misses, so a slow database would otherwise stall the frame; past the
- * deadline the lookup resolves as undecided and the frame is refused without
- * counting an ownership violation.
+ * On `cluster_settings` because every coordinator shares the database. NULL ⇒ the
+ * orchestrator's configured default.
  *
- * Cluster-global (every coordinator talks to the same database), so it lives on
- * `cluster_settings` rather than `org_settings`. NULL ⇒ the orchestrator's own
- * configured default applies.
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has the
- * column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/104_check_run_terminal_sent.d.ts

@@ -1,21 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `check_run_tracking.terminal_sent_at` (nullable timestamptz).
+ * Add `check_run_tracking.terminal_sent_at`.
  *
- * `check_run_id` is written at CREATE time, while the check run is still
- * `queued`, so it proves creation and never completion. Without a completion
- * signal a check run stuck `queued` on the provider is indistinguishable from
- * the provider simply lagging, which is what made a check-run poll timeout
- * unattributable: nothing on our side recorded whether the terminal update had
- * been sent at all.
+ * `check_run_id` is written at create time, while the check run is `queued`, so it proves
+ * creation, never completion. Without a completion signal a check run stuck `queued` on the
+ * provider is indistinguishable from provider lag, so a check-run poll timeout was
+ * unattributable.
  *
- * Stamped only after the provider accepts a `completed` update. Nullable and
- * best-effort like every write on this table — a tracking write must never
- * break check-run reporting — so NULL means "we have no record of sending it",
- * not "it was never sent".
- *
- * Idempotent: guarded on column existence; a re-run on a DB that already has
- * the column is a no-op.
+ * Stamped only after the provider accepts a `completed` update. Best-effort like every write on
+ * this table (a tracking write must never break check-run reporting), so NULL means "no record
+ * of sending it", not "never sent". Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/105_org_trust_policy.d.ts

@@ -3,14 +3,12 @@ import { type Kysely } from 'kysely';
  * Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
  * trust policy pushed on `trust_policy.update`.
  *
- * A dedicated table rather than `org_settings` columns, because this is
- * Platform-owned policy the orchestrator consumes, not operator-owned config the
- * operator tunes. `source` records which of the two wrote the row so the admin
- * surface can present a Platform-managed policy as read-only.
+ * A dedicated table, not `org_settings` columns: this is Platform-owned policy,
+ * not operator config. `source` records which side wrote the row, so the admin
+ * surface shows a Platform-managed policy as read-only.
  *
- * Persisting rather than caching in memory is deliberate: a security policy that
- * silently reverts to a default across a restart is worse than one that is never
- * applied.
+ * Persisted, not cached in memory: a security policy that silently reverts to a
+ * default across a restart is worse than one never applied.
  *
  * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
  */

package/dist/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.d.ts

@@ -1,17 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
- *
- * Retention window for `check_run_tracking` rows. The hourly cleanup sweep
- * deletes rows untouched for longer than this; 0 disables the sweep.
- *
- * Cluster-global (the sweep runs once per fleet on the cleanup tick, with no
- * tenant in scope at the read site), so it lives on `cluster_settings` rather
- * than `org_settings`. NULL means the orchestrator's own configured default
- * applies.
- *
- * Idempotent: guarded on column existence; a re-run on a database that already
- * has the column is a no-op.
+ * Add `cluster_settings.check_run_tracking_ttl_days`: the hourly cleanup sweep deletes
+ * `check_run_tracking` rows untouched for longer than this; 0 disables the sweep; NULL uses the
+ * orchestrator's configured default. Cluster-global, not `org_settings`, because the sweep runs
+ * fleet-wide with no tenant in scope at the read site. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/107_check_run_tracking_updated_at_index.d.ts

@@ -2,21 +2,15 @@ import { type Kysely } from 'kysely';
 /**
  * Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
  *
- * `CheckRunTrackingStore.pruneStale` — the hourly retention sweep — filters
- * `WHERE updated_at < now() - <window>`. The table already carries two indexes
- * — the primary key on `(provider, owner, repo, sha, check_name)` and the
- * partial `idx_check_run_tracking_run_id` — but `updated_at` leads neither, so
- * that predicate can use neither and without this index every sweep
- * sequentially scans the whole table. The scan
- * is worst exactly where it hurts: a deployment that accumulated rows before
- * retention existed has the largest table and gets the scan hourly, on every
- * coordinator, since the cleanup tick is not leader-gated.
+ * The hourly retention sweep `CheckRunTrackingStore.pruneStale` filters
+ * `WHERE updated_at < now() - <window>`, and `updated_at` leads neither the primary key
+ * `(provider, owner, repo, sha, check_name)` nor the partial `idx_check_run_tracking_run_id`, so
+ * without this index every sweep scans the whole table — hourly, on every coordinator (the
+ * cleanup tick is not leader-gated), and worst on deployments that accumulated rows before
+ * retention existed.
  *
- * Mirrors `idx_dispatch_queue_run_id` (migration 072) and
- * `idx_request_idempotency_created_at` (migration 068), both of which exist to
- * index a TTL sweep's prune predicate.
- *
- * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ * Mirrors `idx_dispatch_queue_run_id` (072) and `idx_request_idempotency_created_at` (068), which
+ * also index a TTL sweep's prune predicate. Idempotent (`IF NOT EXISTS`).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/113_execution_runs_workflow_repo_index.d.ts

@@ -3,27 +3,18 @@ import { type Kysely } from 'kysely';
  * Add the partial index `idx_execution_runs_workflow_repo` on
  * `execution_runs (workflow_repo_identifier) WHERE workflow_repo_identifier IS NOT NULL`.
  *
- * Matching a workflow registration to its runs keys on the repository that
- * DEFINES the workflow — `workflow_repo_identifier ?? repo_identifier` — which
- * the orchestrator expresses as
- * `workflow_repo_identifier IN (…) OR (workflow_repo_identifier IS NULL AND repo_identifier IN (…))`
- * (`registration/registration-run-match.ts`). The second arm rides
- * `idx_execution_runs_repo` from migration 001; the first arm had no index at
- * all, because migration 112 added the column without one. A planner cannot
- * use an index for only half a disjunction, so the whole predicate degraded to
- * a sequential scan over a table that grows with every run — on
- * `dashboard.registrations.list`, which runs its grouped MAX on every list
- * request.
+ * Registration-to-run matching keys on the repository that defines the workflow
+ * (`registration/registration-run-match.ts`):
+ * `workflow_repo_identifier IN (…) OR (workflow_repo_identifier IS NULL AND repo_identifier IN (…))`.
+ * The second arm rides `idx_execution_runs_repo` (migration 001); migration 112 left the first
+ * unindexed. A planner cannot index half a disjunction, so `dashboard.registrations.list` fell
+ * to a sequential scan of a table that grows with every run; with both arms indexed it can
+ * BitmapOr them.
  *
- * With both arms indexed the planner can BitmapOr them.
+ * Partial, which keeps it small: the column is non-null only for cross-repository
+ * organization-wide runs, and the first arm never matches NULL (`NULL IN (…)` is never true).
  *
- * Partial by design, and the partiality is what makes it cheap: the column is
- * non-null only for a cross-repository organization-wide run, a small minority
- * of rows, so the index stays a fraction of the table's size and skips every
- * per-repository run. It also matches the predicate exactly — the first arm
- * can never match a NULL row, since `NULL IN (…)` is never true.
- *
- * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ * Idempotent: `IF NOT EXISTS`.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/115_global_workflows_cluster_switch.d.ts

@@ -1,9 +1,8 @@
 import { type Kysely } from 'kysely';
 export declare function up(db: Kysely<unknown>): Promise<void>;
 /**
- * Restores the org column with its original NOT NULL DEFAULT false. A rollback
- * cannot recover the per-org values the up-migration dropped — they are gone —
- * so every org comes back at the opt-in default.
+ * Restores the org column as NOT NULL DEFAULT false. The per-org values `up` dropped are
+ * unrecoverable, so every org comes back at the opt-in default.
  */
 export declare function down(db: Kysely<unknown>): Promise<void>;
 //# sourceMappingURL=115_global_workflows_cluster_switch.d.ts.map

package/dist/db/migrations/121_org_settings_allow_untrusted_dockerfile_builds.d.ts

@@ -2,15 +2,14 @@ import { type Kysely } from 'kysely';
 /**
  * Add `org_settings.allow_untrusted_dockerfile_builds boolean NOT NULL DEFAULT false`.
  *
- * A job may build its container image from a Dockerfile in the repository. That
- * build runs arbitrary `RUN` commands on the agent host's daemon, OUTSIDE the
- * hardened posture the job's own steps get (`CapDrop: ALL`, no-new-privileges,
- * pids/memory/CPU caps) — a build cannot be capability-restricted the way a
- * container run can.
+ * A job may build its image from a repository Dockerfile, whose `RUN` commands
+ * execute on the agent host's daemon OUTSIDE the hardened step posture
+ * (`CapDrop: ALL`, no-new-privileges, pids/memory/CPU caps): a build cannot be
+ * capability-restricted like a container run.
  *
- * So the default is deny for an untrusted ref (a fork PR, an unresolved
- * contributor — the same classification the cache write scope uses). An operator
- * who wants fork PRs building their own images turns it on per org, deliberately.
+ * So it is denied by default for an untrusted ref (a fork PR, an unresolved
+ * contributor — the cache write scope's classification); an operator opts in
+ * per org.
  *
  * Idempotent: a re-run on a DB that already has the column is a no-op.
  */

package/dist/db/migrations/122_host_roster_scaler_managed.d.ts

@@ -1,24 +1,17 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `host_roster.scaler_managed boolean NOT NULL DEFAULT false`.
+ * Add `host_roster.scaler_managed`: whether a scaler backend spawned the agent.
  *
- * `runsOnAll` fans a job out across the declared fleet. Every registering agent
- * upserts a roster row, auto-scaler-spawned ones included, so a pre-spawned
- * warm agent was a valid fan-out target — and a child pinned to it runs at the
- * pool's fixed shape rather than its own. This column records the one fact that
- * separates the two populations: whether a scaler backend spawned the agent.
+ * `runsOnAll` fans a job out across the declared fleet, and every registering agent upserts a
+ * roster row, so a pre-spawned warm agent was a fan-out target and a child pinned to it ran at
+ * the pool's fixed shape rather than its own.
  *
- * It is written from the scaler manager's registration lookup (a spawn record
- * exists for the agent id), NOT from `lifecycle_class`. `lifecycle_class`
- * snapshots the auth TOKEN's type and is `ephemeral` for every agent when the
- * auth mode is `none`, so it cannot distinguish a fleet host from a scaler
- * agent in that mode.
+ * Written from the scaler manager's registration lookup (a spawn record exists for the agent
+ * id), NOT from `lifecycle_class`, which snapshots the auth TOKEN's type and is `ephemeral` for
+ * every agent in auth mode `none`.
  *
- * DEFAULT false is load-bearing: a row written before this migration must read
- * as not-scaler-managed so an existing fleet host stays a fan-out target
- * immediately, without waiting to re-register.
- *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * DEFAULT false is load-bearing: a pre-existing row reads as not-scaler-managed, so an existing
+ * fleet host stays a fan-out target without re-registering. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/123_workflow_registrations_default_branch.d.ts

@@ -1,23 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `workflow_registrations.default_branch text` (nullable).
+ * Add `workflow_registrations.default_branch`.
  *
- * A `__schedule_fire` run executes the default branch's lock file, so the
- * default branch IS that run's branch — which is what a branch-restricted
- * context needs in order to accept it. The value is already computed at
- * registration time from the webhook payload (the default-branch-push check),
- * it was simply never persisted, so a scheduled run had no branch to present.
+ * A `__schedule_fire` run executes the default branch's lock file, so the default branch IS its
+ * branch, which a branch-restricted context needs to accept it. Registration already computes it
+ * from the webhook payload (the default-branch-push check); this persists it.
  *
- * NULLABLE with no default, deliberately. The default branch is knowable only
- * from a webhook payload, so there is nothing to backfill a pre-existing row
- * with: a registration written before this migration reads NULL until its
- * repo's next default-branch push re-registers it. The dispatch path reads NULL
- * as "no branch" and the context branch gate then rejects with its honest
- * named-cause verdict — a DEFAULT would instead invent a branch the
- * registration never proved, which is exactly the confusion this whole column
- * exists to end.
- *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * NULLABLE with no default, deliberately: only a webhook payload reveals the default branch, so
+ * a pre-existing row reads NULL until its repo's next default-branch push re-registers it.
+ * Dispatch reads NULL as "no branch" and the context branch gate rejects with its named cause; a
+ * DEFAULT would invent a branch the registration never proved. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;